EU Court and Data Retention: Admissibility of IP Addresses in Criminal Proceedings

1. The facts

   The case stems from a request for a preliminary ruling submitted to the EU Court of Justice by several digital rights associations. The associations had challenged before the French Council of State the decrees concerning the activities of the authority for online copyright protection. The French system allowed for the generalized retention of and access to users' IP addresses to prosecute copyright violations on peer-to-peer networks. The central issue concerned the possibility of identifying suspects of non-serious crimes without prior oversight by a judge or an independent authority. Following the Grand Chamber ruling, the proceedings are now in the implementation phase by national courts, directly influencing the interpretation of data retention rules across the European Union.

2. The legal framework

   The regulatory framework revolves around the European directive on electronic communications, whose provisions allow Member States to restrict communication confidentiality for security purposes, and the EU Charter of Fundamental Rights, specifically regarding data protection. In Italy, the key provision is set out in the Privacy Code, which governs retention periods for traffic data.

   1. The function of the rule is to balance the right to privacy with the interest in prosecuting crimes.
   2. The violation of these limits or access procedures results in the inadmissibility of the acquired data under the code of criminal procedure, as evidence collected in breach of the law cannot be admitted to the trial file.
   3. Criminal procedure rules complement the framework by establishing that data acquisition must be authorized by the Judge for Preliminary Investigations upon request of the Public Prosecutor.

3. What the case law says

   European case law initially maintained a strict position, establishing that the generalized and indiscriminate retention of traffic and location data was permitted only to counter serious threats to national security. However, the most recent orientation introduced a fundamental distinction between location data, which is highly invasive, and the IP address alone. The courts have clarified that for the sole identification of a user via IP in ordinary crime investigations, generalized retention is compatible with EU law, provided it does not allow a precise profile of the subject's private life to be drawn. The principle of prior authorization remains paramount: access to data cannot be a discretionary decision of investigators but must undergo scrutiny by an independent authority to ensure compliance with due process.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Always verify the existence of authorization from the Judge for Preliminary Investigations for any acquisition of records or IP addresses, regardless of the severity of the alleged offense.
   2. Promptly raise objections regarding the inadmissibility of data acquired directly by the Public Prosecutor without a judicial filter.
   3. Technically distinguish between mere access data (IP) and complex traffic data to properly tailor the defense strategy based on the protection thresholds established by the CJEU.
   4. Monitor the evolving framework of the Privacy Code to ensure retention periods do not exceed legal limits.

References: Direttiva sulla tutela della vita privata nelle comunicazioni elettronicheCarta dei Diritti Fondamentali dell'Unione EuropeaCodice in materia di protezione dei dati personaliCodice di procedura penale

Editorial oversight: Avv. Federico Papa·ICAMUpdated 3 October 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction