The Protection of Privacy of IP Addresses in Slovenia Presented by: Mr. Damjan Date: 24 November 2022 IP ADDRESS - Numerical identifier assigned to every device on a network. - IPv6: 128 bits written as eight four-digit hexadecimal numbers separated by colons. • 192.0.2.1 • 2001:db8:0:1234:0:567:8:1 - Defines the location of the device in the network. - Allows the devices to recognize each other and communicate with each other using the Internet Protocol. - Static IP address: permanently allocated by the ISP to a particular device. - Dynamic IP address: assigned to device only temporarily, each time the device connects to the internet. Can only be traced to the ISP PROTECTION OF PRIVACY OF IP ADDRESS - - Technological protection: • VPN: through encrypted tunnels • Anonymous browser (Tor): onion routing Legal protection • Information privacy (personal data protection) • Communication privacy LEGAL BASES - - Slovenian Constitution: • Article 35: general right to privacy • Article 38: the protection of personal data ECHR: • - Article 8: the protection of private and family life EU Charter of Fundamental Rights • Article 7: the respect for private and family life • Article 8: the protection of personal data GDPR: DEFINITION OF PERSONAL DATA - Article 4(1) GDPR: - Personal data means any information relating to an identified or identifiable natural person (data subject). - An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. • Also online identifiers provided by users' devices, applications, tools and protocols, such as IP addresses, cookie identifiers or as RFID tags - Processing of personal data can be only performed on the basis of the consent of the data subject concerned or some other legitimate basis laid down by law. CJEU CASE LAW - C 70/10 Scarlet Extended: • IP addresses are protected personal data because they allow the users to be precisely identified - C 293/12 and C 594/12 Digital Rights Ireland - C-582/14 Patrick Breyer v Germany • Not necessary that all the information enabling the identification of the data subject is in the hands of one person. • Is the possibility to combine a dynamic IP address with the additional data held by the ISP a means likely reasonably to be used to identify the data subject? • Not the case if the identification of the data subject is prohibited by law or practically impossible. POSITION OF THE SLOVENIAN INFORMATION COMMISSIONER - Advisory opinions: • IP addresses should be considered personal data in most situations as they can be used, at least indirectly, to identify individuals. - A dynamic IP address is personal data when combined with information on the time it was assigned or the time of access to the network. - A static IP address is always considered personal data because the individual user is always identifiable on its basis. LEGAL BASE - IP address: technical information required to establish online communication. - Separate from the content of the communication, yet closely related to it as metadata. - Article 37 of the Slovenian Constitution - Article 8 of the ECHR - Article 7 of the EUCFR - „Letters and correspondence" → protects the privacy of any mode of communication, regardless of the technology used. - Not only personal, intimate communication → also protects communication with professional and commercial content. STRICT PROCEDURAL SAFEGUARDS - Requirements for interference with communication privacy under the Slovenian Constitution: • only based on a court order and • only when expressly provided for by law and • only if necessary for the institution or course of criminal proceedings or for reasons of national security. - No secondary legislation defines the extent of communication privacy. - e-Privacy Directive: • No surveillance or interception of communications and traffic data without the consent of users or legal authorization. • The access to such information stored on user's personal equipment is only permitted if the user has been clearly and fully informed. • When traffic data are no longer required for communication or billing, they must be erased or made anonymous. THE PROTECTION OF METADATA - Slovenian Constitutional Court (Up-106/05, 2. 10. 2008): • The protection of communication privacy is not limited to the content of communication but extends to traffic data that relates to it (data on the manner and parties to the communication, its timing, duration, and geolocation, etc.). WHAT CONSTITUTES A WAIVER OF IP ADDRESS PRIVACY? - IP address does not enjoy protection under the scope of communication privacy right if the users have disclosed it voluntarily. • Peer-to-peer (P2P) file sharing network in which all users of the network were able to see the IP addresses of other users, but not their identities. • Posting an offensive comment on a public online forum which displayed the users' IP address CASE BENEDIK - Mr. Benedik sentenced for possessing and distributing child pornographic material. - Identified based on the IP address obtained by the Swiss police by monitoring the P2P file-sharing network Razorback - The Slovenian police requested the Slovenian ISP to disclose the user of the IP address and conducted a house search. - Supreme Court: The communication could not be considered private since no intervention in the internet traffic was necessary to monitor the exchanges in the P2P network. - Constitutional Court: Benedik had consciously exposed his IP address to the public by using a public P2P network. No legitimate expectation of privacy. - ECtHR: Not reasonable expectation of privacy of the IP address but reasonable expectation of privacy of his identity.. which the complainant never disclosed nor was it identifiable by the service provider. A high degree of anonymity. - → Amendments to the Criminal Procedure Act: a court order is required to obtain traffic data as well as to obtain subscription data where processing of traffic data is required to achieve that. WHAT ABOUT STATIC IP ADDRESS? - The Criminal Procedure Act does not require a court order for the police to obtain subscriber data from the ISP if no processing of traffic data is required. - Appellate Court in Ljubljana: • Each access to the internet via a dynamic IP address creates traffic data, which must be processed to identify the user. communication privacy • Static IP address: ISP can identify the user by viewing its own records on the users of assigned IP addresses. No processing of traffic data no invasion into communication privacy no court order required - Appellate Court in Maribor: • An IP address, regardless of whether it is a static or dynamic IP address, is traffic data that falls within the framework of communication privacy - Supreme Court: • If the subscription data of IP addresses are never made public, there are no valid reasons for a legal distinction between static and dynamic IP addresses. CONCLUSION - The privacy of IP addresses can be protected both under the rules for the protection of personal data and under the right to communication privacy. - In privacy law: Is the information private or revealed by the person? - Data protection: Has the data subject has given a valid consent for the processing of their personal data? - Stricter protection of dynamic IP addresses under communication privacy and of static IP addresses under data protection rules. - A growing awareness of the courts of the privacy implications of IP addresses and the increasing possibilities of the abuse in combination with the processing of other metadata.