In its jugment of 30 April 2024 (C-470/21), the Court of Justice of the European Union answered three questions referred by the French Administrative Supreme Court (‘Conseil d’Etat’), that can be summed up as follows: must Article 15(1) of Directive 2002/58 on privacy and electronic communications be interpreted as precluding national legislation which authorises the public authority responsible for the protection of copyright against infringements of those rights committed on the internet to access data, retained by providers of publicly available electronic communications services, relating to the civil identity associated with IP addresses previously collected by rightholder organisations, so that that public authority can identify the holders of those addresses?
The request was made in proceedings between the French non-profit organisation La Quadrature du Net (and other such organisations), which has set itself a mission to defend the ‘rights and freedom of citizens on the Internet’, and the French Government concerning the legality of a decree defining the processing of personal data of internet users suspected of having engaged in an activity infringing copyright in that he or she has unlawfully made protected works available on the internet for downloading by others.
In this ruling, the CJEU clarifies its rather ambiguous position in the judgment French Data Network of 6 October 2020 (C-511/18), which was interpreted by the French legislator as not allowing the identification of internet users for civil faults and ‘minor’ criminal offences.
What the judgment says
In this ruling, the CJEU rules that article 15(1) of Directive 2002/58 must be interpreted as not precluding national legislation which authorises a public authority in charge of fighting copyright infringement to access data, retained by internet providers, relating to the civil identity associated with IP addresses previously collected, in order to identify the holders of those addresses and take measures against them.
The Court states that such legislation must comply with the following conditions:
- The data must be retained in conditions which ensure that it is not possible to draw conclusions about the private life of those IP address holders (e.g. it must not be possible to establish a detailed profile of those persons).
- The data must be retained separately and be used exclusively by the public authorities to identify the person suspected of having committed a criminal offence.
- The possibility of linking such data with files containing information that reveals the title of protected works, in cases where the same person repeats an activity infringing copyright or related rights, must be subject to review by a court or an independent administrative body.
- The data processing system used by the public authority must be subject to a review by an independent body at regular intervals.
Why the judgment is very important (in particular in France)
The CJEU is clearer here than in French Data Network (C-511/18), in which it stated that general and indiscriminate retention of traffic and location data that allows the identification of persons on the internet creates a serious risk of establishing their profile. It now clearly rules that data can be accessed even for less serious crimes, while setting out guarantees in order to protect the rights and freedoms of the data subjects.
The French legislator had perhaps interpreted this judgment too strictly. Indeed, in Act No 2021-998 of 30 July 2021 and Act No 2022-299 of 2 March 2022, it had entirely denied the right to identify internet users who were suspected of civil faults or criminal offences for which a prison sentence of more than one year is incurred, meaning that gathering necessary information to act against certain offenses was simply not possible in practice (however, classical forms of copyright infringement are sanctioned by up to 3 years in prison).
As a result of this judgment, ARCOM, the French regulatory authority that fights online copyright infringement (see here), can continue to fight unlawful downloading (see here). More generally, this decision was very well received in France.
_____________________________
To make sure you do not miss out on regular updates from the Kluwer Copyright Blog, please subscribe here.
Kluwer IP Law
The 2022 Future Ready Lawyer survey showed that 79% of lawyers think that the importance of legal technology will increase for next year. With Kluwer IP Law you can navigate the increasingly global practice of IP law with specialized, local and cross-border information and tools from every preferred location. Are you, as an IP professional, ready for the future?
Learn how Kluwer IP Law can support you.
