German court set to rule on legality of IP address harvesting

Germany's federal court is set to hand down a ruling about the legality of storing IP addresses.

It'll be the culmination of a long-running suit brought by Patrick Beyer, who wants to prevent German government Websites from storing his IP addresses.

The government's argument is that storing visitors' IPs, along with a timestamp of the visit, is necessary to identify where attacks come from and, in the event of an attack, help with forensics.

Beyer, a lawyer and member of the Pirate Party in the state of Schleswig-Holstein, first brought the anti-syslog lawsuit in 2008, and last October, the European Court of Justice (ECJ) handed the German government a win.

It ruled (PDF) that IP addresses can be collected if they don't identify an individual, and noted that the record that ties an account holder to an IP address is held not by a government Website, but by an ISP.

The court also ruled that defending a site from attack is a legitimate use of IP addresses.

The next step in the case is for the German court to decide how to apply the ECJ decision to Beyer's case.

Beyer is still hoping that his argument, that the syslogs breach German data protection laws, will prevail.

As Germany's international broadcaster Deutsche Welle notes, the key issue for the court will be to determine the extent of the government's “legitimate interest” in collecting the IP addresses. ®