Internet protocol as personal data

The Organic Law on Data Protection (15/1999) establishes the principle that persons from whom personal data is requested should be informed in advance of certain aspects expressly, precisely and unequivocally. However, when personal data has not been obtained directly from the interested party, he or she must be informed expressly, precisely and unequivocally by the person in charge of the file (or by his or her representative) within three months of registration of the data, unless he or she had been previously informed of the contents of the data processing, the origin of the data and other legally required aspects. 

As an exception to the above, this information need not be provided to the interested party when:

• This is expressly provided for by law.
• The data processing has historical, statistical or scientific purposes.
• It is impossible to provide the information to the interested party or doing so would require disproportionate efforts, in the opinion of the Data Protection Agency or an equivalent regional body, considering the number of interested parties, the age of the data and possible compensatory measures.
• The data comes from public sources and is intended for advertising or commercial activity. In this case, in every communication addressed to the interested party, he or she must be informed of the origin of the data and of the identity of the person in charge of the data processing, as well as of his or her rights.

Productores de Música de España (PROMUSICAE), the Spanish music producers' association, requested from the Data Protection Agency authorisation to process data regarding the internet protocol (IP) addresses of internet users in order to combat online music piracy. The agency rejected the motion on 2nd July 2009. On 1st September 2011 the Chamber for Contentious-Administrative Proceedings of the National High Court confirmed the agency's decision.

The court pointed out that “the concept of personal data is very broad”, and that:

“The criterion of identifiability is basic in order to understand that the IP address must be deemed personal data and, therefore, is subject to the same guarantees that are applied to any kind of personal data with regard to the processing of the data.”

What PROMUSICAE was seeking in relation to the users' IP addresses clearly fell within the concept of data processing, and consequently necessitated the application of the general criteria and requirements of the concept of data processing. In the chamber’s opinion, “the IP address is personal data” and the appellant was seeking to “carry out the processing of said data without having the consent of the interested party”.
The chamber refused to allow PROMUSICAE to avail itself of the option provided by the law of dispensing with the consent of the interested party when the personal data come from publicly accessible sources. The court reasoned that this was because:

“the IP address which the appealing party could obtain by means of a particular computer program are data which under no circumstances can be understood as coming from publicly-accessible sources due to the simple fact that they appear on the Internet, and the exception to the requirement of the consent to data processing stemming from Article 6.2 of the Organic Law on Data Protection cannot be applied.”

Further:

“the consent set forth in Article 6.1 of the Organic Law on Data Protection shall be tacit, but in any case, shall be unequivocal, and said condition is not a result of the transparency of IP address on the Internet.”

It continued:

“even if it is understood that tacit consent could exist, it turns out that the consent shall never be understood as having been given to such a specific and precise type of processing as the one that is sought: the application of a computer program to determine the IP address of the users of programs used to download phonograms and music.”

The chamber reached the same conclusion with the application of Act 25/2007 on the conservation of data relative to electronic communications and public communication networks, with the following reasoning:

“the specific regulations on electronic communications prevents the admission of the appealing party’s wishes, since (regardless of whether or not one has the consent of the interested party and of the owner of the IP address) it is not possible for internet service providers to have at their disposal the information of their customers’ IP addresses in order to provide that to an entity such as the appellant which, among other considerations, is simply a private entity and does not have the status of a management entity for the purpose of evaluating the use it seeks to make of the data arising from the downloaded phonograms and movies.”

PROMUSICAE has appealed the chamber's ruling to the Supreme Court. Thus, the situation will not be resolved until the ruling of the Supreme Court, which will have to consider the criteria established by the European Court of Justice in its ruling of 24th November 2011 (C-468/10 and C-469/19) with regard to the Spanish data protection regulations.