D: The directive governing data retention is disproportionate

The Administrative Court in Wiesbaden, Germany sees the obligation to store retained data as a violation of basic data protection rights and establishes with the judgment that a dynamic IP address constitutes personal data.

The main item of the lawsuit (6K1045/08.Wi) is the publication by the authorities of information, solely on the Internet, about recipients of European Union agricultural development payments from European funding programs. The court views this publication as inadmissible and also considers the question of whether a web server may save communication data, in this case IP addresses.

The court finds that neither § 15 of the German Telemedia Act nor § 113a of the German Telecommunication Law authorize the storage of IP addresses.

In detail, the court establishes that, in a democratic society, it is not necessary to put the citizens under a kind of general suspicion. According to the court, the individual has done nothing to justify this kind of intrusion. Nevertheless, his traffic data will be retained to a certain extent, without concrete suspicion. There is no call for the intrusion in to personal rights. Art. 8 ECHR (European Convention on Human Rights) also provides for the preservation of the principle of proportionality. The court considers that this is not upheld by Guideline 2006/24/EG and hence the ruling 113a of the German Telecommunication Law regulating the retention of data, is inadmissible.

In its judgment, the Wiesbaden Administrative Court also explicates that - like the Administrative Court in Berlin (5C 314/06) and the Art. 29 Group (WP 104, 150) - it is of the opinion that dynamic IP addresses also constitute personal data.

With this judgment, a further court subscribes to the opinion that IP addresses are to be classified as personal data. In addition, the court is of the opinion that the storage of IP addresses by a web server is not necessary and therefore inadmissible.

In the light of this development, companies should refrain from the storage of IP addresses by web servers.

With regard to the necessity of storing connection data (data retention), the provision in § 113a German Telecommunication Law is binding, pending a judgment by the Federal Constitutional Court (in German BVerfG)- subject to the restrictions imposed according to the Federal Constitutional Court judgment from 11.03.2008. Companies must therefore observe this provision, although the Administrative Court in Hesse considers it disproportional.