Vodafone with Loschelder successful against obligation to provide customer data
On 10 November 2014, the OVG Nordrhein-Westfalen (Higher Administrative Court of North Rhine-Westphalia) decided that the Bundesnetzagentur (Federal Network Agency) cannot commit the Vodafone GmbH to provide customer data, if the security and law enforcement authorities demand such information on customer data belonging to a dynamic IP-address.
When investigating against cyber crime, authorities usually only obtain a dynamic IP-address (IP-address assigned to a user for one session only) of potential criminals. Under certain conditions telecommunications service providers such as Vodafone can identify the person using this IP-address.
The interest of the law enforcement authorities to obtain the name of the person stands in opposition to the legal obligation of Vodafone to protect their customer data: Vodafone is entitled to determine which customer is using a dynamic IP-address only if expressly permitted by law. From Vodafone’s viewpoint, today the Telecommunication Act does no longer provide for such legal permission: Once the BVerfG (Supreme Federal Constitutional Court) declared the rules on data retention 2010 to be unconstitutional and invalid, Vodafone stopped collecting and storing dynamic IP-addresses in its fixed network. Since then the Telecommunication Act did not provide for new rules entitling telecommunications service providers to collect and store dynamic IP-addresses for legal prosecution.
That is why Vodafone started court actions against the obligation to provide customer data identified by a dynamic IP-address as stated by the Bundesnetzagentur based on the Telecommunication Act. The OVG Nordrhein-Westfalen has now ruled that the Telecommunication Act does not provide for an obligation of telecommunications service providers to submit these customer data. Therefore the Bundesnetzagentur was not entitled to issue such an obligation of Vodafone. Obligations can arise only from the specific laws of the security authorities which would then, accordingly, be enforce by them. Irrespective of this, the OVG Nordrhein-Westfalen did not comment on the question if Vodafone at all would be entitled to determine these data.
Vodafone was represented by Dr. Raimund Schütz and Dr. Kristina Schreiber.