ECJ: Personal reference for IP addresses affirmed – § 15 para. 1 TMG is contrary to European law

In its ruling of 19.10.2016 – Ref: C 582/14, the ECJ ruled that IP addresses are personally identifiable if the website operator has legal means to assign them. This will always be the case if the host provider can still perform the assignment. Furthermore, the ECJ ruled that the German provision of Sec. 15 para. 1 of the Telemedia Act (TMG) violates the EC Data Protection Directive 95/46 (DSRL). The judgment had been expected, as the opinion of 12.05.2016 already went in this direction and the ECJ thus continues its case law. The ruling has far-reaching consequences in German law:

The ECJ has now confirmed its established case law with regard to a German standard: the legislator had no authority to make specific arrangements for the balancing of interests clause for the processing of usage data collected online. The legislator had in § 15 para. 1 TMG stipulates that usage data (IP address, timestamps and the like) may only be processed to the extent necessary to enable and bill for the use of telemedia. Other purposes, e.g. virus protection or online tracking, were currently not possible or only possible under the increased requirements of Section 15 para. 3 TMG permissible.

The ECJ now continued its case law that the national legislator cannot impose stricter requirements than those provided for in the DSRL. Art. 7 lit. f DSRL provides that data may be processed by a controller after a balancing of interests. Within the DSRL, the processing of usage data must be based on the general balancing of interests clause.

The unlawfulness under European law of § 15 para. 1 of the German Telemedia Act (TMG) means that responsible bodies can collect more online data than before. This issue will continue in the General Data Protection Regulation (GDPR), since there, too, only a general interest balancing clause is provided for and no specific regulations on the collection of online data.

The ECJ ruled that IP addresses constitute personal data if the user of the IP address has additional knowledge and can make the assignment to a person based on available legal means.

Since the host provider can assign the IP address to the specific name and contact data of the Internet connection owner, the IP address is certainly personal for the latter. An arbitrary third party who only has the IP address can be attributed the information of the host provider due to the ruling of the ECJ, so that the IP address is now considered personal for someone without a concrete possibility of attribution. This is because the ECJ emphasizes the possibility (paras. 47-49) of obtaining the assignment of the IP address with the support of a third party in order to establish a personal link. Providers of online media services can determine the person in question with the help of the host provider and an authority such as the public prosecutor’s office. Since, in principle, every German authority is entitled to legal means of surrendering allocation data (e.g., via Section 101 (2) Sentence 1 No. 3 UrhG), a personal reference must always be affirmed for IP addresses in the future.

The ruling has far-reaching consequences for the application of data protection laws – including the upcoming GDPR. Since there was no clear regulation on the reference to persons under the GDPR either, but the regulations were comparable to the previous regulation, the ruling must be applied to the future law.

The consequence is, for example, that any identification numbers are considered personal (only) to the extent that an entity holds the allocation key and the key can be made available upon request. Based on the ruling, previous classifications of data processing as anonymous instead of personal should be subject to a new review.

Contact: Dr. Stefan Drewes, Tel.: +49-228-90248070,