privacy gdpr european-union
Is a public IP address classified as &quot;personal data&quot; for a third party under EU law?
<p><strong>Situation</strong>: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in the logs of the web server.</p>

<p><strong>Question</strong>: are such <strong>public</strong> IP addresses classified as "personal data" under EU law?</p>

<p>Notes:</p>

<ul>
<li>the web site owner <strong>has no possibility, by themselves,</strong> to link the public IP with an individual</li>
<li>the IP address can be linked to an individual by the ISP. This ISP is unrelated to the web site owner</li>
<li>there are numerous discussions about the fact that "an IP address is personal data". When digging into the documents, it becomes less clear because one of the conditions for the IP to be PII is, for the one who handles that IP, to have the <em>"legal means" of obtaining access to the information held by the ISP in order to identify the individual.</em> (see <a href="https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases" rel="nofollow noreferrer">here</a> or <a href="http://curia.europa.eu/juris/document/document.jsf%3Bjsessionid=9ea7d2dc30d5104fab56cd7c48bea355f43196e1e7f2.e34KaxiLc3qMb40Rch0SaxyKax50?text=&amp;docid=184668&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1771402" rel="nofollow noreferrer">here</a>)</li>
</ul>

<h3>Apparently, Yes</h3>

<p>In the <a href="http://curia.europa.eu/juris/document/document.jsf?docid=184668&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=6236796" rel="noreferrer">ECJ's Breyer decision</a> the final conclusion reads:</p>

<blockquote>
  <p>Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.</p>
</blockquote>

<p>It is true that in this case the decision was actually under Directive 95/46/EC, not the GDPR, but the GDPR took its definition of personal Data directly from Directive 95/46/EC, so that should make no difference.</p>

<p>It is also true that in this case the website in question was operated by the German Federal government, an not by a private individual, or by a private business. A government might have "legal means" to link an IP address with an individual that a private actor does not. However in point 23 of the decision, the Court refered to the IP addresses as:</p>

<blockquote>
  <p>... stored by the Federal Republic of Germany, acting in its capacity as an online media services provider, ...</p>
</blockquote>

<p>which seems to indicate that the same ruels were being applied to it as would have been to a private entity.</p>

<p>Point 44 of the decision says that:</p>

<blockquote>
  <p>The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46.</p>
</blockquote>

<p>In point 47, the court says that:</p>

<blockquote>
  <p>... in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.</p>
</blockquote>

<p>This leads the court to point 49, where it says that;</p>

<blockquote>
  <p>Having regard to all the foregoing considerations, ... Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.</p>
</blockquote>

<p>Nothing in the decision indicates that any particular governmental authority was considered to provide the "legal means" to get an ISP to link an IP used at a particular time to an individual.</p>

<p>In <a href="https://gdpr-info.eu/issues/personal-data/" rel="noreferrer">this page from Intersoft consulting</a> it is said that:</p>

<blockquote>
  <p>Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible. ... The same also applies to IP addresses. If the controller has the legal option to oblige the provider to hand over additional information which enable him to identify the user behind the IP address, this is also personal data. </p>
</blockquote>

<p>In <a href="https://eugdprcompliant.com/personal-data/" rel="noreferrer">this page from eugdprcompliant.com</a> it is said that:</p>

<blockquote>
  <p>A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant.</p>
</blockquote>

<p>Finally the european Commission says, on <a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en" rel="noreferrer">this official page</a>:</p>

<blockquote>
  <p>Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.</p>
</blockquote>

<p>...</p>

<blockquote>
  <p>Examples of personal data</p>
</blockquote>

<p>...</p>

<blockquote>
  <p>an Internet Protocol (IP) address;</p>
</blockquote>

<p>While the case law is scanty on the point, it appears that the consensus is that IP addresses, even dynamic IP addresses, will be considered to be Personal Data under the GDPR.</p>

<p>></p>
