Patrick Breyer v Bundesrepublik Deutschland.
Date: 2016-10-19
25


The Bundesgerichtshof (Federal Court of Justice) refers to the academic disagreement relating to whether, in order to determine whether someone is identifiable, an ‘objective’ or ‘relative’ criterion must be used. The application of an ‘objective’ criterion would have the consequence that data such as the IP addresses at issue in the main proceedings may be regarded, at the end of the period of use of the websites at issue, as being personal data even if only a third party is able to determine the identity of the data subject, that third party being, in the present case, Mr Breyer’s internet service provider, which stored the additional data enabling his identification by means of those IP addresses. According to a ‘relative’ criterion, such data may be regarded as personal data in relation to an entity such as Mr Breyer’s internet service provider because they allow the user to be precisely identified (see, in that connection, judgment of 24 November 2011, Scarlet Extended, C‑70/10, EU:C:2011:771, paragraph 51), but not being regarded as such with respect to another entity, since that operator does not have, if Mr Breyer has not disclosed his identity during the consultation of those websites, the information necessary to identify him without disproportionate effort.
43


In so far as that recital refers to the means likely reasonably to be used by both the controller and by ‘any other person’, its wording suggests that, for information to be treated as ‘personal data’ within the meaning of Article 2(a) of that directive, it is not required that all the information enabling the identification of the data subject must be in the hands of one person.
52


In that connection, it must be recalled that the activities mentioned by way of examples by that provision are, in any event, activities of the State or of State authorities and unrelated to the fields of activity of individuals (see judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 43, and of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 41).
57


The Court has held that Article 7 of Directive 95/46 sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful and that the Member States cannot add new principles relating to the lawfulness of the processing of personal data or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in that article (see, to that effect, judgment of 24 November 2011, ASNEF and FECEMD, C‑468/10 and C‑469/10, EU:C:2011:777, paragraphs 30 and 32).
58


Article 5 of Directive 95/46 authorises Member States to specify, within the limits of Chapter II of that directive and, accordingly, Article 7 thereof, the conditions under which the processing of personal data is lawful, the margin of discretion which Member States have pursuant to Article 5 can therefore be used only in accordance with the objective pursued by that directive of maintaining a balance between the free movement of personal data and the protection of private life. Under Article 5 of Directive 95/46, Member States also cannot introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7 thereof, nor can they amend, by additional requirements, the scope of the six principles provided for in Article 7 (see, to that effect, judgment of 24 November 2011, ASNEF and FECEMD, C‑468/10 and C‑469/10, EU:C:2011:777, paragraphs 33, 34 and 36).
62


Article 7(f) of that directive precludes Member States from excluding, categorically and in general, the possibility of processing certain categories of personal data without allowing the opposing rights and interests at issue to be balanced against each other in a particular case. Thus, Member States cannot definitively prescribe, for certain categories of personal data, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case (see, to that effect, judgment of 24 November 2011, ASNEF and FECEMD, C‑468/10 and C‑469/10, EU:C:2011:777, paragraphs 47 and 48).