Luxembourg, 27 October 2022
Press Release No 172/22
First Advocate General Szpunar: a national authority should be able to access civil identity data linked to IP addresses where such data are the only means of investigation enabling the identification of the holders of those addresses suspected of online copyright infringement.
In his view, such a proposal fully complies with the requirement of proportionality and ensures respect for the fundamental rights guaranteed by the Charter.
The issue of the retention and access to certain data of internet users is a topic of perennial interest and has been the subject of recent, yet already ample, case-law of the Court. Four associations for the protection of rights and freedoms on the internet (La Quadrature du Net, the Federation of Associative Internet Access Providers, the Franciliens.net and the French Data Network) brought an action before the Conseil d’État (Council of State, France) for annulment of the implied decision by which the Prime Minister rejected their application for the repeal of a decree. For the purposes of the protection of certain intellectual works on the Internet, automated processing of personal data has been introduced.
The objective of that processing is to send individuals the warning provided for in the Intellectual Property Code, the purpose of which is to combat the offence described as ‘gross negligence’, which is the fact that a person does not prevent his access to the internet from being used to commit acts constituting infringement of copyright. The recommendations sent to the holders of the relevant subscriptions are part of the ‘graduated response’ procedure.
Those associations claim that that decree authorises access to connection data in a disproportionate manner for copyright offences committed online which are not serious, without prior review by a judge or authority offering guarantees of independence and impartiality, as advocated by the case-law of the Court1.
The Conseil d’État notes that, for the purposes of these recommendations, the officials of the High Authority for the dissemination of works and the protection of rights on the internet (Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet – HADOPI) collect, each year, a considerable amount of data relating to the civil identity of the users concerned. In view of the volume of those recommendations, making that collection subject to prior review would make it impossible to prepare those recommendations. It therefore asks the Court about the scope of that prior review and, in particular, whether the civil identity data corresponding to an IP address is subject thereto.
In his Opinion delivered today, Advocate General Szpunar takes the view that EU law should be interpreted as not precluding measures providing for the general and indiscriminate retention of IP addresses assigned to the source of a connection, for a period limited in time to what is strictly necessary, for the purposes of preventing, investigating, detecting and prosecuting online criminal offences for which the IP address is the only means of investigation enabling the identification of the person to whom that address was assigned at the time of the commission of the offence. In so doing, he proposes to the Court some readjustment of the case-law on national measures for the retention of IP addresses interpreted in the light of EU law, without, however, calling into question the requirement of proportionality imposed for the retention of data, in the light of the serious nature of the interference with the fundamental rights enshrined in the European Charter of Fundamental Rights of the European Union.
The First Advocate General adds that Hadopi’s access to civil identity data linked to an IP address also appears to be justified by the public interest objective for which providers of electronic communications services were ordered to retain the data so that access to those data should be made possible in order to pursue the same objective, short of accepting general impunity for offences committed exclusively online.
In his view, EU law does not require the existence of prior review of Hadopi’s access to civil identity data linked to users’ IP addresses by a court or an independent administrative body, for two reasons: first, Hadopi’s access is limited to linking civil identity data to the IP address used and to the file viewed at a given point in time; it does not enable the competent authorities to reconstruct the online clickstream of the user in question or, therefore, to draw precise conclusions concerning his or her private life beyond the identification of the specific file viewed when the infringement was committed. Second, Hadopi’s access to civil identity data linked to IP addresses is strictly limited to what is necessary to achieve the objective pursued, namely the prevention, investigation, detection and prosecution of online criminal offences for which the IP address is the only means of investigation enabling the person to whom that address was assigned at the time of the commission of the offence to be identified, of which the graduated response mechanism forms part.
Finally, the First Advocate General points out that the graduated response procedure remains subject to the provisions of Directive 2016/680 and that, as such, the natural persons targeted by Hadopi enjoy a set of substantive and procedural guarantees.
NOTE: The Advocate General’s Opinion is not binding on the Court of Justice. It is the role of the Advocates General to propose to the Court, in complete independence, a legal solution to the cases for which they are responsible. The Judges of the Court are now beginning their deliberations in this case. Judgment will be given at a later date.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
1 See judgment of 21 December 2016, Tele2 Sverige and Watson and Others, C-203/15 and C-698/15 (see also PR No 145/16).
Source – EU Court of Justice – Email