Privacy & Information Security Law Blog

On May 12, 2016, the Advocate General (“AG”) of the Court of Justice of the European Union (“CJEU”) issued an opinion stating that Internet Protocol (“IP”) addresses are personal data and data protection law should apply to IP addresses. Specifically, the AG urged the CJEU to rule that a dynamic IP address is personal data to the extent that an Internet access provider has additional data that in combination with the IP address would allow for the re-identification of the user.

The opinion was issued in Patrick Breyer v. Federal Republic of Germany, a case which was referred to the CJEU by Germany’s Supreme Court in 2014. The AG's opinion is a procedural step before the court issues its final decision, which is expected soon. The opinion is not binding on the CJEU, but is highly influential.