Facts
This judgment concerns a recommendation by the Federal Data Protection and Information Commissioner (FDPIC) addressed to Logistep AG. The FDPIC found that Logistep AG, using specially developed software, searched various peer-to-peer networks (P2P networks) for allegedly copyright-protected works and recorded the following data, which it then stored in a database:
- the username of the P2P network user
- the IP address of the Internet connection used
- the GUID (a unique identification number of the software used by the provider of the copyright-protected work)
- the P2P network protocol used
- the name and electronic fingerprint (hash code) of the copyright-protected work
- the date, time, and duration of the connection between Logistep AG's software and the software of the provider of the respective copyright-protected work
These data would then be passed on to the copyright holders, who would use them to identify the owner of the Internet connection and to assert claims for damages.
Considerations
The Federal Supreme Court concluded that the data processing practiced by Logistep AG constitutes an impermissible violation of personality rights. The data processing violates the principles of purpose limitation and recognizability under Art. 4 (3) and (4) of the Federal Act on Data Protection (FADP), as it generally occurs without the knowledge and recognizability of the affected persons.
While justification grounds under Art. 13 FADP can in principle also be invoked in the event of a violation of the principles…