2 February 2011 – As previously mentioned (see News dated 30 November 2010), the Swiss Federal Supreme Court held, in a decision dated 8 September 2010, that collecting dynamic IP addresses of persons uploading copyright-protected works and then forwarding those addresses to copyright holders so as to enable them to enforce their rights constitutes an unlawful and unjustifiable breach of the privacy of the persons concerned.

The court's decision was published in December 2010 on the website of the court (1C_285/2009; an official publication in the official collection is foreseen).

The court's reasoning was as follows:

The court first analyzed whether or not dynamic IP addresses may be considered personal data. It held that this question could not be answered in the abstract but that the concrete circumstances of the particular case must be taken into account. According to the court, the decisive element is whether the person processing the data, or third parties who are interested in identifying the individual user can, based on common experience, be expected to undertake the effort to make such identification. The court further held that in order for the data to qualify as personal data, it is not necessary for the person processing it (i.e. Logistep AG) to be in a position to identify the individual behind the data itself. Rather, it is sufficient if the recipient of the data (i.e. the copyright holder) may do so. Since Logistep AG's business model consists of allowing copyright holders to identify the person behind the data by filing a criminal complaint and accessing records during the criminal proceedings, the court held that in these specific circumstances the dynamic IP addresses are personal data. Therefore, the Swiss Data Protection Act applies to the processing undertaken by Logistep AG.

Second, the court held that Logistep AG's processing of the dynamic IP addresses violated the principles of purpose limitation and transparency as set out in Art. 4 paras. 3 and 4 of the Swiss Data Protection Act and thus breached the privacy of the persons concerned. Although the court recognized that such a breach may be justified by a prevailing private or public interest, it held that the existence of such a prevailing interest may only be admitted very restrictively. In this respect, the court ruled that Logistep AG's economic interest in obtaining remuneration for its services, the interest of the copyright holders in enforcing their rights, as well as the public's interest in efficiently fighting against copyright infringement do not prevail over the importance of the privacy interest being breached. The court also held that the activity of Logistep AG – i.e. searching in P2P-networks for copyright protected works and storing data about the persons offering such works for download – is a method, which due to the absence of a statutory regime in this area leads to uncertainty in relation to the methods used on the internet as well as in relation to the type and scope of the data collected and their processing. In particular, the court noted that the storage and possible use of the data outside of ordinary court proceedings are not clearly defined. Based on the foregoing, the Swiss Federal Supreme Court ordered Logistep AG to cease any data processing in the area of copyright and to refrain from forwarding the data it had already collected to the copyright holders.

The Court's decision is subject to several criticisms: First, it is questionable whether the dynamic IP addresses, as processed by Logistep AG, qualify as personal data.

In fact, a recent decision of the German Hanseatisches Oberlandesgericht (decision 5 W 126/10, 3 November 2010) reached the opposite conclusion. The German court determined that since it is not possible for Logistep AG to identify the person behind the dynamic IP addresses through ordinary means and without additional information, IP addresses collected by Logistep AG do not qualify as personal data under the German data protection legislation. Second, the Swiss Federal Supreme Court did not fully consider all aspects when balancing the private and public interests at stake in collecting the dynamic IP addresses against the breach of the privacy of the persons concerned. In particular, the court did not sufficiently take into account the fact that other than the purely private interests of Logistep AG, there is an important public interest in enforcing the provisions of copyright law, infringements of which are explicitly criminally sanctioned. Finally, the court did not sufficiently take into account the interests of the copyright-holders in being able to enforce their rights. Stated bluntly, the Swiss Federal Supreme Court gave more weight to the privacy interests of the copyright infringers than to the legally protected interests of the copyright holders, thus leaving the latter with very little protection against online copyright infringements. Hopefully this decision will remain an isolated instance and its reasoning will be reconsidered when applied to similar sets of facts.