Luxembourg, 30 April 2024
Judgment of the Court in Case C-470/21| La Quadrature du Net and Others – Personal data and action to combat counterfeiting
Combating criminal offences and interference with fundamental rights: a national public authority responsible for combating online counterfeiting may access identification data on the basis of an IP address
—
The Court specifies the requirements concerning the arrangements for retaining and accessing those data
Member States may impose on internet access providers an obligation to retain IP addresses, in a general and indiscriminate manner, for the purposes of combating criminal offences in general, provided that such retention does not allow precise conclusions to be drawn about the private life of the person concerned. That can be achieved by retention arrangements that ensure a genuinely watertight separation of IP addresses and other categories of personal data, in particular civil identity data.
Member States may also, under certain conditions, authorise the competent national authority to access the civil identity data associated with IP addresses, provided that such retention – guaranteeing a watertight separation of the different categories of retained data – has been ensured.
Where, in atypical situations, the specific features of a national procedure governing such access may – through the linking of the data and information collected – allow precise conclusions to be drawn about the private life of the person concerned, access must be subject to prior review by a court or by an independent administrative body.
In order to protect works covered by copyright or related rights against offences committed on the internet, a French decree introduced two personal data processing operations. The first operation consists of the collection, by rightholder organisations, of IP addresses which appear to have been used on peer-to-peer websites to commit such offences and the referral of those IP addresses to the Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet (High Authority for the dissemination of works and the protection of rights on the Internet) (Hadopi) 1. The second operation, carried out by the internet access providers at Hadopi’s request, consists, inter alia, of matching the IP address with the civil identity data of its holder. Those data processing operations enable Hadopi to initiate a procedure against the persons identified, combining educational and punitive measures, which may lead to a referral to the public prosecution service in the most serious cases.
Four associations for the protection of rights and freedoms on the internet brought an action before the Conseil d’État (Council of State, France) seeking annulment of the decree at issue. The Conseil d’État asks the Court of Justice whether the abovementioned data processing operations are compatible with EU law.
The Court, sitting as the Full Court, holds that the general and indiscriminate retention of IP addresses does not necessarily constitute a serious interference with fundamental rights. Such retention is permitted where the national legislation imposes retention arrangements that ensure a genuinely watertight separation of the different categories of personal data and thus rule out the possibility that precise conclusions could be drawn about the private life of the person concerned.
The Court also specifies that EU law does not preclude national legislation authorising the competent public authority, for the sole purpose of identifying the person suspected of having committed a criminal offence, to access the civil identity data associated with an IP address, retained separately and in a genuinely watertight manner by the internet access providers. The Member States must nevertheless ensure that that access does not allow precise conclusions to be drawn about the private life of the IP address holders concerned. That means that officials with such access must be prohibited from disclosing information on the content of the files consulted, from tracking the clickstream on the basis of IP addresses and from using those IP addresses for any purpose other than that of identifying their holders with a view to the potential adoption of measures.
Where data relating to the civil identity of users of electronic communications is accessed for the sole purpose of identifying the user concerned, a prior review of that access by a court or by an independent administrative body is not required since the interference entailed by that access cannot be classified as serious. Such a review must be carried out, however, where the particular features of a national procedure governing such access may – through the linking of the data and information collected as that procedure progresses though its different stages – allow precise conclusions to be drawn about the private life of the person concerned and, accordingly, give rise to a serious interference with fundamental rights. In such a case, that review by a court or an independent administrative body must take place before that linking, while preserving the effectiveness of that procedure by, in particular, allowing the identification of the cases in which there is a possible further repetition of the offending conduct in question.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of EU law or the validity of an EU act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
Unofficial document for media use, not binding on the Court of Justice.
The full text and, as the case may be, an abstract of the judgment is published on the CURIA website on the day of delivery.
—
1 On 1 January 2022, Hadopi was merged with the Conseil supérieur de l’audiovisuel (Higher council for the audiovisual sector) (CSA) to form the Autorité de régulation de la communication audiovisuel et digiques (Authority for the Regulation of Audiovisual and Digital Communications) (ARCOM). Since then, the graduated response procedure, which has remained essentially unchanged, is implemented by two members of the board of ARCOM, one of whom is appointed by the Conseil d’État (Council of State, France) and the other by the Cour de cassation (Court of Cassation, France).