> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Breyer: When an IP Address Becomes Personal Data
- URL: https://www.thedelatorrereview.com/breyer-when-an-ip-address-becomes-personal-data/
- Published: 2016-10-19T01:23:00.000Z
- Updated: 2026-10-10T21:13:35.000Z
- Description: Breyer asks when information becomes personal data even though the controller cannot identify the person on its own. The CJEU held that a dynamic IP address may be personal data where the controller has legal means reasonably likely to be used to identify the individual.
- Author: Lydia
- Tags: Court of Justice of the European Union (CJEU), Caselaw, Anonymization, Telecommunications Data, Legitimate Interests, Balancing Test, Data Protection Directive, Directive 95/46/EC, Personal Information

**Case C-582/14 | Patrick Breyer v Bundesrepublik Deutschland | Court of Justice of the European Union | Second Chamber | 19 October 2016**

> **Practice Takeaways:** ① **Identifiability is contextual.** Information can be personal data even when the controller cannot identify the individual using that information alone. ② **Third-party information can matter.** The necessary identifying information does not all have to be held by the same person. ③ **The question is whether identification is reasonably possible.** Purely theoretical possibilities are not enough; legal and practical accessibility matter. ④ **Legal means of identification count.** If a controller can lawfully obtain identifying information through another party or public authority, the individual may be identifiable. ⑤ **Disproportionate effort can take identification outside the test.** Identification that is prohibited by law or practically impossible because of excessive time, cost, or manpower may be too remote. ⑥ **Legitimate interests require balancing.** National law cannot categorically predetermine the outcome where EU law requires the controller’s legitimate interests to be weighed against the individual’s rights.

---

Can information be personal data when the organization holding it **cannot identify the person on its own**?

That was the question at the heart of *Breyer*. German federal websites logged the dynamic IP addresses of visitors, but the additional information needed to identify those users was held by their internet service providers.

The Court held that a dynamic IP address can nevertheless be personal data **in relation to the website operator** where that operator has legal means reasonably likely to be used to obtain the additional information necessary to identify the user. Information does not escape data-protection law simply because identification requires information held by someone else. (Judgment, paras. 38–49.)

---

> ***"for information to be treated as ‘personal data’ \[...\] it is not required that all the information enabling the identification of the data subject must be in the hands of one person."*** (Judgment, para. 43.)

---

But the Court did not adopt an unlimited test. If identification is prohibited by law or practically impossible because it would require **disproportionate time, cost, or effort,** the risk of identification may be too insignificant for the information to concern an identifiable person. (Judgment, paras. 45–46.)

The Court also addressed a second important question: Member States could not categorically prevent controllers from relying on **legitimate interests** where EU law required a case-specific balancing of competing interests. (Judgment, paras. 56–64.)

## What Happened

Patrick Breyer accessed several publicly available websites operated by German federal institutions. Those websites retained information about each visit in log files, including the page or file requested, search terms entered, time of access, amount of data transferred, whether access was successful, and the **IP address of the computer making the request**. (Judgment, paras. 13–16.)

The federal institutions retained those logs partly to prevent cyberattacks and enable attackers to be identified and prosecuted. Breyer sought an injunction preventing Germany from retaining his IP address after he left the websites, except where storage was necessary to restore the availability of the service following a fault. (Judgment, paras. 14, 17.)

The lower German courts drew an important distinction.

- If Breyer disclosed his identity while visiting a website, the website operator could connect that identity with his dynamic IP address. In that situation, the IP address was personal data.
- But where Breyer did not identify himself, the website operator could not independently connect the dynamic IP address to him. Only his internet service provider held the additional information necessary to make that connection. The German appellate court therefore concluded that, in those circumstances, the IP address was not personal data in the hands of the federal website operator. (Judgment, paras. 19–21.)

Both sides appealed to Germany’s Federal Court of Justice, which referred two questions to the CJEU.

- First, could a dynamic IP address constitute personal data for the website operator when the information needed to identify the user was held by the user’s internet service provider?
- Second, if it was personal data, could German law categorically prevent its continued processing for purposes such as maintaining the security and operability of the website? (Judgment, paras. 22–30.)

## Why the Case Matters

*Breyer* addresses one of the hardest elements in the definition of personal data: **when is a person “identifiable”?**

The issue arises whenever one dataset does not itself reveal an individual’s identity but can potentially be combined with other information that does.

The Court rejected the idea that all identifying information must already be in the controller’s possession. Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46) expressly covered persons who could be identified **directly or indirectly**, while Recital 26 required consideration of the means reasonably likely to be used by the controller **or another person**. (Judgment, paras. 40–44.)

But *Breyer* also rejected an unlimited approach under which information would become personal data merely because somebody, somewhere, might theoretically possess identifying information.

The relevant inquiry is practical and contextual: **is identification reasonably likely using means that are legally and practically available?**

That makes *Breyer* foundational not just for IP addresses, but for questions involving **pseudonymized data, coded datasets, device identifiers, online identifiers, and anonymization more generally**.

The case therefore complements [***Nowak: When an Exam Answer Becomes Personal Data***](https://www.thedelatorrereview.com/nowak-when-an-exam-answer-becomes-personal-data/). *Breyer* focuses principally on whether the person is **identifiable**; *Nowak* later focuses on when information **“relates to”** that identifiable person.

## The Key Holding

The Court held that a dynamic IP address registered by an online media services provider can constitute personal data **in relation to that provider** where the provider has legal means enabling it to identify the individual using additional information held by the user’s internet service provider. (Judgment, para. 49.)

That qualification—**“in relation to that provider”**—matters.

**The Court did not hold that every dynamic IP address is necessarily personal data in every context.** Instead, it examined whether the particular controller had access, directly or through legally available channels, to means reasonably likely to permit identification.

The Court also held that Article 7(f) of Directive 95/46 prevented Member States from adopting national rules that categorically excluded certain legitimate interests without permitting the case-specific balancing required by EU law. (Judgment, paras. 56–64.)

## The Court’s Analysis

### 1\. A Dynamic IP Address Does Not Directly Identify a Person

The Court began by distinguishing dynamic from static IP addresses.

A static IP address remains constant and can permit continuing identification of a connected device. A dynamic IP address, by contrast, is temporarily assigned for a particular internet connection and changes with subsequent connections. (Judgment, paras. 36–37.)

The dynamic IP address at issue therefore did not, by itself, disclose Breyer’s identity. It was not information relating to an identified natural person. (Judgment, para. 38.)

The real issue was whether he was nevertheless **identifiable**.

### 2\. Identification Does Not Have to Be Possible From the Data Alone

The Court relied on the word **“indirectly”** in the definition of personal data.

If information can identify someone only when combined with other information, that does not prevent it from being personal data. And Recital 26 expressly required consideration of means reasonably likely to be used by the controller or by another person. (Judgment, paras. 40–42.)

The Court therefore stated an important principle: **all of the information necessary to identify the data subject does not have to be in the hands of one person.** (Judgment, para. 43.)

The fact that the identifying subscriber information was held by Breyer’s internet service provider rather than by the federal website operator was therefore not enough, by itself, to take the IP address outside the definition of personal data. (Judgment, para. 44.)

> **Practice Tip:** **Do not assess identifiability by looking only at the dataset in front of you.** Ask whether the individual can reasonably be identified using additional information available through other persons or systems.

### 3\. But a Merely Theoretical Possibility of Identification Is Not Enough

The Court then imposed the important limiting principle.

It asked **whether combining the dynamic IP address with information held by the internet service provider constituted a *“means likely reasonably to be used”*** to identify the user. (Judgment, para. 45.)

Identification would not satisfy that test where it was prohibited by law or practically impossible because it required disproportionate effort in terms of time, cost, and manpower, such that the actual risk of identification was insignificant. (Judgment, para. 46.)

This prevented the concept of personal data from extending to every situation in which identification was theoretically imaginable.

Advocate General Campos Sánchez-Bordona made the same point particularly clearly. Treating information as personal data whenever *any* hypothetical third party might possess identifying information would, in practice, make almost every piece of information personal data because one could rarely exclude all theoretical possibilities of identification. (Opinion, paras. 64–68.)

> **Practice Tip:** **Identifiability requires a realistic pathway to identification.** Consider the legal, technical, organizational, financial, and practical barriers to obtaining and combining the additional information—not merely whether identification is conceivable.

### 4\. Legal Access to Third-Party Data Can Make Identification Reasonably Possible

German law did not generally permit the internet service provider simply to hand subscriber information directly to the website operator.

But that did not end the analysis.

In the event of a cyberattack, legal mechanisms existed through which the website operator could contact the competent authorities, which could then obtain the relevant information from the internet service provider and use it to identify the individual. (Judgment, para. 47.)

The Court therefore concluded that the website operator appeared to possess **means reasonably likely to be used to identify the individual with the assistance of other persons**. (Judgment, para. 48.)

That was enough to bring the dynamic IP address within the definition of personal data in relation to the provider.

The case therefore sits between two extremes.

- It rejects the proposition that the controller must possess all identifying information itself.
- But it also rejects the proposition that information is personal data whenever identification is theoretically possible somewhere in the world.

The relevant question is whether **a realistic and lawful route to identification exists in the circumstances**.

### 5\. Public Authorities Can Sometimes Be Acting Like Ordinary Controllers

The websites were operated by German federal institutions, raising another question: did the Directive apply at all?

Directive 95/46 excluded certain State activities, including activities in the area of criminal law. But the Court held that the federal institutions were, subject to the national court’s verification, acting as providers of online services rather than exercising State criminal-law powers. Their status as public authorities did not by itself take the processing outside the Directive. (Judgment, paras. 51–53.)

The **nature of the** **activity**, rather than simply the institutional identity of the controller, was therefore relevant.

### 6\. Website Security Can Be a Legitimate Interest

The Court then turned to Article 7(f) of Directive 95/46, the predecessor to the GDPR’s legitimate-interest ground.

Germany’s Telemedia Act, as interpreted by the referring court, permitted website operators to process user data without consent only insofar as necessary to facilitate and charge for the particular use of the service. That interpretation could prevent retention after the user left the website even where continued storage was intended to protect the general security and operability of the service. (Judgment, paras. 55–60.)

The Court recognized that website operators **may have a legitimate interest in ensuring the continued functioning of their websites**. (Judgment, para. 60.)

But it did not decide that retention was automatically lawful.

Instead, the point was that legitimate interests had to be capable of entering the balancing exercise required by EU law.

### 7\. National Law Cannot Eliminate the Required Balancing Exercise

Article 7(f) permitted processing where necessary for a legitimate interest unless that interest was overridden by the rights and freedoms of the data subject.

The Court relied on its earlier judgment in *ASNEF* to emphasize that Member States could not alter the EU-law grounds for lawful processing by adding requirements that changed their scope. (Judgment, paras. 57–58.)

A Member State therefore could not categorically provide that a particular legitimate interest—such as maintaining the general operability of a website—could never justify the processing.

EU law required the competing interests to be capable of being **balanced in the circumstances of the individual case**. (Judgment, paras. 59–64.)

> **Practice Tip:** **Legitimate interest is a balancing test, not a categorical rule.** The fact that a particular purpose may constitute a legitimate interest does not make the processing lawful automatically; necessity and the individual’s competing rights still have to be assessed.

## The Advocate General’s Opinion

Advocate General Manuel Campos Sánchez-Bordona approached the identifiability question by confronting the debate between an **“objective” or “absolute”** approach and a **“subjective” or “relative”** approach. (Opinion, paras. 52–54.)

Under a purely absolute approach, information could be personal data whenever any third party might be capable of identifying the person.

- The Advocate General considered that interpretation too broad. If every hypothetical third party had to be considered, virtually no information could confidently be treated as non-personal because one could almost always imagine someone, somewhere, possessing additional identifying data. (Opinion, paras. 64–68.)

But he also rejected an approach limited to information already possessed by the controller.

- The internet service provider was not a hypothetical or inaccessible third party. It was a central actor in the internet architecture, known to possess the subscriber information needed to connect the dynamic IP address to the user. The remaining question was whether obtaining that information was **reasonably feasible and legally possible**. (Opinion, paras. 69–73.)

For the Advocate General, lawful means of obtaining that information counted as reasonable means. He therefore concluded that the IP address constituted personal data where the internet service provider held the additional identifying information and could reasonably be approached through lawful channels. (Opinion, paras. 72–78.)

On legitimate interests, he similarly concluded that maintaining the functioning and security of a website could in principle constitute a legitimate interest, but that its weight had to be assessed against the rights and interests of the user in the particular circumstances. (Opinion, paras. 95–105.)

The Court largely followed that approach.

## What the Court Did—and Did Not—Decide

The Court **did** hold that a dynamic IP address can constitute personal data for a website operator even though that operator cannot identify the individual from the IP address alone.

It **did** hold that information necessary for identification may be distributed among different persons.

It **did** require a realistic assessment of whether the means of identification are reasonably likely to be used, taking into account legal and practical obstacles.

And it **did** hold that maintaining the security and continued functioning of a website may constitute a legitimate interest that must be capable of being weighed against the rights and freedoms of users.

But the Court **did not** hold that every IP address is automatically personal data in every context.

It **did not** hold that the mere theoretical existence of identifying information somewhere is sufficient.

It **did not** decide that storing IP addresses for cybersecurity purposes is always lawful.

And it **did not** conduct the ultimate legitimate-interest balancing itself. Its holding was that national law could not categorically prevent that balancing from taking place.

## *Breyer* Today

*Breyer* was decided under Directive 95/46, but its core analysis remains highly relevant under the GDPR.

Article 4(1) GDPR continues to define personal data as information relating to an **identified or identifiable natural person**, while Recital 26 directs controllers to consider **“all the means reasonably likely to be used”** to identify the person, including factors such as the cost and time required for identification and available technology.

The GDPR also expressly recognizes **online identifiers**, including IP addresses, as information that may leave traces capable of being combined with other information to create profiles or identify individuals. (Recital 30.)

The legitimate-interest principle likewise continues in Article 6(1)(f) GDPR, although the GDPR now expressly provides that public authorities may not rely on that ground when processing personal data **in the performance of their public tasks**.

The enduring lesson of *Breyer* is therefore not simply that “IP addresses are personal data.”

It is more precise:

**Whether information relates to an identifiable person depends on the realistic means available to connect that information to the individual.**

## Conclusion

*Breyer* transformed what might appear to be a technical question about IP addresses into a broader rule about **identifiability**.

A controller does not need to possess every piece of information required to identify a person. Additional information held by another party may count if the controller has a realistic and lawful means of using it.

But identifiability is not limitless. A purely hypothetical possibility does not suffice where identification is prohibited by law or practically impossible because of disproportionate effort.

That is *Breyer*’s lasting contribution:

---

> **Personal data is not defined solely by what a dataset reveals on its face. It also depends on what the controller can reasonably do with that information—and with the additional information realistically available to it.**

---

## Sources and Useful Reading

### Sources

CJEU judgments, Advocate General opinions, and related case materials are available through [**InfoCuria**](https://infocuria.curia.europa.eu/tabs/tout?lang=EN&ref=thedelatorrereview.com&searchTerm=C%252D582%252F14), the Court of Justice of the European Union’s official case-law database. The case can be located using **Case C-582/14, Patrick Breyer v Bundesrepublik Deutschland**.

- Court of Justice of the European Union, Second Chamber, Case C-582/14, *Patrick Breyer v Bundesrepublik Deutschland*, Judgment of 19 October 2016, ECLI:EU:C:2016:779.
- Opinion of Advocate General Manuel Campos Sánchez-Bordona, Case C-582/14, delivered 12 May 2016, ECLI:EU:C:2016:339.

### Useful Reading from *The De La Torre Review*

- **What Is “Personal Data” Under EU Data Protection Law?** — An overview of the definition of personal data under the GDPR, including when a person is “identified or identifiable,” the role of information held by third parties, pseudonymization, anonymous data, and the “means reasonably likely to be used” standard. It provides the broader GDPR framework for the identifiability question at the center of *Breyer*. [Read the Article.](https://www.thedelatorrereview.com/what-is-personal-data-under-eu-data-protection-law/)
- **Nowak: When an Exam Answer Becomes Personal Data** — Builds on *Breyer*’s approach to identifiability. *Nowak* relies on *Breyer* in explaining that all information necessary to identify an individual need not be held by a single person, before developing a separate framework for determining when information “relates to” that individual. [Read the Article.](https://www.thedelatorrereview.com/nowak-when-an-exam-answer-becomes-personal-data/)
- ***Satakunnan & Satamedia: Public Data Is Still Personal Data*** — An earlier part of the Court’s development of a broad conception of personal data and the scope of EU data-protection law. [Read the Article.](https://www.thedelatorrereview.com/satakunnan-satamedia-public-data-is-still-personal-data/)
- **ASNEF: Lawful Basis for Processing Under Member State Law** — Provides the foundation for *Breyer*’s legitimate-interest analysis. In *ASNEF*, the Court held that Member States could not add requirements that alter the scope of the lawful-processing grounds in Article 7 of Directive 95/46 or predetermine the outcome of the balancing required under Article 7(f). *Breyer* relies on that reasoning in rejecting national rules that categorically excluded certain legitimate interests from consideration. Read the Article.
- **Lindqvist: When Putting Personal Information Online Became Data Processing** — Provides an important foundation for *Breyer*’s analysis of the scope of EU data-protection law. *Breyer* relies on *Lindqvist* in explaining that the Directive’s exclusion for certain State activities concerns activities of the State or State authorities that are unrelated to the fields of activity of individuals. [Read the Article.](https://www.thedelatorrereview.com/lindqvist-when-a-parish-website-became-data-processing/)
- **ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing** — Provides the foundation for *Breyer*’s legitimate-interest analysis. *Breyer* relies on *ASNEF* in holding that Member States cannot categorically exclude particular legitimate interests from consideration where EU law requires a **case-specific balancing** against the rights and freedoms of the data subject. [Read the Article.](https://www.thedelatorrereview.com/asnef-when-member-states-cannot-rewrite-the-lawful-bases-for-processing/)
- **“Scarlet: Why Copyright Enforcement Cannot Require General Internet Surveillance.”** Building on *Promusicae*’s fair-balance principle, the CJEU rejected an injunction requiring indiscriminate filtering of internet traffic. The judgment explains why copyright enforcement must respect limits on general monitoring and protect business freedom, personal data, and lawful communications. [Read the article.](https://www.thedelatorrereview.com/scarlet-why-copyright-enforcement-cannot-require-general-internet-surveillance/)

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/09/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-21.png)