The Court of Justice of the European Union-CGUE on April 30, 2024, in Case C‑470/21, ruled that a national public authority responsible for combating online counterfeiting may access identification data on the basis of an IP address.

The case.

The issue discussed by the Court was whether the access by a public authority responsible for the protection of copyright and related rights against infringements of those rights committed on the internet (Authority for the Regulation of Audiovisual and Digital Communications-ARCOM) to data relating to the civil identity associated with an IP address retained by providers of electronic communications services, previously collected by right holder organizations, for the purpose of combating counterfeiting offences committed online and taking measures against them, without that access being subject to the requirement of a prior review by a court or an independent administrative body, can be justified under the Directive on privacy and electronic communications. The case, in particular, concerned downstream on peer-to-peer networks.

The appeal to the Court of Justice.

The French Council of State asks the Court of Justice whether the data processing operations are compatible with EU law. The request has been made in proceedings between the French associations for the protection of rights and freedoms on the internet brought an action before the French Council of State, seeking annulment of Decree on the automated personal data processing system authorised by the Intellectual Property Code, known as the System for the management of measures for the protection of works on the internet: the applicants claimed that the Intellectual Property Code is contrary to the right to respect for private life enshrined in the French Constitution and infringes EU law, in particular Directive on privacy and electronic communications and the Constitution. The applicants in the main proceedings submitted, in particular, that the System for the management of measures for the protection of works on the internet permit access to connection data in a disproportionate manner for non-serious copyright offences committed on the internet, without prior review by a judge or an authority offering guarantees of independence and impartiality.

The Court’s decision.

The Court holds that the general and indiscriminate retention of IP addresses does not necessarily constitute a serious interference with fundamental rights and may, where appropriate, take measures against them, provided that, under that legislation, among which:

1. Member States must nevertheless ensure that that access does not allow precise conclusions to be drawn about the private life of the IP address holders concerned – which may be accomplished, in particular, by imposing on providers of electronic communications services an obligation to retain the various categories of personal data, such as data relating to civil identity, IP addresses and traffic and location data, in such a way as to ensure a genuinely watertight separation of those different categories of data, thereby preventing, at the retention stage, any combined use of those different categories of data and for a period not exceeding what is strictly necessary;
2. that public authority’s access to such data retained separately and in a genuinely watertight manner serves exclusively to identify the person suspected of having committed a criminal offence and is subject to the necessary safeguards to ensure that that access cannot allow precise conclusions to be drawn about the private life of the IP address holders, for example by establishing a detailed profile of those persons;
3. where data relating to the civil identity of users of electronic communications is accessed for the sole purpose of identifying the user concerned, a prior review of that access by a court or by an independent administrative body is not required since the interference entailed by that access cannot be classified as serious. Such a review must be carried out, however, where the particular features of a national procedure governing such access may – through the linking of the data and information collected as that procedure progresses though its different stages – allow precise conclusions to be drawn about the private life of the person concerned and, accordingly, give rise to a serious interference with fundamental rights. In such a case, that review by a court or an independent administrative body must take place before that linking, while preserving the effectiveness of that procedure by, in particular, allowing the identification of the cases in which there is a possible further repetition of the offending conduct in question.

The effectiveness of the Court of Justice decisions.

A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of EU law or the validity of an EU act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised; therefore, the scope of this decision could play significant effects on a variety of cases involving conduct of online misuse of copyright and related rights, not only through peer-to-peer services, but also through other channels and platforms, such as Telegram or websites.