European Union: Issued CJEU ruling in lawsuit concerning national authority access to identification data on the basis of IP address during investigations of online counterfeits (C-470/21)

On 30 April 2024, the Court of Justice of the European Union (CJEU) issued a judgment in Case C-470/21, addressing the compatibility of certain data processing operations with EU law, specifically concerning the general and indiscriminate retention of IP addresses by internet access providers for combating online counterfeiting. The Court clarified that Member States could require such retention, provided it does not allow for inferences about individuals' private lives, ensuring a strict separation of IP addresses from other personal data. Additionally, the Court ruled that national authorities could access civil identity data linked to IP addresses under stringent conditions, aiming to identify individuals suspected of criminal offences without serious interference with fundamental rights. This ruling underscores the balance between combating criminal activities and protecting personal data within the European Union's framework.