On 1 October 2019, the Court of Justice of the European Union handed down a crucial decision impacting the way that consent is obtained on the internet. The judgment relates to Case C-673/17. In the Planet49 case, the German Federal Court referred a number of questions to the CJEU regarding the validity of consent to cookies placed by a website operating an online lottery.
The Court of Justice of the European Union has ruled that dynamic IP addresses are capable of constituting personal data under certain circumstances, ending years of speculation about whether such essential building blocks of the Internet qualified for protection under the EU Data Protection Directive. In Patrick Breyer v Bundesrepublik Deutschland, Breyer challenged the collection and use of dynamic IP addresses from websites run by the German Federal Government. The CJEU decided that in circumstances where a third party holds information which might likely be used to identify the user of a website when put together with the dynamic IP addresses held by the provider of that website, those IP addresses constitute personal data. In this blog post, we explore the decision in Breyer, which may impact the laws and concept of personal data of Member States beyond Germany.