German Federal Supreme Court confirms: Dynamic IP addresses may constitute personal data

According to a press release dated 16 May 2017, and following the Court of Justice of the European Union's (CJEU) preliminary ruling in Case C-582/14 dated 19 October 2016 (see our previous blog), the German Federal Supreme Court (Bundesgerichtshof – FSC) confirmed in a judgment of 15 May 2017, case no. VI ZR 135/13 that dynamic IP addresses constitute personal data within the meaning of Article 2(a) Directive 95/46/EC, in relation to a service provider, where the service provider has the legal means which enable it to identify the data subject with additional data which the service provider has about that person.

Accordingly, the FSC held that Section 12(1) and Section 12(2) of the German Telemedia Act (Telemediengesetz – TMG) and Section 3(1) of the German Data Protection Act (Bundesdatenschutzgestz – BDSG) need to be interpreted in line with Directive 95/46/EC.