Bonnier: When Copyright Disclosure Depends on Proportionality

Case C-461/10 | Court of Justice of the European Union | Third Chamber | 19 April 2012

Practice takeaways: ① Disclosing a subscriber’s name and address by linking them to an IP address is processing of personal data. ② The Data Retention Directive governed data retained for serious-crime purposes; it did not govern this private civil copyright request. ③ EU law permitted, but did not require, Member States to authorize subscriber disclosure. ④ A lawful regime must allow case-specific balancing and respect proportionality. ⑤ The Swedish safeguards mattered: clear evidence, investigative usefulness, and reasons outweighing harm. ⑥ An IP address may point toward a subscriber, but it does not necessarily prove who committed the infringement.

In Bonnier, the Court of Justice of the European Union confronted a more developed version of the problem it had addressed in Promusicae and Tele2: may copyright holders obtain the identity of an Internet subscriber associated with an IP address allegedly used for unlawful file sharing?

The Court again refused to make either copyright or privacy absolute. EU law did not prevent Sweden from authorizing disclosure in civil proceedings. But the result depended on a national framework that allowed the court to evaluate the evidence, the usefulness of the information, the harm disclosure could cause, and the proportionality of the requested measure.

Bonnier therefore adds something important to the earlier cases.

• Promusicae identified the obligation to strike a fair balance.
• Tele2 reaffirmed that Member States may create civil disclosure mechanisms.
• Bonnier shows what a balancing mechanism can look like in practice.

The short version

Five Swedish audio-book publishers alleged that 27 protected works had been made available without permission through an FTP server. They traced the activity to a specified IP address during a narrow period in the early morning of 1 April 2009 and asked a Swedish court to order the Internet service provider, Perfect Communication Sweden AB (ePhone), to disclose the subscriber’s name and address. (Judgment, paras. 25-29.)

ePhone resisted, relying principally on the Data Retention Directive, Directive 2006/24. The Swedish Supreme Court asked whether that directive barred a national rule allowing subscriber disclosure to a private copyright holder in civil proceedings and whether Sweden’s failure to transpose the directive changed the answer. (Judgment, paras. 34-36.)

The CJEU held that the Data Retention Directive did not control the dispute. That directive addressed data retained for the investigation, detection, and prosecution of serious crime and communicated to competent national authorities. The Swedish procedure had a different purpose: disclosure to private parties in civil proceedings to establish an intellectual-property infringement. (Judgment, paras. 38-46.)

The Court nevertheless examined the ePrivacy and IP Enforcement Directives. It held that disclosure of the subscriber’s name and address was processing of personal data, but that EU law did not preclude Sweden’s disclosure regime because the national court could weigh the competing interests in each case and apply proportionality. (Judgment, paras. 51-61.)

Why the case matters

Bonnier sits at the intersection of three legal regimes: copyright enforcement, electronic-communications privacy, and data retention. Its importance lies partly in keeping those regimes conceptually separate.

The fact that communications data exist does not determine why they were retained, who may obtain them, or for what purpose they may be used. Likewise, the fact that copyright holders need subscriber information does not itself create an unconditional entitlement to it.

The Court’s answer depended on legal purpose and procedural design. The Data Retention Directive’s serious-crime framework did not govern a private civil request. The ePrivacy Directive did apply because subscriber disclosure involved personal-data processing. And the IP Enforcement Directive supported effective copyright protection, but without displacing data-protection rules.

Most importantly, Bonnier translated the abstract idea of a ‘fair balance’ into concrete safeguards. Swedish law required more than an allegation. It required clear evidence of infringement, a showing that disclosure would facilitate the investigation, and a determination that the reasons for disclosure outweighed the harm to the affected person or other conflicting interests. (Judgment, paras. 19-20, 58-60.)

Key holding

The Court reached three connected conclusions.

• First, Directive 2006/24 did not preclude the Swedish disclosure mechanism because a private civil copyright proceeding fell outside that directive’s material scope. Sweden’s failure to transpose the directive was therefore irrelevant. (Judgment, paras. 40-46, 61.)
• Second, communicating a subscriber’s name and address by reference to an IP address constituted processing of personal data and fell within Directive 2002/58. At the same time, a request made to protect copyright fell within Directive 2004/48. Both regimes mattered. (Judgment, paras. 51-54.)
• Third, Directives 2002/58 and 2004/48 did not preclude national legislation permitting disclosure where the national court could weigh the conflicting interests on the facts of each case and give due account to proportionality. The Court considered the Swedish law capable, in principle, of ensuring a fair balance. (Judgment, paras. 55-61.)

The Swedish disclosure framework

Sweden had transposed Article 8 of the IP Enforcement Directive through provisions added to its copyright law. Those provisions authorized a court to order information about the origin and distribution network of infringing goods or services, including names and addresses. An electronic-communications provider whose service had been used in the infringement could fall within the disclosure obligation. (Judgment, paras. 18-19.)

But disclosure was not automatic. The statute required:

• clear evidence that someone had committed an infringement;
• information that could be regarded as facilitating the investigation; and
• reasons for the measure that outweighed the nuisance or other harm to the affected person or another conflicting interest.

Those conditions became central to the CJEU’s proportionality analysis. They gave the national court a structure for evaluating both the copyright holder’s enforcement interest and the subscriber’s data-protection interest.

The Court’s analysis

1. The Data Retention Directive did not govern the request

The Court began by defining Directive 2006/24 narrowly. It was a special and restricted regime for data generated or processed by communications providers and retained so that they would be available for the investigation, detection, and prosecution of serious crime. Data retained under that regime were to be provided only to competent national authorities in specific cases under national law. (Judgment, paras. 38-43.)

The Swedish copyright provision pursued a different objective. It concerned disclosure in civil proceedings so that private parties could establish an intellectual-property infringement. That different purpose placed the national legislation outside the directive’s material scope. (Judgment, paras. 44-46.)

This was a scope ruling, not a conclusion that any data held by an ISP could be repurposed freely. The Court expressly proceeded on the premise that the data had been retained lawfully under national legislation satisfying Article 15(1) of the ePrivacy Directive—a matter for the Swedish court to verify. (Judgment, para. 37.)

2. Subscriber disclosure was processing of personal data

The publishers wanted the provider to connect an IP address to a subscriber’s name and physical address. The Court held that communicating those data constituted processing of personal data within Directive 2002/58, read together with Directive 95/46. The request therefore fell within the ePrivacy framework. (Judgment, paras. 51-53.)

At the same time, the request sought to protect copyright and therefore fell within Directive 2004/48. Bonnier was not governed by a single body of law. The Court had to interpret the privacy and copyright regimes together. (Judgment, para. 54.)

3. EU law permitted disclosure but did not require it

Relying on Promusicae and Tele2, the Court repeated the governing rule: EU law does not prevent Member States from requiring disclosure of personal data to private parties seeking to bring civil copyright proceedings, but it does not compel Member States to create that obligation. (Judgment, para. 55.)

Member States therefore retain legislative choice. That choice is constrained, however, by the need to interpret and apply national law consistently with fundamental rights and general principles of EU law, including proportionality. (Judgment, para. 56.)

4. The Swedish safeguards made the difference

The Court then moved from the general rule to the design of Sweden’s law. It highlighted the requirements of clear evidence, investigative usefulness, and a balancing of the reasons for disclosure against the nuisance or harm it could cause. (Judgment, para. 58.)

Because those conditions enabled the national judge to weigh the competing interests on the facts of each case and account for proportionality, the Court regarded the legislation as capable, "in principle", of ensuring a fair balance between copyright protection and subscriber data protection. (Judgment, paras. 59-60.)

The words ‘in principle’ matter. The CJEU did not itself decide that the publishers had met Sweden’s evidentiary threshold or that disclosure should ultimately issue. Those questions remained for the national proceedings. The ruling addressed the compatibility of the legislative framework with EU law.

The Advocate General’s Opinion

Advocate General Niilo Jääskinen reached the same basic conclusion on the Data Retention Directive: it did not apply to a civil request by private copyright holders, and Sweden’s failure to transpose it was irrelevant. (Opinion, paras. 39-48, 63.)

His Opinion placed sharper emphasis on purpose limitation and the legal basis for retention. He explained that EU law did not itself supply detailed rules authorizing telecommunications data to be retained and transmitted for private copyright enforcement. For such disclosure to be lawful, national legislation had to provide in advance and in detail for the relevant restrictions, including the scope of the data, purposes, retention, and access. (Opinion, paras. 50-61.)

He also cautioned that an IP address does not necessarily prove the identity of the person who committed an infringement. Several individuals may share a connection; wireless networks may be unsecured; computers may be hijacked; and multiple people may use the same device. An IP address may identify a subscriber account without conclusively identifying the actor. (Opinion, paras. 42-43.)

The Opinion’s proposed answer therefore included an express condition: the information must have been retained for disclosure and use for that purpose under detailed national legislative provisions consistent with EU data-protection law. (Opinion, para. 63.) The Court did not reproduce that formulation in its operative ruling, but it did assume lawful retention under national law. (Judgment, para. 37.)

The personal-data dimension

Bonnier illustrates the difference between an identifier and attribution. The publishers already had an IP address and a precise time window. What they lacked was the provider-held information needed to translate that technical identifier into a named subscriber.

That linkage is why disclosure is itself data processing. It changes what the information can do: an observed network event becomes associated with a particular account holder and physical address.

Subscriber identification and proof of infringement are not the same thing

But subscriber identification and proof of infringement are not the same thing. The subscriber may be a useful investigative lead without necessarily being the individual who uploaded the works. That distinction reinforces the importance of evidentiary thresholds, limited requests, and judicial proportionality review.

What the Court did—and did not—decide

The Court did decide that:

• the Data Retention Directive did not govern this private civil disclosure request;
• communicating the subscriber’s name and address constituted processing of personal data;
• EU law permitted Sweden to authorize disclosure for civil copyright enforcement; and
• a regime allowing case-specific weighing of interests and proportionality could, in principle, preserve a fair balance.

The Court did not decide that:

• copyright holders have an automatic EU-law right to subscriber information;
• an allegation of infringement is sufficient without evidence;
• an IP-address match proves that the subscriber committed the infringement;
• any communications data retained for any purpose may be repurposed for copyright litigation; or
• the publishers were ultimately entitled to disclosure under Swedish law.

Bonnier after Digital Rights Ireland

Two years after Bonnier, the CJEU invalidated Directive 2006/24 in Digital Rights Ireland. That development removes the Data Retention Directive as a valid current legal framework, but it does not erase Bonnier’s core contribution.

The enduring holding concerns how a civil disclosure regime must operate where national law authorizes access: the request remains subject to data-protection rules, a fair balance of rights, and proportionality. Bonnier is therefore best read today as part of the line running from Promusicae and Tele2 toward the Court’s later, more developed communications-data jurisprudence.

Conclusion

Bonnier did not hold that copyright automatically defeats subscriber privacy. Nor did it hold that privacy categorically prevents disclosure. It upheld the possibility of disclosure because Swedish law placed the decision in a framework requiring evidence, usefulness, harm assessment, and proportionality.

Put simply: EU law may allow an IP address to be connected to a subscriber for civil copyright enforcement, but the connection must be made through a lawful process that fairly balances the rights on both sides.

Sources and Additional Resources

Sources

CJEU judgments, Advocate General opinions, procedural notices, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

Search Case C-461/10 on InfoCuria

• Court of Justice of the European Union, Third Chamber, Case C-461/10, Bonnier Audio AB and Others v Perfect Communication Sweden AB, Judgment of 19 April 2012, ECLI:EU:C:2012:219.
• Advocate General Jääskinen, Opinion in Case C-461/10, delivered 17 November 2011, ECLI:EU:C:2011:753.

Related reading from The de la Torre Review

• “Promusicae: When an IP Address Becomes a Person.” The doctrinal starting point for Bonnier. Promusicae held that EU law neither requires nor prohibits subscriber disclosure for civil copyright claims, but national implementation must preserve a fair balance between competing fundamental rights. Read the article.
• “Tele2: When Copyright Enforcement Meets Communications Privacy.” Tele2 applied Promusicae and confirmed that Member States may authorize disclosure of subscriber data for civil copyright enforcement, subject to fundamental-rights and proportionality constraints. Read the article.
• “Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” The 2014 judgment invalidating the Data Retention Directive discussed in Bonnier and establishing the sensitivity of communications metadata. Read the article.
• “Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive.” A later CJEU decision distinguishing between interferences with privacy according to their seriousness and clarifying access to subscriber-identification information. Read the article.
• “Scarlet: Why Copyright Enforcement Cannot Require General Internet Surveillance.” Building on Promusicae’s fair-balance principle, the CJEU rejected an injunction requiring indiscriminate filtering of internet traffic. The judgment explains why copyright enforcement must respect limits on general monitoring and protect business freedom, personal data, and lawful communications. Read the article.