Stichting Brein – Court Ruling (Netherlands, 2022)

Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In December 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks. However, Brein did not possess the name and address details of the torrent users, but only their IP-adresses. Hence, it needed the cooperation of Internet Service Provider (ISP) to link an IP address to name and address details. With this information, Brein would be able to send the warning letters. Ziggo, however, did not want to cooperate voluntarily. Therefore, Brein filed a submission at the Midden-Nederland Court of First Instance (Rechtbank) to force Ziggo to send the warning letters to the respective users. The first instance Court rejected this submission in a previous interim relief proceeding. This Court of First Instance held that combining IP addresses and contact details of ISP clients entailed the processing of personal data relating to criminal convictions and offences or related security measures (criminal data) pursuant to Article 10 GDPR. The ISP didn't receive a permit from Dutch the DPA to process criminal personal data, and therefore lacked a legal basis. The Court also held that Articles 32 and 33 UAVG (Dutch law for the implementation of the GDPR) were the only provisions which contained 'appropriate safeguards' as stated in Article 10 GDPR. Brein appealed this ruling. The Court of appeal held that it had to answer two questions: (1) if there was a legal basis that could force the ISP to cooperate with the request of Brein and (2) if the ISP was even allowed to combine the contact details and the IP addresses in the first place. The Court held that both questions should be answered negatively. The Court of appeal started by confirming that combining IP addresses and contact details was indeed processing of criminal data under Article 10 GDPR. The ISP would need a legal basis for this processing, which had to be conducted under the control of official authority or had to be authorised by Union or Member State law, providing appropriate safeguards for the rights and freedoms of data subjects. The first question was not a question regarding the GDPR. It concerned a balancing exercise in a Dutch provision (Article 6:162 BW) to determine if the ISP was obligated to supply the contact details of its users. The Court of appeal held that the ISP could not be obligated to supply the information. The second question was the fact if the ISP was even allowed to process the data under Article 10 GDPR. The Court rejected an argument from Brein that article 6:162 BW could be used besides Articles 32 and 33 UAVG to provide 'appropriate safeguards'. This argument was rejected by the Court because nothing in this provision could substantiate the claim by Brein. Brein also stated several reasons why Articles 32 and 33 UAVG could be used as legitimate grounds for processing. The controller also rejected all of these claims by Brein. Therefore, the Appealing Court held that the ISP did not have a legal ground under Article 10 GDPR to process the criminal data. The ISP could therefore not be obligated by the Court to combine the IP addresses and contact details in order to send warning letters to its users. The Court stated that Brein could have filed a request to force the ISP to get a licence from the Dutch DPA. However, since it didn't take this potential step, there was no legal basis for the processing in question.