Jusletter IT

It is a standard in contemporary legal systems that an infringement (a copyright violation, defamatory statement, press libel, unfair market practice, etc.) entitles an aggrieved party to commence judicial proceedings in order to obtain damages and cease the violation. The globalisation process and the widespread of electronic communication make things complicated. The anonymity of a particular user constitutes a barrier for the prospective plaintiff who cannot name the defendant and initiate civil action properly. To make things worse, the confidentiality of communications is an indispensable precondition of one’s right to privacy.¹ The two liberties (i.e. privacy and access to the court) being expressed in several multilateral conventions, EU primary and secondary law and national constitutions are definitely in clash in case of on-line infringements. Leaving aside the problem of web abuses would make the Internet a field of acquiesced illegal activity. On the other hand, strengthening the surveillance over the electronic communication amounts to deprivation of the right to privacy and weaken the trustworthiness of the Internet Service Provider (ISP) who is bound by telecommunications secrecy. ISP would also incur the costs of monitoring what would not be in accordance with the economic interest of a private undertaking. The veil of anonymity is pierced only in the face of justified need thereof.

A person using the Internet leaves traces of her activities therein. However, the technological development makes sometimes difficult or even unable to identify an individual only on the basis of these traces. The crucial piece of information left by a concrete user connecting to the web is an IP address. Being a unique sequence of digits it is attributable to a particular device (namely a computer) at one time. The IP address could be static (the same for one interface) or dynamic (changeable for every connection). This can also alter while changing the connection place and many people can share the same IP. The only entity which is able to link a concrete IP with a subscriber is the ISP.

The controversial legal issue is the affiliation of IP addresses to personal data. According to the Art. 2(a) of the DPD² , ‹personal data› shall mean any information relating to an identified or identifiable natural person (‹data subject›); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity. Similar definitions were adopted by either Art. 6 of Polish Act on the Protection of Personal Data (DPA)³ and § 4 of Austrian Federal Act concerning the Protection of Personal Data (DSG).⁴ The question is whether the IP address enables the identification of a particular person as it refers only to a device which is not necessarily to be associated with a natural person. The number would be different for every change of network connection (e.g. placing a device in an Internet café or a Local Area Network) which is a common practice in case of mobile devices.⁵ The static IP is likely to fit in this definition. However, the problem becomes complicated when the dynamic IP address is at stake. According to Art. 29 Working Party Opinion 4/2007 on the concept of personal data, Internet access providers and managers of local area networks can, using reasonable means, identify Internet users to whom they have attributed IP addresses as they normally systematically «log» in a file the date, time, duration and dynamic IP address given to the Internet user. The same can be said about Internet Service Providers that keep a logbook on the HTTP server. In these cases there is no doubt about the fact that one can talk about personal data in the sense of Article 2 a) of the Directive. Further, the Art. 29 Working Party acknowledged that no every IP address enables to identify a particular user, but the ISP does not have a priori knowledge whether the natural person is identifiable or not by the reference to the IP so every address should be regarded as a component of personal data. Such is also the attitude of Polish Inspector General on the Protection of Personal Data (Generalny Inspektor Ochrony Danych Osobowych – GIODO)⁶ expressed in his official statement.⁷ The Austrian Telecommunications Act (Telekommunikationsgesetz – TKG⁸ ) seems to comply with this standard,⁹ notwithstanding the fact that the Austrian Supreme Court (Oberster Gerichtshof) did not acknowledged IPs to be a subject of telecommunications secrecy¹⁰ what raised many controversies.¹¹

In 2007, the ECJ decided thePromusicae case.¹² Several users were downloading copyright protected files withpeer-to-peer file sharing method.Promusicae being a collecting society wanted to initiate civil proceedings. It demanded IP addresses from ISP who refused to transfer them claiming that he is not obliged to do so. Upon submission for preliminary ruling, the ECJ ruled that the relevant EU legislation,i.e. ECD¹³ , ISD¹⁴ , IPED¹⁵ and EPD¹⁶ do not require the Member States to lay down, in a situation such as that in the main proceedings, an obligation to communicate personal data in order to ensure effective protection of copyright in the context of civil proceedings .¹⁷ The ECJ reserved that the interpretation of the directives should be such thata fair balance [is]to be struck between the various fundamental rights protected by the Community legal order .¹⁸ The solution adopted by the Member States ought to be in accordance withfundamental rights or with the other general principles of Community law, such as the principle of proportionality .¹⁹ The reserved attitude expressed in the judgement is an allowance for the Member States to decide over their own solution over the problem of disclosure of IP addresses upon the demand of the aggrieved party.

Shortly after Spanish request for a preliminary ruling inPromusicae , a similar matter was raised before Austrian jurisdiction²⁰ when several users were downloading the files protected under copyright withpeer-to-peer method. Gesellschaft zur Wahrnehmung von Leistungsschutzrechten GmbH (LSG) – a collecting licensing association demanded IP addresses from ISP – Tele2 Telecommunication GmbH (Tele2). Paragraph 81(1a) of Federal Law on Copyright in Works of Literature and Art and on Related Rights (UrhG)²¹ stipulates that:

Paragraph 87b(3) UrhG imposes on the intermediary an obligation togive the person whose rights have been infringed information as to the identity of the infringer (name and address) or the information necessary to identify the infringer, following an application in writing by the person whose rights have been infringed, such application to include sufficient reasons. The reasons given must include in particular sufficiently precise details as to the facts which give rise to a suspicion that there has been an infringement of rights. The person whose rights have been infringed shall pay the intermediary reasonable compensation for the costs incurred in the provision of that information.

The defendant refused to disclose the desired data on the ground that he is not the intermediary under relevant Austrian and EU legislation as he only provides the Internet access without exercising effective control over use of the service provided. Based on that fact the violations committed by the users are not attributable to the ISP and he cannot store IP addresses, the defendant claimed that such a practice is prohibited and not compliant with EU legislation. Moreover, Tele2 supported the statement that in accordance with the EU directives, the right to protection of personal data prevails over other values protected by law in the ongoing case. LSG, invoking the stipulations of domestic law, claimed that the ISP is obliged to disclose the IP addresses as he should be treated as the intermediary in accordance with the ISD to enable pursuing copyright violations by holders. Austrian court acknowledged the existence of the obligation to disclose and store the personal data what was the subject matter of appeal and revision.Oberster Gerichtshof being aware ofPromusicae proceedings being in course made reference to the Opinion of Advocate General who questioned the compliance of obligation to disclose and store subscribers‘ personal data for the purposes of civil proceedings. The court asked the ECJ for the preliminary ruling for determination whether the term «intermediary» from the Art. 5(1)(a) is applicable to ISP and whether there is an obligation to disclose and store IP addresses for the purposes of civil proceedings.

The ECJ delivered an order²² whereby it invokedPromusicae judgement and applicability of EPD in the case. The Court acknowledged that the exception from the personal data protection should notexclude from its [i.e. EPD]scope the protection of the right to property or situations in which authors seek to obtain that protection through civil proceedings .²³ Further, the ECJ confirmed the standard expressed inPromusicae stating that there is no obligation imposed on the Member States whether to disclose or not personal data for the purposes of civil proceedings.A fair balance ,fundamental rights ,general rules of Community law andthe principle of proportionality remained safety precautions while exercising this discretionary power.

Interestingly, the Supreme Court acknowledged the lack of obligation to disclose the data because compliance with such a provision would be contrary to another obligation of ISP who is prohibited to store temporary IP addresses (regarded as traffic data as opposed to permanent ones which are master data and are allowed to be stored pursuant to § 99 para. 1 TKG).²⁴ Prohibition of retention is expressed in EU law as well,inter alia under DPD (Art. 6(1)(e)) and EPD (Art. 6(1-3)). In the clash of two freedoms, the right to privacy preponderates according to Austrian domestic legislation.

The problem of disclosure of personal data for the purposes of civil proceedings appeared before Polish jurisdiction as well. The point is the judgements concerning the problem were delivered not on the basis of copyright infringement but libels (according to Polish civil code²⁵ –a violation of personal interest ). In 2004 the Provincial Administrative Court in Warsaw delivered a judgement which did not oblige the ISP to disclose the desired IP addresses²⁶ . The prospective plaintiff felt offended by the content of some forum posts placed on the website by the users. In order to draft the statement of claim properly the civil court demanded the names of the defendants. The ISP refused to do it claiming that there is no provision in Polish legislation obliging the administrator of the data to disclose them to a private petitioner for the purposes of pursuing violations of one’s rights. The Court pointed out the mistake of the legislator who neglected to provide the data for the private sector units in case of justified demand thereof. As a result, DPA was amended in 2004 and the scope of application of the Art. 29 thereof embraced private controllers as well. However, the judgement delivered on the basis of previous legal background was not in favour of the plaintiff.

The second case concerning IP addresses took place in 2010 before the same court.²⁷ Polish singer, Maryla Rodowicz, decided to sue the two users who wrote some offensive statements against her and her child. In order to commence a lawsuit she also had to place the family names of the defendants on the statement of claim. The ISP refused to reveal the IP addresses and attribute them to particular users as it claimed that they do not constitute personal data, they are protected by the telecommunications confidentiality and finally that despite amending the provision of DPA there is still no obligation to disclose the desired data. The argument concerning lack of IP affiliation to the personal data was quashed on the basis of the invoked Working Party Opinion. The problem in question was treated as a justified exception of confidentiality. However, many controversies were raised by the application of Art. 29 of DPA which lays down as following:

The expression «may» in the second paragraph does not point out the subject of the norm. It could be interpreted as a right to disclose the personal data upon controller’s will. This solution could be justified as the way of protecting the telecommunications confidentiality, trustworthiness of ISP and its pecuniary interest. However, it would constitute a great threat for person aggrieved by the on-line abuses and deprive them of any remedy against the tortfeasors. The second interpretation is to impose an obligation on the controller to disclose the data for private entity in case of justified need thereof. It is definitely not in accordance with the literal meaning of the act but is aimed to protect the justified interest of an injured party. The Court have chosen the second option, but ISP lodged an appeal for cassation to the Supreme Administrative Court and the case is still pending (however, SAC suspended the execution of the decision obliging to disclose the addresses²⁸ ).

As can be understood by the Austrian example, the duty to store the data is an indispensable precondition for effective civil enforcement by right holders. EPD is an EU legal instrument governing data protection in electronic communication. The act obliges ISPs to erase traffic data (inter alia IP addresses) or make them anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to billing purposes, marketing economic services and public interest exceptions (enlisted in DPD, Art. 13(1)). On the other hand, DRD²⁹ obliges Member States to establish a retention period from 6 to 24 months (Art. 6) for IP addresses regarded asdata necessary to trace and identify the source of a communication (Art. 5(1)(a)(2)(iii)). The said Directive raised many objections and fears among Member States and its compliance with ECHR³⁰ and Charter of Fundamental Rights was doubtful. Moreover, the DRD was adopted in reaction to terrorist attacks in London and Madrid (see: Recitals 8 and 10) so it should have been an instrument of Common Foreign and Security Policy and Police and Judicial Co-operation in Criminal Matters (i.e. former Second and Third Pillars) and such were the objections of Ireland who brought an action before the ECJ in opposition against the DRD.³¹ The implementation of the Directive was also acknowledged to be unconstitutional by Constitutional Supreme Courts in Germany and Romania.³² Recital 25 of the DRD stipulates that Member States are freeto adopt legislative measures concerning the right of access to, and use of, data by national authorities, as designated by them. Issues of access to data retained pursuant to this Directive by national authorities for [activities of former 2nd and 3rd Pillars]fall outside the scope of Community law . In fact, this provision in connection with exception from the standard of protection of personal data prescribed by DPD, Art. 13(1) allows Member States to employ the data retention mechanism for any purposes according to relevant domestic legislation. For example, the period of retention provided by Polish Telecommunications Law,³³ Art. 180a is 24 months. Adoption of maximum retention period was justified by transitory localization of the country and alleged threat of terrorist activity.³⁴ In practice, DRD enables to make the exception from a general obligation to erase the data so vast that the guarantees provided by EPD become inapplicable.

To sum up, the controversies whether an IP address is personal data in the legal meaning seem to be less fierce after issuance of Article 29 Working Party Opinion on the basis of DPD, Art. 2(a). Notwithstanding, a binding instrument or judicial decision of ECJ would be desirable. However, that is the only point wherewith Member States seem to agree. The problem of disclosure has already been brought before the courts in France³⁵ and the UK³⁶ . By the impact ofPromusicae Member States are free to adopt different solutions over the question of disclosure of IP addresses which are usually influenced by the shape of domestic legislation.

What can be easily observed by the reference to Austrian and Polish standards is that the obligation to disclose or prohibition thereof is usually not expressed directly and it is a matter of interpretation of national law not only regarding personal data protection and it is dependant on other obligations,e.g. telecommunications secrecy which can occur preponderant. The Austrian solution seems to be in favour of preponderance of communications privacy, which is the result of prohibition of retention. On the other hand, Polish lawmaker and judicial authorities decided otherwise – the right to sue prevailed over confidentiality of communications what was the result of interpretation of wrongly drafted national legislation. The standard can differ depending on Member State and the right protected what can lead to fragmentation of the single market.

However, the general obligation to disclose IP addresses upon legitimate demand of an aggrieved party seems to be acceptable in the absence of any other remedy protecting a right holder against infringements committed on the Internet. It ought to be limited by the due process requirements and the principle of proportionality (as pointed out by the ECJ inPromusicae) . Moreover, IP addresses collected in the course of retention procedures – implemented in order to combat serious crimes, especially of terrorist character – are likely to be used for the purposes of civil proceedings. In fact, such a framework can be easily circumvented and the right to access to the retained data is likely to be abused by the lawmakers. Undoubtedly, this situation is a result of a shortage of a precise regulation on the EU level.

---

Árpád Geréd, Rechtsanwalt, BMA Brandstätter Rechtsanwälte GmbH, Wallnerstraße 3, 1010 Wien, AT
arpad.gered@bma-law.com ,www.bma-law.com

---