CJEU rules IP addresses may constitute personal data