Feeds

IP address-tracing software breached data protection law

Swiss court rules on Logistep

Next gen security for virtualised datacentres

The Swiss Federal Court has ruled that software which identified the internet protocol (IP) address of unauthorised music uploaders broke data protection law.

The court backed that country's data protection commissioner, who said that Logistep violated Switzerland's Data Protection Act when it used the software. The IP addresses were personal data, the Court said, and processing that data without the knowledge or permission of the person concerned was a breach of the law, it said.

The Court recognised the economic interest that copyright holders had in stopping the illegal sharing of material in which they had rights, but said that that interest did not justify what it called a significant intrusion into the privacy of each affected user.

Logistep's File Sharing Monitor software searches peer-to-peer (P2P) networks and when it finds copyright-infringing files logs the IP address of the uploader. This information is then passed to copyright holders, who can use it as the basis of legal action.

The status of IP addresses has been hotly contested in Europe, with some privacy advocates arguing that they are personal data as defined in the EU's Data Protection Directive, and others arguing that though they are personal data in some circumstances, that is not always the case.

Switzerland is not a member of the EU so is not bound by the Data Protection Directive, but its court has found that in this case the IP addresses did qualify as personal data. This means that anybody using and storing the IP addresses must abide by its data protection laws.

Switzerland's data protection commissioner had told Logistep that its behaviour violated the law, but a lower court had sided with the company. The Federal Court has reversed that decision.

Richard Schneider of Logistep said in a statement that his company's work had been recognised in other European countries. In an automatic translation his statement said that the verdict could lead to "a massive and uncontrolled illegal distribution of copyright-protected content in Switzerland, a sort of legal limbo".

IP addresses on their own do not identify individuals, but when combined with information held by an internet service provider (ISP) they can be used to identify which internet connection was used.

A French court ruled earlier this year that a French music royalty collection society did not breach data protection law when using IP addresses and that the addresses were not personal data because they did not directly identify users.

In 2008 the then-head of a committee of the EU's data protection officials told OUT-LAW Radio that though there were circumstances in which IP addresses were not personal data, they should always be treated as such as a matter of good data protection policy.

"In the most cases IP addresses have to be seen as personal related and therefore the European Directive on Data Protection covers also the use of IP addresses," said Peter Schaar. "I understand that under specific circumstances IP addresses are not personal-related but in general we would say as data protection authorities IP addresses are personal data because they identify indirectly the user of computer systems connected to the internet."

Copyright © 2010, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

The essential guide to IT transformation

More from The Register

next story
Hello, police, El Reg here. Are we a bunch of terrorists now?
Do Brits risk arrest for watching beheading video nasty? We asked the fuzz
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
EU justice chief blasts Google on 'right to be forgotten'
Don't pretend it's a freedom of speech issue – interim commish
Detroit losing MILLIONS because it buys CHEAP BATTERIES – report
Man at hardware store was right: name brands DO last longer
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.