data protection law, founded on the basic idea that the general framework on Data
Protection in EU Law seeks to ensure a high level of protection of the fundamental
rights and freedoms of natural persons, in particular their right to privacy, with
respect to the processing of personal data.
8
Furthermore, an independent European advisory body on data protection and
privacy, composed of a representative of the supervisory authority of each Member
State, the European Data Protection Supervisor and a representative of the Commission, has played a very significant. The so-called Working Party on the Protection of
Individuals with regard to the Processing of Personal Data set up under Article 29 of
Directive 95/46/EC has become particularly influential in the interpretation, application and evolution of EU Data Protection Law by means of the opinions and other
documents.
9 As of 25 May 2018 the Article 29 Working Party ceased to exist and
was replaced by the European Data Protection Board (EDPB)
10 established under
the GDPR. The EDPB is composed of the head of one supervisory authority of each
Member State and of the European Data Protection Supervisor [Art. 68(3) GDPR].
1.2 The Concept of Personal Data and Data Protection
as Fundamental Right
For the purposes of the GDPR, personal data means: “any information relating to an
identified or identifiable natural person (‘data subject’); an identifiable natural person is
one who can be identified, directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental, economic, cultural
or social identity of that natural person” [Art. 4(1) GDPR]. The case-law of the CJEU
has confirmed that the concept of personal data encompasses IP addresses.
11
8 See, e.g., Judgment of the CJEU of 13 May 2014, rendered in case C-131/12, Google Spain SL and
Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González,
ECLI:EU:C:2014:317, para. 66 with further references.
9 Available at http://ec.europa.eu/justice/article-29/documentation/index_en.htm.
10 https://edpb.europa.eu/.
11 See Judgment of the CJEU of 19 October 2016, case C-581/14, Patrick Breyer v. Bundesrepublik
Deutschland, ECLI:EU:C:2016:779, establishing that Article 2(a) of Directive 95/46/EC “must be
interpreted as meaning that a dynamic IP address registered by an online media services provider
when a person accesses a website that the provider makes accessible to the public constitutes
personal data within the meaning of that provision, in relation to that provider, where the latter has
the legal means which enable it to identify the data subject with additional data which the internet
service provider has about that person”. Furthermore, see Judgments of the CJEU of 8 April 2014,
Digital Rights Ireland and Seitlinger, Joined Cases C-293/12 and C-594/12, ECLI:EU:C:2014:238,
para. 26; and of 21 December 2016, Tele2 Sverige AB and Secretary of State for the Home
Department, Joined Cases C-203/15 and C-698/15, ECLI:EU:C:2016:970, para 98. See also
Judgment of the ECtHR of 24 April 2018, Benedik v. Slovenia (app. no. 62357/14) regarding
dynamic IP addresses.
Data Protection in the Internet: A European Union Perspective
459
Protection in EU Law seeks to ensure a high level of protection of the fundamental
rights and freedoms of natural persons, in particular their right to privacy, with
respect to the processing of personal data.
8
Furthermore, an independent European advisory body on data protection and
privacy, composed of a representative of the supervisory authority of each Member
State, the European Data Protection Supervisor and a representative of the Commission, has played a very significant. The so-called Working Party on the Protection of
Individuals with regard to the Processing of Personal Data set up under Article 29 of
Directive 95/46/EC has become particularly influential in the interpretation, application and evolution of EU Data Protection Law by means of the opinions and other
documents.
9 As of 25 May 2018 the Article 29 Working Party ceased to exist and
was replaced by the European Data Protection Board (EDPB)
10 established under
the GDPR. The EDPB is composed of the head of one supervisory authority of each
Member State and of the European Data Protection Supervisor [Art. 68(3) GDPR].
1.2 The Concept of Personal Data and Data Protection
as Fundamental Right
For the purposes of the GDPR, personal data means: “any information relating to an
identified or identifiable natural person (‘data subject’); an identifiable natural person is
one who can be identified, directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental, economic, cultural
or social identity of that natural person” [Art. 4(1) GDPR]. The case-law of the CJEU
has confirmed that the concept of personal data encompasses IP addresses.
11
8 See, e.g., Judgment of the CJEU of 13 May 2014, rendered in case C-131/12, Google Spain SL and
Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González,
ECLI:EU:C:2014:317, para. 66 with further references.
9 Available at http://ec.europa.eu/justice/article-29/documentation/index_en.htm.
10 https://edpb.europa.eu/.
11 See Judgment of the CJEU of 19 October 2016, case C-581/14, Patrick Breyer v. Bundesrepublik
Deutschland, ECLI:EU:C:2016:779, establishing that Article 2(a) of Directive 95/46/EC “must be
interpreted as meaning that a dynamic IP address registered by an online media services provider
when a person accesses a website that the provider makes accessible to the public constitutes
personal data within the meaning of that provision, in relation to that provider, where the latter has
the legal means which enable it to identify the data subject with additional data which the internet
service provider has about that person”. Furthermore, see Judgments of the CJEU of 8 April 2014,
Digital Rights Ireland and Seitlinger, Joined Cases C-293/12 and C-594/12, ECLI:EU:C:2014:238,
para. 26; and of 21 December 2016, Tele2 Sverige AB and Secretary of State for the Home
Department, Joined Cases C-203/15 and C-698/15, ECLI:EU:C:2016:970, para 98. See also
Judgment of the ECtHR of 24 April 2018, Benedik v. Slovenia (app. no. 62357/14) regarding
dynamic IP addresses.
Data Protection in the Internet: A European Union Perspective
459