The EUCJ ruled that the operator of a website could have a legitimate interest in storing certain personal data relating to visitors to that website in order to protect itself against cyberattacks.
Patrick Breyer v Bundesrepublik Deutschland: Mr Breyer filed a lawsuit before the German courts to prevent Governamental websites from recording and storing his IP addresses. Addiitonal data stored is the date and time when a site was accessed, for the purpose of preventing cyber attacks and to be bale to pursue criminal proceedings.
Do dynamic IP addresses constitute “personal data”?
The court ruled that a dynamic IP address constitutes a personal information if the website operator had the legal means to identify the relevant individual with the help of the internet service provider. Moreover, in the case, the German institutions had a legitimate interest in processing such personal data for the purpose of preventing cyber attacks.