Asked for a preliminary ruling from an Antwerp court, the CJEU ruled in particular on the systematic collection of IP addresses. This was an intellectual property rights holder whose copyrighted work had been shared over a peer-to-peer network. The holder of these rights systematically collected the IP addresses of infringers in order to request their identification data from access providers.
In a judgment of June 17, 2021 (case C-597/19), the CJEU established three conditions of Article 6.1.f of the GDPR so that the processing of personal data is lawful:
- the processing of personal data must have as its objective the pursuit of a legitimate interest;
- said processing must be necessary to achieve the legitimate interest pursued;
- the interests or fundamental rights and freedoms of the data protection subject must not prevail.
In the present case, the Court considers that the defense of intellectual property rights constitutes a legitimate interest and that the collection of IP addresses may be necessary insofar as “identification of the owner of the connection is often possible only on the basis of the IP address and the information provided by the Internet service provider”.
An important decision on the balance between the protection of intellectual property rights and the protection of personal data.