IP addresses are considered personal data if the user’s identity can be determined
In its decision 136 II 508 of 8 September 2010, the Federal Tribunal had to decide, among other things, whether IP addresses are personal data within the meaning of Art. 3 lit. a FADP and whether the provisions of the FADP are applicable. A company searched for copyright infringements in peer-to-peer (P2P) networks and, among other things, recorded the IP address of the internet connection used in order to forward it to the copyright holders so that they could assert their claims for damages. The FDPIC found that this processing method violated the privacy of a large number of individuals and recommended that the company immediately cease processing the data unless there was a sufficient legal basis under civil law for using the data collected. The company rejected the FDPIC’s recommendation.
On the decision of the Federal Court:
In its decision 136 II 508 of 8 September 2010, the Federal Tribunal had to decide, among other things, whether IP addresses are personal data within the meaning of Art. 3 lit. a FADP and whether the provisions of the FADP are applicable. A company searched for copyright infringements in peer-to-peer (P2P) networks and, among other things, recorded the IP address of the internet connection used in order to forward it to the copyright holders so that they could assert their claims for damages. The FDPIC found that this processing method violated the privacy of a large number of individuals and recommended that the company immediately cease processing the data unless there was a sufficient legal basis under civil law for using the data collected. The company rejected the FDPIC’s recommendation.
Every computer connected to the Internet can be identified by its IP address. According to the Court, the company’s business model in this case is based on the ability to use IP addresses to identify individuals. The Court held that an IP address is personal if it can be used by the copyright holder to identify infringers upon receipt of the relevant data. The court concludes that IP addresses are therefore personal data within the meaning of Art. 3 (a) FADP.