Update On The UK's Information Commissioner, IP Addresses And Russia's ‘Right To Be Forgotten' Laws

With the Privacy Shield, the Umbrella Agreement and the GDPR capturing significant attention, it would be easy to overlook some of the other important developments that have taken place in the data protection sphere. We have rounded up some of the main stories.

Next UK Information Commissioner announced

Pending the formal approval process, Elizabeth Denham (Information and Privacy Commissioner, British Columbia, Canada) is scheduled to take over from Christopher Graham as the UK's next Information Commissioner. Minister for Data Protection Baroness Neville-Rolfe, has commended Ms. Denham on her proactive approach to enforcing data protection law, and acknowledged her "track record of working with business and other stakeholders". Ms. Denham's appointment should take place in June as Mr. Graham's term of office ends 28 June.

Court of Justice of the European Union to decide whether IP addresses are 'personal data'

The Court of Justice of the European Union (“CJEU”) is currently hearing arguments on whether IP addresses constitute personal data under Article 2(a) of the European Data Protection Directive. The outcome could have significant ramifications for web advertisers, market researchers, and other online businesses that rely on IP addresses to track internet usage.

Case C-582/14 is being brought against the German Federal Government to challenge its storage of IP addresses of those who access the government website. The case, which was referred to the CJEU by the German Federal Court of Justice, seeks clarification on whether the definition of "Personal Data" should be interpreted to mean that an IP address constitutes personal data if a third party (i.e., an internet service provider) possesses additional data to identify the end user. The argument is that taken together, the time, date and IP address can make it possible to identify the end user. If the CJEU agrees, it could mean internet businesses have to change their business models as they can no longer track internet usage.

The decision could also have wider implications under German law, as it would mean that IP addresses cannot be stored without the...