In its decision dated 3 November 2016, the French Supreme court brings to an end many years of uncertainty by explicitly acknowledging the status of personal data of an IP address.

The question relating to the IP address status has long been subject to debate within French judicial authorities whereas the G29, an assembly of the European data protection authorities, had already clearly explained the reasons why an IP address should be considered as data concerning identifiable persons in its opinion dated 20 June 2007.

In accordance with article 2 and article 22 of the Law n°78-17 dated 6 January 1978 on data processing, files and liberties, the French Supreme Court clearly states that “an IP address, allowing to identify a natural person directly or indirectly, is personal data, so that its collection constitutes the processing of personal data and is subject to a preliminary filing to the CNIL”.

This decision falls in line with the recent ECJ judgement dated 19 October 2016 which had already ruled that an IP address is personal data.

The position of the French Supreme Court is now consistent with the position of the European judicial authority on this matter.