3 ms·

No, that's not the correct interpretation. The examples of personal data list what can be personal data. It does not mean that each item in the list is persona

No, that's not the correct interpretation. The examples of personal data list what can be personal data. It does not mean that each item in the list is personal data in isolation. The case law is that an IP address is personal data if it is linked to an identified or identifiable person, which is not more than what the GDPR says. The IP address was held along with other data by an entity which also had access to further data, which meant that the person was identifiable. All of these circumstances taken together meant that, in that specific case, the IP address was personal data: "48 Thus, it appears that the online media services provider has the means which may likely reasonably be used in order to identify the data subject, with the assistance of other persons, namely the competent authority and the internet service provider, on the basis of the IP addresses stored. "49 Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person." IP address is personal data for the provider because/if they have access to information to identify the person (key above is 'where the latter has the legal means' to access the necessary additional data). But an IP address isn't personal data in itself, only when additional data are available that make the person identifiable. So your claim that "At least in Germany, it has been ruled that an IP address in and of itself is personal data" is not correct and not what this case law says. I don't have the legal means, or any means really, to ask an ISP or whoever else for additional data on the IP addresses of random, unknown visitors to my website, therefore those IP addresses are not personal data to me as they do not related to any identifiable (by me) individuals. Unfortunately, as you show, there is indeed a lot of confusion, misinterpretation, and misunderstanding out there.

d1sxeyes 4y ago
It's a bit disingenuous of you to skip the immediately preceding paragraph, which explains how the court determined whether the website operator "has the legal means" or not, and highlights that in Germany, specific legal channels exist for a website operator in the event of cyber attacks to get this information. > Although the referring court states in its order for reference that German law does not allow the internet service provider to transmit directly to the online media services provider the additional data necessary for the identification of the data subject, it seems however, subject to verifications to be made in that regard by the referring court that, in particular, in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.
- mytailorisrich 4y ago
  OK, I might retract my comment about Germany specifically. But the wider point remains that an IP address isn't generally personal data in itself. Certainly this is quite irrelevant to the point here, which is a simple flag for dark mode. If that has to create and endless and tedious debate then the GDPR are not fit for purpose, but I maintain that it is fine to store it without explicit consent because it is not personal data in itself and, in any case, there is a legitimate interest to do so.
  - d1sxeyes 4y ago
    Although this judgement was in Germany, I don’t see a reason that it would not apply to any other EU state, and I haven’t found any case law that says that an IP address in isolation is not personal data. Anyway, there’s no requirement for any piece of data to be independently identifying in order for it to come under the scope of personal data per GDPR. A piece of information is personal data if it can be linked to an individual. This applies whether the linking can be done in isolation or only with other pieces of information, and whether the link is explicit or inferred, direct or indirect, and whether the controller/processor has immediate access to the other pieces of data or not. Even if you rely on legitimate interest as a basis for processing personal data (and you might do, depending on your actual interests), you still have to do your paperwork, complete the PIAs and balancing tests.
    - mytailorisrich 4y ago
      The GDPR and this very case law say that an IP address in isolation and in general is not personal data. Indeed, the case law explicitly says that an IP address is personal data IF the controller has or has a way to get additional data to make the person identifiable (which is what the GDPR already explicitly say). No-one is identifiable with an IP address only, there must be additional data, which I need to possess or have access to, even if only in specific cases (which is the key point of this German case law).
      - d1sxeyes 4y ago

d1sxeyes 4y ago

It's a bit disingenuous of you to skip the immediately preceding paragraph, which explains how the court determined whether the website operator "has the legal means" or not, and highlights that in Germany, specific legal channels exist for a website operator in the event of cyber attacks to get this information. > Although the referring court states in its order for reference that German law does not allow the internet service provider to transmit directly to the online media services provider the additional data necessary for the identification of the data subject, it seems however, subject to verifications to be made in that regard by the referring court that, in particular, in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.

mytailorisrich 4y ago
OK, I might retract my comment about Germany specifically. But the wider point remains that an IP address isn't generally personal data in itself. Certainly this is quite irrelevant to the point here, which is a simple flag for dark mode. If that has to create and endless and tedious debate then the GDPR are not fit for purpose, but I maintain that it is fine to store it without explicit consent because it is not personal data in itself and, in any case, there is a legitimate interest to do so.
- d1sxeyes 4y ago
  Although this judgement was in Germany, I don’t see a reason that it would not apply to any other EU state, and I haven’t found any case law that says that an IP address in isolation is not personal data. Anyway, there’s no requirement for any piece of data to be independently identifying in order for it to come under the scope of personal data per GDPR. A piece of information is personal data if it can be linked to an individual. This applies whether the linking can be done in isolation or only with other pieces of information, and whether the link is explicit or inferred, direct or indirect, and whether the controller/processor has immediate access to the other pieces of data or not. Even if you rely on legitimate interest as a basis for processing personal data (and you might do, depending on your actual interests), you still have to do your paperwork, complete the PIAs and balancing tests.
  - mytailorisrich 4y ago
    The GDPR and this very case law say that an IP address in isolation and in general is not personal data. Indeed, the case law explicitly says that an IP address is personal data IF the controller has or has a way to get additional data to make the person identifiable (which is what the GDPR already explicitly say). No-one is identifiable with an IP address only, there must be additional data, which I need to possess or have access to, even if only in specific cases (which is the key point of this German case law).
    - d1sxeyes 4y ago