Patrick Breyer – CJEU Judgment (Germany, 2016)

Mr. Breyer accessed several websites, which provided topical information, operated by German Federal Institutions which were accessible to the public. To prevent attacks, the sites stored information on all access operations in log files. Information stored include name of the web page, terms entered in the search fields, time of access, quantity of data transferred, an indication of whether the access was successful and the IP address of the computer that accessed the website. Mr. Breyer brought an action before the German Administrative Court seeking an order to restrain the Federal Republic of Germany from storing his access information of his visit to the website. This first action was dismissed. He appealed to the Court of Appeal. The court granted the injunction but only in part. The court ordered the Federal Republic of Germany to refrain from storing or arranging with third parties to store, at the end of each consultation period, information relating to Mr. Breyer's access including his IP address and any information that could result in revealing his identity. The court further stated that a dynamic IP address together with the date on which the website was accessed, where the user had revealed his identity during that consultation period, amounts to personal data since the user’s identity is tied to that particular dynamic IP address. On the other hand, the court observed stated that where Mr Breyer did not reveal his identity and only the internet service provider knew his identity the dynamic IP address doesn’t amount to personal data. Mr Breyer and the Federal Republic of Germany each brought an appeal on a point of law before the Federal Court of Justice, Germany (Bundesgerichtshof). Mr Breyer sought to have his application for an injunction upheld in its entirety while the Federal Republic of Germany sought to have it dismissed. The Federal court stayed the proceedings and referred the following issues to the CJEU. The CJEU answered the following