European law doesn’t recognize animals as data subjects, but information about pets frequently leads directly to their owners, raising GDPR implications.
The Law Knows Only Humans
The law is often more straightforward than intuition. Article 4(1) of the General Data Protection Regulation (GDPR) defines personal data as information relating to an identified or identifiable natural person.
This single sentence contains a boundary that contemporary technologies haven’t yet shifted. A natural person remains a human being—not a dog on a walk, a cat observing street life, or a cow peacefully grazing.
Animal Number, Human Data
While GDPR doesn’t directly concern animals, it frequently appears wherever they do. Information about an animal almost always leads to a human.
Consider dog microchip registries: the number under an animal’s skin isn’t isolated. The database includes the owner’s name, address, and sometimes phone number. Veterinary documentation similarly links an animal’s medical history to the responsible person’s data.
Livestock registries and identification systems allow tracing animals to farms, production scales, and often the operator. The number of animals, their breed, and registration methods create a broader picture than zoology alone.
C-582/14 Breyer
European law can be surprising. A key principle of data protection was clarified in a case involving internet technologies.
Patrick Breyer challenged the practice of public administration storing dynamic IP addresses of users visiting government websites. The case reached the Court of Justice of the European Union (CJEU), which in its ruling of October 19, 2016, in case C-582/14 Breyer v. Bundesrepublik Deutschland, recognized that information can be considered personal data even when identification is indirect.
A realistic possibility of linking information to a specific natural person is sufficient.
C-434/16 Nowak
Years later, the CJEU received a question that initially seemed elementary. Irish law student Peter Nowak argued his exam paper should be considered personal data.
The dispute reached Luxembourg, where the Court, in its ruling of December 20, 2017, in case C-434/16 Nowak v. Data Protection Commissioner, stated that information is personal data if it relates to, describes, or allows evaluation of a person.
It doesn’t require a photograph or ID number; information revealing a fragment of a person’s biography or assessing their actions is enough.
C-212/13 Ryneš
Some cases before the Court begin prosaically. This was the case with Czech citizen František Ryneš, who installed a surveillance camera at his home after a series of burglaries, which also captured a portion of the street.
The case reached the CJEU, which in its ruling of December 11, 2014, in case C-212/13 Ryneš v. Úřad pro ochranu osobních údajů, clarified that monitoring covering public space is subject to data protection regulations.
This logic has consequences beyond cities. Cameras installed on farms, stables, or livestock facilities often monitor animals, but also capture neighbors, passersby, or delivery drivers.
The Boundary of the Law
European law isn’t indifferent to animals. Article 13 of the Treaty on the Functioning of the European Union states that animals are sentient beings.
This sentence forms the basis of the entire animal welfare protection system, defining conditions for breeding, transport, and slaughter, and obligating states and European institutions to consider animal suffering.
The boundary arises when it comes to privacy law. In the world of personal data protection, animals don’t become subjects of the law, possess personal data, or enjoy the rights provided by GDPR.
