Court decision · 19 October 2016
Patrick Breyer v Bundesrepublik Deutschland
Case C-582/14, ECLI:EU:C:2016:779 · Court of Justice of the European Union
European UnionPersonal data
What it means for your code
Treat IP addresses in logs and analytics as personal data: define retention, legal basis and access controls.
What happened
German federal websites logged visitors' dynamic IP addresses to defend against cyber attacks.
What was decided
A dynamic IP address is personal data for a website operator that has legal means to identify the user with additional information held by the internet access provider.
The legal test applied
- Data is personal where the controller has legal means reasonably likely to be used to identify the person with information held by a third party
What would have changed the outcome
- IP addresses truncated or aggregated so they cannot be linked back
Read the decision at the source
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.