DPA case PVN-2021-06 (Datatilsynet 21/00045) – Dismissed (Norway, 2021)

After reviewing their Microsoft Hotmail account login activity, a data subject believed that the account had been hacked as the list of IP addresses showed unlawful logins and email activity. The data subject asked Microsoft support for help to identify these IP addresses, both in terms of the IP "owner" and the login location. Microsoft rejected the request. The data subject then required assistance of the Norwegian DPA, based on GDPR rights. The DPA denied the request as per Article 55 GDPR, stating that the GDPR does not apply to his situation. In this regard, the DPA noted that IP addresses may be personal data as per Article 4(1) GDPR and that the data subject indeed has a right to obtain these from Microsoft - however only as far as it concerns his own personal data. According to Article 15(1) GDPR where a data subject's access right pertains to their personal data, not the personal data of someone else. Consequently, the DPA stated that they are not competent to instruct Microsoft to hand over this information. The data subject lodged a complaint to the DPA about their decision, however, the DPA upheld their decision and it was (as per Norwegian law) referred to the Privacy Appeals Board. The Privacy Appeals Board agreed with the DPA and rejected the data subject's complaint. The Privacy Appeals Board noted that regardless of the data subject's claim, it's not Microsoft who has the list of IP addresses matched with identity, but internet providers (for limited time). Further, they note that it's usually difficult to determine the location of an IP address, especially if someone uses a mobile phone and VPN (Virtual Private Network).