Case C‑582/14

Patrick Breyer

v

Bundesrepublik Deutschland

(Request for a preliminary ruling from the Bundesgerichtshof)

‛Reference for a preliminary ruling — Processing of personal data — Directive 95/46/EC — Article 2(a) — Article 7(f) — Definition of ‘personal data’ — Internet protocol addresses — Storage of data by an online media services provider — National legislation not permitting the legitimate interest pursued by the controller to be taken into account)’

Summary — Judgment of the Court (Second Chamber), 19 October 2016

1. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Scope — Personal data — Definition — Dynamic IP address registered by an online media services provider when a person accesses a website — Included — Condition — Existence of legal means enabling the online media services provider to identify the data subject with additional data which the internet service provider has about that person.

   (European Parliament and Council Directive 95/46, Art. 2(a))

2. Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Conditions for lawfulness of processing personal data — Purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed — National legislation not permitting consideration of the legitimate interests of the online media services provider to ensure the general operability of these services — Unlawful

   (European Parliament and Council Directive 95/46, Art. 7(f))

1.  Article 2(a) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic internet protocol address (IP address) registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

   The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46.

   (see paras 44, 49, operative part 1)

2.  Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding the legislation of a Member State, pursuant to which an online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that collection and use of that data are necessary to facilitate and charge for the specific use of those services by that user, even though the objective aiming to ensure the general operability of those services may justify the use of those data after a consultation period of those websites.

   Article 7(f) of that directive precludes Member States from excluding, categorically and in general, the possibility of processing certain categories of personal data without allowing the opposing rights and interests at issue to be balanced against each other in a particular case. Thus, Member States cannot definitively prescribe, for certain categories of personal data, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case.

   (see paras 62, 64, operative part 2)