Switzerland

[CH] Collecting IP Addresses to Hunt down Internet Pirates is Illegal

IRIS 2011-3:1/10

Patrice Aubry

RTS Radio Télévision Suisse, Geneva

IP addresses are protected personal data: they cannot be collected or used by a private undertaking without the consent of the persons concerned. This was the opinion of the Swiss Federal Tribunal (TF), upholding the opinion of the Federal Data Protection and Transparency Commissioner (Préposé fédéral à la protection des données et à la transparence - PFPDT). The PFPDT had ordered the Swiss company Logistep to stop its search for IP addresses on peer-to-peer networks until such time as a suitable legal basis had been adopted by the legislator.

Under commission from copyright holders, Logistep was hunting down musical and audiovisual works offered illegally by Internet users over peer-to-peer networks. Using specific software, Logistep collected transmission data on content exchanges, and more particularly the IP addresses of the users involved. It then passed this information on to the copyright holders to enable them to identify the Internet users concerned and have them prosecuted.

By considering the IP address as protected personal data within the meaning of the Federal Act on Data Protection (Loi fédérale sur la protection des données - LPD), the PFPDT held that such a practice was unlawful, as it infringed the personality rights of the Internet users concerned. Since Logistep refused to stop its activities, the PFPDT referred the matter to the Federal Administrative Tribunal (Tribunal administratif fédéral - TAF), but it refused to accept the application. Although it confirmed that IP addresses were indeed protected personal data, the TAF held that the interests of the copyright holders took precedence over those of Internet users in having information about them protected. According to the TAF, the collection and transmission of this personal data was therefore not subject to the consent of the persons concerned.

In a decision delivered on 8 September 2010 and published in January 2011, the TF cancelled the judgment delivered by the TAF and found in favour of the PFPDT. According to the TF, collecting IP addresses without the users’ knowledge and in a way that they were not able to recognise constituted a serious infringement of privacy and contravened the provisions of the LPD. Furthermore, there was no overwhelming public or private reason (the existence of which could only be admitted in very limited circumstances) to justify such an activity. Thus the judgment delivered by the TF forbids Logistep from collecting IP addresses and passing them on to copyright holders. The TF emphasised however that its decision referred solely to Logistep’s processing of personal data and did not constitute the establishment of a general right of precedence to the protection of data over the protection of copyright. In the absence of a relevant legal foundation, it was for the legislator to take the necessary steps to guarantee protection of copyright, taking the new technologies into account.