The Federal Supreme Court ordered Logistep to halt all copyright-related data processing activities and banned it from forwarding any data already collected to copyright holders. In so doing, it has sent out a strong signal that it opposes all attempts by private individuals, and not just in the copyright sector, to take on certain tasks that must remain the prerogative of the State.
Acting on behalf of rights holders, Logistep had been collecting the IP addresses of users who were using Peer-to-Peer networks in order to exchange what was purported to be illegal uploads of copyrighted material, such as video and music files. Once they were in possession of the IP addresses, rights holders filed criminal charges which allowed them to identify the persons involved and to claim damages from them. According to our assessment, the data processing was carried out without the knowledge of the persons concerned, thereby infringing the principle of purpose limitation. Moreover, no legal justification had been provided. At the beginning of 2008 we recommended that Logistep end its searches in Peer-to-Peer networks until the legislator had created an appropriate legal basis (cf. the German or French version of our 15th Report on Activities 2007/2008, Section 1.3.1).
Logistep rejected our recommendation, as a result of which we filed a complaint with the Federal Administrative Court (FAC). The FAC rejected the complaint in its decision of 27 May 2009, holding that the interests of rights holders had priority over the interests of P2P users (cf. the German or French version of our 16th Report on Activities 2008/2009, Section 1.3.1). We then filed an appeal against this decision with the Federal Supreme Court. The latter overturned the decision of the first instance and endorsed our position. It instructed Logistep to halt all copyright-related data processing activities and banned it from forwarding any data it had already collected to rights holders. The link to the Court's decision of 8 September 2010 can be found (in German) on our website at www.derbeauftragte.ch under Documentation - Data protection - Appeals.
The ruling by Switzerland's highest court will have repercussions that go far beyond the immediate case at hand. In the grounds for its decision, the Court held that:
- In the case of a data transfer, if the recipient is able to identify the person concerned, the data shall be considered personal. If personal data are involved, the Data Protection Act must apply to all processing activities involving this data.
- In the abstract, it is impossible to determine whether IP addresses, in particular dynamic ones, involve personal data or not. However, IP addresses are considered to be personal data if, based on common experience, third parties who are interested in identifying the individual user can be expected to undertake the effort to make such identification. This was certainly true in the case of Logistep, since its entire business model was premised on the identification of the individual user.
- In processing the data it had collected, Logistep had violated the principles of purpose limitation and transparency. The issue to be decided was whether the company had provided any legal justification for its actions. In the court's opinion, a strictly systematic interpretation according to which a legal justification can only be invoked for the cases covered by paragraphs b) and c), but not a) of Article 12.2 of the Data Protection Act is not admissible, for even though the current version of sub-paragraph a) no longer refers to justificatory grounds, it does not explicitly exclude them either. The provision must therefore be interpreted in such a way that a justification for the processing of personal data in violation of the principles set out in Article 4, Article 5 paragraph 1 and Article 7 paragraph 1 of the FADP cannot as a general rule be excluded; however in this specific case, justificatory grounds may only be accepted with the greatest restraint.
- A recommendation issued by the FDPIC aims at defending a multitude of individuals and therefore is in the public interest. This interpretation of the FDPIC's recommendations must be borne in mind when weighing up the different interests at stake in accordance with Article 13 paragraph 1 of the FADP. This is important in that a recommendation - and in particular a recommendation that is endorsed by a court of law - has an indirect effect on all individuals who apply similar methods.
- Logistep was pursuing an economic interest in that it employed dedicated software in order to search P2P networks for copyrighted material and store user data. From a general perspective, i.e. going beyond the specific case at hand, the lack of a statutory framework creates uncertainty in terms of the type and scope of the collection and subsequent processing of data obtained from the Internet. An issue of particular concern is the fact that the storage and possible use of data outside of normal court proceedings has not been clearly defined. Even the general interest in effectively combatting copyright infringement does not counterbalance the effects of far-reaching breaches of privacy and the uncertainties surrounding the controversial methods used for data processing on the Internet.
- The Supreme Court made it clear that it did not consider that data protection must always take precedence over copyright protection. In its opinion, it is the task of the legislator, and not the judge, to ensure that the appropriate steps are taken to guarantee copyright protection when works are distributed via the new technologies.
- What the Supreme Court did not address was whether the law enforcement agencies are authorized to use the data collected by Logistep or not.