Francis Davey

Exporting personal data I: introduction (and a small Brexit niggle)

2020-01-25T06:13:00.000+00:00

Well, I'm back.

I hope to carry on blogging about the law from the slightly different perspective that I have adopted in the past. In particular, I want to try talking about some difficult questions that I come across while working with clients and which I can't help thinking about in my spare time. Thank you for helping me scratch that itch.

This post is just an introduction. If you are familiar with how the GDPR works, then you should skip to the bit about Brexit.

The export of personal data

I want to start by talking about the General Data Protection Regulation, or GDPR as it is affectionately known, which will have been in force for two years in May. In particular, I want to talk about the regime create by the GDPR for the international transfer of data. From a technical point of view, transferring data around the world is, thanks to the Internet, not only straightforward but often invisible. However, from a legal perspective it is not so simple.

The reason why the GDPR tries to control international transfers of data is simple to see. The GDPR's aim is to create a region of really strong protection for personal data in the European Union and the European Economic Area. If someone processing personal data could simply transfer it outside that region and do whatever they liked with it, it would be really easy to get around the GDPR. The protection it gives would be much less useful.

How exports are controlled

The GDPR divides the world into two parts: a "safe" part, which at the moment contains the EU and the EEA; and a potentially wild and dangerous part consisting of what are called "third countries". By the way, there is (as far as I have been able to discover) no formal definition of "third country" as you might expect. It seems to be understood to mean anywhere that isn't a member state of the EU or the EEA, but maybe other countries (eg the UK after Brexit) could escape being "third countries" in the same way as the EEA members have done.

By default, moving data from the safe part of the world to a third country is forbidden, unless one of a (long) list of conditions is met. I plan to look through some of these conditions over this blog series, but in a moment, I will give a brief summary of two that are particularly significant.

Adequacy

The European Commission can declare that a country has "adequate" protection. Even though the country is a mere third country, it has done enough to live up to the high standards set by Europeans and data may be exported there.

This is a sort of data imperialism, perhaps with the hope that European data protection law will dominate the world. Given the steadily increasing list of countries declared "adequate", this may be working.

But, a word of caution about adequacy. Adequacy decisions can be made that are limited to certain kinds of transfer. In other words, just because a country is in the list, does not mean that you can just export data there without further thought. A few countries, for example the United States and Japan have adequacy decisions that are limited in various ways.

For example, the United States clearly does not think that it has to play along with the EU's data protection rules but has set up a system known as the "Privacy Shield" which allows companies to opt into a lightweight version of the GDPR. The USA only counts as having "adequate" protection for transfer to companies who are members of the Privacy Shield. I will have quite a bit to say about the Privacy Shield in a later blog.

Standard Contractual Clauses

A very popular option is for the export and importer to sign an agreement which contains a set of standard clauses approved by the European Commission (or in theory by another regulator). These are, in essence, a promise by the importer that they will not take advantage of the fact that the data is now outside the "safe" part of the world to do evil and/or unspeakable things to it and that they will in all ways be good. The standard clauses are meant to be enforceable by individuals whose personal data is being processed and they contain their own rules controlling further export of the data.

At first sight this system seems very flexible. Most transfer of data will either be internal to a company (in which case each part can sign the standard clauses) or be made subject to some terms or conditions, even if they are standard terms on a website. Including some standard material cut and pasted from the European Commission or elsewhere should be easy enough.

In practice there are quite a few difficulties with the standard clauses, which I intend to look at in some detail later in this series.

What about Brexit?

Unless something dramatic happens between now and then (given past history this is not entirely impossible), the effect of the EU-UK withdrawal agreement and the European Union (Withdrawal Agreement) Act 2020 is that the UK will leave the EU next week on the 31 January 2020.

Article 127 of the withdrawal agreement and section 1 of the Act keep EU law going in the UK for the time being during what is known as the "implementation period" until 31 December 2020 at 11.00pm GMT, though of course that data could end up being renegotiated. So at first sight it would appear that nothing will change for a while yet.

But I still have a concern. From the many examples I have seen, many agreements for sharing, selling or otherwise transferring personal data have provisions in them saying something like "... shall not transfer any personal data outside the European Economic Area..." or wording like that. The problem here is that, despite all the magic words about the implementation period, the UK will not as a matter of fact be in the European Economic Area and so any transfer within or to the UK may well end up being in breach of contract.

I have, since Brexit became a clear possibility, tried to press different wording on clients and their contracting partners. Typically I swap in "third country" for "outside the European Economic Area". It seems to me that the effect of the withdrawal agreement will be that the UK is not a "third country" until at least the end of the implementation period. The alternative would be to include a section attempting to explore all the possibilities along the lines of "If the UK is a member of ...." which seems complicated and fragile.

Does any of this matter? English courts are quite good at preventing over-literal readings of a contract. It's quite possible that a court would be generous and decide that the parties didn't intend that transfer to a country subject to EU law would be prohibited. But I can see the counter-argument quite easily. Not least that the UK is now not nearly as "safe" in GDPR terms as the EU was because in less than a year it could leave the whole protection framework behind.

That is why I have called this a "niggle" and not a problem. Even so, it is much better to avoid having courts sort your contracts out for you. In my experience, ambiguities make it easier for an aggrieved party to get legal proceedings off the ground, even if they ultimately lose, or to refuse to comply with a contract without being taken to court. It is something that is worth correcting if you can.

Defamation - staying protected

2015-05-20T21:22:00.001+01:00

In March, with the wonderful support of mySociety, I presented a half-day training session at Mozilla London about the English law of defamation and its relevance to people running websites with user-generated content. There has been some interesting new law (including the Defamation Act 2013) which bears close examination.

People seemed to have fun and mySociety have kindly produced a video of me giving the event. I am not sure how watchable this really is because I was not presenting for a video, but for an audience. My slides (in PDF format) and some notes should be available on github pages.

My apologies for the very many errors and formatting infelicities there are bound to be. I am still new at publishing things in this way. Comments welcome, but errors, missing material or other areas where you think there may be room for improvement are best raised as github issues.

Private copying - a new copyright exception in the UK

2014-07-30T17:05:00.000+01:00

Hooray! We (in the UK) now have a "private copy" exception to copyright. About time too. Until recently, many forms of private copying were infringements of copyright. In particular format shifting such as copying music from your old CD's and DVD's onto your phone or making a "mix tape" for your own use were infringements of copyright and, if you believe some of the rhetoric of the music industry, morally equivalent to theft.

By contrast, almost everyone seemed both to engage in private copying and to think it was OK. Indeed a recent survey I conducted suggests that the vast majority of people think that format shifting is OK (a 95% credible interval of 89 - 93% of the population). So it is very surprising that the law continued to turn its face against something subject to such overwhelming approval.

Analysis

The new law comes in the form of the Copyright and Rights in Performances (Personal Copies for Private Use) Regulations 2014, which is as yet only available in draft. It will come into force on 1st October and add a new section 28B to the Copyright, Designs and Patents Act 1988.

The effect of the new law is that making a copy of a work is not an infringement, subject to 3 conditions:

the source of the copy (i.e. what you are copying from) is either your "own copy" or a "personal copy"
it is made for your private use
it is made for ends which are "neither directly nor indirectly commercial"

Own copy

Your "own copy" of a work is one which:

you have lawfully acquired
on a "permanent basis"
is not an infringing copy
has not been made under any exception to copyright

This means that you cannot use the private copy exception to "launder" an infringement, eg by copying a work from a friend (still an infringement) and then making a copy of that copy. Similarly, a copy made for private study or research (an exception to copyright under section 29 of the 1988 Act) or a temporary copy, such as one in the browser's cache (see section 28A) is not your "own copy" and so cannot be safely duplicated under the private copy exception.

Your "own copy" is not necessarily a copy that you "own" in the intellectual property law sense. As I read it "lawfully acquired" includes a download which is only made available under licence. In the long run almost all digital content will be downloaded in some fashion rather than bought on a physical medium so a restriction to "owned" copies would be hopelessly restrictive.

The tricky part of the definition is likely to be what is meant by "lawfully acquired on a permanent basis"?

The new section 28B(4) "helpfully" give a short list of examples of copies that are or are not "lawfully acquired on a permanent basis". I am not sure they help all that much. Unsurprisingly copies which have been borrowed, rented, broadcast or streamed are not "acquired on a permanent basis". The same applies to a "download enabling no more than temporary access to a copy", whereas any other download that arises from a purchase or gift would be lawfully acquired on a permanent basis.

Could a copyright owner get around this exception by selling works for very long periods (decades perhaps) with a provision that the work reverts to the owner at the end? I doubt it. My hope is that the courts apply a normal English understanding to the words "temporary" and "permanent". For example, if I say I have a temporary job, you would be a bit surprised to learn that I have a fixed term of 30 years. You are more likely to describe my post as permanent.

Personal copies

A further example of something that is not your "own copy" is a copy made under the private copy exception. These are known as "personal copies". For example a lawful backup copy of an mp3 music file is not your "own copy", but it is a "personal copy". This means, as you would expect, that you can copy your backup copies.

Private use and file lockers

Just in case there was any doubt, the new s28B will make it clear that making back up copies and format shifting are certainly private use. Interestingly s28B(5)(c) makes it clear that storing a copy online so that you can access it later is also "private use" even though the file will be accessible to the file host as well.

This means that you will be able to store your own and personal copies of files on Dropbox (privately at least) and on similar servers.

Transfers

Section 28B will apply fairly common-sense provisions to transfers. If you transfer a personal copy (i.e. one of the copies you have made under this exception) to someone else, you will be infringing copyright unless the copyright owner has given you permission to do so. Personal copies are not meant to change hands. Even if the transfer is otherwise lawful, you would infringe copyright if you retained any of your other personal copies.

For example: if you buy a DVD, make a back up, and then sell the DVD second-hand (something you are entitled to do under section 18(3) of the 1988 Act), you must delete that back up copy. If you keep the back up copy it becomes and infringing copy and stops being a "personal copy".

Is lending OK?

But wait there is something a little odd here. Section 28B(6) says "Copyright in a work is infringed if an individual transfers a personal copy of the work to another person (otherwise than on a private and temporary basis)...". That appears to suggest that it is OK to transfer a personal copy of the work to another person if it is done on a private and temporary basis.

Could my "private use" include lending copies - on a temporary basis only - to friends? There is certainly material in s28B for such an argument. Whether it would run in court is another matter.

Restrictions by the copyright owner

One point that (bafflingly) appears to have upset a number of politicians is the new 28B(10) which blocks copyright owners from preventing private copying by contract. Clearly without such a clause it would be routine to add a provision that private copying was in breach of contract and we might as well not have bothered.

Copyright owners could also use a form of digital rights management to prevent private copying. Circumventing that protection may, at least for something that is not a computer program, itself be an infringement contrary to s296ZA.

It is already the law that, where digital rights management (what is referred to in the legislation as "effective technological measures) prevents one of a list of "permitted acts" (found in schedule 5A of the 1988 Act) then anyone prevented from doing the permitted act may complain to the Secretary of State, who may then do something about it.

This has always seemed to me a rather weak remedy since the Secretary of State is not obliged to do anything about it. When I last asked, no valid complaints appear ever to have been made.

Rather than make private copying another "permitted act" and thus apply the existing mechanism to it, the regulations will create a new s296ZEA. The main difference from 296ZE appears to be that it applies not only when the making of personal copies is prevented, but also when there is a technological restriction that restricts the number of personal copies which may be made. Whether anyone complains to the Secretary of State remains to be seen, please let me know if you do.

Legacy copies

If you made a copy in the past that would have been a "personal copy" if the new law had been in force back then - for example it would have to have been made from your "own copy" and been for individual private use - then that copy is now a personal copy.

Those old mix tapes that people made will become (on 1st October) "personal copies" and so may be lawfully backed up etc provided of course the mix tape was made from their owners "own copy" etc. Oddly the making of the copy (in the past) is still an infringement and so a copyright owner could, in principle, sue you for making private copies in the past, but nothing can be done about your use or possession of them now.

What about compensation?

One objection to these regulations raised by some rights owners is that there should be provision for them to receive some form of compensation for the private copying.

The power used to make the regulations derives from article 5(2)(b) of the Information Society Directive (2001/29/EC) which allows member states of the EU to provide for exceptions to the "reproduction right" (i.e. the right to copy):

in respect of reproductions on any medium made by a natural person for private use and for ends that are neither directly nor indirectly commercial, on condition that the rightholders receive fair compensation which takes account of the application or non-application of technological measures referred to in Article 6 to the work or subject-matter concerned

This would appear to mean that some form of "fair compensation" is required. In many EU countries this takes the form of a levy, for example on CD's, that is then distributed via collecting societies.

But recital 35 of the directive says that in assessing the level of fair compensation "account should be taken of the circumstances of each case" and "In cases where rightholders have already received payment in some other form, for instance as part of a licence fee, no specific or separate payment may be due.". The argument made by the UK government is that because private copying is restricted to a lawfully acquired work, the rights owner will have already priced in any private copying when charging for that access and so there is no need for any further payment. The level of "fair compensation" is nil.

Whether this argument is likely to be challenged by any part of the copyright industry I do not know. Given that private copying, of the kind that will be permitted by section 28B, is almost universal, it is hard to believe that these regulations will impose any further, quantifiable, loss on rights owners. It seems tome that the very limited private copy exception should not entitle rights owners to any further compensation. We shall see.

Copynorm survey - answering some questions

2014-02-12T11:14:00.002+00:00

Thank you for everyone who has responded to the survey so far. I have just short of 500 responses, it would be really great to double that before the survey closes, so please share with your friends.

The survey has generated a lot of comments and I think I owe it to those who have bothered to comment to collect together some of their questions and address them here. Unfortunately I can't discuss the thinking behind the questions - otherwise I might bias the answer - and so I won't talk about specific questions.

The unexplored

There are a lot of interesting areas that I have left unexplored. That is deliberate. In order to keep the survey reasonably short and within various technical constraints I had to pare down the range of things I explored considerably.

Penniless artists

For example: does the status of the creator of the work make a difference? Some people do seem to think that a very wealthy rock star has less right to complain about copying of their work than a penniless artist: others disagree. It would be very interesting to know what difference that made and I considered asking questions to explore that distinction. Unfortunately those questions had to be cut.

A similar example is given by a commenter known as Julian:

... if the artist gets paid 0.02p out of a £15.99 product, or is dead, then it's a little difficult to argue that copying the CD counts as stealing from them.

Intention

It is often asserted that people who illegally download music (in particular) are more likely to buy music than people who do not. I have no idea whether that is true, but there is clearly a view that it is OK to circumvent a publisher and download something without paying if you are "testing" the work out. Provided you actually buy a copy if you keep it, then you have done nothing wrong.

An anonymous commenter said:

in the situation where [someone] wants to listen to an album but doesn't want to pay for it, while I marked that I thought it was OK, there needs to be a little nuance there. If he wants an album so he can hear it and decide whether or not he likes it and is willing to spend money, that's totally fine. If he wants it specifically so he doesn't ever have to pay for it, that's a problem.

This was another of the questions I wanted to ask but fell on the cutting room floor.

The law

One of the main aims of this survey is to find out what people think is acceptable not what people think is legal. But that causes a problem for some people who believe there is inherent value in obeying the law whatever their own morality might be.

"James" says:

whilst I believe that the law relating to copyright, patents, trademarks and other forms of so-called "intellectual property" ought to be drastically liberalised, I believe that people ought to obey the law even though they disagree with it this distinction is not recorded by the survey

James's position is to give what philosophers call "deontological value" to the law. His concern is that the survey doesn't capture that distinction.

In fact I am in roughly the same position as James. As a child I was enormously influenced by the character of Sir Thomas More as brilliantly portrayed by Paul Scofield in Fred Zinnemann's A Man for All Seasons and in particular by the following quote:

William Roper: So, now you give the Devil the benefit of law!
Sir Thomas More: Yes! What would you do? Cut a great road through the law to get after the Devil?
William Roper: Yes, I'd cut down every law in England to do that!
Sir Thomas More: Oh? And when the last law was down, and the Devil turned 'round on you, where would you hide, Roper, the laws all being flat? This country is planted thick with laws, from coast to coast, Man's laws, not God's! And if you cut them down, and you're just the man to do it, do you really think you could stand upright in the winds that would blow then? Yes, I'd give the Devil benefit of law, for my own safety's sake!

(courtesy IMDB)

The answer to James is that I am aware that the law affects people's views on right and wrong and I will try to take that into account. If I have sufficient responses from different jurisdictions world-wide (I am hopeful) then I may be able to analyse whether the jurisdiction in which someone lives affects their views.

Gervase Markham also wonders why I don't ask people "do you think this should be legal so you could do this". That would be a fascinating. In fact my first plan for the project was to find out what people thought was or was not legal. I think it would be really interesting to know what people think the law actually is and that seems to me logically prior to asking them whether they want the law to be changed (you can't want to change the law if you don't know what it is).

All I can say is that what my supervisor and I ended up thrashing out was different. However if anyone wants to help out with a survey of that or something else of interest later in the year, I would be very interested in suggestions (see my remarks at the end).

Charles Oppenheim says:

Another problem with the survey is that, assuming the changes go through, UK copyright law will permit some of the actions outlined in the survey that are currently illegal.

That may be right (there's a lot of "it depends") and if people would like me to I would be happy to produce an analysis of all the questions and their legality once I am finished with the dissertation.

The world as it is

Reuben Thomas is unhappy that his answers may not reflect his true belief.

I said "yes" to almost every part of every question, but that does not mean that I think that it's good if everyone copies and shares everything; it's rather that the current situation is bad in so many ways.

He then goes on to give a number of situations where (to paraphrase) the market is distorted, which in turn may justify behaviour that would not be justified if those distortions were not present. Origami Girl and Saxon Christopher raise similar points.

My hope was that people would understand the survey to be about the world as it is with all its perfections and oddities. I wanted to avoid being overly abstract. I thought that concrete "real world" situations might bring clearer answers. Whether I am right about that remains to be seen. However the point is taken and, if I had more space, would be something worth exploring.

Ethics

Paul and Gervase both suggest asking a question along the lines of "would you do this?". That would be a logical since I ask what other people would do, why don't I ask what the person answering the survey would do. The simple answer is that I am constrained by university rules on ethics. If I ask whether someone would do something that may be unlawful (or in some places and cases criminal) that is very much more intrusive than asking them what they think is OK. It is also very close to asking them "have you ever done this?", which would be an even more intrusive question.

Much as I would like to know, I have had to avoid questions like this altogether.

Free text

I considered allowing free text comments in the survey (either for each question or for the survey as a whole). Maybe I should have allowed them as an option. I was keen to keep things short and simple and I thought the value of adding free text might be less than the cost in additional cognitive load on people answering the survey.

Given the very interesting questions and comments from people on completion, maybe that was a mistake and I should have added something to let people express their frustration at the narrowness of the categories offered (something I struggle with in surveys) and to offer me the benefit of their wisdom. I am grateful that so many have bothered to add their comments to the survey.

Finally

Thank you for all your comments. I am sorry if I haven't (yet) addressed something you have said. I am really grateful for all the feedback.

One of the main themes seems to be that I didn't answer questions people wanted answering. I hope to have this dissertation done and dusted by May / June, but I will still have some time left on my surveymonkey subscription so if anyone wanted to do the hard work of canvassing people to answer another more detailed survey, or a survey about other things (eg what you think the law should be) I would be more than happy to offer legal, technical and statistical advice and support.

I think we know far too little about what the general population thinks about copying and the law, so the more the merrier. Maybe a kickstarter to raise funds to buy a properly sampled audience is something to try.

I hope to be able to publish the data in open data format and some commentary on the final results later in the year, but for now please keep sharing and let's see if we can hit 1,000 respondents.

Copying, sharing and remixing - what do you think?

2014-02-10T22:49:00.001+00:00

I am completing a part-time LLM (masters) in computer and communications law with Queen Mary University London. I would really appreciate your help in completing a survey. It should take less than 5 minutes to complete. If you want to know more about the survey, read on...

I, like many lawyers, spend a lot of time thinking, talking and writing about intellectual property law and, in particular, copyright. But law is not the whole story. People do what they do for all sorts of reasons: what the law says is only one of them.

People may also be driven by socially accepted rules of conduct known as social norms. In simple terms: what they think is OK. Norms are complicated things. For example you may have your own views about what is OK, but you might also pay attention to:

what you think other people think is OK
what you think other people actually do

Obviously law affects social norms. I'm sure it would be a fun an interesting exercise to find out what people think they are allowed to do by the law. But that is not what I am trying to find out - this time anyway.

For my research I have created a to try to find out something about social norms for a number of common situations where someone might want to copy, share or remix an existing work. I hope that learning what people actually think will be illuminating.

I would therefore be extremely grateful if you could try the survey out for yourself and also pass it on to as many of your friends, relatives, colleagues (and really anyone else you know) as you can.

I hope to post the results of the survey in July of this year (2014) and discuss some of the results as they come in. For now I won't say any more about the design so that I do not influence you when you fill it in (which I am sure you are going to do). If you don't want to read my other blog posts restrict yourself to the tag copynorms.

Here is the link for the survey again in case you missed it.

Open up data about justice

2013-09-25T15:03:00.000+01:00

Very recently the government published the Shakespeare Review on open data. I have recently been told that:

The government, in response to the Shakespeare Review of Public Sector Information, has committed itself to publishing a core reference dataset, listing unpublished datasets together with a schedule of release. Government departments have been going through a process of identifying the data they hold and prioritising their release.

What I am given to understand is that we should all be telling the Government, right now, that particular datasets need to be released.

As a lawyer, I am particularly interested in information about the workings of the court system. data.gov does not appear to allow me to search for unpublished datasets belonging to the court service only, but it does allow me to pull up unpublished datasets for the Ministry of Justice.

I am not entirely sure what is there or how useful it might be. For example there is a case management system called caseman that is used by county courts. I suspect that there is a lot of potential in opening up that dataset, but it is hard to tell without more information.

There is even a dataset described as:

Tribunals Service Case Management systems including: ARIA, ETHOS (and Caseflow), GAPs 2, MARTHA, CICA and a set of SQL and Access based systems, and manual case records.

I have told the MOJ that they might as well have described this as "stuff" for all it really helps me. But it is quite possible there is much of interest there too.

Each dataset allows (signed up users) to give feedback on release of the data. Feedback is supposed to be focussed particularly on economic and social growth - nothing persuades governments like "if you release this dataset, there will be a £100M growth in GDP".

Sadly, to date, almost all the interesting datasets have attracted no comments at all. I wonder whether this is to do with lack of publicity or whether people (like me) feel that it is difficult to make concrete comments on datasets about which they know nothing. If any reader of this blog feels strongly about open data, can I invite you to give feedback on some (or all) of these datasets.

Note: I have blogged elsewhere on this topic already with a slightly different emphasis.

Orphan Works - the new law in the UK

2013-05-03T15:41:00.002+01:00

My social media feeds have been full links to alarmist stories about a recent change to UK copyright law that allows for the licensing of orphan works. Photographers have been particularly concerned after one site (which I won't dignify with a link) used the headline "ALL your pics belong to everyone now". So much alarm has been created that the UK's intellectual property office felt moved to publish a PDF debunking some of the myths that have arisen. I was waiting until the Enterprise and Regulatory Reform Act 2013 was published on the government's legislation website before making my own comment.

The problem of orphan works is well known. Copyright lasts for a long time. In the UK it will usually be for 70 years after the death of the author. Discovering the author of a work to discover whether it is, or is not, protected by copyright can be difficult, let alone discovering the present owner of that copyright in order to ask them for a licence. The effect of that is that many works are either not used, or used only by organisations that care little about copyright on the ask forgiveness not permission principle.

There are radical solutions to this problem, for example we could require that copyright owners register their copyrights in order to enforce them, as the United States did until relatively recently. Or we could adopt William Patry's more modest proposal where no registration would be required for an initial, but relatively short, copyright term. To extend the life of a work's copyright, the copyright owner would be required to register. Such a system would make it very easy to discover who was the owner of a work older than the short initial period of copyright, but of course there would be administrative costs associated with it. Legislators have been more timid in their response.

The European Directive

One solution that has already been enacted is the European the orphan works directive (2012/28/EU), although the UK does not have to transpose it into UK law until 29 October 2014.

The orphan works directive is an exceptionally modest provision. Its beneficiaries are public libraries, education establishments, museums and archives. Any institution wishing to use an orphan work must first carry out a "diligent search" in good faith from "appropriate sources". The directive itself lists some "appropriate sources" which would have to be searched, but member states may add to the list, which varies depending on the type of work involved.

Records have to be kept by the institutions of their diligent searches which must be sent to their national government which in turn must make the results available on a publicly searchable website (good to see that governments are beginning to understand open data). This ought to make it easy for copyright owners to discover whether one of their works has been designated as an "orphan" and, having found out, make sure that oprhan status is rescinded.

Institutions may only use the works to achieve their "public-interest missions" and may only charge in order to recover costs of copying or making available to the public. They may not exploit the works commercially.

Canada

The orphan works directive tries to maintain the broad integrity of copyright by delegating the task of carrying out a diligent search and managing the orphan works system to trusted public institutions. By contrast Canada has been using an orphan works law which relies on a central authority, theCopyright Board of Canada.

Section 77 of the Canadian Copyright Act 1985, entitled "owners who cannot be located", requires anyone seeking a licence for what we call orphan works to satisfy the Copyright Board that they have made "reasonable efforts to locate the owner". The Board may then issue a non-eclusive licence on any terms it chooses to specify. According to their brochure they will usually require the payment of a licence fee, which will be paid to a collecting society. If the owner of the copyright appears within 5 years of they expiry of the licence, they may claim the licence fee. Where the fee was paid to a collecting society, the society will pay the owner.

The Board do not issue very many licences - roughly 22 a year since 1990. Not all applications for a licence are accepted. Whether "it works" in Canada I do not know, but copyright has clearly not come to an end there.

The United Kingdom

So where does that leave us? Section 77 of the Enterprise and Regulatory Reform Act 2013 introduces a new section 116A of the Copyright, Designs and Patents Act 1988 concerned with orphan works. Section 116A is a mere skeleton. It allows the government to make regulations that would allow someone (an authorised person) or alternatively some people to be chosen by someone designated for the purpose, to grant licences to orphan works. The content and circumstances of the licences we do not know. All we do know is:

a work will not be an orphan work unless a diligent search is made for the copyright owner
what counts as a "diligent search" will be defined in the regulations
the licences may not be exclusive
nor may they be granted to a person authorised to grant licences

Now in theory this means we could end up with a Wild West system where there was little real control over licensing of orphan works. The regulations could be very lax on what counted as a "diligent search" and very generous about the licensing terms. That is always a risk with open-ended legislative provisions (and why they should not be used by Parliament).

The reality, according to the intellectual property office, is that we will end up with something similar to the Canadian system. Licences will not be free. Copyright owners will be able to claim fees that have been paid. There will almost certainly be a fairly tight and prescriptive description of what counts as a "diligent search". It will not be enough simply to look at the metadata on a photograph, shrug one's shoulders, and go ahead.

Extended Collective Licensing

In parallel to section 116A is a new 116B which will allow collecting societies in sectors where they now organise (eg books and music) to be given permission to license works that they do not have any existing right to license - eg where they do not own the rights and the author has not given the society permission to license them. This is not an orphan work provision. It applies even though the society knows full well who the author of a work might be. I mention it because it has been mixed into some of the reports about the orphan works provisions.

I have my doubts about extended collective licensing, but it will at least be an "opt out" system. No-one has to participate if they do not want to. In a sector where most licensing is direct (author to user) such as photography, there may never be such a system as the intellectual property office has indicated.

Consultation

The intellectual property office tell me that there will be extensive consultation on the detail of any regulations. Anyone having an interest in these provisions should make sure they engage with the consultation or join with others to represent them collectively. I am sure the open rights group will be making representations.

The defamation bill 2012 and the web

2012-07-03T18:41:00.000+01:00

I have already commented on one aspect of the Defamation Bill 2012 that is directly aimed at operators of websites, but there are two other provisions, in the current draft (in the public bill committee) at clauses 8 and 10, which have a bearing on the way we do things on the web and which I do not believe have been properly thought through.

The host's nightmare

As soon as you allow other people to contribute material to your website, whether by comments to a blog, forum posts or something more substantial such as a wiki, you risk being held accountable for what they say. Even if you could rely on one of various defences, such as the "hosting" defence in the e-commerce directive, if a potentially defamatory comment has been brought to your attention, you are put in the invidious position of deciding whether to remove it or be prepared to defend your decision to allow it to stay. The various intermediary defences only go so far. If you bravely decide to keep it there, you may find yourself having to defend the statement itself. But of course if its not your statement, you may find that very difficult to do.

Last year I highlighted the problem this can cause for WhatDoTheyKnow but this is a problem that can affect vast numbers of website providers and of course any upstream posts they have. Surely this needs fixing?

What ought to happen?

Suppose someone - call them X - finds that a really damaging, but false, allegation has been made about them on a website run by Y, which will, or at least is likely to, cause X harm but the statement was made by someone else - call them Z. Y acting as an innocent host (forum operator, blogger etc). It seems right that X should be able to do two things:

have the statement removed, or at least corrected in some way
be compensated for damages for any harm they have suffered

These are two quite different things. It is only someone who is, in some sense, at fault for making the false statement who should be responsible for any compensation - where we can argue what "at fault" might mean. But, merely because someone ought not to be liable to pay damages for a damaging and false statement, does not mean they should not be responsible for removing it in any possible circumstances. For example, if X were able to prove in court that the statement was false - more than a claimant in defamation has to do right now - and satisfy the court that the statement should be removed at X's expense, then it seems hard to believe that X should have no way to compel Y to do so.

The defamation bill breaks this simple idea in at least two places.

Clause 10

The existing clause 10(1) says:

A court does not have jurisdiction to hear and determine an action for defamation brought against a person who was not the author, editor or publisher of the statement complained of unless the court is satisfied that it is not reasonably practicable for an action to be brought against the author, editor or publisher.

What this seems to be trying to do is to force claimants to go after the "real" culprit than an innocent intermediary. X must sue Z not Y. That seems entirely reasonable if we are talking about a claim for damages. If X can sue Z then they should get on and do it. But it may be utterly useless if X wants to prevent the continued publication of the statement. For example if X is able to sue Z and obtain damages but Y has closed Z's account (Z clearly being a troublemaker) then it is useless for X to obtain a court order against Z to stop the publication. Z no longer has the power to do so. Only Y can remove the statement, but X cannot sue Y - the court has no jurisdiction to hear their claim.

I do not believe this is what clause 10 is meant to do but as far as I can see, that is its effect.

The single publication rule

The bill also addresses a much older controversy, that goes back to the odd case of Duke of Brunswick v Harmer (1849) 14 QB 185. Charles II, Duke of Brunswick does not seem to have been a very nice man. He was drummed out of Brunswick and his duchy taken over by his brother. While living in Paris he sent a servant to collect a newspaper article about him in the archives of the British Museum. Although the limitation period since the article had been first published by the newspaper had long run out, he successfully sued for libel on the basis that there had been a fresh publication, to his servant, of the article when he had gone to collect it from the museum.

This rule has received lots of criticism over the years. See, for example, a Guardian article from 2005 suggesting that it threatens the internet. Newspapers that keep online archives have been particularly concerned. The limitation period for libel is one year after which time a newspaper editor could, potentially, breathe a sigh of relief, but if each time someone accesses an online newspaper archive there is a fresh publication, liability could last forever.

As an aside, the worst part of the Duke of Brunswick case has always seemed to me to be the fact that the Duke himself organised the publication to one of his servants. It seems unfair to allow someone to engineer an actionable wrong against themselves for which they can be compensated. Thankfully the world has moved on. Today the Duke of Brunswick's claim would almost certainly be struck out as an abuse of process because it fails to show a substantial tort, see Dow Jones v Jameel [2005] EWCA Civ 75.

It turns out that the multiple publication rule probably doesn't threaten newspaper archives. The Court of Appeal did not believe so in Loutchansky v The Times and the European Court of Human Rights, in the circumstances, agreed. Clearly there could be problems with a newspaper threatened with a libel action for an article published so long before that it would be difficult to defend, but if that were to happen, the newspaper's article 10 rights ought to permit the court to strike it out - at least the European Court of Human Rights seemed to think that is what ought to happen. I suspect our courts would agree.

The other concern about archived material was that once a defamation claim had been upheld, the article would have to be removed, changing the past in Orwellian fashion. Not so (it seems). All that is needed is the attachment of a short "Loutchansky" notice to the article indicating that its contents are disputed.

For example:

“Legal Notice 30 July 2009: Mr Budu denies that he was an illegal immigrant. He was granted indefinite leave to remain in the UK on 23 June 2004.”

appears on a BBC news report concerning the claimant in Budu v BBC and seems to have been sufficient.

It seems to me that the multiple publication rule is not as quite as broken as many commentators suggest, but nevertheless, I can see that it is something that might need further though. The Defamation Bill seeks to "fix" it.

Clause 8

Clause 8 essentially abolishes the rule in the Duke of Brunswick case. It applies where anyone:

publishes a statement to the public (“the first publication”), and
subsequently publishes (whether or not to the public) that statement or

a statement which is substantially the same.

In which case the one year provided for in the Limitation Act 1980 starts running at the first publication. It does not start running again at every subsequent web access.

The authors of this clause clearly had in mind newspaper archive style publication where the first publication is made in a blaze of prominence and later publications (via the archive) are simply parasitic on the first. A claimant, they obviously feel, has had an opportunity to make their complaint when the publication is first made and should not be able to challenge it later. For paper news that is later electronically archived I can see that might make sense.

But the web works differently. Many things are published in obscurity. In theory they are available to the world, but often search engines do not find them or at least consign them to many pages down the search results which is effectively the same thing. Sometimes something then happens to force the obscure into the limelight. A blog-post or an article might be found by someone influential and re-posted, re-tweeted or otherwise given more juice. It is at that moment that an obscure defamatory comment might come into the limelight and cause its subject problems.

As far as I can see clause 8 completely ignores the way the web actually works and relies on first publication being the most prominent. It gives a nod to a change in circumstance in 8(4) which says:

This section does not apply in relation to the subsequent publication if the manner of that publication is materially different from the manner of the first publication.

But in my example the manner of publication has not changed. It is the way the web links to it that has and that is all important. The limitation period for defamation can be waived by the court in certain circumstances, so clause 8 might not be an absolute bar to a claim, but in my view it would be much better if the whole provision had been thought through properly bearing in mind the way the web now operates.

The Communications Data Bill (first look)

2012-06-17T20:48:00.001+01:00

On Thursday the government announced the Communications Data Bill. The official copy is available as CM8359 but the open rights group have made it available in in an easier to read format. The bill has attracted a lot of interest, so I thought it would be useful if I posted an explanation of what it does and does not do. Bills of this kind benefit from (or suffer, depending on your point of view) considerable amendment while passing through Parliament, so the end product may be very different.

The bill replaces two existing pieces of legislation: chapter I, part II of the Regulation of Investigatory Powers Act 2000 (RIPA) and part 11 of the Anti-terrorism, Crime and Security Act 2001 (ATCSA). For some what will be of interest will be the ways in which the bill changes that existing law, but for others that law is already controversial, so they may see debates on the bill as a chance to re-visit the state we are in.

Communications data

Chapter I, part II of RIPA is all about allowing public bodies to obtain "communications data". The bill and RIPA use essentially identical definitions of communications data (RIPA s22(4) Bill cl.2(9)), which the bill helpfully divides into three parts:

traffic data - which includes the identity and location of the communication's end-points and the individuals (if any) sending and receiving it;
use data - information which is not traffic data about the use made of a telecommunications service or in connection with the use of a telecommunications service or system;
subscriber data - any other information obtained by the provider of a telecommunications system about the people to whom it is provided

But, in both cases, not the content of any communications. Traffic data may include the contents of a communication, in so far as it is "traffic data" but "use data" may not.

The definition is very broad. In RIPA terms a "telecommunications service" is:

any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service)

A "telecommunications system" is:

a system (including the apparatus comprised in it) that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electro-magnetic energy

This definition clearly includes radios and televisions; telephones and mobile telephones and routers. It almost certainly includes mail servers. I am less sure about a server which has multiple roles - since it might be difficult to say that it "exists .. for the purpose", but anyone running a server which acted as a mail transfer agent or on which ran a mail user agent (eg gmail) would surely be running a telecommunications service even if the server itself was not a telecommunications system.

This means that subscriber information and usage patterns of facebook, gmail and so on are already within the scope of RIPA. The bill uses almost identical definitions for telecommunications services and systems, which suggests that exactly the same sets of data will be in scope.

Obtaining communications data

The RIPA regime for obtaining communications data has essentially two parts:

authorisations - given by a "designated person" to other members of their organisation or suitably associated organisations (eg collaborating police forces), who are then "authorised officeers". The effect of an authorisation is to make lawful, including removing any civil liability, anything an authorised officer does while obtaining communications data under their authorisation.
notices - given by a "designated person" to postal or telecommunications operators, requiring them to obtain (if they are able to) and disclose communications data

Authorisations and notices last up to a month but may be renewed.

The bill has a broadly similar structure with, as far as I can tell, a few changes:

First, an authorisation (given by a designated person) may authorise an authorised officer to give notice to telecommunications operators (cl 9(3)(d)) in contrast to RIPA where it is the designated person who may give notices (s21(4)). In other words the power to force telecommunications operators to obtain and cough up communications data appears to be delegated further down the tree. I do not know enough about how RIPA is operated within police forces to know whether this will make any practical difference.

The second change is more significant. In RIPA a "telecommunications operator" is someone who "provides a postal or telecommunications service" (s25(1)). The definition in the bill (cl 28(1)) extends "operator" to include not only those providing a service but to any person who "controls or provides a telecommunication system".

In theory that means that anyone who owns a mobile telephone (or radio or television) is a "telecommunications operator", so that, in theory, the government could order us all to keep records of who watches any television we control. While any government doing so would look extremely stupid - and find themselves out of office very fast - the increase in reach has other more usable implications. For instance it extends to manufacturers of communications equipment, who might usefully be asked to install hardware or software to make interception easier. It will be much harder to say that particular data is out of scope.

Retaining data

The power to obtain communications data from communications operators is only of any use if there is data to obtain. At present the main provision for requiring retention of communications data is the data retention directive. This is directed at "providers of publicly available electronic communications services or of a public communications network" (article 3) who are defined (in the framework directive) in relation to services consisting of the transmission of signals over networks. In particular the obligation does not apply to those (like gmail and facebook) who provide "information society services".

Part 11 of ATCSA, which I mentioned earlier, did give the government a power to pass secondary legislation requiring communications providers (as defined in RIPA) to retain communications data, but only for national security purposes. The power had a sunset clause which meant that if, after two years, the government had not exercised the power it would lapse which it did on December 14 2003.

The bill will change all that. Drastically. Clause 1(1) of the bill states:

(1) The Secretary of State may by order—

(a) ensure that communications data is available to be obtained from telecommunications operators by relevant public authorities in accordance with Part 2, or

(b) otherwise facilitate the availability of communications data to be so obtained from telecommunications operators.

Other than that, there are no restrictions on what the order may do. All the limitations are procedural (consultation, laying before Parliament). This means that the government may do pretty much anything that is at least rationally connected to ensuring that communications data is available. If there was any doubt about this, the rest of clause 1 spells out just how wide the power is, for instance:

requirements ("you must") or restrictions ("you must not") may be imposed on anyone;
the Secretary of State may be given a power to impose requirements and restrictions on anyone by notice
those requirements may include forcing the use of particular software, equipment or algorithms
any requirements may be aimed at a different communication provider's data (eg an out of UK mail provider that does not wish to help the UK government might be targeted by asking ISP's to monitor usage of the site)
telecommunications operators can be made to contract out compliance with the government or with private firms, including "on a commercial basis", eg the government could nominate a private contractor that would store data on behalf of ISP's and force ISP's to hire them to do so commercially.

It seems to me that clause 1 is just too wide. It allows far too many things. There are essentially no restraints to stop a determined government doing what it wants. The requirement for Parliamentary approval (for instance) is in practice of little weight. Secondary legislation is almost never refused by Parliament and there is no mechanism for amendment to an order that has been laid before the house.

Filtering

Clause 14 (and following) referring to "filtering arrangements" seems to have caught many people's eyes. The explanatory notes suggest that the government intends to run a great big "Request Filter" which will collate communications data from many different sources and also act as a useful front end for designated officers, for example to work out what questions to ask, what sort of results will be obtained and to extract the communications data required.

As a part of the legal analysis I'm not sure that the provisions concerning "filtering arrangements" are particularly interesting. They make it clear that the Secretary of State can run a system like the "Request Filter", but they don't give the government any more powers to obtain data - those are all to be found in clause 1. Clause 14 etc may be there to ensure that no-one challenges the creation of a Request Filter on the grounds that it is beyond the powers (ultra vires) of the Secretary of State's office to maintain it.

But the filtering arrangements are interesting in that they give us a clue of one of the things the government has in mind.

Conclusion

In short the bill is all about increasing the amount of communications data that the authorities can get hold of. It does this in two principle ways: (1) by giving an essentially unlimited power to the government to order anyone to do anything rationally connected with that aim (and presumably proportionate and human rights compliant - though that may result in much time-consuming litigation); and (2) by widening the scope of people who can be asked to give up communications data to anyone who controls any communications equipment - in practice almost everyone old enough to own a mobile telephone.

There are a few other bits and pieces in the bill I have not mentioned, for example a requirement for local authority officers to obtain judicial approval for authorisations and a certain amount of tidying up.

It is almost impossible to have a sane debate about this sort of law because, as always, the government are likely to say "but we will only use our powers for good". What is more the bill, if passed, won't do anything particularly bad itself that badness is merely a potential badness that allows for misuse of the power at a later date. Again governments will swear on their mothers' that they will only pass just and sensible secondary legislation.

I hope this short post will inform the debate.

Trolls and the defamation bill 2012

2012-06-12T23:02:00.001+01:00

The Defamation Bill 2012 had its second reading in the House of Commons today. One aspect of the bill which did not (as far as I can see) appear in the draft bill is a rather peculiar defence for website owners. In characteristic style, the BBC picked it up under the title websites to be forced to identify trolls under new measures and mangled the story completely.

The BBC's report mentions the case of Nicola Brookes, who appears to have been the victim of vicious trolling on facebook. It is reported that she obtained a court order forcing facebook to reveal the IP addresses of its users who harassed her anonymously using the site. I have no further details of that case, but it would seem to be an entirely conventional Norwich Pharmacal order used by Nicola Brookes in order to bring a prosecution for breach of the Protection from Harassment Act 1997. Her case has nothing (much) to do with defamation which is not a crime as implied by the BBC.

Her case is an illustration of the fact that there is already a fairly well tested power to force intermediaries, including social networking sites, to reveal the identity of wrongdoers (criminal or civil) by court order. There is no new power to do this under the defamation bill.

What the defamation bill has done is introduce a new defence for some intermediaries - "website operators". In the current draft of the bill, clause 5 applies where "an action for defamation is brought against the operator of a website in respect of a statement posted on the website." The operator has a defence is they are able to show that it was not them that posted the statement on the website.

I'm not exactly sure what "posted" means in this context. Does it include (say) the FOI responses of public authorities on www.whatdotheyknow.com? The public authority is the immediate cause of the appearance of a statement on the site, but the actual transfer from incoming email to web page is done by the site's own software. This does matter. It would be great if sites like whatdotheyknow had a defence against material they manage, but they are unlikely to want to test the matter in court.

In my experience these kinds of semantic difficulties are often sharpened up later on in a bill's passage. I hope that happens in this case.

The defence is not an absolute one. It an be defeated if three conditions hold:

the claimant could not identify the person making the complaint
the claimant gave the operator a notice of complaint relating to the statement
the operator failed to respond to the notice of complaint in time

Where the content of the notice, what is "in time" and what an operator is required to do in response are to be specified in a regulations made later with an inevitably reduced level of parliamentary scrutiny, although the notice will be required to specifically point to "where on the website the statement was posted". Surprisingly many "take down" requests my clients receive don't even go this far.

So, lets be clear, there's nothing here that requires the website owner to do anything unless they want to. The sanction for non-compliance is that they lose a defence to a libel claim. But website owners already have a number of common law and statutory defences. In particular they are protected by Article 14 of the e-commerce directive. This is an absolute defence against almost any liability a website owner might have for information supplied by a third party provided that either:

they don't know about the illegality or
once they do know they act "expeditiously" to remove the information

This has never been a very good defence since the host has to make up their mind whether or not they know about the illegality, but of course, how can they know? If it is information supplied by a third party they may have no idea. The European Court of Justice has been relatively generous about "knowledge" in this context - being well aware of the difficulties the host may have - but in the context of defamation it is always going to be a tough call. The fact that something looks defamatory ought to be obvious in most cases just by reading it.

So the proposals in clause 5 might have the effect of persuading website owners to give up the identity of anonymous users of their site as a result of general fear, uncertainty and doubt. On the other hand there will be nothing to stop them removing the material if they prefer to do so.

My views of the bill roughly echo those of the Inform Blog. Some of the "reforms" may even make things worse since they copy (into statute) things the courts are doing already, but none of us will be entirely sure whether that copy was, or was intended to be, perfect, so there may be yet more litigation to sort that out. Why we need to enact reforms the courts have already worked out for themselves seems puzzling to me, but I am not a politician.

As things stand the proposed clause 5 has a number of oddities.

First, there's nothing that penalises false use of a notice of complaint, nor is there anything allowing the regulations to impose sanctions on a claimant who misuses the procedure. In my view that should be fixed.

Second, if the claimant can already find out the identity of an anonymous troll (via the Norwich Pharmacal procedure), why do we need to qualify the website owner's defence at all? Sure, a Norwich Pharmacal order is expensive, but then so is a libel claim.

Third, and most odd of all, the new clause 5 would give an absolute defence for any comment which was from an identifiable individual. As it stands if I, under my own name, post the most unpleasant libel to a website hosted in the UK, the victim of the libel can sue me but cannot sue the website. But suing me may not be what the victim wants - I might be dead, have no money or have run away to another country where they cannot catch me.

What a victim will often want in such cases is for the libel to go away and/or be corrected. They want some way of having the libel taken down. As it stands clause 5 may take away the victims power to do that since the website owner will have no liability in defamation at all. In some cases (eg blog comments) even I may not be able to remove a publication I have made, so a court order against me (the guilty party) may also be useless.

I am not sure that is what intended and expect that the wording will be tidied up considerably if the clause goes forward but I still doubt very much that it is the right approach.

Copyright in industrial art - more protection

2012-05-24T21:46:00.000+01:00

The problem with copyright is that it isn't strong enough - are words you are unlikely to hear me say. Today clause 55 of the Enterprise and Regulatory Reform Bill brings us an amendment to a fairly obscure corner of the Copyright, Designs and Patents Act 1988.

UK Copyright law has always had a somewhat awkward relationship with 3 dimensions. Graphical works, sculptures, collages and photographs are all protected "irrespective of artistic quality". Apart from sculptures, copyright also protects works of architecture (buildings and models for them) and works of "artistic craftsmanship". The latter category appears to be a fairly narrow one, though exactly how narrow is unclear.

Instead, UK law offers an alternative protection in the form of various design rights. There are actually 4 of these - design right, registered designs, and community unregistered and registered design rights. All of these are different to a greater or lesser extent, protecting different things, in different ways for different periods of time.

Inevitably there are overlaps between the two sets of rights. The Copyright, Designs and Patents Act 1988 does a certain amount to keep the two spheres of art and design separate. For example section 51 prevents the making of a object to a design from being an infringement of the design document. But it is section 52 that interests us today.

Section 52 deals with the situation where an artistic work has been exploited in the making of articles by an industrial process and marketing them in the UK. At the end of 25 years after the articles are first marketed, it ceases to be an infringement of copyright to copy the work by making articles (of any kind) or doing any thing for the purpose of making those articles (for example by producing preliminary design drawings). The articles may also be sold to the public and otherwise dealt with without infringing copyright in the original artistic work.

Section 52 is supplemented by the Copyright (Industrial Process and Excluded Articles)(No. 2) Order 1989 which, amongst other things, excludes certain kinds of article from its operation. For example, exploiting an artistic work by making a sculpture would not engage section 52 and hence would not weaken copyright protection after 25 years, which is one of the reasons why the question of whether a storm-trooper's helmet was a "sculpture" was considered by our Supreme Court in Lucasfilm v Ainsworth (see from paragraph 29). Many more literary or artistic articles are excluded as well such as greetings cards, book jackets and stamps (you can read the whole list in regulation 3).

In other words, an artistic work is protected by copyright, but if its owner stoops to allow its industrial exploitation then, in that sphere, it is given a period of protection akin to that of a registered design.

What section 52 does not do is shorten the period of copyright protection, it merely weakens the protection copyright gives. A clear example of this appeared in Jules Rimet Cup v Football Association [2007] EWHC 2376 (Ch) which was a dispute about the registration of a trademark in World Cup Willie. The court had to decide (amongst other things) what effect section 52 had on the Football Association's copyright in the image of World Cup Willie. It had been the subject of considerable exploitation, but the court decided that, while section 52 would allow the making of many kinds of World Cup Willie articles, it would not allow the making of excluded articles (such as the sculptures, stamps and greetings cards mentioned above). To do so would still be an infringement of copyright.

An example (stolen from Copinger) demonstrates how section 52 works. Suppose an artist drew a picture of an iconic vehicle - lets say a car- in a comic strip. After 25 years of marketing models of the car as merchandising, the artist could no longer use copyright protection from preventing others making rival versions of the car, but the artist could still stop the making of stamps, greeting cards and, most importantly, comic books based on the original drawings.

The proposed clause 55 will do away with all that. The artist would, if the clause passes, be able to sue any imitator of the car for copyright infringement. Clause 55 therefore represents a further extension of copyright, albeit in a rather subtle way.

The coverage of the proposal has been rather patch. The Design Council say:

We understand that the Bill will repeal section 52 of the Copyright, Designs and Patents Act 1988, which currently restricts copyright to 25 years (calculated from the date on which the work is first placed on the market) on artistic works which are exploited through an industrial process.

Which, you will see, is garbled at best. The Design Council seems to think the clause only applies to "design classics". The government's own press release demonstrates the same confusion:

... extending copyright protection for mass-produced artistic works to life of the creator plus 70 years. These measures will promote innovation in the design industry and encourage investment in new products, while discouraging unauthorised copies

As usual there is an unevidenced claim that there will be a promotion of innovation and of course no comment no the innovation in terms of competing designers seeking to give a new physical embodiment to already exploited artistic works.

All this coverage suggests that at least some of those thinking about the new law are thinking it applies to works of artistic craftsmanship alone, whereas it will apply much more widely than that, even to tins of paint.

Marks: 0/10 for failing to address what impact this will have on the now lawful re-exploitation of industrially produced art.

Newzbin2 - the order

2011-10-26T15:28:00.000+01:00

The High Court has just handed down its order in "Newzbin2".

For those not following the story so far goes like this: newzbin (whose site I will not link to for obvious reasons) describe themselves as a "Hand edited, searchable archive of Usenet binary content from the creators of the NZB Format." USENET is of course the grandparent of most peer-to-peer file sharing networks. People were sharing copyright material via USENET even when I started using the internet over 20 years ago. Newzbin do not host any of the material (which is available via USENET) but their site undoubtedly makes it much easier to find copyright infringing material to be downloaded. Unsurprisingly, many large copyright owners do not like it.

Last year, a group of Hollywood studios persuaded Mr Justice Kitchen that Newzbin were guilty of copyright infringement in three different ways (1) their actions amounted to "authorisation" of copyright infringement; (2) they were also joint infringers with or procurers of the infringement of their subscribers; (3) even though they did not host any of the movies complained about they "made them available to the public" which is an act protected by copyright. The case Twentieth Century Fox v Newzbin [2010] EWHC 608 (Ch) makes interesting reading as it explores just how far a website may (or in that case may not) go without infringing copyright.

Newzbin's reaction was to be expected: their operation moved outside the jurisdiction of the UK courts. Undeterred (one hopes they were sufficiently web-savvy to have anticipated the move) the studios applied to the High Court for an injunction against BT to force BT to block access to Newzbin to its (ISP) customers. The studios made use a statutory power given to the High Court to make injunctions of this kind under section 97A of the Copyright Designs and Patents Act 1988.

At the end of July, Mr Justice Arnold agreed to grant the injunction (Twentieth Century Fox v British Telecommunications [2011] EWHC 1981 (Ch) ). Lillian Edwards wrote a very neat analysis of the decision on the day it appeared. As she explains, Newzbin was an unusually good case for an injunction, not least because there had already been a decision of the High Court finding that the site was involved in copyright infringement. Other cases may be more difficult for rights holders to argue. It will depend.

Mr Justice Arnold postponed deciding on the exact form of the injunction — that is exactly what BT should be ordered to do — until he had heard further submissions from the parties. His decision on the form of order was what was handed down today.

A huge simplifying factor is that BT are already running a system known as Cleanfeed which is used to filter out material on the Internet Watch Foundation's list of suspect IP addresses and blacklisted URL's. This meant the order could require BT to add IP addresses and URL's supplied by the studios to its Cleanfeed list.

Cleanfeed is not used with all BT ISP products. In particular it is not used for what is effectively wholesale supply of internet connectivity, nor to particular customers in certain cases — one example being the police who, one imagines, absolutely do wish to be able to access illegal material for investigatory purposes. The order applies "In respect of its customers to whose internet service the system known as Cleanfeed is applied whether optionally or otherwise". Read literally that would appear to mean that customers who have Cleanfeed as an option but have opted out would still have to be filtered by BT. It is unclear to me whether that is what the judge intends.

The order makes it clear that BT is not required to carry out deep packet inspection. BT need simply rely on the IP addresses and URL's reported to it by the studios, but this, in my view, leads to the most serious defect in the order: it relies entirely on the good faith and judgment of the studios. There is no sanction for mis-reporting of websites. Since there is no requirement to publish the list of sites supplied to BT or to notify site owners that they have been placed on the list, it may be difficult to ensure that the studios act fairly and properly.

BT did try to obtain what is known as a cross-undertaking or an indemnity from the studios which would have compensated BT for any loss it suffered as a result of any mistakes made by the studios. The judge rejected that request on the basis that, as he decided, BT could not be liable for damages (eg by being sued by its customers) because it was acting under a court order. That will no doubt be a useful decision for ISP's and web service providers in other situations, but it did mean there was no basis for imposing any sanction on the studios for supplying incorrect sites in its list.

There was some argument as to how precisely the list should be described. In order to ensure that it would be difficult to circumvent the order, the judge decided that the order would apply to not only the newzbin website itself but also to "any other IP address or URL whose sole or predominant purpose is to enable or facilitate access to the Newzbin2 website". Here we see one of the weaknesses of section 97A. It gives the High Court the power to grant an injunction but it fails completely to say what kind of an injunction that might be. In particular it does not say that the injunction should be restricted to preventing access to sites where copyright is being infringed (like Newzbin). I am therefore concerned about whether the combination of the wording of the order and lack of sanction on studios may cause problems at a later date.

The other significant issue was costs. While costs (which lawyers get very excited about) may not seem as interesting as arguments about what should be blocked and how, costs are often as expensive to a party as the consequences of losing (or winning) a claim. Costs are a big deal. One positive outcome of the decision is that BT was entitled to be paid its legal costs for the first part of the claim up to 16 December 2010 - in other words the costs that would have to be incurred to obtain a court order. In the future ISP's can be reasonably confident that they can demand a court order before instituting website blocking and not expect to have to pay the costs of that order. The judge found that BT should pay the costs of the contested part of the proceedings, but that each party would bear its own costs for the decision about the final order.

In conclusion, I have two points to make: first, it is now clear that copyright owners are perfectly able to obtain quite favourable court orders to block websites, so that there was really no need for the Digital Economy Act 2010 to introduce more website blocking provisions when the existing ones (in section 97A) had not been properly tried out. Second, other cases may not work out the same way as this one. For example TalkTalk do not run Cleanfeed. One expects that the argument (and subsequent order) in a case against TalkTalk might be a little different for that reason. We will see.

Can we force facebook to give us its "like" database?

2011-10-20T09:45:00.000+01:00

Jim Killock of the Open Rights Group pointed me at an interesting response made by facebook to an Irish student named Max's subject access request under Irish data protection legislation which forms a part of the Europe versus facebook campaign.

The particular point that interests me is that, concerns facebook's tracking of all pages visited which show a "like" button - a practice that can be really intrusive. Although Max did obtain a considerable quantity of information, facebook did not release to him their list of "like" tracked data.

In their response facebook say:

Section 4(12) of the Acts carves out an exception to subject access requests where the disclosures in response would adversely affect trade secrets or intellectual property. We have not provided any information to you which is a trade secret or intellectual property of Facebook Ireland Limited or its licensors.

Unfortunately for facebook, that isn't quite what the relevant Irish legislation appears to say (health warning: I am not an Irish lawyer). What section 4(12) of the Irish Data Protection Act 1988 says, according to a consolidated version of the statute, is:

(12) Subsection (1)(a)(iv) of this section is not to be regarded as requiring the provision of information as to the logic involved in the taking of a decision if and to the extent only that such provision would adversely affect trade secrets or intellectual property (in particular any copyright protecting computer software).

Note the phrase "information as to the logic involved in the taking of a decision". What this is all about is that section 4 gives data subject several different rights. One right (in section 4(1)(iii)(I)) is to be supplied with a copy of "the information constituting any personal data of which that individual is the data subject" - a simple right to information. Another, and different right, can be found in section 4(1)(iv) which applies to automatic decision making by the data controller. Here the data subject has a right to be informed of the "logic involve in the processing". Obviously that's quite a different right since it is essentially a right to know about algorithms rather than data.

Quite clearly section 4(12) is a restriction on the right under 4(1)(iv) to know about the logic of automatic decision making and not a restriction on the right of information simplicter. Nice try facebook, but I can't see that working.

Our own legislation is very slightly different. We also have a right (in section 7(1)(d) of the Data Protection Act 1998 to be informed about the logic involved in automatic decision making, but the restriction on that right is limited to trade secrets. Section 8(5) says:

Section 7(1)(d) is not to be regarded as requiring the provision of information as to the logic involved in any decision-taking if, and to the extent that, the information constitutes a trade secret.

So that any UK national involved in the Europe v facebook campaign has a much stronger argument.

In any case, at best facebook can claim a database right over the contents of the list of pages visited by Max that they have collected using the "like" button. The database right is a creature of European law (directive 96/9/EC). Recital 48 of the directive states that "the provisions of this Directive are without prejudice to data protection legislation", which seems to me to argue that data protection law ought to trump database right. If you think about it, the contrary would be an impossible situation. Personal data will often be protected by database rights. If you could use database rights to avoid subject access requests they would be of far less use.

Digital Economy Act appeal: more detail

2011-10-10T17:06:00.000+01:00

As I said on Saturday, TalkTalk and BT have obtained permission to appeal to the Court of Appeal in their judicial review of the Digital Economy Act 2010 ("the DEA").

Thanks to the counsel for the appellants I now have a little more information. The appeal is going forward on essentially the first four grounds that were put forward at the original judicial review hearing. The appellants did not appeal on the fifth ground: proportionality. I thought it might be useful, at this stage, to give an extremely rough outline of those four grounds.

The first objection concerns the Technical Standards Directive (83/189/EEC), the aim of which is that any laws that impose technical standards on goods or services (known as "technical standards" and "rules on services") are reported to the European Commission in enough time for the impact of the proposed law on intra-community trade to be assessed and any objections to be raised. This is known as the "standstill period". Failure to comply with the procedure renders the relevant law unenforceable.

The appellants say: "The DEA is a technical standard and/or rule on services; it wasn't notified to the Commission before it was passed, therefore it is void. The government responds: "No it isn't! Its not nearly detailed enough to be a technical standard etc at this stage, you have to wait for all the little statutory instruments we are going to make under it before there's enough detail to need notification."

The second ground concerns the E-Commerce Directive. As readers may know, this gives various kinds of immunity to providers of "information society services" and in particular to ISP's who, as "mere conduits", are not liable for the information that they transmit.

The appellants case is that the DEA does impose liability for information transmitted and/or it imposes a requirement to remove or disable access to information. Neither of these, they say, can be imposed on a mere conduit. In the High Court, the appellants also argued that the DEA imposed a "general obligation to monitor" which is forbidden by article 15 of the directive. That argument is no longer live - I think (though I may have misunderstood this) because the Court of Appeal did not give permission on that point.

The third ground is based on the Directive on Privacy and Electronic Communications (2002/58/EC) which (amongst other things) imposes conditions on the processing of traffic data by ISP's. Ordinarily, traffic data must be anonymised or erased when it is no longer needed for the purposes of transmission, except for certain limited exceptions and derogations. The appellants case is that the DEA's purpose does not fall within any of those exceptions or derogations and so keeping the traffic data in order to enforce copyright is not permitted.

The last of the four grounds is built on the Authorisation Directive. The Authorisation Directive was aimed at opening up the electronic communications sector to competition by preventing member states from imposing onerous conditions on prospective comms providers. To that end, a member state may not charge a prospective ISP fees, or impose conditions on them, unless authorised to do so by the directive. The appellants say that is exactly what the DEA does, or will do, and that the DEA therefore offends against the Authorisation Directive. The appellants won a partial victory on this point in the High Court, managing to knock out a requirement that they pay a share of OFCOM's fees for managing the initial obligations code.

I am extremely pleased that permission has been given. Being optimistic, I can hope that light will be thrown - possibly even by the CJEU if the Court of Appeal consults it - on any one of these directives. They are all of some importance in my practice and so I am understandably keen to see as much clarity as possible. With four directives to chose from there's every chance that some useful principles will come out of this case.

In any event, it means that the "graduated response" intended by the DEA is going to be just that farther in the future. In related news, Julian Hupper (Liberal Democrat MP for Cambridge) has tweeted his plan to try to have the web blocking provision (section 17) of the DEA repealed. The government have already indicated that they are unlikely to use section 17 in the foreseeable future, so this may be uncontroversial. I will watch events with interest as they unfold.

Digital Economy Act to go to the Court of Appeal

2011-10-08T16:12:00.000+01:00

Yesterday, the Court of Appeal gave BT and TalkTalk permission to appeal to the Court of Appeal. I do not have any more details - in particular what was the reasoning of the court and what on what grounds will the appeal be argued. I hope to blog about them as soon as they become available.

Earlier this year, the Court of Appeal, in the form of Buxton LJ, had refused permission to appeal, leading to some rather misleading press coverage such as the Guardian's "Court of appeal's decision means long-running battle by UK's biggest ISPs is effectively over". Not so of course.

Unless the Court of Appeal thinks that an application for permission is "totally without merit", a prospective appellant may always renew an application for permission orally, under CPR 52.3. This, is, I understand, what BT and TalkTalk did.

Google's name policy is not illegal

2011-07-26T09:15:00.000+01:00

This is a quick response to a google+ post suggesting that google's "real name" policy is contrary to the Privacy and Electronic Communications (EC Directive) Regulations 2003.

The post is, I'm afraid, quite wrong. The poster relies on regulation 18 which controls the compilation of any "directory of subscribers". It gives various rights which depend on the nature of the directory (telephone or not) and the nature of the person included (individual or corporation) which might allow opting out or require opting in and so on.

Regulation 18 only applies to a "directory of subscribers". The term "subscriber" is defined in regulation 2 to mean "a person who is a party to a contract with a provider of public electronic communications services for the supply of such services". A "public electronic communications service" is defined in section 151 of the Communications Act 2003 to mean "any electronic communications service that is provided so as to be available for use by members of the public" and "electronic communications service" is defined in section 32 of the same act to mean "a service consisting in, or having as its principal feature, the conveyance by means of an electronic communications network of signals, except in so far as it is a content service".

So: google+ is not a public communications provider and hence its members are not subscribers. Regulation 18 does not apply.

As far as I can tell, there is no regulatory reason why google+ should not operate a "real name" policy. They would have to be a little careful about the implementation of the policy within the EU in case they fall foul of European discrimination law. If, for instance, they ended up systematically blocking individuals from one racial group significantly more than those from another because their real names seemed too odd to google employees, that might amount to racial dscrimination. As readers will know, some ethnic groups prefer to have a single name, rather than a forename + surname model.

But that depends on how the policy is implemented, not the policy itself. So I would suggest not contacting the ICO who is already quite busy.

Peer to Patent (UK) launched

2011-06-01T10:17:00.000+01:00

The UK's Intellectual Property Office has launched a website that allows members of the public to supply prior art (and comment on) for pending patent applications. Peer to Patent is an idea that was piloted in the United States (with a second pilot ongoing). A pilot in Australia also ran for a six month pilot from December 2009. I do not know what plans there are for continuing it. The "prior art" or, strictly speaking, the "state of the art" is a central concept in patent law. In the UK, section 2 of the Patents Act 1977 ("novelty") explains that an invention is only "new" (and therefore patentable) if it is not already part of the state of the art. Section 3 ("inventive step") relies on the state of the art (or at least part of it) in defining whether or not a patent contains an inventive step (again without which it will not be patentable). The problem that peer-to-patent seems to be trying to solve is to give patent examiners access to that prior art. There is no "prior art" database that an examiner can simply search. They can try looking at past patents which certainly contain a great deal of prior art, but an invention may not have been patented — particularly in an area of industry which is new or in which patents were not traditionally sought. Computer software patents are a prime example of this. In Australia one patent examiner commented:

I would say that the [Peer-to-Patent Australia prior art] documents were of greater relevance than those found during the initial search. I think they were somewhat helpful for this particular application, in which the claims were drafted using broad terminology, which was difficult to search.

So, patent examiners do appear to be finding it useful. An earlier blog post by the IPKAT on the subject attracted some negative comments. They seem overly cynical to me. The US and Australian experiences do seem to suggest that patent examiners like it and that more prior art is being exposed at an earlier stage which must be a good thing. Now, I am sceptical that the patent system (either in the UK or the world) does what it is supposed to do. For example, the very high cost of bringing or defending patent proceedings means that practice and theory diverge considerably. There are numerous other criticisms that one might reasonably levy. But, sceptic or not, I welcome anything that tries to make the system better, even if its very modest indeed. I would encourage anyone with specialist knowledge of the patents on offer to engage. Of course, really they need a badge system. Maybe it will come.

Restraining cookies: the new privacy rules

2011-05-17T15:08:00.003+01:00

On 26th May 2011, a new law — the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 — comes into force which will change fundamentally the legal regime governing cookies and other similar locally stored data. As I will explain, the legal change is a big deal, but the practical effect may, at least in the short term, be small.

The Information Commissioner has published some useful practical guidelines (alas only as a PDF). They are not definitive (so they may not protect you in the unlikely event someone tries to sue you for damages caused by a breach of the regulations) but since the Information Commissioner (or his office at least) has the primary role in enforcing the regulations, complying with his guidelines will go a long way to avoiding any possible legal repercussions. If you have a short attention span and wish to read only one thing about the new cookie law then I'd advise you go there (see you another time and thanks for visiting).

The new rules apply to storing (or accessing information stored) on a public network user's computer. That includes not only cookies and "flash cookies" but any other information that might be stored on a local computer, for example they would certainly apply to the iPhone's storage of location data. For brevity I'll talk about cookies, storing cookies but all that follows applies much wider than that.

Overview

The amended regulation 6 will forbid anyone from storing cookies unless one of the following applies:

the user has given their prior, informed, consent (an opt out is no good)
it is for the sole purpose of "carrying out the transmission of a communication"
it is strictly necessary for the provision of an information society service that was requested by the user

In practice this means that, except in very limited circumstances, prior explicit permission will need to be given by a user before using cookies. The limited circumstances might include situations where the illusion of a session (http being stateless) is needed in order to provide the user with the service they want, for example via a "shopping cart".

Tracking what a user does (eg with a tool like google analytics) or supplying additional services they might want (eg "other users also bought...") would not be for a service "requested by the user" and so would need consent.

Consent may be given by the user explicitly setting their browser to accept cookies. At the moment most browsers will, by default, accept cookies and so it is not, at present, realistic to rely on a user's browser settings to gain the necessary consent. Browser technology may change to make such a reliance tenable and I expect there to be some pressure in that direction.

Clauses in a website's terms and conditions which do not have to be explicitly accepted by a user (for example because they are linked to at the bottom of a page) are, in my view, also not going to be any good.

One small consolation to online service providers is that the ICO has said that in the early stages of this new law all he will look for is a plan to get things right, rather than expect 100% compliance from 26th May. That isn't an excuse to be complacent, but does give some breathing space.

Detail

The origin of the new law is in an amendment to the directive on privacy and electronic communications (directive 2002/58/EC). There doesn't appear to be a consolidated version in html format online, but for the purposes of this post all we care about is replace article 5(3) which was added by directive and reads:

3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

One one analysis it is not the web server (and thus the operator of the server) who stores or gains access to cookies on a user's machine, rather the server returns a "Set-Cookie" response which a web browser has no obligation to honour. It is also the web browser that transmits the value of a cookie back to the web server.

The directive is not intended to be understood in so narrow a sense. Only a small minority of web users understand how http works. The majority will not realise that information is being stored by their web browser on someone else's behalf. It is clearly the risks associated with this lack of knowledge that the directive aims to address. Recital 24 says:

(24) Terminal equipment of users of electronic communications networks and any information stored on such equipment are part of the private sphere of the users requiring protection under the European Convention for the Protection of Human Rights and Fundamental Freedoms. So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The use of such devices should be allowed only for legitimate purposes, with the knowledge of the users concerned.

Recital 25 makes it clear that "cookies" are one such device. It concedes that they can be legitimate and useful but that any use must be with informed consent.

Article 5(3) is very broad in its application. It catches storage on any "terminal equipment" (so mobile devices as well as traditional PC's) and is not restricted to the web or web browsers. The terminal equipment need only belong to a "user" which is defined in article 2(a) as anyone using the network for private or business purposes. So it does not seem to be possible to agree with a subscriber to (say) an ISP or mobile phone service in advance that they consent to the storage of cookies etc on any terminal equipment using their connection if others might use it with different equipment.

The only obvious restrictions to 5(3) are:

It only applies to services available over public communication networks and so does not apply to (i) private network services or (ii) to gaining access to a computer without using a network at all.
Unsurprisingly, member states are allowed to create their own exceptions where necessary for the purposes of public security, defence and the prevention of crime. Just such an exception was made by the UK in regulation 28 .

Who is responsible? For example, at present I publish this blog using google's blogger service. If google choose (say) to track those reading my blog using cookies without my asking them to, what then? In my view it is the service provider (in this case google) that is carrying out the unlawful activity rather than I, although if I have expressly asked them to do so, then we may both be responsible. If, on the other hand, my blog was made available on a "dumber" hosting service - for example if I installed my own wordpress isntance on a server on which I had shell access and I decided to use cookies, then it would be I, not the provider of my shell access account, who would have to take care of the legalities.

There are two ways that a user (or subscriber)'s rights may be enforced. First by the information commissioner in much the same way as data protection obligations are enforced. Second, regulation 30 permits an individual who has suffered damages as a result of a breach (who might not be the user or subscriber whose equipment was accessed) to bring a claim for damages against the person who committed the breach. There is a defence of reasonable care against such a claim.

So, where cookies are used to illicitly track an individual's preferences and sold to advertisers to allow advertising to be targeted, there is unlikely to be any actual damage and enforcement would have to be by the information commissioner. By contrast, where the use of cookies results in someone's bank details being obtained by a third party (entirely possible with some of the more poorly written systems out there) there may well be financial loss and a right of action. In practice I don't expect to see very many claims, interesting though they would be.

Update

An anonymous commenter asks about other forms of content stored by a web browser. A web browser will almost always store the http response(s) to any request. Some of the information contained in that response may be sent back to the server. A simple example being the value of any fields set in an HTML form, but there are many other, in some cases very sophisticated, mechanisms for doing the same thing. Even the URL in an href attribute can be used to store information — as those with long web memories will recall, one of the earliest example applications using HTML created a noughts and crosses game doing just that.

I suspect that the courts will read the directive as applying only to data stored on a user's computer that can (in principle) be later retrieved by the person storing it or by some other third party. It seems to me that the directive is intended at that kind of mischief which arises where someone or some people track what a user does and keep secret information about them that they can use for their own purposes. Of course there are still risks if information is stored without your knowledge even if it is accessible only to the user of the computer, so the courts may decide to read the directive more widely than that.

Most of these forms of storage will be lawful because they are strictly necessary to provide the service sought by the user. HTML stored by the browser which is displayed to the user is a necessary part of browsing any web page. Ditto where form fields are used for any kind of web transaction such as logging in or purchasing a product. The service can't be supplied without some local state being maintained one way or another. The user will expect it to be so.

On the other hand, keeping a complicated session key that tracks (or allows the tracking) of the user's behaviour without forming part of the functionality the user wanted, would, in my view, fall foul of the directive and need express consent. The fact that cookies aren't used is irrelevant.

Colonel Mustard is not in the Library with a copyright claim form

2011-03-15T00:16:00.004+00:00

My friend Sym came up with a neat joke:

Playing Big Society Cluedo. It's easier than normal Cluedo because there isn't a library.

and promptly tweeted it. Much retweeted it ended up being used by the BBC's Now Show, without attribution of any kind. Sym is a generous soul and I doubt that worried him too much but he mentioned it on his (private) facebook wall.

As regular readers will know I'm not exactly a copyright maximalist, but I do find it unattractive that large and powerful organisations that would certainly pursue you if you used their intellectual property appear to be quite happy to use other people's so long as those other people are too small to matter very much. I jokingly suggested I'd help draft his claim form and that lead him to wondering whether there could be any copyright in so slight a thing as a tweeted joke.

Unsurprisingly there are lots of answers on the internet, as a cursory google search will show. One site says categorically "no"; an article in the WIPO magazine thinks "it depends" and there's even a site called canyoucopyrightatweet.com written by a US attorney which again comes down on the side of "it depends". Unfortunately all the really detailed discussion relates to US law, not European or English law. While there's some internationally harmonisation of copyright, there are still significant differences.

So, what of English law. Well, English copyright protects, amongst other things any "original literary work". Most tweets are not going to be original - in fact in many cases that is the whole point - but some, like Sym's joke, seem quite capable of being so. Certainly, I am quite sure that he came up with the joke first.

A "literary work" does not have to be high art. Indeed section 3 of the Copyright, Designs and Patents Act 1988 says that a

“literary work” means any work, other than a dramatic or musical work, which is written, spoken or sung

so its really quite a broad term. In a relatively recent case which rejected a claim for copyright in the names of commands for an airline booking system, Mr Justice Pumfrey was quite clear that single words, at least on their own, could not be copyrighted. In the 2009 Infopaq case, the European Court of Justice were prepared to accept that an 11 word textual extract could be the subject of copyright and last year in the case of Meltwater Mrs Justice Proudman agreed that, whatever might have been the position under English law, the decision in Infopaq made it plain that as a matter of European law copyright could exist in newspaper headlines provided they were original enough.

So it seems to me that a tweet, provided it is sufficiently original, can be the subject of copyright.

But as I said in an earlier post the existence of copyright is only half the question. What would or would not infringe a short humorous tweet? I haven't heard the particular episode of the Now Show in question but if they read it out they have certainly infringed (and twitter's terms of service don't appear to let them off the hook). If, on the other hand, they only paraphrased the joke, the question is more difficult. Sym might be able to claim ownership of the particular expression of his joke, but he cannot copyright the idea that lies behind it. That idea is free and open to all.

The difficulty with this neat distinction (called the "idea/expression dichotomy") is that courts recognise that you can infringe by copying something more abstract than the exact words used. This should be obvious when you consider that a translation of a work (which will usually use quite different words, unless its into "pirate") is a potential infringement of the original work. Too close a copy of the plot or characterisation in a play (say) would be an infringement even if there had been a good deal of rewriting and reworking.

How on earth this would apply to something as small and neat as a tweet is anybody's guess. I suspect that it is only a matter of time before someone tries to test the question.

UPDATE

In the comments, Sym has helpfully provided the quote from the Now Show:

Someone amused me no end on twitter the other day, ok, when they answered twitter's question 'what are you doing?' by writing: "I'm playing big society cluedo, it's easier than normal cluedo because there isn't a library"

Clearly, if there is copyright in the tweet, this looks like a potential infringement because the whole tweet has been copied pretty much verbatim. But, could there be a defence. There is, of course, no such thing as "fair use" in English law. But quoting a tweet could be "fair dealing for purposes of criticism or review" which is a defence under section 30 of the Copyright, Designs and Patents Act 1988. This requires that:

the use is fair dealing
the purpose of the use is criticism or review of a work (not necessarily the work quoted) or works
the use is accompanied by sufficient acknowledgement

Normally it would not be "fair dealing" to use the whole of a work, but where the work is as short as a tweet it is likely to be impossible to use it critically in any meaningful way without quoting the whole of it. "Someone amused me" probably counts as "criticism".

What about attribution? Section 178 of the act defines "sufficient acknowledgement" as "an acknowledgement identifying the work in question by its title or other description, and identifying the author". "Someone" doesn't seem like enough to me. Although its just possible to argue that "Someone" means "Someone on twitter" and that it is thereby possible identify the author by searching on twitter for the origin of the tweet. Seems like a long shot to me.

Update: I realise with some embarrassment that I didn't link to Lillian Edward's blogpost on this very question.

Don't return your census form early

2011-03-13T10:50:00.000+00:00

This seems a topic that has generated much discussion, so I thought I'd comment on it.

In the United Kingdom we are having a census on Sunday 27th March 2011. It can be completed online or by sending back a census form that has been delivered to most households by now. The census is being carried out by the Office for National Statistics (ONS). Their website says, under the heading "When to return the questionnaire":

Census day is Sunday 27 March. Your answers should be about your household on this day. Please submit or return your completed questionnaire before, on or after this date.

On any analysis that seems a bit odd. Surely you should only be returning your census form after the date of the census since, though you can have a pretty good guess what the answers to the many questions might be, you can't know for certain.

As far as I can see, the ONS is simply wrong to suggest that early return is OK. This Census is governed by the Census (England) Regulations 2010, regulation 10 of which states:

10.—(1) Every prescribed person to whom a household pack has been delivered or on whose behalf delivery was taken under these Regulations must, on the day after census day or as soon after as is reasonably practicable—

(a)complete the copy of questionnaire H1 included in the pack, place it in the reply-paid envelope provided and send the questionnaire to the Authority by post; or

(b)return the information requested by questionnaire H1 electronically using such an electronic system as the Authority may provide for this purpose and in accordance with the instructions included in the accompanying pack.

Which quite clearly does not allow an early census return. Failure to comply with regulation 10 is made a criminal offence (albeit a very minor one) by section 8 of the Census Act 1920. There doesn't appear to be, in the regulations or the act, any power for the ONS to disapply these provisions or vary when the census returns may be made.

I'm not a census lawyer, so maybe I'm missing something here. What's more I doubt that it would be easy to prosecute someone for doing what the ONS has precisely told them to do. It still seems to me to be an odd way to run a census.

Phone hacking and copyright

2011-03-04T16:32:00.001+00:00

Hugo at the 1709 blog asks a question about a recent case involving 2 of those who may have been victims in the News of the World phone hacking affair (as wikipedia calls it). Before I try to answer the question, some background.

From information obtained from the Metropolitan Police, Andrew Gray and Steve Coogan both suspected that their voicemail had been accessed by Glenn Mulcaire, the private investigator at the centre of the affair. They sued him — apparently for breach of confidence.

The claimants felt that the Mr Mulcaire's defence left a lot more questions unanswered. For example who had instructed him to intercept voicemails; to whom had he passed on the information; and who else had he been targeting. In order to press him further they each made a request for information asking him a number of questions which, unsurprisingly, he did not appear to wish to answer. In order to resist answering the claimants' requests, Mr Mulcaire relied on the common law right not to be required to answer questions that might incriminate oneself.

The right, known as the "privilege against self-incrimination" is not an absolute one. There are a number of statutory exceptions to it. For example section 31 of the Theft Act 1968 prevents someone from relying on the privilege in proceedings for recovery of property (where things they say might well implicate them in a charge of theft). In a similar manner, section 72 of the Senior Courts Act 1981, lifts the privilege in "proceedings for infringement of rights pertaining to any intellectual property or for passing off".

The phrase "intellectual property" means different things to different people and is much misused. There is no single statutory definition either. I found it interested to read that the court was shown a sample of 20 different enactments where "intellectual property" is defined in different ways and for different purposes and, in the Income Tax Act 2007, in three different parts of the same act. In section 72 it is defined thus:

"intellectual property" means any patent, trade mark, copyright, design right, registered design, technical or commercial information or other intellectual property;

Now the defendants contended that "commercial information" meant only commercial information which was protectable as intellectual property (for which see the other items in the list). The claimants (correctly in my view) said this didn't make sense — obviously what was meant was an extended definition to include "normal" intellectual property of the kind we are used to talking about such as copyright but extended to cover things that would normally not be treated as intellectual property, such as commercial information.

Mr Justice Vos agreed. The defendant lost his privilege and the claimants were allowed to ask some of their questions. Others, the judge thought, were not strictly relevant and constituted "a fishing expedition" (as lawyers call it). An earlier and very similar case, this time involving Nicola Phillips as the victim, had already been decided in the same way and headed to the Court of Appeal. The hope is that all three cases will be joined on appeal and a decision given.

Given how topical phone hacking has been, and the fact that many readers of this blog are involved in industries where confidential information could be intercepted wrongly, I thought this was an interesting case to talk about.

Now to Hugo's question. He asks the question that may be in some of your lips: why didn't the claimants bring a claim for infringement of copyright? Then there would have been no doubt about the application of section 72 and no need to have the argument in the first place. He asks:

Could the claimants simply have relied on the argument that Mulcaire had in any case infringed copyright in sound recordings by recording and transcribing the voicemails? Copyright in sound recordings is owned by their ‘producer’, who is ‘the person by whom the arrangements necessary for the making of the sound recording are undertaken’. Would this be Steve Coogan and Andrew Gray – or would it be Vodafone?

Note that we aren't interested in copyright in the words that were recorded on the victims' voice mail. Even if they qualified for copyright protection — one assumes that "hi, its me" probably does not, whereas something with more substance probably does — the person who left the message would be the author of the words and therefore the copyright would belong to the caller or their employer.

Copyright does protect sound recordings, though for a shorter period than copyright in literary, musical or dramatic works. As Hugo points out, section 9 of the Copyright Act makes the "producer" of a sound recording its "author" (and therefore potential first owner of the copyright) and section 178 gives us the definition.

The nearest authority I can think of is A&M Records v Video Collection International [1995] EMLR 25 which concerned the ownership of an arrangement of "Let's Face the Music and Dance" created for Torvill and Dean's 1994 competition entry. The skater's agent asked a conductor to do the job. He found an arranger, paid for an arrangement of the work suitable for the skaters and then conducted it in a studio he had hired with an orchestra he had put together. The court found that while the conductor had clearly made the recording, it was the agent who had made the "arrangements necessary for the making of the sound recording". I thin this indicates that the courts take a high level view of "producership" and so it would be Mr Gray and Mr Coogan who made the arrangements and were the "producers" even if everything else was done by their mobile telephone company.

But wait, the story doesn't end there. There's no point asking whether something is protected by copyright, without also asking whether there has been infringement. In this case, if Mr Mulcaire had transcribed the telephone conversations, rather than just listened to them and made notes of the facts contained in them, would he have "copied" them? We are all used to the extended definition that section 17 gives to copying of a literary, dramatic, musical or artistic work, which includes "reproducing the work in any material form", but there is no such extended definition for sound recordings. To transcribe a sound recording is not to "copy" it since no new sound recording is made.

So, Mr Mulcaire might have infringed the copyright in the words recorded but that copyright didn't belong to Messrs Gray and Coogan. They probably did own the sound recording copyright, but that wasn't infringed. Their lawyers obviously did know what they were doing (as we suspected) in only suing for breach of confidence. If there's a moral here its that having multiple copyrights in the same "thing" makes for a more complicated analysis.

Digital Economy Act Costs - an unlawful Prisoners Dilemma

2011-01-27T23:35:00.001+00:00

On 17 January 2010, the draft Online Infringement of Copyright (Initial Obligations) (Sharing of Costs) Order 2011 was laid before parliament. It is the first substantive item of secondary legislation made under the Digital Economy Act 2010 and concerns about the simplest thing possible: how much copyright owners and ISP's will have to pay under the Initial Obligations Code (IOC). Despite its simplicity it has been misdrafted and it may also be unlawful.

Background

In case you haven't been following (and why should you?), the Initial Obligations Code is intended to allow copyright owners to send "copyright infringement reports" or CIR's to ISP's, that allege, roughly speaking, that the copyright owner has reason to believe that there has been some copyright infringement associated with one of the ISP's IP addresses. Some of these reports (which and how many to be determined by later legislation) must then be reported by the ISP to its subscriber. If a subscriber collects enough CIR's over a certain period of time (again to be determined) their IP address will go on a list which the copyright owner can then demand from the ISP which will (in theory at least) allow the copyright owner to match up different CIR's to the same subscriber.

There is no such thing as a free lunch. All this has to be paid for. OFCOM which polices the system will need funds to do so, ISP's will incur costs processing CIR's and there will also be an appeal system for subscribers who believe that a CIR was given wrongly which will have to be paid for. The Order is intended to split the cost 75:25 as between copyright owners and ISP's.

I want to avoid engaging in a discussion as to whether the principle of the act is a useful way to encourage people to stop infringing copyright, or a hopelessly misguided waste of time for everybody. I think my views on that are sufficiently well known. What interests me is whether there is anything technically wrong with the order itself, and I think there may be.

A technical miscalculation

Copyright owners are supposed to pay ISP's 75% of the costs that (OFCOM thinks) they will incur in handling the CIR's. OFCOM sets a rate per CIR that copyright owners must pay, which it can change from time to time. Copyright owners pay in advance, and this is where things come unstuck.

Paragraph 2 of the Order's schedule requires the copyright owner to notify in advance any ISP to which it intends to submit CIR's and give an estimate of the number of CIR's it expects to be submitting. Before the start of each notification period, the copyright owner must submit another estimate for the coming notification period and then pay the rate set by OFCOM multiplied by:

(a)the number of copyright infringement reports which the qualifying copyright owner estimates it will make to the qualifying internet service provider under the Code during the notification period; less
(b)the difference between the number of copyright infringement reports which that qualifying copyright owner estimated it would make to that qualifying internet service provider under the Code in the previous notification period and the number it actually made to that qualifying internet service provider in that period, if lower.

Read that carefully. It means that if the copyright owner systematically under estimates the number of CIR's, it will never have to pay the difference. Indeed there is nothing to stop the copyright owner giving an estimate of "1" in each year and paying the fee for exactly one report.

The proportion of fees payable by any copyright owner (or ISP for that matter) to OFCOM are also based on the copyright owner's estimates. The actual number of CIR's submitted never enters into the calculation. This amounts to a zero-sum game between all copyright owners. Each will have an incentive to submit the lowest estimates possible.

Unless I have completely misread the Order this seems quite mad and must (surely) be the result of a misdraft.

UPDATE:

I have been told that OFCOM stated at a stakeholders' meeting that the initial obligations code would limit the number of CIR's a copyright owner could submit in any notification period to the number it had estimated at the start of that period. This would be a change from the draft code published last year and is as suggested by Malcolm Hutty in the comments below.

This does avoid the strong incentive to underestimate the number of CIR's to be submitted, but it does not leave the scheme in a satisfactory state. It is still the case that fees payable to OFCOM are based on estimates and not reality. While that will penalise a copyright owner that overestimates, it will also penalise any ISP that receives an over-estimate of CIR's. The ISP's have no recourse in such a situation.

There is nothing in the Act that prevents the costs regime from dealing with reality and apportioning costs according to actual use (with balancing payments where necessary). OFCOM's suggestion looks like a quick and dirty bug fix, rather than a well thought through statement of policy.

Is the Order lawful?

According to James Firth, it appears that a different concern has been raised by the European Commission. Does the rule on cost sharing comply with the the "Authorisation Directive" (2002/20/EC).

The Authorisation Directive is, as EU directives go, pretty straightforward. The idea behind it is that regulation of those wishing to offer public communication networks should be extremely lightweight. Member States may regulate, but only within fairly tightly defined limits. In particular they may only impose conditions on the operator of a public communications network that fall within one of a list of type of condition (found in Annex A of the Directive).

The list is fairly long, but much of it is pretty common sense. There are only two which could plausibly allow the UK via OFCOM to make ISP's pay for the operation of the Initial Obligations Code.

First, which is what is being referred to in James's post, the UK (via OFCOM) could require ISP's to pay "administrative charges" in order to be authorised to operate a public communications network. Article 12 of the Directive makes it quite clear that "administrative charges" must be just that — charges for the administration of the general authorisation scheme for public communication networks. That does not include an obligation to pay for an appeals body to hear subscriber appeals or money to OFCOM to monitor and run a scheme for assisting copyright owners enforce their rights.

Second, it is permissible to impose a condition restricting the transmission of "illegal content" (such as content which infringes copyright) and "harmful content" (such as indecent images of children). It seems to me that the CIR/initial obligations scheme of the Digital Economy Act 2010 is not a "restriction" on the transmission of illegal content, but something quite different. What is more, a requirement to pay fees cannot be a "restriction" even on a fairly relaxed reading of the Directive.

In other words I cannot see anything in the Authorisation Directive that could allow the UK to impose a requirement to pay for the initial obligations scheme that is compatible with the Authorisation Directive. Unless I am missing something, the Order, as it stands is unlawful.

Interestingly, the 1709 blog asks whether the Order complies with the Technical Standards Directive and suggests that it does, because the imposition of fees and costs under the Order is a restriction permitted by the Authorisation Directive. Alas, whatever view one might take about technical standards, I don't believe the Order complies with the Authorisation Directive.

Conclusion

The Order isn't really news and I am sure the government believes they are complying with the Authorisation Directive. We disagree and only time (and perhaps the ECJ) will tell, but it does worry me that in this already contentious area the first piece of subordinate legislation is already buggy.

A new kind of copyright? Graphical user interfaces in the ECJ.

2011-01-03T17:10:00.000+00:00

A decision of the European Court of Justice published before Christmas concerning whether a graphical user interface is protected by copyright causes me concern. I have not seen any detailed analysis of the decision which may be due to Christmas and New Year stupor. I plead the same excuse for what follows.

The case Bezpečnostní‌ softwarová‌ asociace‌ –‌ Svaz‌·softwarové‌ ochrany v Ministerstvo kultury C-393/09 has a rather involved background an excellent account of which is provided by Martin Husovec on his blog. Very roughly speaking, a Czech organisation called the Security Software Association (BSA) wished to set up a collective licensing scheme for computer software which included the right to transmit works by cable television. The point in issue was whether the broadcast of the graphical user interface of a computer program could infringe copyright (and would therefore require licensing).

Copyright in computer programs was harmonised across the EU under the Software Directive (91/250/EEC). Article 1(2) applies the directive to "the expression in any form of a computer program". The first question referred to the ECJ was whether a graphical user interface could be described as a computer program "in any form". The ECJ said "no". One fact influencing the court was that Article 10(1) of the TRIPS Agreement requires the protection of computer programs "whether in source or object code". Clearly source and object code are examples of forms of expression of a computer program.

Similarly the 7th recital to the directive states that the term "computer program" also includes "preparatory design work leading to the development of a computer program provided that the nature of the preparatory work is such that a computer program can result from it at a later stage". The common element of these examples, thought the court, was that they lead to the reproduction or creation of a computer program. A graphical user interface does not enable the reproduction or recreation of a compute program, therefore it is not the expression of a computer program "in any form".

This all seems reasonable so far. Although a graphical user interface might contain one or more images or graphical works that would attract copyright as an "artistic work" in the normal way; attempts to claim copyright in an abstraction of the user interface — such as its mode of operation — have tended to founder in the English Courts in cases such as Nova Productions v Mazooma Games [2007] EWCA Civ 219 (concerning features of the play of two computer Pool games) and in Navitaire v Easyjet (concerning a clone of a air travel booking system).

However, the court went on to consider — although it had not been asked to do so — whether the graphical user interface of a computer program might be protected by the "ordinary" law of copyright. Here the court appears to have committed the logical fallacy of affirming the consequent. To explain why I need to say a something about earlier developments in European Copyright Law.

The Information Society Directive (Directive 2001/29/EC) ("INFOSOC") has partially harmonised other forms of copyright in the European Union. Article 2 INFOSOC requires that Member States create in their domestic law a "reproduction right" for "authors, of their works". Although described as a "right" it amounts to a prohibition on anyone else reproducing (in whole or part) a work without the author's permission. In other words it is a copyright. Although INFOSOC does not define "works" (or indeed "reproduction" or "reproduction in part"), the European Court of Justice in the earlier case of Infopag v Danske Dagblades Forening C-5/08 held that the directive only applies to a work that is "original in the sense that it is the author's own intellectual creation".

So to the apparent fallacy: in Bezpečnostní‌, the ECJ reasons thus:

The Court has held that copyright within the meaning of Directive 2001/29 is liable to apply only in relation to a subject-matter which is original in the sense that it is its author’s own intellectual creation (see, to that effect, with regard to Article 2(a) of Directive 2001/29, Infopaq International, paragraphs 33 to 37).

Consequently, the graphic user interface can, as a work, be protected by copyright if it is its author’s own intellectual creation.

In other words the court deduces from a statement of the form "P implies Q" a conclusion that "Q implies P". Infopaq establishes that being the author's "own intellectual creation" is a necessary condition. That does not mean it is a sufficient one.

Now the judges of the ECJ are, for the most part, bright and well educated. They will be well aware of the dangers of affirming the consequent. I think it is safe to assume they don't mean quite what they appear to be saying. In particular, the idea that any form of intellectual creation is protected by the general law of copyright would be quite revolutionary.

For example, INFOSOC does not exclude from copyright protection inventions that could form the subject of a patent, or designs that might be protectable under one of the European design rights. Although both might well be some author's "own intellectual creation", I doubt very much that copyright is intended by anyone to extend so far.

In English law merely being creatively original is not enough for a work to obtain copyright protection. For example in Creation Records v News Group Newspapers [1997] EMLR 444, the judge held that it was not even arguable that the scene for the Oasis album cover of Be Here Now could be protected by copyright. It simply did not fit into any existing protected category — and the record company attempted to argue that it was a dramatic work, a work of artistic craftsmanship or even a collage.

So I assume (in hope) that all the ECJ are guilty of is a failure to show working and that they have in mind some other criteria that must be satisfied before a work is protected by copyright. What those criteria might be the ECJ do not say which leaves me with the following questions: if a graphical user interface is protected by copyright, what kind of a work is it and what about it is protected?

It may be possible to gain some inkling as to what is in the ECJ's mind from their answer to the second question posed to them. They were asked if graphical user interfaces were protected by copyright in computer programs (the first question), would television broadcasting of the graphical user interface be an infringement of that copyright (by communication of that work to the public)? Although the ECJ had answered "no" to the first question, ever helpful they considered whether, on the assumption that graphical user interfaces were protected by "ordinary" copyright, TV broadcasting of them could constitute infringement. Again the ECJ thought "no" because the viewers "cannot use the feature of that interface which consists in enabling interaction between the computer program and the user".

It seems from this that the ECJ have in mind not the graphical elements of the user interface, but something about its operational behaviour. A sort of copyright in interactivity, which cannot of course be infringed by TV broadcasting because you cannot interact with the subject of the broadcast. If that is what the ECJ have in mind, then I am troubled.

First, what kind of a copyright is this? Is it an artistic work, a literary work or something else (a work of artistic craftsmanship perhaps)? For the purposes of English law this matters. Different species of work are protected in different ways, even if the differences are sometimes rather subtle. The ECJ do not tell us the answer to this question.

Second, where is the graphical user interface "fixed". In English law a work is only protected if and when it is fixed in some permanent form. If I make a really excellent speech, I will have copyright in the speech when, but only when, it is recorded. Similarly if a group of musicians create an exciting musical work while jamming together in the studio, the work will not be protected until fixed in some form. Is the graphical user interface fixed in the computer program's source code? If so, copying the code may be an infringement of the copyright in the graphical user interface. If it is not fixed in the code, where is it?

Lastly, there are numerous special rules that apply to copyright in computer programs. For example there are rights to make back-up copies, to test and to decompile for certain purposes. If the ECJ is right, these would not apply to a user interface which represented an author's own intellectual creation. In English law, moral rights do not apply to computer programs, but would (presumably) apply to a suitable user interface. Both of these conclusions could be awkward.

Not all is bleak. The ECJ emphasize that when assessing whether a graphical user interface is protected by copyright as its author's "own intellectual creation", a national court should ignore components of an interface that are "differentiated only by their technical character". It will not be every, or every aspect, of a user interface that will be protected. Despite this limitation I suspect that this decision, if taken to its logical conclusion and followed by later cases, will require some careful rethinking about copyright in the computer industry. Just what we need.

ACS:Law - at last, a hearing

2010-12-21T12:15:00.001+00:00

UPDATE: For professional reasons I won't be commenting on this case for the time being. Please feel free to continue to comment on this post, but don't feel insulted if I do not respond.

After my recent post on ACS:Law's failure to obtain default judgments in some of their claims. Another judgment Media C.A.T Limited v Alan Billington [2010] EWPCC 18 of the patents county court has been pointed out to me.

The facts of the particular case are not particularly crucial. The Defendant, an Aaron Billington, complains amongst other things that there is no "Alan Billington" and that he did not receive a "response pack" (which comes with the Claim Form and which includes a form for acknowledging service). Although he does not say so, there also seems to be a complaint that ACS:Law did not follow good pre-action practice.

What is interesting is that the judge reviewed cases pending before the court (27 in all) and has ordered that a hearing for directions be held at 10:30am on 17th January 2011. At the hearing the court can decide how the cases should be dealt with. Clearly if you are (or know someone who is) one of the defendants and there's a reasonable defence to the claim, or the sum claimed is larger than the claimant is entitled to, then it would be a very good idea to attend the hearing and have your (or their) voice heard.

Although courts do have a power to make orders on their own initiative, without being asked to do so by the parties, many courts do not seem to use this power as much as, perhaps, Lord Woolf envisaged when he created the civil procedure rules. The hearing proves to be interesting as it may give a much broader picture of how ACS:Law are progressing their cases and it may also help the court to tidy up what sounds (from the last judgment anyway) like something of a mess even from a purely technical perspective. Mildly good news I think.

ACS:Law come unstuck

2010-12-08T16:17:00.001+00:00

Earlier this month ACS:Law suffered a set-back in their campaign against alleged copyright infringement through peer-to-peer file sharing. ACS:Law (or more pedantically, their clients) had tried to obtain judgments in default against 8 defendants, but failed for a variety of reasons in each case. The judge in the Patents County Court criticised the nature of their claim and the way in which the applications were brought — reported as Media C.A.T Limited v A (and others) [2010] EWPCC 17.

Default judgment is a speedy way for claimants to obtain judgment without a trial. In most cases a defendant served with a claim form and particulars of claim is supposed to acknowledge service and then file a defence. If not acknowledgement or defence is forthcoming the claimant can ask the court to give it judgment in default.

This is where ACS:Law start to come unstuck. In 3 of the cases a defence had been filed in court. So default judgment does not apply. In a further 3 of the cases there was no evidence on the court file that the claim form and particulars of claim had been served on the defendant. It is ordinarily the court's job to serve these documents, but there's no presumption that it has. In my practice I have come across situations where some administrative mistake has been made and the court has failed to do so. Whatever the reason, it is bad practice to issue requests for default judgment without checking with the court that no defence has been filed. A slap on the wrist for ACS:Law in my view. As the judge said "The requests for judgment should never have been filed."

There is an easy way and a not so easy way to ask the court for a default judgment. The easy way simply requires the claimant to file a request to the court. The defendant does not have to be informed of the request and will ordinarily know nothing about it. The not so easy way requires a formal application, with evidence, to the court, which must be served on the defendant, who will therefore have an opportunity to defend against it.

The "easy way" is only available where the claim is for one or more of: a specified amount of money, an amount of money to be decided by the court, delivery of goods where the claim form gives the defendant the alternative of paying their value (CPR 12.4). In each case, the claim was not only for damages for copyright infringement (including additional damages for flagrant infringement), interest and costs but also for:

"a permanent injunction pursuant to the inherent jurisdiction of the Court; ordering the defendant to take reasonable steps to safeguard their internet connection being used, either through the defendant's personal computer and/or third parties taking advantage of the defendant's unsecured wireless connection to repeat the infringement of the claimants copyright in the Work(s)."

Ooops. That doesn't appear to comply with CRP 12.4. The judge thought not. ACS:Law ought to have made a formal application rather than merely filed a request and that would have alerted the defendants to the possibility of default judgment and given them an opportunity to respond. The judge had serious doubts as to whether, in peer to peer file sharing cases, default judgment ought to be given on request without a formal application. He said:

In all these circumstances, a default judgment arrived at without notice by means of an essentially administrative procedure, even one restricted to a financial claim, seems to me to be capable of working real injustice.

Most interesting for me are the criticism that the judge made of the way in which the case was pleaded (one assumes by ACS:Law, but certainly on their behalf).

The particulars of claim stated that the claimant "represents" the owner of copyright in the films that were the subject of the claim. Only the owner of the copyright or a licensee (and for a non-exclusive licensee only if certain conditions are met) has a right to sue for copyright infringement. Thus the pleadings were defective.
The allegations relate to unsecured internet connections. It is unclear whether the owner of (say) an open wifi can be held responsible for copyright infringement effected using that connection.
The claimant's plea was that the defendant was guilty of "allowing" copyright infringement, which, as the judge put it, "is simply wrong". The term used by the act is "authorising", which is rather different.

and more of the same. In short: even accepting all of ACS:Law's allegations, they do not appear to have a proper case. To succeed they would at least have to amend their claim, assuming they have a case at all.

A health warning: this decision is made by a county court. It is not, strictly speaking, binding on any future court. It does however illustrate the extremely dubious nature of the claims being put before the court by ACS:Law and will, I hope, encourage defendants to be more confident in resisting them. The list of defects in the pleadings might make a useful basis for an application to strike out against the claimant.

Hat tip to Philippe Bradley for pointing this case out to me.

Francis Davey

Exporting personal data I: introduction (and a small Brexit niggle)

The export of personal data

How exports are controlled

Adequacy

Standard Contractual Clauses

What about Brexit?

Defamation - staying protected

Private copying - a new copyright exception in the UK

Analysis

Own copy

Personal copies

Private use and file lockers

Transfers

Is lending OK?

Restrictions by the copyright owner

Legacy copies

What about compensation?

Copynorm survey - answering some questions

The unexplored

Penniless artists

Intention

The law

The world as it is

Ethics

Free text

Finally

Copying, sharing and remixing - what do you think?

Open up data about justice

Tribunals Service Case Management systems including: ARIA, ETHOS (and Caseflow), GAPs 2, MARTHA, CICA and a set of SQL and Access based systems, and manual case records.

Orphan Works - the new law in the UK

The European Directive

Canada

The United Kingdom

Extended Collective Licensing

Consultation

The defamation bill 2012 and the web

The host's nightmare

What ought to happen?

Clause 10

The single publication rule

Clause 8

The Communications Data Bill (first look)

Communications data

Obtaining communications data

Retaining data​

Filtering

Conclusion

Trolls and the defamation bill 2012

Copyright in industrial art - more protection

Newzbin2 - the order

Can we force facebook to give us its "like" database?

Digital Economy Act appeal: more detail

Digital Economy Act to go to the Court of Appeal

Google's name policy is not illegal

Peer to Patent (UK) launched

Restraining cookies: the new privacy rules

Overview

Detail

Update

Colonel Mustard is not in the Library with a copyright claim form

UPDATE

Don't return your census form early

Phone hacking and copyright

Digital Economy Act Costs - an unlawful Prisoners Dilemma

Background

A technical miscalculation

UPDATE:

Is the Order lawful?

Conclusion

A new kind of copyright? Graphical user interfaces in the ECJ.

ACS:Law - at last, a hearing

ACS:Law come unstuck

Retaining data