French justice refuses that Meta (Facebook and Instagram) transmit an IP address to it in legal proceedings concerning you

The Paris Court of Appeal, in a ruling handed down at the end of December, limited the identification data communicated by Meta, Facebook’s parent company, as part of legal proceedings. The company wanted to give him IP addresses.

Access to private information belonging to companies which are also private, for the sake of legal proceedings, is a very delicate question, which prompted the Paris Court of Appeal to rule unequivocally. The court, in a proceeding between the American giant Meta, owner of Facebook and Instagram, and the National Association for the Prevention of Alcoholism and Addictology (ANPAA), recalled what identification data can be communicated by the social network, in in the context of a legal case. And you will see that things are far from simple.

Meta wanted to communicate the IP address of the holders of the infringing Instagram accounts

In a ruling dated December 21, 2023, the Paris Court of Appeal clarified the identification data that Meta can disclose outside of criminal proceedings. The case was launched by the ANPAA, which had identified 19 Instagram accounts having published illicit advertisements for alcoholic beverages, which constitutes an infraction of the public health code. And all the more so since some of these publications did not even display the legal health notice of the Evin law, you know, the famous “ Alcohol abuse is dangerous for health “.

By sparing you all the details of the procedure, the association ended up requesting, in May 2022 from Meta, the contact details of the affected Instagram users, as well as the removal of the disputed publications. Nothing very shocking in itself, except that it was obviously necessary to agree on the personal identification data to be transmitted.

Meta informed the Paris Court of Appeal that it was ready to provide the name(s) and first name(s) of the holder of each account, the date of creation of the account in question, the associated email address, as well as the IP address corresponding to the creation of the account. The American company indicates that these elements constitute “ basic subscriber information » (BSI), that is to say the basic information in its possession. If the Paris Court of Appeal is almost in tune with Mark Zuckerberg’s company, one detail upsets it.

Justice preferred to do without the IP, favoring strict identification

And this detail is that of the IP address. The Court of Appeal decided to reduce the scope of the identification data that can be communicated on the basis of a decree of October 20, 2021. It recalled that hosts have no obligation to communicate “ that information relating to the civil identity of the user ”, as part of a procedure.

Other information, such as “ banking information » or those “ allowing the source of the connection or those relating to the terminal equipment used to be identified, in particular the IP address ”, should not be used.

If the account holders refused to remove the famous publications on their own, it should be noted that Meta has deleted all the disputed posts. As for the data, the Court of Appeal explained that it was satisfied only with the surnames, first names or company name of the account holder, but also the pseudonyms and email addresses associated with the accounts.

Source: judgment of the Court of Appeal, by Legalis