Court of Justice of the European Union — Premier ministre

Decided by

Court of Justice of the European Union

Parties

La Quadrature du Net, Fédération des fournisseurs d’accès à Internet associatifs, Franciliens.net, French Data Network v. Premier ministre, Ministre de la Culture

Decision date

April 30, 2024

Remedy

The Court ruled that Directive 2002/58 does not preclude national legislation permitting public access to civil identity data linked to IP addresses to combat copyright infringement, provided strict data separation, procedural safeguards, and non-automated prior review conditions are met.

Appeal

Appeal status not stated

Key holdings

1. IP addresses constitute both traffic data under Directive 2002/58 and personal data under general data protection law.

   “IP addresses constitute both traffic data for the purposes of Directive 2002/58 and personal data for the purposes of the GDPR” — paragraph 60

2. Linking user identity data with files revealing protected work titles in repeat offence cases requires prior review by a court or independent body.

   “linking such data with files containing information that reveals the title of protected works the making available of which on the internet justified the collection of IP addresses” — paragraph 164

3. The required prior review by a court or independent administrative body before linking sensitive user data cannot be entirely automated.

   “a prior review may in no case be entirely automated” — paragraph 148

In plain English

French digital rights associations, including La Quadrature du Net, challenged French decree rules regarding the automated processing system used by Hadopi, the authority responsible for copyright protection on the internet. They argued that permitting public access to connection data and personal identity details to combat online copyright infringement violated European Union privacy rights without prior judicial review. The Conseil d'État referred questions to the Court of Justice of the European Union. The Court evaluated whether national rules authorizing access to civil identity data associated with collected IP addresses were compatible with European Union law. The Court ruled that European Union law does not preclude national legislation that permits an authority to access civil identity data linked to IP addresses retained by internet service providers to identify suspected copyright infringers, provided strict conditions are met. First, different data categories must be kept in a genuinely watertight separation to prevent profiling. Second, access must serve exclusively to identify suspects and prevent tracking clickstream activity. Third, linking identity data with files revealing work titles during repeat offences requires prior review by a court or independent body, which cannot be entirely automated. Finally, the data processing system must undergo regular independent review.