Joint answer given by Mrs Reding on behalf of the Commission Written questions :P-001257/13 , E-001574/13 , E-000956/13
An Internet Protocol (IP) address is a unique identifier used to connect users and websites, including those selling travel services. Websites can easily build a unique profile of Internet users, as they ‘log’ the IP address of the users' devices. According to the questions, websites provide different prices to users, using their IP addresses.
To the extent that, combined with other information received by the servers they allow those users to be precisely identified, IP addresses are personal data within the meaning of the DPD (95/46/EC)(1).
In line with the national laws implementing the DPD, personal data must inter alia be processed on legitimate grounds, for a specific purpose and the processing must be proportionate to the aim pursued. The clients of the travel companies should be informed about the processing. Without prejudice to the powers of the Commission as guardian of the Treaty, national data protection supervisory authorities are the competent bodies to monitor the application of the national measures implementing the DPD(2).
The Unfair Commercial Practices Directive (UCPD‐ 2005/29/EC) and Regulation (EC) 1008/2008(3) provide that information on the total price must be provided in any invitation to purchase; this legislation does not prevent traders from changing the price in a later invitation to purchase, as long as the total price is clearly displayed before the consumer completes the purchasing process. In the recently adopted report on the UCPD, the Commission acknowledged the emergence of new forms of dubious commercial behaviour via online platforms. It is organising workshops to further assess under which circumstances the sudden increase of prices by a trader may become illegitimate from a consumer protection angle.
Data Protection Directive 95/46/EC of the European Parliament and of the Council of 24.10.1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281 of 23.11.1995, p. 31.
Regulation (EC) No 1008/2008 of the European Parliament and of the Council of 24 September 2008 on common rules for the operation of air services in the Community (Recast), OJ L 293, 31.10.2008, p. 3-20.