Are IP addresses permitted to be stored on a precautionary basis?

For how long may the IP address be stored "on a precautionary basis" or must it be deleted immediately? In the dispute between a customer and Deutsche Telekom AG that commenced in 2007, the Federal Court of Justice (BGH) has taken a further position, now also on the points of indicated pseudonymisation and the unlawfulness of precautionary data storage.

The holder of the DSL connection demanded that Deutsche Telekom AG delete the IP address immediately. In the earlier proceedings, it had already been decided that whilst the corporation could not store the IP address for the initially proposed duration of 80 days, it could indeed do so for 7 days.

In the renewed appeal, the Federal Court of Justice (BGH) dealt inter alia with the question of whether pseudonymisation was indicated. Furthermore, the Federal Court of Justice (BGH) was confronted with thejudgment of the Court of Justice of the European Union (EuGH) of 8 April 2014 – Az. C-293/12, by which the invalidity of the European Directive on the retention of data was declared.

The decision of the Court

The pseudonymisation demanded by the user was rejected by theFederal Court of Justice (BGH) in its judgment of 3 July 2014 – Az. III ZR 391/13.

In pseudonymisation, the customer identification would not be linked to the IP address used, but rather to another anonymous character string. The assignment of the character string to a specific user would be carried out by an external service provider.

The Federal Court of Justice (BGH) held that the IP address in itself was also anonymous. Conclusions regarding a specific user would only be possible through the linking with the additional data of the user's specific session. The added value in data protection would therefore be achieved solely by the fact that the pseudonymisation would have to be reversed by an external neutral body. However, reversing the pseudonymisation for each individual misuse case would, given the multitude of misuse cases per month, constitute an unreasonable additional burden. Following the evidence heard in the appellate proceedings, 500,000 misuse cases would have to be pursued monthly.

The Federal Court of Justice (BGH) also saw no reason in the judgment of the Court of Justice of the European Union (EuGH) regarding the invalidity of the Directive on data retention to revise the retention period of 7 days. The Federal Court of Justice (BGH) argued that, quite apart from the fact that the Directive contained a significantly longer retention period of 6 months (at minimum), the considerations of the Court of Justice of the European Union (EuGH) were not applicable. In the present case, the storage took place in the interest of the network operator and not for access by the police and public prosecution authorities.

Conclusion

Even if there is no apparent reason, according to the case law of the Federal Court of Justice (BGH), the IP address of the user may be stored by its telecommunications provider for 7 days. This is justified by the need to prevent disruptions to the communications infrastructure.