|
|
|
|
|
|
by AnthonyUK
1557 days ago
|
|
|
This was the finding of the case Patrick Breyer vs Germany in 2016 https://www.whitecase.com/publications/alert/court-confirms-... What makes a dynamic IP address personal data?
The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and
the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual.
On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD. The CJEU also did not ask the specific question in that case - Were the BRD LIKELY to identify Mr Breyer? If this is something that you have never done before or will do in the future then it is not likely that you will try to identify someone by their IP. |
|
|
>Where a piece of information (such as an IP address) does not directly identify a person, that piece of information will nevertheless be personal data in the hands of any party that can lawfully obtain sufficient additional data to link the information to a person's real world identity
In a world of data brokers that makes IP addresses PII. The only way it's not is if you verify that there is no way you can lawfully obtain additional data to link the IP to a person. I don't see how you can practically do that.