Are Internet protocol addresses personal data? the fight against online copyright infringement

Computer Law and Security Review

Volumn 27, Issue 4, 2011, Pages 348-361

  Moiny, Jean Philippe ^a  

^a UNIVERSITY OF NAMUR   (Belgium)

Author keywords

Data protection; Electronic communications; Internet Protocol address; Online copyright infringement

Indexed keywords

CASE LAW; COPYRIGHT INFRINGEMENT; DATA PACKET; DATA PROTECTION; ELECTRONIC COMMUNICATIONS; INTERNET PROTOCOL ADDRESS; IP ADDRESSS; ONLINE COPYRIGHT INFRINGEMENT;

COMPUTER CRIME; COPYRIGHTS; INTERNET; LAWS AND LEGISLATION; TELECOMMUNICATION NETWORKS;

INTERNET PROTOCOLS;

EID: 79960925586     PISSN: 02673649     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.clsr.2011.05.004     Document Type: Article

References (77)

1. LRDP Kantor in association with Centre for Public Reform, Korff D, Brown I (core experts) et al. Comparative Study on Different Approaches to New Privacy Challenges, in particular in the light of Technological Developments. Final report delivered in the framework of contract JLS/2008/C4/011, European Commission, Directorate-General Justice, Freedom and Security, 20 January 2010, from http://ec. europa.eu/justice/policies/privacy/docs/studies/new-privacy- challenges/final-report-en.pdf, p. 28, [accessed 15.09.10]. The overall study is hereinafter referred to as "Comparative Study on Different Approaches to New Privacy Challenges".
2. See Article 5.1 of Directive 2002/58/EC. As regards theses concepts, see notably Moiny J-P. Cloudy weather cloud based social networks sites: under whose control?. In: Dudley-Sponaugle A, Braman J, Vincenti G, editors. Investigating cyber law and cyber ethics: issues, impacts and practices. IGI Global, forthcoming 2011.
3. "As regards the exception relating to unauthorized use of the electronic communications system, this appears to concern use which calls into question the actual integrity or security of the system", (ECJ, Judgment of the Court (Grand Chamber), January 29, 2008, Promusicae v. Telefonica, Case C-275/06, European Court Reports 2008, p. I-00271, no. 52).
4. Article 3.1 of Directive 2006/24/EC.
5. Article 5.1, (a), (2), (iii), and (c), (2), (i), of Directive 2006/24/EC.
6. More precisely, data have to be retained to the extent they "are generated or processed by providers of publicly available electronic communications services or of public communications network within their jurisdiction in the process of supplying the communications services concerned", article 3.2 of Directive 2006/24 (emphasis added by author). As regards the services and networks at stake, see article 2.1 of Directive 2006/24 and article 2 (a), (c) and (d) of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002, on a common regulatory framework for electronic communications networks and services (Framework Directive), OJ L 108, 24.4.2002, hereinafter referred to as "Directive 2002/21". See also Moiny J-P. Cloudy weather cloud based social networks sites: under whose control?. In: Dudley-Sponaugle A, Braman J, Vincenti G, editors. Investigating cyber law and cyber ethics: issues, impacts and practices. IGI Global, forthcoming 2011, footnote no. 179.
7. The Court ruled that article 8.1 of Directive 2004/48/EC (Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the Enforcement of Intellectual Property Rights, O.J. L 157, 30.4.2004), articles 15.2 and 18 of Directive 2000/31 (Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market ('Directive on electronic commerce'), O.J. L 178, 17.7.2000, hereinafter referred to as "Directive 2000/31/EC") and articles 41, 42 and 47 of the TRIPS do not require Member States to lay down an obligation to communicate personal data in the context of civil proceedings, see Promusicae v. Telefonica, ECJ 2008, nos. 58-60.
8. Promusica v. Telefonica, ECJ 2008, nos. 65-68. More recently, see ECJ, Order of the Court (Eight Chamber), February 19, 2009. LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten GmbH v. Tele2 Telecommunication GmbH, Case C-557/07, European Court reports 2009, p. I-01227.
9. Loi no. 2009-669 du 12 juin 2009 favorisant la diffusion et la protection de la creation sur internet, http://www.legifrance.gouv.fr/.
10. See Decret n-2010-236 du 5 mars 2010 relatif au traitement automatiséde donnees á caractére personnel autorisépar l'article L. 331-29 du code de la proprieté intellectuelle denommé"Systéme de gestion des mesures pour la protection des oeuvres sur internet", available on http://www.legifrance. gouv.fr/.
11. See Macrez F, Gossa J. "Surveillance et securisation: ce que l'Hadopi rate, A propos de la "petite loi" "Creation et Internet". Revue Lamy Droit de l'Immateriel, no. 50, 2009, p. 85.
12. See Moiny J-P. Cloudy weather cloud based social networks sites: under whose control?. In: Dudley-Sponaugle A, Braman J, Vincenti G, editors. Investigating cyber law and cyber ethics: issues, impacts and practices. IGI Global, forthcoming 2011.
13. Loi n-2004-575 du 21 juin 2004 pour la confiance dans l'economie numerique (consolidee au 11 juillet 2010, retrieved on October 4, 2010, from http://www.legifrance.gouv.fr.
14. Tribunal de Grande Instance de Paris, summary judgment (ordonnance de refere), March 5, 2009, Magdane et al. v. YouTube, retrieved on October 4, 2010, from http://www.legalis.net/.
15. This question has not been contested on appeal, see Cour d'appel de Paris (Court of Appeal), 4th Chamber, Judgment, March 26, 2010, YouTube v. Magdanes et al., retrieved on October 4, 2010, from http://www.legalis.net/.
16. Tribunal de Grande Instance de Paris, 3d Chamber, Judgment, June 24, 2009, Lafesse et al. v. Google et al., retrieved on October 4, 2010, from http://www.legalis.net/.
17. See Trezeguet M. "Prestataires du web 2.0: l'adresse IP est une donnee personnelle". Revue Lamy du Droit de l'Immateriel, no. 51, 2009, pp. 47-48.
18. Tribunal de Grande Instance de Paris, summary judgment (ordonnance de refere), June 23, 2008, J.F. v. SAS Networks, p. 4, retrieved on October 4, 2010, from http://www.juriscom.net/jpt/visu.php?ID=1089.
19. "Save as otherwise provided, the definitions in Directive 95/46/EC [.] shall apply" (Article 2, al. 1 of Directive 2002/58/EC). See Article 2, h) of Directive 95/46/EC.
20. See http://dtecnet.com/.
21. See EMI Records et al. v. Eircom (IEHC 2010), no. 20.
22. See notably in the same sense, the position of the Belgian Privacy Commission, Avis d'initiative concernant la compatibilitéde la recherche d'infractions au droit d'auteur sur Internet avec les dispositions juridiques protegeant les donnees á caractére personnel et les communications, n-44/2001, November 12, 2001; European Data Protection Supervisor, Opinion on the current negotiations by the European Union of an Anti-Counterfeiting Trade Agreement (ACTA), O.J. C 147, 5.6.2010, nos. 51-52.
23. "Since it was likely to be deeply unfair that only Eircom with about 40%of the market share, as the defendant in these proceedings, should bear the burden of this settlement, thus activating the winds of market forces to drive customers towards Eircom's competitors, the plaintiffs agreed to initiate similar proceedings against other internet service providers in the State" (EMI Records et al. v. Eircom (IEHC 2010), no. 10).
24. Cour d'appel de Paris, 13th Chamber, April 27, 2007, Anthony G. v. SocietéCivile des Producteurs Phonographiques (SCPP), retrieved on October 4, 2010, from http://www.legalis.net/.
25. Cour d'appel de Paris, 13th Chamber, May 15, 2007, Henri S. v. SocietéCivile des Producteurs Phonographiques (SCPP), retrieved on October 4, 2010, from http://www.legalis.net/.
26. Tribunal de Grande Instance de Bobigny, December 14, 2006, Laurent f. v. SACEM et al., retrieved on October 4, 2010, from http://www.legalis.net/.
27. Tribunal de Grande Instance de Saint-Brieuc, September 6, 2007, SocietéCivile des Producteurs Phonographiques (SCPP) et Societédes Auteurs, Composieteurs et Editeurs de Musique (SACEM) v. J.P., retrieved on October 4, 2010, from http://www.legalis.net/.
28. Cour de Cassation, Criminal Chamber, June 16, 2009, SocietéCivile des Producteurs Phonographiques (SCPP) et al. v. J.P., see L. COSTES, "Télechargement illegal d'oeuvres musicales et processverbal de l'agent verbalisateur", Revue Lamy Droit de l'Immateriel, no. 52, 2009, pp. 16-18.
29. Cour d'appel de Rennes, 3d Chamber, May 22, 2008, Cyrille S. v. Societédes Auteurs, Compositeurs et Editeurs de Musique (SACEM) and Societépour l'Administration du Droit de Reproduction Mecanique des Auteurs et Compositeurs de Musique (SDRM), retrieved on October 4, 2010, from http://www.legalis.net/.
30. Cour de Cassation, Criminal Chamber, January 13, 2009, Societédes Auteurs, Compositeurs et Editeurs de Musique (SACEM) and Societépour l'Administration du Droit de Reproduction Mecanique des Auteurs et Compositeurs de Musique (SDRM) v. Cyrille S., 8 Recueil Dalloz, 2009, p. 497.
31. In the same sense see Costes L. "Télechargement illicite d'oeuvres : constatation de l'infraction et donnees personnelles". Revue Lamy Droit de l'Immateriel, no. 46, 2009, p. 22
32. Chafiol-Chaumont F, Bonnier A. "L'identification des "pirates du Web" á partir de leurs adresses IP,Dela qualificationduconstat probatoiredel'agent assermentémandatépar laSACEMau projet de loi "HADOPI". Revue Lamy Droit de l'Immateriel, no. 49, 2009, p. 86
33. Pignatari O. "Télé- chargement illicite d'oeuvres musicales: l'articulation e toujours e delicate avec les donnees personnelles et le rejet persistant de la copie privée". Revue Lamy Droit de l'Immateriel, no. 60, 2010, p. 15 and the references quoted by the author in footnote no. 16.
34. In the same sense, see notably Daleau J. note under Cour de cassation, crim., 13 janvier 2009, 8 Recueil Dalloz, 2009, p. 497
35. Teller M. "Les difficultes de l'identiténumérique: quelle qualification juridique pour l'adresse IP?". Recueil Dalloz, no. 29, 2009, p. 1990.
36. Cour d'appel de Paris, 12th Chamber, February 1st, 2010, Cyrille S. v. SACEM and SDRM, retrieved on October 4, 2010, from http://www.legalis.net/).
37. Federal Data Protection and Information Commissioner (Switzerland), http://www.edoeb.admin.ch/aktuell/01688/index. html?lang=en, last visited on October 7, 2010. See also the press release of the Federal Court (September 8, 2010), http://www.bger. ch/fr/mm-1c-285-2009-d.pdf, [accessed 14.12.10]. The decision (cases nos. 1C-285/2009 and 1C-295/2009) is published in German language on http://www.bger.ch.
38. The Commission underlined that this identification of individuals is necessary to the fulfillment of the objective pursued e in the case e by the IFPI, that is to say to take proceedings against the individual who have the IP addresses at stake. Commission for the protection of privacy (Belgium). Avis d'initiative concernant la compatibilitéde la recherché d'infractions au droit d'auteur commises sur Internet avec les dispositions juridiques protegeant les donnees á caractére personnel et les télecommunications, n-44/2001, November 12, 2001, p. 3. The advices of the Belgian privacy commission (CPVP) are available on http://www. privacycommission.be.
39. See the Belgian public register of processings, https://www. privacycommission.be/elg/publicRegister.htm?decArchiveId=32072, declaration made by IFPI Belgium, and published form the 22 January 2008.
40. See Electronic Frontier Foundation, "RIAA v. The People: Five Years Later", September 2008, retrieved on October 5, 2010, from http://www.eff.org/riaa-v-people.
41. For a thorough study in the United States as regards IP addresses, see J.J. McIntyre, "Thenumber is me: why internet protocol (IP) addresses should be protected as personally identifiable information", DePaul Law Review, no. 60, 2011, forthcoming, retrieved on http://www.ssrn.com
42. U.S. Court of Appeals for the Eight Circuit, April 1st, 2005, The Recording Industry Association of America v. Charter Communications, p. 5, from http://www.ca8.uscourts.gov [accessed 04.10.10].
43. U.S. Court of Appeals for the Fifth Circuit, February 25, 2010, Maverick Recording Company et al. v. Whitney Harper, no. 08-51194, pp. 2-3, from http://www.ca5.uscourts.gov/[accessed 04.10.10].
44. US District Court for the Central District of California, June 19, 2007, Columbia Pictures et al. v. Justin Bunnell et al., U.S. Dist. LEXIS 46364, from http://www.eff.org/files/filenode/torrentspy/200808 14%20judgment.pdf [accessed 07.10.10].
45. Columbia Pictures et al. v. Justin Bunnell et al. (C.D. Cal. 2007), p. 15, line 10.
46. Justice Chooljian ordered that "defendants shall mask, encrypt, or redact IP addresses through a hashing program or other means, provided, however, that if a given IP address appears more than once, such IP address is concealed in a manner which permits one to discern that the same IP address appears on multiple occasions"; and she specified that "Plaintiffs are prohibited from using "brute force" or any other means to pierce or reverse any such mask/encryption/redaction" (U.S. District Court for the Central District of California, Magistrate Order, May 29, 2007, Columbia Pictures et al. v. Justin Bunnel et al., no. CV 06-1093 FMC(JCx), p. 34, lines 3-12, from http://www.eff. org/files/filenode/torrentspy/columbia-v-bunnell-magistrate- order.pdf [accessed 04.10.10].).
47. Hustinx PJ. Protection of personal data on-line: the issue of IPaddresses; 2009, p. 7, fromhttp://www.edps.europa.eu/EDPSWEB/webdav/site/ mySite/shared/Documents/EDPS/Publications/Speeches/2009/09-04-15-adresses-IP-EN. pdf [accessed 05.10.10] (also published in 1 Legicom, 2009, n-42). At the present time, a bill proposes to clarify the status of IP addresses, proposing that they be protected according to the French data protection act, see http://www.senat.fr/rap/l09-330/l09-3302.html [accessed 06.10.10].
48. Tribunal de Premiére Instance de Bruxelles, June 29, 2007, s.c.r. l. Societébelge des auteurs c. s.a. Scarlet, retrieved on October 4, 2010, from http://www.juriscom.net/documents/tpibruxelles2007 0629.pdf. An appeal has been filed against this decision, before the Cour d'appel de Bruxelles. The latter sought a preliminary ruling to the ECJ. At the time of finalizing the present paper, the case is pending before the ECJ (Scarlet Extended SA v. Sabam, Case C-70/2010), and the Advocate General Cruz Villalon has already presented his opinion on April 14, 2011. His opinion has however not been analyzed for the purpose of the paper.
49. The Court underlined that "les logiciels de filtrage et de blocage ne traitent en tant que tels aucune donnee á caractére personnel; [.] á l'instar des logiciels antivirus ou antispam, ils sont de simples instruments techniques qui comme tels ne réalisent pas d'activites impliquant l'identification d'internautes" (s.c.r.l. Societébelge des auteurs c. s.a. Scarlet, TPI Bruxelles, 2009, p. 10).
50. Administrative Appeal Board (Hong Kong), November 26, 2007, Shi Tao v. Privacy Commissioner for Personal Data, administrative appeal n-16 of 2007, retrieved on October 6, from http://www. pcpd.org.hk/english/publications/files/ Appeal-Yahoo.pdf.
51. As regards the case, see Office of the Privacy Commissioner for Personal Data, Data Protection Principles in the Personal Data (Privacy) Ordinance e from the Privacy Commissioner's perspective, Second Edition, Hong Kong, 2010, pp. 13-14, from http://www.pcpd.org. hk/english/publications/files/Perspective-2nd. pdf [accessed 05. 10.10].
52. According to French law, in order to determine if a natural person is identifiable, all the means that enable to realize its identificationmust be considering includingmeans available to the data controller or to any person, or means that can be accessed by these latter, see Article 2 of the Loi n-78-17 du 6 janvier 1978 relative á l'informatique, aux fichiers et aux libertes (consolidated version of June 2010), available on http://www.legifrance.gouv.fr.
53. See clause n-4: Registration and Account Security of Facebook terms of use, available on http://www.facebook.com/terms.php?ref=pf [accessed 05.10.10].
54. See clause 5.1 of Google terms of service, available on http://www.google.com/accounts/TOS?hl=en [accessed 05.10.10].
55. In the United States, it seems that such reasoning would be refuted. See US Court of Appeals for the Sixth Circuit, September 28, 2006, Klimas v. Comcast Cable Communications, Inc., 465 F.3d 271, retrieved on October 5, 2010, from http://www.ca6.uscourts. gov/internet/index.htm. It was alleged that the IAP Comcast had recorded the Web traffic of its subscribers (their IP addresses and the URL visited). The relevant rule at stake related to the collection of subscribers' personal data, and was taken from the Cable Act 1984 (45 U.S.C.A. x 551). The Court firstly considered that the Cable Act 1984 did not apply to broadband Internet service (p. 5). The Court underlined that the Cable Act 1984 only defines what was not personal data. Are not personally identifiable information, "any record of aggregate data which does not identify particular person". Then the In this respect the Court considered that "[t]he only record containing the identity of "particular persons" mentioned in the complaint, as noted above, is the list of Comcast internet service subscribers, which e standing alone e obviously is not covered by the Act" (p. 8). It is interesting to note that the Court previously precised that the "complaint also alleged that the defendant had information from which it could identify its subscribers, but not that the defendant had actually correlated the IPeURL linkages with the subscriber list". Therefore it seems that in the Court's view, it is not sufficient that a correlation may be done between databases. For personal data to be at stake, a correlation should have been actually done.
56. See notably http://www.tcpipguide.com/free/t-IPv6Interface IdentifiersandPhysicalAddressMapping.htm; http://www.open wall.com/ presentations/IPv6/; http://technet.microsoft.com/enus/library/cc736439%28WS. 10%29.aspx; http://en.wikipedia.org/wiki/MAC-address.
57. See European Commission IPv6 Task Force, Discussion document from the European Commission IPv6 Task Force to Article 29 Data Protection Working Group, February 17, 2003, available on http://www.ec.ipv6tf.org/PublicDocuments/ Article29-v1-2.pdf, pp. 2-3
58. IETF, T. Narten, R. Draves and S. Krishan, Privacy Extensions for Stateless Address Autoconfiguration in IPv6, September 2007, available on http://tools.ietf.org/html/rfc4941.
59. Supreme Court of the State of New Jersey, April 21, 2008, State of New Jersey v. Shirley Reid, 195N.J. 422, 949 A.2d 850, p. 16, from http://www.jdsupra.com/post/documentViewer.aspx?fid=f4f80 aa4-908e-4092-9397- 29c23282be59 [accessed 05.10.10].
60. Berkeley, School of Information, J. Gomez, T. Pinnick and A. Soltani, "KnowPrivacy", June 1st, 2009, p. 28, retrieved on April 10, 2010, from http://knowprivacy.org/. The study continues: "[h] owever, the numbers we compiled do not include subsidiaries of subsidiaries".
61. The concept of personal data is defined by Article 1, x 1 of the loi du 8 decembre 1992 relative á la protection de la vie privee á l'egard des traitements de donnees á caractére personnel, M.B. 18 mars 1993, available on http://www.ejustice.just.fgov.be/loi/loi.htm.
62. See Projet de loi transposant la Directive 95/46/CE du 24 octobre 1995 du Parlement europeen et du Conseil relative á la protection des personnes physiques á l'egard du traitement des donnees á caractére personnel et á la libre circulation de ces données, exposédes motifs, Doc. parl., Senat, sess. ord. 1997-1998, n-1566/1, p. 12, from http://www.senate.be/www/?MIval=/index-senateMENUID=10000LANG=fr [accessed 07.10.09].
63. Commission for the protection of privacy (Belgium), Notice explicative e declaration ordinaire, July 2007, p. 21.
64. Institute of Electrical and Electronics Engineers IEEE Standard for Local and Metropolitan Area Networks: Overview and Architecture. IEEE Std 802-2001, pp. 6, 11 and 20-21, from http://standards.ieee.org/getieee802/download/802- 2001.pdf [accessed 07.10.10].
65. McIntyre JJ. The number is me: why internet protocol (IP) addresses should be protected as personally identifiable information. DePaul Law Review, no. 60, 2011, forthcoming, retrieved on http://www.ssrn.com.
66. U.S. Court of Appeals for the Ninth Circuit, USA v. Jerome T. Heckenkamp, April 5, 2007, 82 F.3d 1142 (9th Cir. 2007), pp. 3-6, from http://www.ca9. uscourts.gov/datastore/opinions/2007/04/04/0510322.pdf [accessed 06.10.10].
67. "IP spoofing is the practise of forging various portions of the Internet Protocol (IP)", http://spoofer.csail.mit.edu/faq.php, [accessed 07.10.10].
68. See Gerphagnon J-O, Portes de Albuquerque M, Portes de Albuquerque M. Securitéinformatique, Attaques informatiques, pp. 7-13, from http://www.rederio.br/downloads/pdf/nt00700.pdf [accessed 07.10.10].
69. Kissel E, Mirkovic J. Comparative evaluation of spoofing defenses. USC/ISI technical report number ISI-TR-655, January 2009, p. 1, from http://www.isi.edu/wmirkovic/publications/spo ofer.pdf [accessed 07.10.10].
70. PCMAG.com Encyclopedia, http://www.pcmag.com/encycl opedia-term/0,2542,t= proxyserver&i=49892,00.asp, [accessed 07.10.10].
71. Hustinx PJ. Protection of personal data on-line: the issue of IP addresses, 2009, p. 1, from http://www.edps.europa.eu/EDPSWEB/webdav/site/ mySite/shared/Documents/EDPS/Publications/Speeches/2009/09-04-15-adresses-IP-EN. pdf [accessed 05.10.10] (also published in 1 Legicom, 2009, n-42). At the present time, a bill proposes to clarify the status of IP addresses, proposing that they be protected according to the French data protection act, see http://www.senat.fr/rap/l09-330/l09-3302.html, [accessed 06.10.10].
72. See http://www.ixquick.com/fra/protect-privacy.html [accessed 05.10.10].
73. As regards the idea of subjecting the processing of IP addresses to a specific legal regime, see for instance, in the same sense in France, F. Chafiol-Chaumont and A. Bonnier. "L'identification des "pirates du Web" á partir de leurs adresses IP, De la qualification du constat probatoire de l'agent assermentémandatépar la SACEM au projet de loi "HADOPI". Revue Lamy Droit de l'Immateriel, no. 49, 2009, p. 89.
74. For instance in the United Kingdom, "the same piece of data may be personal data in one party's hands while it may not be personal data in another party's hands" (Information Commissioner's Office. Data protection technical guidance determining what is personal data. p. 11, from http://www.ico.gov.uk/upload/documents/library/data-protection/ detailed-specialist-guides/personal-dataflowchart-v1-with-preface001.pdf, [accessed 05.10. 10]). According to the UK Data Protection Act 1998, Section 1 (1): personal data "means data which relate to a living individual who can be identified e (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (emphasis added by author).
75. See Korff D. Country studies, Germany. In: Comparative study on different approaches to new privacy challenges. June 2010, p. 3, from http://ec.europa. eu/justice/policies/privacy/docs/studies/new-privacy-challenges/ final-report-country-report-A6-united-kingdom.pdf [accessed 05.10.10]. See p. 6 as regards IP addresses where the author points out that for the UK Information Commissioner's Office seems to consider that IP addresses are not personal data for websites operators e but for IAPes as long as they retain identification data e, except if "if they are actually used by the operator to collate the data from different visits, i.e. to build up a "profile" of the visitor" (p. 6).
76. See also Information Commissioner's Office. Data protection good practice note, collecting personal information using websites, pp. 2-3, from http://www.ico.gov.uk/upload/documents/library/data-protecti on/practical-application/collecting-personal-information-from-websites-v1.0.pdf [accessed 05.10.10].
77. See Korff D. Country studies, Germany. In: Comparative study on different approaches to new privacy challenges. May 2010, p. 4, from http://ec.europa.eu/ justice/policies/privacy/docs/studies/new-privacy-challenges/ final-report-country-report-A4-germany.pdf, [accessed 05.10.10]. The author concludes from this sense of personal data that IP addresses are personal data for IAPes but not for the other ones.