CURIA - Documents
43 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
153
However, since IP addresses may be used, among other things, to track an Internet user’s complete
clickstream and, therefore, his or her entire online activity, that data enables a detailed profile of the
user to be produced. Thus, the retention and analysis of those IP addresses which is required for
such tracking constitute a serious interference with the fundamental rights of the Internet user
enshrined in Articles 7 and 8 of the Charter, which may have a deterrent effect as mentioned in
paragraph 118 of the present judgment.
154
In order to strike a balance between the rights and interests at issue as required by the case-law
cited in paragraph 130 of the present judgment, account must be taken of the fact that, where an
offence is committed online, the IP address might be the only means of investigation enabling the
person to whom that address was assigned at the time of the commission of the offence to be
identified. To that consideration must be added the fact that the retention of IP addresses by
providers of electronic communications services beyond the period for which that data is assigned
does not, in principle, appear to be necessary for the purpose of billing the services at issue, with the
result that the detection of offences committed online may therefore prove impossible without
recourse to a legislative measure under Article 15(1) of Directive 2002/58, something which several
governments mentioned in their observations to the Court. As those governments argued, that may
occur, inter alia, in cases involving particularly serious child pornography offences, such as the
acquisition, dissemination, transmission or making available online of child pornography, within the
meaning of Article 2(c) of Directive 2011/93/EU of the European Parliament and of the Council of
13 December 2011 on combating the sexual abuse and sexual exploitation of children and child
pornography, and replacing Council Framework Decision 2004/68/JHA (OJ 2011 L 335, p. 1).
155
In those circumstances, while it is true that a legislative measure providing for the retention of the
IP addresses of all natural persons who own terminal equipment permitting access to the Internet
would catch persons who at first sight have no connection, within the meaning of the case-law cited
in paragraph 133 of the present judgment, with the objectives pursued, and it is also true, in
accordance with what has been stated in paragraph 109 of the present judgment, that Internet users
are entitled to expect, under Articles 7 and 8 of the Charter, that their identity will not, in principle,
be disclosed, a legislative measure providing for the general and indiscriminate retention of only IP
addresses assigned to the source of a connection does not, in principle, appear to be contrary to
Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the
Charter, provided that that possibility is subject to strict compliance with the substantive and
procedural conditions which should regulate the use of that data.
156
In the light of the seriousness of the interference entailed by that retention with the fundamental
rights enshrined in Articles 7 and 8 of the Charter, only action to combat serious crime, the
prevention of serious threats to public security and the safeguarding of national security are capable
of justifying that interference. Moreover, the retention period must not exceed what is strictly
necessary in the light of the objective pursued. Finally, a measure of that nature must establish strict
conditions and safeguards concerning the use of that data, particularly via tracking, with regard to
communications made and activities carried out online by the persons concerned.
157
Concerning, last, data relating to the civil identity of users of electronic communications systems,
that data does not, in itself, make it possible to ascertain the date, time, duration and recipients of
the communications made, or the locations where those communications took place or their
frequency with specific people during a given period, with the result that it does not provide, apart
from the contact details of those users, such as their addresses, any information on the
communications sent and, consequently, on the users’ private lives. Thus, the interference entailed
by the retention of that data cannot, in principle, be classified as serious (see, to that effect,
judgment of 2 October 2018, Ministerio Fiscal, C‑207/16, EU:C:2018:788, paragraphs 59 and 60).
158
It follows that, in accordance with what has been stated in paragraph 140 of the present judgment,
legislative measures concerning the processing of that data as such, including the retention of and
access to that data solely for the purpose of identifying the user concerned, and without it being
2/15/2021, 4:58 PM