Court decision · 24 April 2018
Benedik v. Slovenia
Application no. 62357/14, judgment of 24 April 2018 · European Court of Human Rights
What it means for your code
An IP address in your logs is identifying data the moment it can be resolved to a person. Treat lawful-access requests for it as requiring a proper legal instrument, and log what you disclosed.
What happened
Police obtained the subscriber information behind a dynamic IP address from an internet provider without a court order, having observed the address in a file-sharing network.
What was decided
Even where an IP address is observed publicly, linking it to a subscriber's identity is an interference with private life and requires a legal basis with adequate safeguards; the absence of judicial authorisation violated Article 8.
The legal test applied
- Resolving a dynamic IP address to a subscriber's identity interferes with private life
- Public observation of the address does not remove the expectation of privacy in the identity behind it
- The interference requires a legal basis with adequate safeguards, including judicial authorisation
What would have changed the outcome
- A properly authorised order with recorded grounds satisfies Art. 8
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.