Recital 32

IP addresses as well as access numbers and related information can constitute a crucial starting point for criminal investigations in which the identity of a suspect is not known. They are typically part of a record of events, also known as a server log, that indicates the commencement and termination of a user access session to a service. It is often an individual IP address, be it static or dynamic, or other identifier that singles out the network interface used during the access session. Related information on the commencement and termination of a user access session to a service, such as the source ports and time stamp, is needed as IP addresses are often shared amongst users, for example where carrier grade network address translation (CGN) or technical equivalents are in place. However, in accordance with the Union acquis, IP addresses are to be considered personal data and have to benefit from full protection under the Union’s data protection acquis. In addition, under certain circumstances, IP addresses can be considered traffic data. Also, access numbers and related information are considered traffic data in some Member States. However, for the purpose of a specific criminal investigation, law enforcement authorities might have to request an IP address as well as access numbers and related information for the sole purpose of identifying the user before subscriber data related to that identifier can be requested from the service provider. In such cases, it is appropriate to apply the same regime as for subscriber data, as defined in this Regulation.