Stichting Brein won an appeal against Ziggo, as a result of which the provider still has to send a letter of warning from the organization to the customer. A lower court has previously said this is not necessary. However, Ziggo does not have to forward all warning messages immediately.

The lawsuit revolves around a Ziggo client that makes hundreds of e-books available online. Brein wants to warn this customer with a message to indicate that he or she is violating copyright. The organization only has a Ziggo client IP address. So Brein asked Ziggo to associate the IP address with the name and address details, so that Ziggo could send the message. Ziggo doesn’t want to do this, in part because the provider says it needs a permit from the Dutch data protection authority under AVG for this. In June last year, the Central Netherlands Court ruled in favor of Ziggo.

However, in an appeal by both Ziggo and Brein, the Arnhem-Leeuwarden Court of Appeal says that Brein’s interests in closing access to e-books outweigh the breach of privacy for Ziggo’s customer. In addition, Ziggo will not need permission from the Dutch Data Protection Authority, because the provider writes in the Terms and Conditions to collect personal data “to be able to take appropriate measures” if, for example, the customer infringes copyright. “This is not necessarily limited to the case in which Ziggo itself detects illegal or infringing use of an Internet connection.” writes court. Under the General Data Protection Regulation (GDPR), companies may process criminal personal data after a legal claim, which is the subject of this lawsuit. Accordingly, the GDPR is not an obstacle not to link the name and address details with the IP address, according to the court.

After the warning letter is sent, Brein also wants to be able to send a letter to a Ziggo customer and request payment of a periodic penalty if the customer does not stop making e-books available to the public within a certain period. The court agrees here, too. The organization has a basis for this under AVG and that Brein’s interest outweighs the breach of customer privacy, according to the court. The court gives the client five days to take action. Ziggo must then provide name and address details to Brein, after which the institution may send an application subject to the payment of a periodic fine. Breen says she is not claiming any compensation from the client. If Ziggo does not send the data on time, Brein may demand a fine of up to €50,000.

Although Ziggo should forward the warning letter to the customer in this specific case, this does not mean that Ziggo should automatically forward all Brein messages. The foundation asked for it, but the court wrote that it was for “future cases that remain unknown.” This means that it is not possible to assess the interests between the alleged copyright infringement and the privacy interests of such Ziggo customer, the balance required before Ziggo can commit to processing and providing such data.