During its November session, the so-called “Düsseldorfer Kreis” (the assembly of all supreme German DPAs) adopted a resolution on the privacy-compliant design of website tracking procedures (such as Google Analytics).
In the resolution, the Düsseldorfer Kreis states that an analysis of the website usage (including geo-localization) requires opt-in consent of the respective user in case unabridged IP addresses are used for the analysis. The assembly based its finding on the assumption that IP addresses are to be considered personally identifiable information. As a consequence, in the event no proper consent to website tracking measures has been secured, all IP addresses would have to be shortened by the last two to three digits before they could be used for any kind of website usage analysis.
Yet, even if the IP addresses are depersonalized in the described manner but a certain pseudonym is used that might allow re-identification of the users, further measures would have to be taken, says the Düsseldorfer Kreis, in order to meet the statutory requirements. In particular, the special data protection law provisions of the Telemedia Services Act would require that the users be informed about their right to object even usage profiles created under a pseudonym and that the data are strictly separated from other user data.
Moreover, the assembly points out that the requirements of Sec. 11 of the Federal German Data Protection Act on the lawful creation of data processing agencies must be observed in case a third party is mandated with the analysis.
In another decision adopted on November 27, 2009, the Düsseldorfer Kreis took up the issue of marketers’ data usage. The assembly stated that the recently amended provisions on marketers’ use of personal data provide for a transition period through August 31, 2012 for data that was collected prior to the enactment of the amendment. However, it points out that the new provisions are directly applicable in case the controller cannot prove when the data were first stored.
