Promusicae: When an IP Address Becomes a Person

Case C-275/06 | Court of Justice of the European Union | Grand Chamber | 29 January 2008

Practice takeaways: ① Subscriber identification is a personal-data issue. Connecting known IP addresses and timestamps to subscribers’ names and physical addresses involves personal data. ② Copyright enforcement does not automatically override privacy. Effective protection of intellectual property does not create an unconditional entitlement to communications data. ③ Privacy does not automatically override copyright either. EU law leaves Member States room to authorize disclosure in civil proceedings. ④ Fundamental rights must be reconciled. Privacy, property, and effective judicial protection all form part of the analysis. ⑤ Proportionality constrains national implementation. Member States and their courts cannot exercise their discretion without regard to fundamental rights. ⑥ Retention and disclosure are distinct questions. The existence of data in an ISP's systems does not by itself establish that the data may lawfully be repurposed and disclosed.

In Promusicae, the Court of Justice of the European Union confronted a question that would become central to EU digital-rights law: must an Internet service provider disclose the identity of subscribers behind IP addresses so that copyright holders can pursue civil claims against them?

Promusicae, an association representing music producers and publishers, had identified IP addresses allegedly used to share copyrighted music through the peer-to-peer service KaZaA. But an IP address alone did not tell Promusicae who the users were. It therefore asked Telefónica to disclose the names and physical addresses of subscribers associated with specified IP addresses and known connection dates and times.

The Court refused to make either copyright or privacy absolute.

EU law did not require Member States to impose an obligation to disclose those personal data for civil copyright proceedings. But neither did EU law categorically prohibit Member States from permitting such disclosure. Instead, Member States had to implement and apply EU law in a way that struck a fair balance among the fundamental rights involved, including privacy, property, and effective judicial protection, while respecting proportionality.

That balancing principle became the central legacy of Promusicae—and the foundation on which the Court would build one year later in Tele2.

The short version

Promusicae represented producers and publishers of musical and audiovisual recordings. It alleged that Telefónica subscribers were using KaZaA, a peer-to-peer file-sharing program, to make copyrighted recordings available to other users.

Promusicae had identified the relevant IP addresses and dates and times of connection. What it lacked were the identities behind those technical identifiers.

It therefore asked a Spanish court to order Telefónica to disclose the subscribers’ names and physical addresses so that Promusicae could bring civil proceedings against them. The Commercial Court initially granted the request.

Telefónica objected.

Under the Spanish legislation at issue, the retained communications data could be supplied for a criminal investigation, public security, or national defence, but not for an ordinary civil copyright action. The Spanish court therefore asked the CJEU whether EU copyright and information-society law required broader disclosure.

The CJEU said no.

The EU directives invoked by Promusicae did not require Member States to establish an obligation to communicate personal data for the purpose of enforcing copyright through civil proceedings.

But the answer was not that privacy necessarily prohibited such disclosure.

EU law does not require disclosure of subscriber data for civil copyright enforcement—but Member States could permit it if they struck a fair balance between the competing fundamental rights.

Rather, the Court concluded that EU law left Member States a measure of discretion—and required them to exercise it in a way that achieved a fair balance between competing fundamental rights.

Why the case matters

Promusicae is one of the foundational cases for understanding the CJEU's approach to competing rights in the digital environment.

The dispute looked, at first, like a copyright-enforcement problem.

Copyright holders believed their works were being unlawfully shared online. They possessed technical evidence identifying the Internet connections involved, but they could not translate those identifiers into defendants without information held by the ISP.

From the copyright holder's perspective, disclosure was therefore a gateway to enforcement.

But from the subscriber's perspective, the same disclosure meant taking information generated through electronic communications and using it to connect online activity with an identifiable individual.

The Court therefore confronted two sets of legally protected interests: privacy and protection of personal data, on one side; and protection of intellectual property and effective judicial protection, on the other.

Its answer was not to rank one categorically above the other.

Instead, Promusicae established a principle that would recur throughout EU digital law: when EU-law rights collide, the legal framework may require their reconciliation rather than the automatic supremacy of one right over another.

The dispute: from an IP address to a person

Promusicae alleged that Telefónica customers were using KaZaA to share copyrighted recordings. It already had the users’ IP addresses and connection dates and times, but needed Telefónica to link that information to the subscribers’ names and physical addresses so it could bring civil copyright claims.

The case therefore raised an important data-protection question: are IP addresses personal data under EU law?

In this context, yes. The Court treated the information sought by Promusicae as personal data because Telefónica could use the IP address and connection time to identify the subscriber behind the online activity. The Advocate General was even more explicit: information showing which users were assigned particular IP addresses at particular times constituted personal data, and temporarily assigned IP addresses were also traffic data under the ePrivacy Directive.

IP addresses can constitute personal data under EU law when they relate to an identifiable individual.

The key point is that an IP address does not need to identify a person by itself to qualify as personal data. Under EU data-protection law, information can be personal data when the individual is identifiable using additional information available to make the connection.

Here, Telefónica held exactly that additional information. Promusicae's request was therefore not simply about obtaining technical network data—it sought to turn an IP address into an identified subscriber, bringing EU privacy and data-protection rules directly into the copyright dispute.

The Court's analysis

1. The subscriber information was personal data

Promusicae sought the names and physical addresses of subscribers whose IP addresses and connection times were already known. The Court held that disclosing this information involved the processing of personal data relating to identified or identifiable individuals.

The important point was the linkage: the IP address and timestamp could be connected through Telefónica's records to a particular subscriber.

2. Copyright law did not displace data-protection law

Promusicae relied on the E-Commerce, Copyright, and Intellectual Property Enforcement Directives. But those instruments expressly preserved applicable privacy and data-protection protections, including the rules governing the processing of personal data.

Copyright enforcement therefore had to operate within, rather than override, the EU data-protection framework.

3. EU law did not require disclosure for civil copyright claims

The Court held that the relevant EU directives did not require Member States to compel disclosure of personal data to enforce copyright in civil proceedings.

In other words, EU copyright law did not itself give Promusicae a right to obtain the subscriber information it sought.

4. But EU privacy law did not prohibit disclosure either

The opposite was also true. Directive 2002/58 did not categorically prevent Member States from allowing disclosure in civil proceedings.

The Court reasoned that the permitted protection of the “rights and freedoms of others” could encompass property rights, including copyright. Member States could therefore authorize such disclosure—but EU law did not require them to do so.

5. Member States had to strike a fair balance

That discretion was constrained by fundamental rights. The Court identified competing protections for private life and personal data, on one side, and property and effective judicial protection, on the other.

Member States, national authorities, and courts had to reconcile those rights through a fair balance and comply with general principles of EU law, particularly proportionality. This became Promusicae's central doctrinal contribution.

The Advocate General's Opinion

Advocate General Juliane Kokott took a more privacy-protective approach, focusing on the risk that data retained for one purpose may later be used for another.

She emphasized three points. First, information linking an IP address and connection time to a subscriber constituted personal data, and temporarily assigned IP addresses were traffic data (namely, "data which are processed for the purpose of the conveyance of a communication on an electronic communications network.") Second, purpose limitation (i.e. "personal data may be collected only for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes") mattered: the existence of retained traffic data did not automatically justify repurposing them for civil litigation. Third, she distinguished disclosure to competent public authorities from direct disclosure to private copyright holders seeking evidence for civil claims.

The Advocate General therefore concluded that EU law permitted Member States to exclude disclosure of personal traffic data for civil copyright proceedings.

She also cautioned that identifying the subscriber associated with an IP address did not necessarily identify the person who committed the infringement—someone else could have used the connection ("[...] it does not follow conclusively from the fact that copyrights were infringed under an IP address at a particular time that those acts were also carried out by the subscriber to whom that address was assigned at that time" para. 115.)

The Court ultimately went further, holding that Member States could choose to permit civil disclosure, subject to fundamental rights and proportionality. But the Opinion remains important for its emphasis on purpose limitation, communications confidentiality, and the limits of subscriber attribution.

The personal-data dimension

The privacy significance of Promusicae lies in attribution. Promusicae already possessed information about the online activity—an IP address + date + time—while Telefónica held the information needed to connect those technical identifiers to a subscriber name + physical address.

Data protection and privacy implications often arise from linking data that makes an individual identifiable, rather than from any single data point viewed in isolation

That linkage transformed information about an Internet connection into information relating to an identifiable individual. Promusicae therefore illustrates an important feature of EU data-protection law: the privacy significance of data often depends on what other information can be used to identify the person behind it, not simply on whether an individual data point is identifying when viewed alone.

What the Court did—and did not—decide

Promusicae should not be read as holding that copyright holders have a general EU-law entitlement to discover the identities behind IP addresses.

They do not.

The Court specifically held that the directives before it did not require Member States to create such a disclosure obligation.

But the decision should not be read as holding that communications privacy necessarily prevents disclosure in civil copyright proceedings either.

The Court left Member States room to authorize disclosure.

What EU law required was that the resulting legal framework preserve a fair balance among the competing fundamental rights and comply with proportionality.

The distinction would become particularly important in Tele2, where the Court expressly relied on Promusicae when considering another copyright holder's attempt to identify subscribers associated with IP addresses.

Conclusion

Promusicae established an early and enduring principle of EU digital-rights law: the protection of one fundamental right does not automatically extinguish another.

• Copyright holders have legally protected interests in property and effective judicial protection.
• Internet users have legally protected interests in privacy and the protection of their personal data.

EU law did not require Spain to make subscriber information available for civil copyright litigation. But neither did it categorically prohibit Member States from creating mechanisms permitting such disclosure.

Instead, the Court placed the emphasis on fair balance and proportionality.

Knowing an IP address may provide evidence of online activity. Turning that address into the identity of a person is a separate legal step—and one that must account for both privacy and copyright.

Sources and Additional Resources

Sources

The Court of Justice of the European Union makes its judgments, Advocate General opinions, and related case materials available through InfoCuria, its official case-law database. Cases can be located by searching either the case name (for example, Promusicae) or the case number, which for Court of Justice cases generally takes the form C-[number]/[year] (for example, C-275/06). A search for C-275/06 returns both the judgment and Advocate General Kokott's Opinion.

Search CJEU case law on InfoCuria

• Court of Justice of the European Union, Grand Chamber, Case C-275/06, Productores de Música de España (Promusicae) v Telefónica de España SAU**, Judgment of 29 January 2008, ECLI:EU:C:2008:54.**
• Opinion of Advocate General Juliane Kokott, Case C-275/06, Promusicae v Telefónica**, delivered 18 July 2007, ECLI:EU:C:2007:454.**

Additional Resources

• Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” A closer look at the 2014 judgment that invalidated the Data Retention Directive and established that communications metadata can reveal detailed information about an individual’s private life. It provides useful context for the CJEU’s evolving approach to communications data, privacy, and proportionality. Read the article
• Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive.” A later CJEU decision examining government access to subscriber-identification data and distinguishing between interferences with privacy according to their seriousness. It helps trace the development of the Court’s communications-data jurisprudence after Digital Rights Ireland. Read the Article.
• Tele2: When Copyright Enforcement Meets Communications Privacy.” A follow-on CJEU decision applying Promusicae to another request to identify Internet subscribers for civil copyright enforcement. Tele2 confirms that EU law may permit disclosure while requiring a fair balance among fundamental rights and proportionality. Read the article.
• “Scarlet: Why Copyright Enforcement Cannot Require General Internet Surveillance.” Building on Promusicae’s fair-balance principle, the CJEU rejected an injunction requiring indiscriminate filtering of internet traffic. The judgment explains why copyright enforcement must respect limits on general monitoring and protect business freedom, personal data, and lawful communications. Read the article.