ECJ C-582 / 14
The European Court of Justice had to look again at the legal question whether IP addresses are personal data under European data protection laws. This time it was not the internet service provider of a user holding its IP address but a social media provider which would allocate dynamic IP addresses to visitors of its website. The dynamic IP address alone would not enable the social media provider to determine the identity of the user. It would require in addition the personal data stored by the visitor's internet service provider.
The Court found the fact that the online service provider itself did not hold all necessary information for the identification of the data subject not enough to negate the assumption of the dynamic IP address being personal data because the law would expressly include also the indirect determination of a data subject's identity. However, it found decisive whether the possibility to combine a dynamic IP address with the additional data held by the internet service provider constitutes a means likely reasonably to be used to identify the data subject. This would not be the case if for example the identification of the data subject was prohibited by law or practically impossible on account of the fact that it requires disproportional effort.