Francis Davey

Newzbin2 - the order

2011-10-26T15:28:00.000+01:00

The High Court has just handed down its order in "Newzbin2".

For those not following the story so far goes like this: newzbin (whose site I will not link to for obvious reasons) describe themselves as a "Hand edited, searchable archive of Usenet binary content from the creators of the NZB Format." USENET is of course the grandparent of most peer-to-peer file sharing networks. People were sharing copyright material via USENET even when I started using the internet over 20 years ago. Newzbin do not host any of the material (which is available via USENET) but their site undoubtedly makes it much easier to find copyright infringing material to be downloaded. Unsurprisingly, many large copyright owners do not like it.

Last year, a group of Hollywood studios persuaded Mr Justice Kitchen that Newzbin were guilty of copyright infringement in three different ways (1) their actions amounted to "authorisation" of copyright infringement; (2) they were also joint infringers with or procurers of the infringement of their subscribers; (3) even though they did not host any of the movies complained about they "made them available to the public" which is an act protected by copyright. The case Twentieth Century Fox v Newzbin [2010] EWHC 608 (Ch) makes interesting reading as it explores just how far a website may (or in that case may not) go without infringing copyright.

Newzbin's reaction was to be expected: their operation moved outside the jurisdiction of the UK courts. Undeterred (one hopes they were sufficiently web-savvy to have anticipated the move) the studios applied to the High Court for an injunction against BT to force BT to block access to Newzbin to its (ISP) customers. The studios made use a statutory power given to the High Court to make injunctions of this kind under section 97A of the Copyright Designs and Patents Act 1988.

At the end of July, Mr Justice Arnold agreed to grant the injunction (Twentieth Century Fox v British Telecommunications [2011] EWHC 1981 (Ch) ). Lillian Edwards wrote a very neat analysis of the decision on the day it appeared. As she explains, Newzbin was an unusually good case for an injunction, not least because there had already been a decision of the High Court finding that the site was involved in copyright infringement. Other cases may be more difficult for rights holders to argue. It will depend.

Mr Justice Arnold postponed deciding on the exact form of the injunction — that is exactly what BT should be ordered to do — until he had heard further submissions from the parties. His decision on the form of order was what was handed down today.

A huge simplifying factor is that BT are already running a system known as Cleanfeed which is used to filter out material on the Internet Watch Foundation's list of suspect IP addresses and blacklisted URL's. This meant the order could require BT to add IP addresses and URL's supplied by the studios to its Cleanfeed list.

Cleanfeed is not used with all BT ISP products. In particular it is not used for what is effectively wholesale supply of internet connectivity, nor to particular customers in certain cases — one example being the police who, one imagines, absolutely do wish to be able to access illegal material for investigatory purposes. The order applies "In respect of its customers to whose internet service the system known as Cleanfeed is applied whether optionally or otherwise". Read literally that would appear to mean that customers who have Cleanfeed as an option but have opted out would still have to be filtered by BT. It is unclear to me whether that is what the judge intends.

The order makes it clear that BT is not required to carry out deep packet inspection. BT need simply rely on the IP addresses and URL's reported to it by the studios, but this, in my view, leads to the most serious defect in the order: it relies entirely on the good faith and judgment of the studios. There is no sanction for mis-reporting of websites. Since there is no requirement to publish the list of sites supplied to BT or to notify site owners that they have been placed on the list, it may be difficult to ensure that the studios act fairly and properly.

BT did try to obtain what is known as a cross-undertaking or an indemnity from the studios which would have compensated BT for any loss it suffered as a result of any mistakes made by the studios. The judge rejected that request on the basis that, as he decided, BT could not be liable for damages (eg by being sued by its customers) because it was acting under a court order. That will no doubt be a useful decision for ISP's and web service providers in other situations, but it did mean there was no basis for imposing any sanction on the studios for supplying incorrect sites in its list.

There was some argument as to how precisely the list should be described. In order to ensure that it would be difficult to circumvent the order, the judge decided that the order would apply to not only the newzbin website itself but also to "any other IP address or URL whose sole or predominant purpose is to enable or facilitate access to the Newzbin2 website". Here we see one of the weaknesses of section 97A. It gives the High Court the power to grant an injunction but it fails completely to say what kind of an injunction that might be. In particular it does not say that the injunction should be restricted to preventing access to sites where copyright is being infringed (like Newzbin). I am therefore concerned about whether the combination of the wording of the order and lack of sanction on studios may cause problems at a later date.

The other significant issue was costs. While costs (which lawyers get very excited about) may not seem as interesting as arguments about what should be blocked and how, costs are often as expensive to a party as the consequences of losing (or winning) a claim. Costs are a big deal. One positive outcome of the decision is that BT was entitled to be paid its legal costs for the first part of the claim up to 16 December 2010 - in other words the costs that would have to be incurred to obtain a court order. In the future ISP's can be reasonably confident that they can demand a court order before instituting website blocking and not expect to have to pay the costs of that order. The judge found that BT should pay the costs of the contested part of the proceedings, but that each party would bear its own costs for the decision about the final order.

In conclusion, I have two points to make: first, it is now clear that copyright owners are perfectly able to obtain quite favourable court orders to block websites, so that there was really no need for the Digital Economy Act 2010 to introduce more website blocking provisions when the existing ones (in section 97A) had not been properly tried out. Second, other cases may not work out the same way as this one. For example TalkTalk do not run Cleanfeed. One expects that the argument (and subsequent order) in a case against TalkTalk might be a little different for that reason. We will see.

Can we force facebook to give us its "like" database?

2011-10-20T09:45:00.000+01:00

Jim Killock of the Open Rights Group pointed me at an interesting response made by facebook to an Irish student named Max's subject access request under Irish data protection legislation which forms a part of the Europe versus facebook campaign.

The particular point that interests me is that, concerns facebook's tracking of all pages visited which show a "like" button - a practice that can be really intrusive. Although Max did obtain a considerable quantity of information, facebook did not release to him their list of "like" tracked data.

In their response facebook say:

Section 4(12) of the Acts carves out an exception to subject access requests where the disclosures in response would adversely affect trade secrets or intellectual property. We have not provided any information to you which is a trade secret or intellectual property of Facebook Ireland Limited or its licensors.

Unfortunately for facebook, that isn't quite what the relevant Irish legislation appears to say (health warning: I am not an Irish lawyer). What section 4(12) of the Irish Data Protection Act 1988 says, according to a consolidated version of the statute, is:

(12) Subsection (1)(a)(iv) of this section is not to be regarded as requiring the provision of information as to the logic involved in the taking of a decision if and to the extent only that such provision would adversely affect trade secrets or intellectual property (in particular any copyright protecting computer software).

Note the phrase "information as to the logic involved in the taking of a decision". What this is all about is that section 4 gives data subject several different rights. One right (in section 4(1)(iii)(I)) is to be supplied with a copy of "the information constituting any personal data of which that individual is the data subject" - a simple right to information. Another, and different right, can be found in section 4(1)(iv) which applies to automatic decision making by the data controller. Here the data subject has a right to be informed of the "logic involve in the processing". Obviously that's quite a different right since it is essentially a right to know about algorithms rather than data.

Quite clearly section 4(12) is a restriction on the right under 4(1)(iv) to know about the logic of automatic decision making and not a restriction on the right of information simplicter. Nice try facebook, but I can't see that working.

Our own legislation is very slightly different. We also have a right (in section 7(1)(d) of the Data Protection Act 1998 to be informed about the logic involved in automatic decision making, but the restriction on that right is limited to trade secrets. Section 8(5) says:

Section 7(1)(d) is not to be regarded as requiring the provision of information as to the logic involved in any decision-taking if, and to the extent that, the information constitutes a trade secret.

So that any UK national involved in the Europe v facebook campaign has a much stronger argument.

In any case, at best facebook can claim a database right over the contents of the list of pages visited by Max that they have collected using the "like" button. The database right is a creature of European law (directive 96/9/EC). Recital 48 of the directive states that "the provisions of this Directive are without prejudice to data protection legislation", which seems to me to argue that data protection law ought to trump database right. If you think about it, the contrary would be an impossible situation. Personal data will often be protected by database rights. If you could use database rights to avoid subject access requests they would be of far less use.

Digital Economy Act appeal: more detail

2011-10-10T17:06:00.000+01:00

As I said on Saturday, TalkTalk and BT have obtained permission to appeal to the Court of Appeal in their judicial review of the Digital Economy Act 2010 ("the DEA").

Thanks to the counsel for the appellants I now have a little more information. The appeal is going forward on essentially the first four grounds that were put forward at the original judicial review hearing. The appellants did not appeal on the fifth ground: proportionality. I thought it might be useful, at this stage, to give an extremely rough outline of those four grounds.

The first objection concerns the Technical Standards Directive (83/189/EEC), the aim of which is that any laws that impose technical standards on goods or services (known as "technical standards" and "rules on services") are reported to the European Commission in enough time for the impact of the proposed law on intra-community trade to be assessed and any objections to be raised. This is known as the "standstill period". Failure to comply with the procedure renders the relevant law unenforceable.

The appellants say: "The DEA is a technical standard and/or rule on services; it wasn't notified to the Commission before it was passed, therefore it is void. The government responds: "No it isn't! Its not nearly detailed enough to be a technical standard etc at this stage, you have to wait for all the little statutory instruments we are going to make under it before there's enough detail to need notification."

The second ground concerns the E-Commerce Directive. As readers may know, this gives various kinds of immunity to providers of "information society services" and in particular to ISP's who, as "mere conduits", are not liable for the information that they transmit.

The appellants case is that the DEA does impose liability for information transmitted and/or it imposes a requirement to remove or disable access to information. Neither of these, they say, can be imposed on a mere conduit. In the High Court, the appellants also argued that the DEA imposed a "general obligation to monitor" which is forbidden by article 15 of the directive. That argument is no longer live - I think (though I may have misunderstood this) because the Court of Appeal did not give permission on that point.

The third ground is based on the Directive on Privacy and Electronic Communications (2002/58/EC) which (amongst other things) imposes conditions on the processing of traffic data by ISP's. Ordinarily, traffic data must be anonymised or erased when it is no longer needed for the purposes of transmission, except for certain limited exceptions and derogations. The appellants case is that the DEA's purpose does not fall within any of those exceptions or derogations and so keeping the traffic data in order to enforce copyright is not permitted.

The last of the four grounds is built on the Authorisation Directive. The Authorisation Directive was aimed at opening up the electronic communications sector to competition by preventing member states from imposing onerous conditions on prospective comms providers. To that end, a member state may not charge a prospective ISP fees, or impose conditions on them, unless authorised to do so by the directive. The appellants say that is exactly what the DEA does, or will do, and that the DEA therefore offends against the Authorisation Directive. The appellants won a partial victory on this point in the High Court, managing to knock out a requirement that they pay a share of OFCOM's fees for managing the initial obligations code.

I am extremely pleased that permission has been given. Being optimistic, I can hope that light will be thrown - possibly even by the CJEU if the Court of Appeal consults it - on any one of these directives. They are all of some importance in my practice and so I am understandably keen to see as much clarity as possible. With four directives to chose from there's every chance that some useful principles will come out of this case.

In any event, it means that the "graduated response" intended by the DEA is going to be just that farther in the future. In related news, Julian Hupper (Liberal Democrat MP for Cambridge) has tweeted his plan to try to have the web blocking provision (section 17) of the DEA repealed. The government have already indicated that they are unlikely to use section 17 in the foreseeable future, so this may be uncontroversial. I will watch events with interest as they unfold.

Digital Economy Act to go to the Court of Appeal

2011-10-08T16:12:00.000+01:00

Yesterday, the Court of Appeal gave BT and TalkTalk permission to appeal to the Court of Appeal. I do not have any more details - in particular what was the reasoning of the court and what on what grounds will the appeal be argued. I hope to blog about them as soon as they become available.

Earlier this year, the Court of Appeal, in the form of Buxton LJ, had refused permission to appeal, leading to some rather misleading press coverage such as the Guardian's "Court of appeal's decision means long-running battle by UK's biggest ISPs is effectively over". Not so of course.

Unless the Court of Appeal thinks that an application for permission is "totally without merit", a prospective appellant may always renew an application for permission orally, under CPR 52.3. This, is, I understand, what BT and TalkTalk did.

Google's name policy is not illegal

2011-07-26T09:15:00.000+01:00

This is a quick response to a google+ post suggesting that google's "real name" policy is contrary to the Privacy and Electronic Communications (EC Directive) Regulations 2003.

The post is, I'm afraid, quite wrong. The poster relies on regulation 18 which controls the compilation of any "directory of subscribers". It gives various rights which depend on the nature of the directory (telephone or not) and the nature of the person included (individual or corporation) which might allow opting out or require opting in and so on.

Regulation 18 only applies to a "directory of subscribers". The term "subscriber" is defined in regulation 2 to mean "a person who is a party to a contract with a provider of public electronic communications services for the supply of such services". A "public electronic communications service" is defined in section 151 of the Communications Act 2003 to mean "any electronic communications service that is provided so as to be available for use by members of the public" and "electronic communications service" is defined in section 32 of the same act to mean "a service consisting in, or having as its principal feature, the conveyance by means of an electronic communications network of signals, except in so far as it is a content service".

So: google+ is not a public communications provider and hence its members are not subscribers. Regulation 18 does not apply.

As far as I can tell, there is no regulatory reason why google+ should not operate a "real name" policy. They would have to be a little careful about the implementation of the policy within the EU in case they fall foul of European discrimination law. If, for instance, they ended up systematically blocking individuals from one racial group significantly more than those from another because their real names seemed too odd to google employees, that might amount to racial dscrimination. As readers will know, some ethnic groups prefer to have a single name, rather than a forename + surname model.

But that depends on how the policy is implemented, not the policy itself. So I would suggest not contacting the ICO who is already quite busy.

Peer to Patent (UK) launched

2011-06-01T10:17:00.000+01:00

The UK's Intellectual Property Office has launched a website that allows members of the public to supply prior art (and comment on) for pending patent applications. Peer to Patent is an idea that was piloted in the United States (with a second pilot ongoing). A pilot in Australia also ran for a six month pilot from December 2009. I do not know what plans there are for continuing it. The "prior art" or, strictly speaking, the "state of the art" is a central concept in patent law. In the UK, section 2 of the Patents Act 1977 ("novelty") explains that an invention is only "new" (and therefore patentable) if it is not already part of the state of the art. Section 3 ("inventive step") relies on the state of the art (or at least part of it) in defining whether or not a patent contains an inventive step (again without which it will not be patentable). The problem that peer-to-patent seems to be trying to solve is to give patent examiners access to that prior art. There is no "prior art" database that an examiner can simply search. They can try looking at past patents which certainly contain a great deal of prior art, but an invention may not have been patented — particularly in an area of industry which is new or in which patents were not traditionally sought. Computer software patents are a prime example of this. In Australia one patent examiner commented:

I would say that the [Peer-to-Patent Australia prior art] documents were of greater relevance than those found during the initial search. I think they were somewhat helpful for this particular application, in which the claims were drafted using broad terminology, which was difficult to search.

So, patent examiners do appear to be finding it useful. An earlier blog post by the IPKAT on the subject attracted some negative comments. They seem overly cynical to me. The US and Australian experiences do seem to suggest that patent examiners like it and that more prior art is being exposed at an earlier stage which must be a good thing. Now, I am sceptical that the patent system (either in the UK or the world) does what it is supposed to do. For example, the very high cost of bringing or defending patent proceedings means that practice and theory diverge considerably. There are numerous other criticisms that one might reasonably levy. But, sceptic or not, I welcome anything that tries to make the system better, even if its very modest indeed. I would encourage anyone with specialist knowledge of the patents on offer to engage. Of course, really they need a badge system. Maybe it will come.

Restraining cookies: the new privacy rules

2011-05-17T15:08:00.003+01:00

On 26th May 2011, a new law — the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 — comes into force which will change fundamentally the legal regime governing cookies and other similar locally stored data. As I will explain, the legal change is a big deal, but the practical effect may, at least in the short term, be small.

The Information Commissioner has published some useful practical guidelines (alas only as a PDF). They are not definitive (so they may not protect you in the unlikely event someone tries to sue you for damages caused by a breach of the regulations) but since the Information Commissioner (or his office at least) has the primary role in enforcing the regulations, complying with his guidelines will go a long way to avoiding any possible legal repercussions. If you have a short attention span and wish to read only one thing about the new cookie law then I'd advise you go there (see you another time and thanks for visiting).

The new rules apply to storing (or accessing information stored) on a public network user's computer. That includes not only cookies and "flash cookies" but any other information that might be stored on a local computer, for example they would certainly apply to the iPhone's storage of location data. For brevity I'll talk about cookies, storing cookies but all that follows applies much wider than that.

Overview

The amended regulation 6 will forbid anyone from storing cookies unless one of the following applies:

the user has given their prior, informed, consent (an opt out is no good)
it is for the sole purpose of "carrying out the transmission of a communication"
it is strictly necessary for the provision of an information society service that was requested by the user

In practice this means that, except in very limited circumstances, prior explicit permission will need to be given by a user before using cookies. The limited circumstances might include situations where the illusion of a session (http being stateless) is needed in order to provide the user with the service they want, for example via a "shopping cart".

Tracking what a user does (eg with a tool like google analytics) or supplying additional services they might want (eg "other users also bought...") would not be for a service "requested by the user" and so would need consent.

Consent may be given by the user explicitly setting their browser to accept cookies. At the moment most browsers will, by default, accept cookies and so it is not, at present, realistic to rely on a user's browser settings to gain the necessary consent. Browser technology may change to make such a reliance tenable and I expect there to be some pressure in that direction.

Clauses in a website's terms and conditions which do not have to be explicitly accepted by a user (for example because they are linked to at the bottom of a page) are, in my view, also not going to be any good.

One small consolation to online service providers is that the ICO has said that in the early stages of this new law all he will look for is a plan to get things right, rather than expect 100% compliance from 26th May. That isn't an excuse to be complacent, but does give some breathing space.

Detail

The origin of the new law is in an amendment to the directive on privacy and electronic communications (directive 2002/58/EC). There doesn't appear to be a consolidated version in html format online, but for the purposes of this post all we care about is replace article 5(3) which was added by directive and reads:

3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

One one analysis it is not the web server (and thus the operator of the server) who stores or gains access to cookies on a user's machine, rather the server returns a "Set-Cookie" response which a web browser has no obligation to honour. It is also the web browser that transmits the value of a cookie back to the web server.

The directive is not intended to be understood in so narrow a sense. Only a small minority of web users understand how http works. The majority will not realise that information is being stored by their web browser on someone else's behalf. It is clearly the risks associated with this lack of knowledge that the directive aims to address. Recital 24 says:

(24) Terminal equipment of users of electronic communications networks and any information stored on such equipment are part of the private sphere of the users requiring protection under the European Convention for the Protection of Human Rights and Fundamental Freedoms. So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The use of such devices should be allowed only for legitimate purposes, with the knowledge of the users concerned.

Recital 25 makes it clear that "cookies" are one such device. It concedes that they can be legitimate and useful but that any use must be with informed consent.

Article 5(3) is very broad in its application. It catches storage on any "terminal equipment" (so mobile devices as well as traditional PC's) and is not restricted to the web or web browsers. The terminal equipment need only belong to a "user" which is defined in article 2(a) as anyone using the network for private or business purposes. So it does not seem to be possible to agree with a subscriber to (say) an ISP or mobile phone service in advance that they consent to the storage of cookies etc on any terminal equipment using their connection if others might use it with different equipment.

The only obvious restrictions to 5(3) are:

It only applies to services available over public communication networks and so does not apply to (i) private network services or (ii) to gaining access to a computer without using a network at all.
Unsurprisingly, member states are allowed to create their own exceptions where necessary for the purposes of public security, defence and the prevention of crime. Just such an exception was made by the UK in regulation 28 .

Who is responsible? For example, at present I publish this blog using google's blogger service. If google choose (say) to track those reading my blog using cookies without my asking them to, what then? In my view it is the service provider (in this case google) that is carrying out the unlawful activity rather than I, although if I have expressly asked them to do so, then we may both be responsible. If, on the other hand, my blog was made available on a "dumber" hosting service - for example if I installed my own wordpress isntance on a server on which I had shell access and I decided to use cookies, then it would be I, not the provider of my shell access account, who would have to take care of the legalities.

There are two ways that a user (or subscriber)'s rights may be enforced. First by the information commissioner in much the same way as data protection obligations are enforced. Second, regulation 30 permits an individual who has suffered damages as a result of a breach (who might not be the user or subscriber whose equipment was accessed) to bring a claim for damages against the person who committed the breach. There is a defence of reasonable care against such a claim.

So, where cookies are used to illicitly track an individual's preferences and sold to advertisers to allow advertising to be targeted, there is unlikely to be any actual damage and enforcement would have to be by the information commissioner. By contrast, where the use of cookies results in someone's bank details being obtained by a third party (entirely possible with some of the more poorly written systems out there) there may well be financial loss and a right of action. In practice I don't expect to see very many claims, interesting though they would be.

Update

An anonymous commenter asks about other forms of content stored by a web browser. A web browser will almost always store the http response(s) to any request. Some of the information contained in that response may be sent back to the server. A simple example being the value of any fields set in an HTML form, but there are many other, in some cases very sophisticated, mechanisms for doing the same thing. Even the URL in an href attribute can be used to store information — as those with long web memories will recall, one of the earliest example applications using HTML created a noughts and crosses game doing just that.

I suspect that the courts will read the directive as applying only to data stored on a user's computer that can (in principle) be later retrieved by the person storing it or by some other third party. It seems to me that the directive is intended at that kind of mischief which arises where someone or some people track what a user does and keep secret information about them that they can use for their own purposes. Of course there are still risks if information is stored without your knowledge even if it is accessible only to the user of the computer, so the courts may decide to read the directive more widely than that.

Most of these forms of storage will be lawful because they are strictly necessary to provide the service sought by the user. HTML stored by the browser which is displayed to the user is a necessary part of browsing any web page. Ditto where form fields are used for any kind of web transaction such as logging in or purchasing a product. The service can't be supplied without some local state being maintained one way or another. The user will expect it to be so.

On the other hand, keeping a complicated session key that tracks (or allows the tracking) of the user's behaviour without forming part of the functionality the user wanted, would, in my view, fall foul of the directive and need express consent. The fact that cookies aren't used is irrelevant.

Colonel Mustard is not in the Library with a copyright claim form

2011-03-15T00:16:00.004Z

My friend Sym came up with a neat joke:

Playing Big Society Cluedo. It's easier than normal Cluedo because there isn't a library.

and promptly tweeted it. Much retweeted it ended up being used by the BBC's Now Show, without attribution of any kind. Sym is a generous soul and I doubt that worried him too much but he mentioned it on his (private) facebook wall.

As regular readers will know I'm not exactly a copyright maximalist, but I do find it unattractive that large and powerful organisations that would certainly pursue you if you used their intellectual property appear to be quite happy to use other people's so long as those other people are too small to matter very much. I jokingly suggested I'd help draft his claim form and that lead him to wondering whether there could be any copyright in so slight a thing as a tweeted joke.

Unsurprisingly there are lots of answers on the internet, as a cursory google search will show. One site says categorically "no"; an article in the WIPO magazine thinks "it depends" and there's even a site called canyoucopyrightatweet.com written by a US attorney which again comes down on the side of "it depends". Unfortunately all the really detailed discussion relates to US law, not European or English law. While there's some internationally harmonisation of copyright, there are still significant differences.

So, what of English law. Well, English copyright protects, amongst other things any "original literary work". Most tweets are not going to be original - in fact in many cases that is the whole point - but some, like Sym's joke, seem quite capable of being so. Certainly, I am quite sure that he came up with the joke first.

A "literary work" does not have to be high art. Indeed section 3 of the Copyright, Designs and Patents Act 1988 says that a

“literary work” means any work, other than a dramatic or musical work, which is written, spoken or sung

so its really quite a broad term. In a relatively recent case which rejected a claim for copyright in the names of commands for an airline booking system, Mr Justice Pumfrey was quite clear that single words, at least on their own, could not be copyrighted. In the 2009 Infopaq case, the European Court of Justice were prepared to accept that an 11 word textual extract could be the subject of copyright and last year in the case of Meltwater Mrs Justice Proudman agreed that, whatever might have been the position under English law, the decision in Infopaq made it plain that as a matter of European law copyright could exist in newspaper headlines provided they were original enough.

So it seems to me that a tweet, provided it is sufficiently original, can be the subject of copyright.

But as I said in an earlier post the existence of copyright is only half the question. What would or would not infringe a short humorous tweet? I haven't heard the particular episode of the Now Show in question but if they read it out they have certainly infringed (and twitter's terms of service don't appear to let them off the hook). If, on the other hand, they only paraphrased the joke, the question is more difficult. Sym might be able to claim ownership of the particular expression of his joke, but he cannot copyright the idea that lies behind it. That idea is free and open to all.

The difficulty with this neat distinction (called the "idea/expression dichotomy") is that courts recognise that you can infringe by copying something more abstract than the exact words used. This should be obvious when you consider that a translation of a work (which will usually use quite different words, unless its into "pirate") is a potential infringement of the original work. Too close a copy of the plot or characterisation in a play (say) would be an infringement even if there had been a good deal of rewriting and reworking.

How on earth this would apply to something as small and neat as a tweet is anybody's guess. I suspect that it is only a matter of time before someone tries to test the question.

UPDATE

In the comments, Sym has helpfully provided the quote from the Now Show:

Someone amused me no end on twitter the other day, ok, when they answered twitter's question 'what are you doing?' by writing: "I'm playing big society cluedo, it's easier than normal cluedo because there isn't a library"

Clearly, if there is copyright in the tweet, this looks like a potential infringement because the whole tweet has been copied pretty much verbatim. But, could there be a defence. There is, of course, no such thing as "fair use" in English law. But quoting a tweet could be "fair dealing for purposes of criticism or review" which is a defence under section 30 of the Copyright, Designs and Patents Act 1988. This requires that:

the use is fair dealing
the purpose of the use is criticism or review of a work (not necessarily the work quoted) or works
the use is accompanied by sufficient acknowledgement

Normally it would not be "fair dealing" to use the whole of a work, but where the work is as short as a tweet it is likely to be impossible to use it critically in any meaningful way without quoting the whole of it. "Someone amused me" probably counts as "criticism".

What about attribution? Section 178 of the act defines "sufficient acknowledgement" as "an acknowledgement identifying the work in question by its title or other description, and identifying the author". "Someone" doesn't seem like enough to me. Although its just possible to argue that "Someone" means "Someone on twitter" and that it is thereby possible identify the author by searching on twitter for the origin of the tweet. Seems like a long shot to me.

Update: I realise with some embarrassment that I didn't link to Lillian Edward's blogpost on this very question.

Don't return your census form early

2011-03-13T10:50:00.000Z

This seems a topic that has generated much discussion, so I thought I'd comment on it.

In the United Kingdom we are having a census on Sunday 27th March 2011. It can be completed online or by sending back a census form that has been delivered to most households by now. The census is being carried out by the Office for National Statistics (ONS). Their website says, under the heading "When to return the questionnaire":

Census day is Sunday 27 March. Your answers should be about your household on this day. Please submit or return your completed questionnaire before, on or after this date.

On any analysis that seems a bit odd. Surely you should only be returning your census form after the date of the census since, though you can have a pretty good guess what the answers to the many questions might be, you can't know for certain.

As far as I can see, the ONS is simply wrong to suggest that early return is OK. This Census is governed by the Census (England) Regulations 2010, regulation 10 of which states:

10.—(1) Every prescribed person to whom a household pack has been delivered or on whose behalf delivery was taken under these Regulations must, on the day after census day or as soon after as is reasonably practicable—

(a)complete the copy of questionnaire H1 included in the pack, place it in the reply-paid envelope provided and send the questionnaire to the Authority by post; or

(b)return the information requested by questionnaire H1 electronically using such an electronic system as the Authority may provide for this purpose and in accordance with the instructions included in the accompanying pack.

Which quite clearly does not allow an early census return. Failure to comply with regulation 10 is made a criminal offence (albeit a very minor one) by section 8 of the Census Act 1920. There doesn't appear to be, in the regulations or the act, any power for the ONS to disapply these provisions or vary when the census returns may be made.

I'm not a census lawyer, so maybe I'm missing something here. What's more I doubt that it would be easy to prosecute someone for doing what the ONS has precisely told them to do. It still seems to me to be an odd way to run a census.

Phone hacking and copyright

2011-03-04T16:32:00.001Z

Hugo at the 1709 blog asks a question about a recent case involving 2 of those who may have been victims in the News of the World phone hacking affair (as wikipedia calls it). Before I try to answer the question, some background.

From information obtained from the Metropolitan Police, Andrew Gray and Steve Coogan both suspected that their voicemail had been accessed by Glenn Mulcaire, the private investigator at the centre of the affair. They sued him — apparently for breach of confidence.

The claimants felt that the Mr Mulcaire's defence left a lot more questions unanswered. For example who had instructed him to intercept voicemails; to whom had he passed on the information; and who else had he been targeting. In order to press him further they each made a request for information asking him a number of questions which, unsurprisingly, he did not appear to wish to answer. In order to resist answering the claimants' requests, Mr Mulcaire relied on the common law right not to be required to answer questions that might incriminate oneself.

The right, known as the "privilege against self-incrimination" is not an absolute one. There are a number of statutory exceptions to it. For example section 31 of the Theft Act 1968 prevents someone from relying on the privilege in proceedings for recovery of property (where things they say might well implicate them in a charge of theft). In a similar manner, section 72 of the Senior Courts Act 1981, lifts the privilege in "proceedings for infringement of rights pertaining to any intellectual property or for passing off".

The phrase "intellectual property" means different things to different people and is much misused. There is no single statutory definition either. I found it interested to read that the court was shown a sample of 20 different enactments where "intellectual property" is defined in different ways and for different purposes and, in the Income Tax Act 2007, in three different parts of the same act. In section 72 it is defined thus:

"intellectual property" means any patent, trade mark, copyright, design right, registered design, technical or commercial information or other intellectual property;

Now the defendants contended that "commercial information" meant only commercial information which was protectable as intellectual property (for which see the other items in the list). The claimants (correctly in my view) said this didn't make sense — obviously what was meant was an extended definition to include "normal" intellectual property of the kind we are used to talking about such as copyright but extended to cover things that would normally not be treated as intellectual property, such as commercial information.

Mr Justice Vos agreed. The defendant lost his privilege and the claimants were allowed to ask some of their questions. Others, the judge thought, were not strictly relevant and constituted "a fishing expedition" (as lawyers call it). An earlier and very similar case, this time involving Nicola Phillips as the victim, had already been decided in the same way and headed to the Court of Appeal. The hope is that all three cases will be joined on appeal and a decision given.

Given how topical phone hacking has been, and the fact that many readers of this blog are involved in industries where confidential information could be intercepted wrongly, I thought this was an interesting case to talk about.

Now to Hugo's question. He asks the question that may be in some of your lips: why didn't the claimants bring a claim for infringement of copyright? Then there would have been no doubt about the application of section 72 and no need to have the argument in the first place. He asks:

Could the claimants simply have relied on the argument that Mulcaire had in any case infringed copyright in sound recordings by recording and transcribing the voicemails? Copyright in sound recordings is owned by their ‘producer’, who is ‘the person by whom the arrangements necessary for the making of the sound recording are undertaken’. Would this be Steve Coogan and Andrew Gray – or would it be Vodafone?

Note that we aren't interested in copyright in the words that were recorded on the victims' voice mail. Even if they qualified for copyright protection — one assumes that "hi, its me" probably does not, whereas something with more substance probably does — the person who left the message would be the author of the words and therefore the copyright would belong to the caller or their employer.

Copyright does protect sound recordings, though for a shorter period than copyright in literary, musical or dramatic works. As Hugo points out, section 9 of the Copyright Act makes the "producer" of a sound recording its "author" (and therefore potential first owner of the copyright) and section 178 gives us the definition.

The nearest authority I can think of is A&M Records v Video Collection International [1995] EMLR 25 which concerned the ownership of an arrangement of "Let's Face the Music and Dance" created for Torvill and Dean's 1994 competition entry. The skater's agent asked a conductor to do the job. He found an arranger, paid for an arrangement of the work suitable for the skaters and then conducted it in a studio he had hired with an orchestra he had put together. The court found that while the conductor had clearly made the recording, it was the agent who had made the "arrangements necessary for the making of the sound recording". I thin this indicates that the courts take a high level view of "producership" and so it would be Mr Gray and Mr Coogan who made the arrangements and were the "producers" even if everything else was done by their mobile telephone company.

But wait, the story doesn't end there. There's no point asking whether something is protected by copyright, without also asking whether there has been infringement. In this case, if Mr Mulcaire had transcribed the telephone conversations, rather than just listened to them and made notes of the facts contained in them, would he have "copied" them? We are all used to the extended definition that section 17 gives to copying of a literary, dramatic, musical or artistic work, which includes "reproducing the work in any material form", but there is no such extended definition for sound recordings. To transcribe a sound recording is not to "copy" it since no new sound recording is made.

So, Mr Mulcaire might have infringed the copyright in the words recorded but that copyright didn't belong to Messrs Gray and Coogan. They probably did own the sound recording copyright, but that wasn't infringed. Their lawyers obviously did know what they were doing (as we suspected) in only suing for breach of confidence. If there's a moral here its that having multiple copyrights in the same "thing" makes for a more complicated analysis.

Digital Economy Act Costs - an unlawful Prisoners Dilemma

2011-01-27T23:35:00.001Z

On 17 January 2010, the draft Online Infringement of Copyright (Initial Obligations) (Sharing of Costs) Order 2011 was laid before parliament. It is the first substantive item of secondary legislation made under the Digital Economy Act 2010 and concerns about the simplest thing possible: how much copyright owners and ISP's will have to pay under the Initial Obligations Code (IOC). Despite its simplicity it has been misdrafted and it may also be unlawful.

Background

In case you haven't been following (and why should you?), the Initial Obligations Code is intended to allow copyright owners to send "copyright infringement reports" or CIR's to ISP's, that allege, roughly speaking, that the copyright owner has reason to believe that there has been some copyright infringement associated with one of the ISP's IP addresses. Some of these reports (which and how many to be determined by later legislation) must then be reported by the ISP to its subscriber. If a subscriber collects enough CIR's over a certain period of time (again to be determined) their IP address will go on a list which the copyright owner can then demand from the ISP which will (in theory at least) allow the copyright owner to match up different CIR's to the same subscriber.

There is no such thing as a free lunch. All this has to be paid for. OFCOM which polices the system will need funds to do so, ISP's will incur costs processing CIR's and there will also be an appeal system for subscribers who believe that a CIR was given wrongly which will have to be paid for. The Order is intended to split the cost 75:25 as between copyright owners and ISP's.

I want to avoid engaging in a discussion as to whether the principle of the act is a useful way to encourage people to stop infringing copyright, or a hopelessly misguided waste of time for everybody. I think my views on that are sufficiently well known. What interests me is whether there is anything technically wrong with the order itself, and I think there may be.

A technical miscalculation

Copyright owners are supposed to pay ISP's 75% of the costs that (OFCOM thinks) they will incur in handling the CIR's. OFCOM sets a rate per CIR that copyright owners must pay, which it can change from time to time. Copyright owners pay in advance, and this is where things come unstuck.

Paragraph 2 of the Order's schedule requires the copyright owner to notify in advance any ISP to which it intends to submit CIR's and give an estimate of the number of CIR's it expects to be submitting. Before the start of each notification period, the copyright owner must submit another estimate for the coming notification period and then pay the rate set by OFCOM multiplied by:

(a)the number of copyright infringement reports which the qualifying copyright owner estimates it will make to the qualifying internet service provider under the Code during the notification period; less
(b)the difference between the number of copyright infringement reports which that qualifying copyright owner estimated it would make to that qualifying internet service provider under the Code in the previous notification period and the number it actually made to that qualifying internet service provider in that period, if lower.

Read that carefully. It means that if the copyright owner systematically under estimates the number of CIR's, it will never have to pay the difference. Indeed there is nothing to stop the copyright owner giving an estimate of "1" in each year and paying the fee for exactly one report.

The proportion of fees payable by any copyright owner (or ISP for that matter) to OFCOM are also based on the copyright owner's estimates. The actual number of CIR's submitted never enters into the calculation. This amounts to a zero-sum game between all copyright owners. Each will have an incentive to submit the lowest estimates possible.

Unless I have completely misread the Order this seems quite mad and must (surely) be the result of a misdraft.

UPDATE:

I have been told that OFCOM stated at a stakeholders' meeting that the initial obligations code would limit the number of CIR's a copyright owner could submit in any notification period to the number it had estimated at the start of that period. This would be a change from the draft code published last year and is as suggested by Malcolm Hutty in the comments below.

This does avoid the strong incentive to underestimate the number of CIR's to be submitted, but it does not leave the scheme in a satisfactory state. It is still the case that fees payable to OFCOM are based on estimates and not reality. While that will penalise a copyright owner that overestimates, it will also penalise any ISP that receives an over-estimate of CIR's. The ISP's have no recourse in such a situation.

There is nothing in the Act that prevents the costs regime from dealing with reality and apportioning costs according to actual use (with balancing payments where necessary). OFCOM's suggestion looks like a quick and dirty bug fix, rather than a well thought through statement of policy.

Is the Order lawful?

According to James Firth, it appears that a different concern has been raised by the European Commission. Does the rule on cost sharing comply with the the "Authorisation Directive" (2002/20/EC).

The Authorisation Directive is, as EU directives go, pretty straightforward. The idea behind it is that regulation of those wishing to offer public communication networks should be extremely lightweight. Member States may regulate, but only within fairly tightly defined limits. In particular they may only impose conditions on the operator of a public communications network that fall within one of a list of type of condition (found in Annex A of the Directive).

The list is fairly long, but much of it is pretty common sense. There are only two which could plausibly allow the UK via OFCOM to make ISP's pay for the operation of the Initial Obligations Code.

First, which is what is being referred to in James's post, the UK (via OFCOM) could require ISP's to pay "administrative charges" in order to be authorised to operate a public communications network. Article 12 of the Directive makes it quite clear that "administrative charges" must be just that — charges for the administration of the general authorisation scheme for public communication networks. That does not include an obligation to pay for an appeals body to hear subscriber appeals or money to OFCOM to monitor and run a scheme for assisting copyright owners enforce their rights.

Second, it is permissible to impose a condition restricting the transmission of "illegal content" (such as content which infringes copyright) and "harmful content" (such as indecent images of children). It seems to me that the CIR/initial obligations scheme of the Digital Economy Act 2010 is not a "restriction" on the transmission of illegal content, but something quite different. What is more, a requirement to pay fees cannot be a "restriction" even on a fairly relaxed reading of the Directive.

In other words I cannot see anything in the Authorisation Directive that could allow the UK to impose a requirement to pay for the initial obligations scheme that is compatible with the Authorisation Directive. Unless I am missing something, the Order, as it stands is unlawful.

Interestingly, the 1709 blog asks whether the Order complies with the Technical Standards Directive and suggests that it does, because the imposition of fees and costs under the Order is a restriction permitted by the Authorisation Directive. Alas, whatever view one might take about technical standards, I don't believe the Order complies with the Authorisation Directive.

Conclusion

The Order isn't really news and I am sure the government believes they are complying with the Authorisation Directive. We disagree and only time (and perhaps the ECJ) will tell, but it does worry me that in this already contentious area the first piece of subordinate legislation is already buggy.

A new kind of copyright? Graphical user interfaces in the ECJ.

2011-01-03T17:10:00.000Z

A decision of the European Court of Justice published before Christmas concerning whether a graphical user interface is protected by copyright causes me concern. I have not seen any detailed analysis of the decision which may be due to Christmas and New Year stupor. I plead the same excuse for what follows.

The case Bezpečnostní‌ softwarová‌ asociace‌ –‌ Svaz‌·softwarové‌ ochrany v Ministerstvo kultury C-393/09 has a rather involved background an excellent account of which is provided by Martin Husovec on his blog. Very roughly speaking, a Czech organisation called the Security Software Association (BSA) wished to set up a collective licensing scheme for computer software which included the right to transmit works by cable television. The point in issue was whether the broadcast of the graphical user interface of a computer program could infringe copyright (and would therefore require licensing).

Copyright in computer programs was harmonised across the EU under the Software Directive (91/250/EEC). Article 1(2) applies the directive to "the expression in any form of a computer program". The first question referred to the ECJ was whether a graphical user interface could be described as a computer program "in any form". The ECJ said "no". One fact influencing the court was that Article 10(1) of the TRIPS Agreement requires the protection of computer programs "whether in source or object code". Clearly source and object code are examples of forms of expression of a computer program.

Similarly the 7th recital to the directive states that the term "computer program" also includes "preparatory design work leading to the development of a computer program provided that the nature of the preparatory work is such that a computer program can result from it at a later stage". The common element of these examples, thought the court, was that they lead to the reproduction or creation of a computer program. A graphical user interface does not enable the reproduction or recreation of a compute program, therefore it is not the expression of a computer program "in any form".

This all seems reasonable so far. Although a graphical user interface might contain one or more images or graphical works that would attract copyright as an "artistic work" in the normal way; attempts to claim copyright in an abstraction of the user interface — such as its mode of operation — have tended to founder in the English Courts in cases such as Nova Productions v Mazooma Games [2007] EWCA Civ 219 (concerning features of the play of two computer Pool games) and in Navitaire v Easyjet (concerning a clone of a air travel booking system).

However, the court went on to consider — although it had not been asked to do so — whether the graphical user interface of a computer program might be protected by the "ordinary" law of copyright. Here the court appears to have committed the logical fallacy of affirming the consequent. To explain why I need to say a something about earlier developments in European Copyright Law.

The Information Society Directive (Directive 2001/29/EC) ("INFOSOC") has partially harmonised other forms of copyright in the European Union. Article 2 INFOSOC requires that Member States create in their domestic law a "reproduction right" for "authors, of their works". Although described as a "right" it amounts to a prohibition on anyone else reproducing (in whole or part) a work without the author's permission. In other words it is a copyright. Although INFOSOC does not define "works" (or indeed "reproduction" or "reproduction in part"), the European Court of Justice in the earlier case of Infopag v Danske Dagblades Forening C-5/08 held that the directive only applies to a work that is "original in the sense that it is the author's own intellectual creation".

So to the apparent fallacy: in Bezpečnostní‌, the ECJ reasons thus:

The Court has held that copyright within the meaning of Directive 2001/29 is liable to apply only in relation to a subject-matter which is original in the sense that it is its author’s own intellectual creation (see, to that effect, with regard to Article 2(a) of Directive 2001/29, Infopaq International, paragraphs 33 to 37).

Consequently, the graphic user interface can, as a work, be protected by copyright if it is its author’s own intellectual creation.

In other words the court deduces from a statement of the form "P implies Q" a conclusion that "Q implies P". Infopaq establishes that being the author's "own intellectual creation" is a necessary condition. That does not mean it is a sufficient one.

Now the judges of the ECJ are, for the most part, bright and well educated. They will be well aware of the dangers of affirming the consequent. I think it is safe to assume they don't mean quite what they appear to be saying. In particular, the idea that any form of intellectual creation is protected by the general law of copyright would be quite revolutionary.

For example, INFOSOC does not exclude from copyright protection inventions that could form the subject of a patent, or designs that might be protectable under one of the European design rights. Although both might well be some author's "own intellectual creation", I doubt very much that copyright is intended by anyone to extend so far.

In English law merely being creatively original is not enough for a work to obtain copyright protection. For example in Creation Records v News Group Newspapers [1997] EMLR 444, the judge held that it was not even arguable that the scene for the Oasis album cover of Be Here Now could be protected by copyright. It simply did not fit into any existing protected category — and the record company attempted to argue that it was a dramatic work, a work of artistic craftsmanship or even a collage.

So I assume (in hope) that all the ECJ are guilty of is a failure to show working and that they have in mind some other criteria that must be satisfied before a work is protected by copyright. What those criteria might be the ECJ do not say which leaves me with the following questions: if a graphical user interface is protected by copyright, what kind of a work is it and what about it is protected?

It may be possible to gain some inkling as to what is in the ECJ's mind from their answer to the second question posed to them. They were asked if graphical user interfaces were protected by copyright in computer programs (the first question), would television broadcasting of the graphical user interface be an infringement of that copyright (by communication of that work to the public)? Although the ECJ had answered "no" to the first question, ever helpful they considered whether, on the assumption that graphical user interfaces were protected by "ordinary" copyright, TV broadcasting of them could constitute infringement. Again the ECJ thought "no" because the viewers "cannot use the feature of that interface which consists in enabling interaction between the computer program and the user".

It seems from this that the ECJ have in mind not the graphical elements of the user interface, but something about its operational behaviour. A sort of copyright in interactivity, which cannot of course be infringed by TV broadcasting because you cannot interact with the subject of the broadcast. If that is what the ECJ have in mind, then I am troubled.

First, what kind of a copyright is this? Is it an artistic work, a literary work or something else (a work of artistic craftsmanship perhaps)? For the purposes of English law this matters. Different species of work are protected in different ways, even if the differences are sometimes rather subtle. The ECJ do not tell us the answer to this question.

Second, where is the graphical user interface "fixed". In English law a work is only protected if and when it is fixed in some permanent form. If I make a really excellent speech, I will have copyright in the speech when, but only when, it is recorded. Similarly if a group of musicians create an exciting musical work while jamming together in the studio, the work will not be protected until fixed in some form. Is the graphical user interface fixed in the computer program's source code? If so, copying the code may be an infringement of the copyright in the graphical user interface. If it is not fixed in the code, where is it?

Lastly, there are numerous special rules that apply to copyright in computer programs. For example there are rights to make back-up copies, to test and to decompile for certain purposes. If the ECJ is right, these would not apply to a user interface which represented an author's own intellectual creation. In English law, moral rights do not apply to computer programs, but would (presumably) apply to a suitable user interface. Both of these conclusions could be awkward.

Not all is bleak. The ECJ emphasize that when assessing whether a graphical user interface is protected by copyright as its author's "own intellectual creation", a national court should ignore components of an interface that are "differentiated only by their technical character". It will not be every, or every aspect, of a user interface that will be protected. Despite this limitation I suspect that this decision, if taken to its logical conclusion and followed by later cases, will require some careful rethinking about copyright in the computer industry. Just what we need.

ACS:Law - at last, a hearing

2010-12-21T12:15:00.001Z

UPDATE: For professional reasons I won't be commenting on this case for the time being. Please feel free to continue to comment on this post, but don't feel insulted if I do not respond.

After my recent post on ACS:Law's failure to obtain default judgments in some of their claims. Another judgment Media C.A.T Limited v Alan Billington [2010] EWPCC 18 of the patents county court has been pointed out to me.

The facts of the particular case are not particularly crucial. The Defendant, an Aaron Billington, complains amongst other things that there is no "Alan Billington" and that he did not receive a "response pack" (which comes with the Claim Form and which includes a form for acknowledging service). Although he does not say so, there also seems to be a complaint that ACS:Law did not follow good pre-action practice.

What is interesting is that the judge reviewed cases pending before the court (27 in all) and has ordered that a hearing for directions be held at 10:30am on 17th January 2011. At the hearing the court can decide how the cases should be dealt with. Clearly if you are (or know someone who is) one of the defendants and there's a reasonable defence to the claim, or the sum claimed is larger than the claimant is entitled to, then it would be a very good idea to attend the hearing and have your (or their) voice heard.

Although courts do have a power to make orders on their own initiative, without being asked to do so by the parties, many courts do not seem to use this power as much as, perhaps, Lord Woolf envisaged when he created the civil procedure rules. The hearing proves to be interesting as it may give a much broader picture of how ACS:Law are progressing their cases and it may also help the court to tidy up what sounds (from the last judgment anyway) like something of a mess even from a purely technical perspective. Mildly good news I think.

ACS:Law come unstuck

2010-12-08T16:17:00.001Z

Earlier this month ACS:Law suffered a set-back in their campaign against alleged copyright infringement through peer-to-peer file sharing. ACS:Law (or more pedantically, their clients) had tried to obtain judgments in default against 8 defendants, but failed for a variety of reasons in each case. The judge in the Patents County Court criticised the nature of their claim and the way in which the applications were brought — reported as Media C.A.T Limited v A (and others) [2010] EWPCC 17.

Default judgment is a speedy way for claimants to obtain judgment without a trial. In most cases a defendant served with a claim form and particulars of claim is supposed to acknowledge service and then file a defence. If not acknowledgement or defence is forthcoming the claimant can ask the court to give it judgment in default.

This is where ACS:Law start to come unstuck. In 3 of the cases a defence had been filed in court. So default judgment does not apply. In a further 3 of the cases there was no evidence on the court file that the claim form and particulars of claim had been served on the defendant. It is ordinarily the court's job to serve these documents, but there's no presumption that it has. In my practice I have come across situations where some administrative mistake has been made and the court has failed to do so. Whatever the reason, it is bad practice to issue requests for default judgment without checking with the court that no defence has been filed. A slap on the wrist for ACS:Law in my view. As the judge said "The requests for judgment should never have been filed."

There is an easy way and a not so easy way to ask the court for a default judgment. The easy way simply requires the claimant to file a request to the court. The defendant does not have to be informed of the request and will ordinarily know nothing about it. The not so easy way requires a formal application, with evidence, to the court, which must be served on the defendant, who will therefore have an opportunity to defend against it.

The "easy way" is only available where the claim is for one or more of: a specified amount of money, an amount of money to be decided by the court, delivery of goods where the claim form gives the defendant the alternative of paying their value (CPR 12.4). In each case, the claim was not only for damages for copyright infringement (including additional damages for flagrant infringement), interest and costs but also for:

"a permanent injunction pursuant to the inherent jurisdiction of the Court; ordering the defendant to take reasonable steps to safeguard their internet connection being used, either through the defendant's personal computer and/or third parties taking advantage of the defendant's unsecured wireless connection to repeat the infringement of the claimants copyright in the Work(s)."

Ooops. That doesn't appear to comply with CRP 12.4. The judge thought not. ACS:Law ought to have made a formal application rather than merely filed a request and that would have alerted the defendants to the possibility of default judgment and given them an opportunity to respond. The judge had serious doubts as to whether, in peer to peer file sharing cases, default judgment ought to be given on request without a formal application. He said:

In all these circumstances, a default judgment arrived at without notice by means of an essentially administrative procedure, even one restricted to a financial claim, seems to me to be capable of working real injustice.

Most interesting for me are the criticism that the judge made of the way in which the case was pleaded (one assumes by ACS:Law, but certainly on their behalf).

The particulars of claim stated that the claimant "represents" the owner of copyright in the films that were the subject of the claim. Only the owner of the copyright or a licensee (and for a non-exclusive licensee only if certain conditions are met) has a right to sue for copyright infringement. Thus the pleadings were defective.
The allegations relate to unsecured internet connections. It is unclear whether the owner of (say) an open wifi can be held responsible for copyright infringement effected using that connection.
The claimant's plea was that the defendant was guilty of "allowing" copyright infringement, which, as the judge put it, "is simply wrong". The term used by the act is "authorising", which is rather different.

and more of the same. In short: even accepting all of ACS:Law's allegations, they do not appear to have a proper case. To succeed they would at least have to amend their claim, assuming they have a case at all.

A health warning: this decision is made by a county court. It is not, strictly speaking, binding on any future court. It does however illustrate the extremely dubious nature of the claims being put before the court by ACS:Law and will, I hope, encourage defendants to be more confident in resisting them. The list of defects in the pleadings might make a useful basis for an application to strike out against the claimant.

Hat tip to Philippe Bradley for pointing this case out to me.

Image rights: England v Germany and Philip Woolas's mug

2010-11-21T12:08:00.000Z

Matt Wardman of the Wardman Wire asks an interesting question on the mySociety:public mailing list. He had created a couple of mug designs poking fun at the former MP Phillip Woolas and submitted them to the online platform Spreadshirt. According to his blog post they refused to accept the designs, saying:

These designs or products most likely infringe legal regulations. If not then the content is considered offensive, discriminatory or glorifies violence.

Now of course the designs were offensive — in the sense that someone could be offended by them — that really was the idea. If there were a law against being offensive Private Eye could never be published. Spreadshirt's Terms and Conditions say nothing to forbid offensive material; nor could the designs possibly seen as discriminatory (except perhaps against MP's who lose election courts) or glorifying violence. What of the "legal regulations" that Spreadshirt thought might be infringed.

A later response gave some clarification:

"Unfortunately we could not admit them for your shop because they infringe on the personal rights of Phil Woolas. These basically state that any image with his photo or name on it that does specifically refer to his person must be authorized by him. "

Such an unqualified statement of law must be rubbish, at least in any civilised society. If it were true then editors would find it virtually impossible to illustrate their newspapers and most of their budgets would be spent on clearing image rights with those depicted.

English law doesn't recognise an image right per se. The use of a person's image is not entirely free. For example if I take a photograph of you, you may be able to prevent me from using it:

in a way that is defamatory of you — as in Tolley v J S Fry Ltd [1931] AC 333, where an amateur golfer successfully sued for libel when his image was used in a chocolate advert since it carried an implication that he had been paid for the advertisement and was therefore not maintaining his amateur status;
to pass off your business as mine — this extends as far as using the image of a celebrity to falsely imply that they endorse my business, as Talksport did when the edited an image of Eddie Irvine holding a mobile phone into one holding a radio labelled "Talksport" in Edward Irvine Tidswell Ltd v Talksport [2002] EWHC 367 (Ch);
in breach of trademark — assuming of course that you have trademarked your image and that my usage amounts to an infringement of that mark;
in breach of confidence — if I received the photograph in confidence and my use of it is a breach of that confidence
in a way that infringes your right to privacy derived from Article 8.1 of the European Convention on Human Rights(assuming I obtained the photograph in confidence) — in a case (Campbell v MGN [2004] UKHL 22) brought by Naomi Campbell against the Mirror for the publication of photographs of her going to a Narcotics Anonymous meeting, the House of Lords extended the action for breach of confidence to cover intrusions into an individuals private life;

There is also the Data Protection Act 1998. If the photographs are processed by computer (as they are by spreadshirt in this case) then they must also be “personal data”. If so, then they may only be processed if one of the conditions in Schedule 2 to the act are met. Processing for the purposes of journalism, literature and art is excluded from an obligation to comply with most of the data protection principles (by section 32) which makes life very much easier for newspapers. For use of photographs which is not journalism, literature or art, paragraph 6 of Schedule 2 would have to be relied on which requires that:

The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Unfortunately there has been little consideration of this aspect of the Data Protection Act. In many cases the act is pleaded, but the eventual decision hangs on some other branch of the law. For example in Campbell's case.

It seems to me that neither of the mugs could possibly be defamatory (“Phillip Woolarse” doesn't come close), no-one coudl think that the mugs implied that Mr Woolas endorsed the Wardman Wire or that they were really the same business as him. The photographs were taken from election leaflets, criticised by the election court, and so are hardly an invasion of Mr Woolas's privacy and, arguably, they are “art” and so defensible against a Data Protection Act 1998 claim.

So much for England, but spreadshirt is German based. Now as an English lawyer, I known next to nothing about German law, but as I understand it the German KunstUrhG (law on the copyright of works of visual arts and photography) recognises a right known as Recht am eigenen Bild, usually glossed as “right in their own image” which I will refer to as “image right”. Section 22 of the KunstUrhG prohibits the distribution or public exhibition of the image of an individual without that individual's consent. A right to control over the use of one's image is also derived from Article 2 of the German Basic Law.

To an English lawyer's eyes this seems, at least at first sight, to give an excessive degree of control by an individual over the use of their image, and also to be a serious impairment of the freedom of speech. But German law is much more nuanced than that, not least because Article 5 of the Basic Law guarantees a right to freedom of expression.

Section 23 of the KunstUrhG makes a number of sensible exceptions, including one for images of people from the sphere of contemporary history (Bereiche der Zeitgeschichte). Until recently the German courts divided contemporary public figures into two groups: absolute figures of contemporary society (absolute Person der Zeitgeschichte) — those who stand out from the rest of society for example because of their political or social position, such as major political figures; and relative figures of contemporary society (relative Person der Zeitgeschichte)— those in whom there is public interest only due to a single event, such as victims of a notorious crime.

Section 23(1) is subject to section 23(2) which prevents distribution or display which harms the legitimate interests of the person portrayed (or after their death, the legitimate interests of their family). But section 23(2) aside, the absolute/relative classification would have meant that absolute figures of contemporary society had little protection against the use of photographs in a way that invaded their private lives unless they could show that a specific legitimate interest had been harmed.

The German law was found to be contrary to Article 8 of the European Convention on Human Rights in von Hannover v Germany brought by Princess Caroline of Hanover. The German Federal Court dropped the absolute/relative distinction (VI ZR 51/06) and held that the proper approach in all cases was to consider the balance between an individual's article 8 (basic law article 2) rights as against the interests of free speech under article 10 (basic law article 5). This approach has been endorsed as constitutional by the Federal Constitutional Court in a decision [link to English version] which usefully summarises a lot of the background.

Even after Princess Caroline's victory in the European Court of Human Rights, not everything has gone her way. Although the German courts agreed to prevent the distribution of some pictures of her, they permitted others. They have upheld the principle that sometime the interests of journalism, even where that is merely for entertainment rather than purely for information, outweighs the rights of an individual to their image. Princess Caroline is pursuing further action before the European Court of Human Rights.

My apologies for that long digression into German law (or what little I understand of it). In short: Spreadshirt's statement about image rights is rubbish even in German law. It seems to me extremely unlikely that using a picture of a Member of Parliament taken from an election leaflet that was the subject of a notorious and important trial could fall foul of the German image right as I have explained it. Spreadshirt staff may be forgiven for not realising that (if they are based in Germany) but for knowing that Mrs Thatcher (who cast a long long shadow) was a public figure.

Matt Wardman also wondered whether there might be a problem with copyright in the original election leaflet. The short answer is that

copyright subsists in election leaflets just as in almost everything else (there is no special exception for them);
copying the image is therefore a potential infringement, unless there is some defence available;
there is no “fair use” defence in English law, contrary to the situation in the United States;
there might be a defence of fair dealing for the purposes of criticism or review (to be found in section 30 of the Copyright Designs and Patents Act 1988, on the basis that the images on the mugs are a critical work, criticising the election leaflets which brought about Mr Woolas's downfall and that they are fair because they only use a small part of the offending leaflet;
there might also be (and in this case there really ought to be) a public interest defence.

Copyright exceptions are so open textured that it is very difficult to be certain as to any of these, but I suspect any copyright suit would look very stupid.

Final draft of ACTA is out - nothing to see here

2010-11-17T10:22:00.000Z

Thanks to the Patently-O blog on the subject, I learn that the Final Draft of the Anti-Counterfeiting Trade Agreement (ACTA) has been released. The EFF's web page on the subject has some background.

Earlier drafts contained a great deal of "pick and mix" material which still up for debate between the parties. The Final Draft suggests that those differences have been ironed out (though since the deliberations have been in secret I do not know the details).

My skim read suggests that there is not much in the treaty that would require the UK government to change our copyright law either in substance or as to the procedures used to enforce it. That does not mean that ACTA won't be used as an excuse (or opportunity depending on your outlook) to make changes, but there is a sufficient amount of flexibility in the treaty and a sufficient number of weasel words, that there should be no need for it to do so.

The Patently-O blog post does a good job of summarising the feel of the treaty. My own further thoughts follow.

Measures of damages

Article 2.2(2), which survives from earlier drafts, is particularly unreasonable. It starts uncontroversially enough:

Each Party shall provide that in civil judicial proceedings, its judicial authorities shall have the authority to order the infringer ... to pay the right holder damages adequate to compensate for the injury the right holder has suffered as a result of the infringement.

in other words damages should be compensatory and aim to compensate the injured for the wrong done to them — the usual position in English law. The treaty goes on:

In determining the amount of damages for infringement of intellectual property rights, its judicial authorities shall have the authority to consider, inter alia, any legitimate measure of value submitted by the right holder, which may include the lost profits, the value of the infringed good or service, measured by the market price, the suggested retail price.

Now just how bad this is depends on quite what effect "shall have the authority to consider" will have. Logically merely because a court may consider something, does not automatically mean that the court will pay much attention to it. In practice a legislative requirement to consider a factor will often mean that a court feels obliged to give that factor more weight than it would otherwise do.

What is so odd about that is that "market price" and "suggested retail price"may be a very long way from a good measure of the actual loss suffered by a rights holder. For physical goods, production costs may make up a large part of that price, but even for digital goods, the loss effected by infringement will almost always be less than the actual price because not everyone will have been prepared to buy at that price.

It is also very unusual to have a law that requires a court to consider one of the party's evidence as to damages, but not the other. The usual practice is for the court to have one or more objective measures for awarding damages and for the parties to submit evidence as to what those damages should be.

Since, strictly speaking, an English court certainly has the authority to consider any measure of damages put forward by either of the parties, this particular article should require no change to English law.

More damages

Article 2.2(3) obliges that party's to the treaty to implement one of 3 mechanisms for establishing damages for copyright infringement. All parties would have to chose one of:

pre-established damages (that is some fixed measure that the court can apply mechanically
presumptions for determining the amount of damages — in other words a pre-established mechanism for computing the amount
additional damages — that is extra damages over and above those used to compensate

Section 97(2) of the UK's Copyright Designs and Patents Act 1988 already provides for additional damages. So there is no need for change here.

In my last post on ACTA I pointed out that the United States does have a rather draconian form of statutory damages, but only awarded to those who had the presence of mind to register their copyright — surprisingly many do not. At first sight it looks like the US will have to remove that precondition or implement one of the other options for pre-computing damages.

As I said then, it seems odd to me that copyright owners should be put in a better position than most other classes of claimant in civil proceedings (who have to prove their loss in the normal way and who are generally entitled to compensation for their loss and that's all). Rights in real property are not protected in this way. Similarly, someone carelessly injured and left quadriplegic (to use an emotive example) would have to prove all their loss and would expect to obtain no more. Why should IP be so special?

Costs

Article 2.2(5) requires parties to allow courts to award the winner their costs in copyright proceedings. That seems uncontroversial from the English point of view, where "costs follow the event" but the usual US rule is that each party bears their own costs. Copyright is special. 17 USC 505 allows the prevailing party to be awarded their costs and attorney's fees, but this is restricted by which requires that the copyright be registered at the time of the infringement (or soon after where the infringement takes place shortly after publication) as a prerequisite of costs recovery. Again the US may be forced to relax this requirement as a consequence of ACTA.

Summary

There's lots more in the treaty. The criminal provisions are probably already compatible with UK law, though they are triggered by "wilful" copying on a "commercial scale", rather than the various specific situations set out in places like Section 107 of the Copyright Designs and Patents Act 1988. There are all sorts of requirements for the parties to the treaty to work together to eliminate IP infringement and even (in article 3.4) a requirement to engage in pro-IP propaganda (one wonders at a time of budget cuts why we need to spend money on this but...). As far as I can see there's not much in the treaty that needs to directly impinge on our law. What our government chooses to do in response is another matter.

Libellous freedom of information responses

2010-11-12T11:49:00.001Z

For those that have yet to encounter it WhatDoTheyKnow (“WDTK”) is a website that helps members of the public make requests under the Freedom of Information Act. It displays the request and any subsequent communication (that was made via the site) between the person making the request and the public body in question. Anyone else may add comments, known as “annotations” at any stage of a request.

Like most other websites to which members of the public may contribute, WDTK has to be concerned about libellous contributions. As they note although they are forced to hide only a small proportion of the total number of requests, doing so still represents a significant effort for their volunteers. Most of the issues of libel arise either in the original request, or in subsequent correspondence including annotations made by third parties. But there is a more difficult problem where the libel is contained in the FOI response itself.

Consider the recent case of McLaughlin v Lambeth [2010] EWHC 2726 in which one of the alleged libels was contained in a “briefing report” prepared by the local authority and sent to the Department of Education. If a member of the public made a successful FOI request via WDTK for that report, WDTK's software would automatically republish it on their site. The Claimants in McLaughlin might well ask WDTK to remove the disclosed material — what then is WDTK supposed to do?

The difficulty is the classic chilling effect. WDTK are in no position to decide whether the briefing report is libellous, or whether their publication of it is defensible under some general libel defence — for example under public interest “Reynolds” qualified privilege. Unlike the commercial news media, who can take a view that profit made from publication is offset by the occasional loss of a libel suit and have the funds to insure against defamation claims, WDTK is a charity funded, volunteer run site. They are in no position to take the risk which means they cannot as robustly defend the public interest in freedom of information as they would like.

There is an absurdity about this since if one FOI request is successful then (because of the “applicant blind” approach) so ought a subsequent one. If I can obtain the briefing report under FOI, then so can you. It is unclear whether WDTK could display a message stating that a particular response had been removed because it was libellous, but that anyone can request their own copy by clicking on a particular link which would then send a fresh request to the authority. Such an approach might be a “publication” of the libel, depending on how one reads some rather old authorities.

The common law might recognise this absurdity and decide that publication of FOI responses was a form of qualified privilege. There is a line of old authorities that the publication of a fair and accurate copy of (or extract from) any register kept pursuant to statute and which by law the public are entitled to inspect attracts the defence of qualified privilege. For example publication of a copy of a county court judgment would attract common law qualified privilege. The reason for this defence was explained by Lord Esher MR in Searles v Scarlett [1892] 2 QB 56:

“The law provides that the register shall be a public document which anybody may consult for this purpose. That being so, the publisher of such a list ... is only doing for the public what they may do for themselves, and is only giving that information to the public and to tradesmen which the legislature has thought it right they should have.”

That reasoning appears to be equally applicable to republication of an FOI request. It is true that the cases are all concerned with documents or registers that the public is entitled to inspect, rather than request, but it seems to me that the right to email a public body and have a document sent in response is a very similar one and the common law reasoning could be extended if a court were properly persuaded to do so.

All this is not of much use to WDTK. The last thing they would wish to do is to litigate this question. What is interesting to lawyers is rarely rewarding to their clients. It would be much better if the question were settled by statute. Most of the old common law forms of qualified privilege of this type have been given statutory force by section 15 of the Defamation Act 1996. If any of you have the ear of government you might suggest that the addition of an exception for the publication of information released under the Freedom of Information Act (and similar legislation) should be added to part II of Schedule 1 of the Defamation Act 1996. If I am right that the common law covers this situation anyway, all such a change would so is enact in statutory form a defence which already exist.

Of course a wider reform of the law of defamation is also desirable, but failing that, this would be a useful improvement.

Government: the DEA can't be used for disconnection

2010-11-10T17:03:00.000Z

Today’s big news about the Digital Economy Act is that TalkTalk have been granted permission to apply for judicial review of some of its provisions. For those unfamiliar with the process, judicial review requires two stages: first permission to apply and then the review itself. The grounds of review are varied and complex. For the legal geek the statement of facts and grounds [PDF] makes interesting reading.

What has not been discussed widely so far is the government's response to the don't disconnect us petition on the Number 10 petitions website, which includes the following statement:

“ The Digital Economy Act includes a number of measures to tackle the problem and we expect these to be successful in significantly reducing online copyright infringement. However this is an area of rapid technological change and developing consumer behaviour. The Act therefore includes a reserve power to introduce further “technical” measures if the initial measures do not succeed. These technical measures would limit or restrict an infringers’ access to the internet. They do not include disconnection.”

Are the government right? Section 124G(3) of the Communications Act 2003 (introduced by section 9 of the Digital Economy Act 2010) defines a ”technical measure“ to be one of four things:

(3)A “technical measure” is a measure that— (a)limits the speed or other capacity of the service provided to a subscriber; (b)prevents a subscriber from using the service to gain access to particular material, or limits such use; (c)suspends the service provided to a subscriber; or (d)limits the service provided to a subscriber in another way.

Clearly (a), (b) and (d) can be used for various kinds of blocking or throttling and certainly not for disconnecting a subscriber. It is (c) that is the interesting provision. The word “suspend” carries with it a strong implication of transience and not permanence. A natural reading of section 124G does appear to mean that a subscriber cannot be disconnected permanently from access to the internet and to that extent the government appear to be right.

It is unclear whether (if ever) the Number 10 petitions site actually produces useful results or a change in policy. Certainly the usual response is very much along the lines of “your petition has been noted and filed and now we will ignore it”. Here the government's response relies on an overly literal reading of the petitions title. The intent was clearly to protest at the possible removal of access to the internet whether temporarily or permanently. Six months without internet access could be a serious outcome for some.

Of course the act has been so worded that technical measures are directed at a particular service provider. The “evil pirates” will simply sail over to a new service provider well in advance of any supsension of their serve. Such a transfer could even be provided by a service provider for the benefit of their customers (perhaps automatically?). It is those on long fixed term contracts with their ISP's who will may actually suffer. Quite possibly (though I have no statistics on this) those most innocent of the way the internet works.

One positive outcome of the petitions is that, if at a later stage the government try to introduce legislation that does permit permanent disconnection, we will certainly remind them of their response.

Database right: proving infringement

2010-10-28T12:49:00.001+01:00

A recent decision in the Patents County Court — Beechwood House Publishing v Guardian Products [2010] EWPCC 12 concerns the database right. We haven't seen very many database right cases, so I thought it was worth a short comment.

The claimant, who I shall call by their trading name "Binley's" maintain and sell a database of the names and addresses of people associated with GP practices (such as doctors and nurses) which is then sold to companies that wish to use the addresses for direct marketing. It costs, according to Binley's, roughly £110,000 a year to keep the database up to date.

In order to detect any infringement of their database right, Binley's include in their database a number of what they call "seeds". These are bogus entries, giving the address of Binley's staff. When any post is received addressed to a seed address, Binley's can then presumably check the source against their list of clients to check that the marketing comes from someone authorised to use their database.

In about August 2007 Binley's received a letter addressed to a seed. The letter was from Guardian Products (the first defendant) who had obtained their mailing database from the second defendant (Precision Direct Marketing Ltd) who had in turn obtain it from an organisation called Bespoke Database Organisation Ltd (or BDOL for short). Quite why BDOL were not also defendants is unclear. Perhaps they had already reached a settlement with Binley's but we do not know. But it was accepted that BDOL's database contained the offending seed.

Binley's sued the defendants for infringement of their database right. Presumably on the ground that the defendants must have "extracted" — which means (in English law at least) "the permanent or temporary transfer of [the contents of the database] ... to another medium by any means or in any form" (see regulation 12 of the Copyright and Rights in Databases Regulations 1997).

One assumes that Binley's felt their case was pretty strong, so they made an application for summary judgment. A summary judgment application is not a trial, to succeed Binley's needed to persuade the judge that the defendants had "no real prospect" of defending the claim.

On this point Binley's failed. The problem was, from the judge's point of view, that all the evidence he had was:

Binley's database contained one or more seeds
One of those seeds had turned up in BDOL's database

Clearly this was evidence of some copying, but extraction from a database is only unlawful if the extraction is all or a substantial part of the contents of the database (see regulation 16). It might seem highly improbable that the offending seed was the only item copied. Indeed the judge thought that it was "highly probable" the there had been the extraction of a substantial part, that that was not enough to grant summary judgment.

Binley's had not given evidence of the proportion of seeds in their database. Its evidence was there were "a few" but Binley's had refused to give a more precise figure, possibly for commercial reasons. If they had, that might have allowed some assessment of the degree of extraction and therefore whether it was not substantial.

Summary judgment was refused.

What is interesting about this case is that it may be very difficult in practice to prove merely by examining a database's contents that it has been copied from another, especially where the data is relatively regular and commonplace such as names and addresses, without recourse to seeds or some other form of watermarking. The more seeds or watermarking, the easier the task, but at the cost of poisoning the database owner's product with irrelevant or false information.

In some cases other evidence will be available that demonstrates extraction, but here the first defendant appears to have had no direct knowledge of how its database had been created (since it originated in BDOL). In such a situation a database owner may have difficulty proving that the extraction of a substantial part has taken place.

Note that a decision of the Patents County Court sets no precedent. Its value is merely illustrative, but I feel it is interesting nonetheless.

Absence

2010-10-28T12:02:00.002+01:00

My apologies for the long absence from blogging. I have been unable to do so for personal reasons, but I hope to resume in the near future.

ACTA is out

2010-04-21T09:45:00.003+01:00

A draft (in PDF form) of ACTA, the Anti-Counterfeiting Trade Agreement, has been released by the European Commission. This is the first time any of us have been allowed "officially" to see a draft of the treaty as hitherto negotiations have been conducted in secret. As governments often remind us — if you have done nothing wrong you have nothing to hide — why the secrecy?

Inspired by leaked versions, the treaty has excited much opposition. For example from La Quadrature du Net, the EFF and many others. Michael Geist gives a very thorough analysis on his blog site for those inclined to dig deeper.

If you read the draft you will see that it is marked up with numerous possibilities, indicating differences of opinion between the national delegations. The draft coyly avoids telling us which those delegations might be, but a recently leaked draft may give a clue. I am fairly confident that an analysis of the various parties positions can be crowd-sourced so that we all know where to apply pressure.

This multiple choice nature of the draft makes it hard to analyse whether it is really good or bad or indeed what effect it will have at all. This is particularly so where there are two possible drafts: one stating what parties to the treaty "may" do (which means they need not) or "must" do (which means they certainly will). For example Article 2.2(2) on damages.

I leave a thorough analysis to others who have rather more time than I do, but a couple of points strike me as being of particular interest to the digital/internet environment:

Damages

The normal rule in English civil proceedings is that the damages are compensatory and intend to put you back in the position you would have been if the defendant had done no wrong (or not breached a contract or whatever). In some circumstances a claimant might be able to force a defendant to disgorge any gain they have made without a good lawful reason, or even to pay over any profits they have made as a result of their actions.

In the world of intellectual property this limitation does not operate. Many jurisdictions allow more compensation on top. For example s97(2) of the Copyright Designs and Patents Act 1988, a court may award "such additional damages as the justice of the case may require", having particular regard not only to any benefit gained by the defendant but also to the "flagrancy" of the infringement. In the United States 17 USC 504 allows a copyright owner, where they have registered their copyright, to elect to receive "statutory damages" rather than actual damages and profits, at a minimum of $750 (but up to $30,000) per work infringed. The ludicrous effect of such damages is well known.

ACTA's proposed article 2.2(2) proves that the parties may or shall (which to be later determined) maintain a system of pre-established damages much like that of the US, as well as presumptions for determining the amount of damages. Such a presumption might be that the damages suffered for copying N works each of which would have made (if sold) a profit of p would be Np. Such a sum would almost always be more (probably much more) than the actual loss. There may (or shall) also be a provision for "additional damages".

It is quite possible that rights industries could make more money this way than they would if there were no infringement which would be a surprising outcome in any other field of law.

Criminal liability

Copyright infringement may be a criminal offence in the UK in essentially two circumstances: first where it is done in the course of business and second where it is done "to such an extent as to affect prejudicially the owner of the copyright" (I am simplifying this somewhat). Article 2.14 of ACTA suggests there should be criminal liability for infringement on a commercial scale, which is defined to include "significant wilful". I am unclear on what "wilful" means (perhaps readers can help) but that looks to me to increase the range of criminal liability.

Online infringement

The headline part of ACTA for me ought to be section 4 which concerns enforcement "in the digital environment". With the passage of the Digital Economy Act 2010 it may be we have seen the last of new attempts to legislate in this field in the UK for a few years. It may be that ACTA makes little difference to us except to provide the government of the day with political cover to push things a little further.

Article 2.18 requires that parties make available enforcement procedures that include "expeditious remedies to prevent infringement and remedies which constitute a deterrent to further infringement". So to protect and deter. The detail that results from this general requirement could be almost anything because the draft includes two main options, and many sub-options, that range from a less intrusive system of copyright control than we have in the UK to a system that goes much further. I find it difficult to give any kind of useful summary — if such a thing is even possible.

There are options to protect intermediate service providers though these may be predicated on the provider either taking proactive steps to prevent infringement (but not including monitoring) or responding properly to requests to block/take-down material or both. There are also provisions that may require legal protection of effective technological measures, though to what extent they will go further than those already imposed on us is unclear.

Conclusion

There's an awful lot more in there. I look forward to reading a wider analysis and to seeing what response the various campaigning organisations now adopt. Overall the treaty seems to be a mixture of unnecessary repetition of existing treaty arrangements (such as TRIPS or WCT) and overly draconian provisions. In my view the best outcome would be for the treaty to be abandoned, but I realise that is unlikely, so it might be time to focus more on the detail.

New amendment gives copyright owners a blank cheque for web censorship

2010-03-04T09:54:00.000Z

Imagine that, in the Summer of last year, you had been following the MP's expenses scandal and heard that The Telegraph was publishing a rather less redacted version that MP's were prepared to give us. Interested, you navigated your way to www.telegraph.co.uk only to find it was not responding. After some searching around and asking friends you discover that the website has been blocked by most major UK ISP's. It seems a junior official in Parliament had asked them to block The Telegraph for copyright violation.

Just this could happen as a result of amendment 120A to the Digital Economy Bill that was passed yesterday in the House of Lords. Being strictly accurate (and I am a stickler for accuracy) I don't think that Parliament going after The Telegraph is likely any time soon for reasons I will explain at the end of this post, but the reasons for that are political not legal and that should worry all of us.

Why?

What is this all about? The copyright industry (which I will call "the BPI" for short) would like a way to make ISP's block internet access to servers that are involved in wholesale copyright violation. Trying to go after the owners of the servers is difficult, either because they are convicted criminals or because they are a mega corporation that will thumb their noses at the BPI and fight tooth and nail against any effort to take them down. How much easier to get ISP's to do the job.

I believe (and I think most copyright lawyers agree with me) that the courts could be persuaded to develop a general form of order requiring an ISP to block access to unlawful content. They have already done this with so-called "Norwich Pharamcal" orders that are used to ask innocent third parties (like ISP's) to divulge the names of the guilty. If there was any doubt, section 97A of the Copyright Designs and Patents Act 1988 makes it quite clear that the courts have the power to do this.

What seems to be bugging the BPI is that a court order costs money and they (the BPI) will have to pay for it. What they want is to be able to get the orders they want for free, or rather at someone else's expense. Amendment 120A does the job. The killer bit is this wording:

(4) Where—
(a) the Court grants an injunction under subsection (1) upon the application of an owner of copyright whose copyright is infringed by the content accessible at or via each specified online location in the injunction, and
(b) the owner of copyright before making the application made a written request to the service provider giving it a reasonable period of time to take measures to prevent its service being used to access the specified online location in the injunction, and no steps were taken,
the Court shall order the service provider to pay the copyright owner's costs of the application unless there were exceptional circumstances justifying the service provider's failure to prevent access despite notification by the copyright owner.

ISPs will feel forced to block on request

What this means is that a copyright owner can send a notice to an ISP asking them to block access to a website. The ISP has a choice: either they block the site, or they wait to see if a court will make an order to block it. If they wait, they pay the costs. There's going to be a really strong temptation just to block without asking any questions, rather than go to court and risk what will amount to a fine.

Its much worse than that. The written request doesn't need to explain why the website should be blocked. It can just be a bald instruction "block this site", or perhaps a list of websites to block like that supplied by the Internet Watch Foundation>. The ISP won't find it easy to "ask questions" because it will have nothing to work with. There is also nothing to stop the BPI sending huge numbers of requests, swamping the ISP so that a conscientious ISP that does not want to blindly block everything will find it prohibitively expensive to do so.

Furthermore, the website won't usually be run by anyone with a contractual relationship with the ISP. This is not a "block your customers" type of order but a "block someone on the internet" one. The ISP won't have any customer relations incentive not to block, nor will they have any way (in general) of recovering their costs from the website owner.

In most cases the only safe way for an ISP to proceed will be to just block everything they are told to block. What is to stop the BPI routinely requesting a block whenever there is anything they vaguely dislike? Nothing. There is no penalty for sending an unjustified written requests. The request does not have to say that anything in particular is wrong, its just a request after all. If I were the BPI I'd just churn these out wholesale and cherry pick which to actually enforce, relying on the spread of fear, uncertainty and doubt to get my own way.

No redress for the innocent

What about website owners? There's no requirement in the amendment to tell the owner of the website that a request has been made to an ISP. The owner/operater will usually first find out they have been blocked by the ISP after it has happened. Aside from persuading all ISP's in the UK to unblock you (perhaps by promising to pay their costs if they eventually are ordered to block) there is nothing you can do about it. There won't have been a court order, so there's no appeal.

Even if you, as a website owner, hear about the request from some well-meaning ISP, you may not know what it is exactly that you are accused of. Like Joseph K's legal team in The Trial you will have to deduce what you are charged with doing. How anyone can think that is fair or reasonable defeats me.

If an ISP is persuaded to resist a request to block your site and you then intervene in subsequent court proceedings brought by the BPI, the case could go on a long time — copyright cases can be quite complicated. Maybe there are important issues of law at stake that will take the matter to the Supreme Court and back. The result an enormous costs bill. Who will have to foot it if you lose? Ordinarily, the ISP. You can see why an ISP is going to require a lot of persuading not to just roll over and do what its told.

The court will be bypassed

The amendment is stuffed full with good intentions. There's a whole list of things a court would have to take into account before making an order, all of which would be things a court would probably take into account anyway. Courts really don't need to be told to take into account "the importance of preserving human rights, including freedom of expression, and the right to property" for instance — they are required to do so by the Human Rights Act 1998 — which suggests that the amendment was not drafted by someone with any knowledge of legal practice more's the pity.

But all these good intentions are quite irrelevant because the new law gives the BPI huge leverage before anyone gets near a court. The court process may be scrupulously fair, but which ISP is going to routinely risk getting there?

Well there's plenty more that's wrong with the amendment, for example what on earth is a "location on the internet" (IP address, URL, DNS domain...)? Did anyone who knows anything about computer networking get asked about this before it was tabled (I assume: no)? But I think that is enough for me to complain about in one post. I hope you get the general idea. Sadly the politicians involved don't.

Conclusion

The Telegraph case is unlikely. Not because the legal conditions aren't made out - it is certainly true "a substantial proportion of the content accessible at or via" the part's of the Telegraph's site where all those barely redacted expenses claims where displayed infringed copyright, so there's certainly a basis for a claim. The Telegraph is in the position of having an alternative outlet to air its grievances (the paper version) and enough money to fight the government over it and to offer to indemnify any UK ISP that is nervous about it. By contrast the House of Commons was running scared in the middle of 2009 and its officials were probably sane enough to try to avoid the huge scandal associated with blocking the newspaper.

But the blocking of a newspaper, a major site like youtube, or indeed any other site (insert your favourites in here) is by no means implausible. Newspapers regularly republish information quoted in other newspapers, much of which may infringe copyright. Where a site is overseas and won't make so much of a fuss about blocking in the UK, it all becomes more likely.

My last blog on the topic of the Bill complained of a similar power that would allow the government to block sites it didn't like such as wikileaks. Subsequent amendments blocked that hole, but now we have a new provision that lets private individuals as well as the government shut down sites, with wikileaks still a prime target. Politicians of all parties need to think very seriously about whether they really want to give the BPI this amount of power.

Home copying of e-books and digital rights management

2009-12-28T14:39:00.001Z

A frequently asked question that seems appropriate this time of year (given the number of e-books that are likely to appear in people's Christmas stockings) concerns what one is legally allowed to do with documents on one's own e-book, particularly one that is protected by some form of digital rights management.

Let us consider John, a keen adopter of technology. John has a number of different e-book reader platforms and numerous e-books in a variety of formats. He'd like to be able to make back up copies of the books and transfer them from one device to another — known as "format shifting". He is interested in what the law has to say about it. To keep things simple I'm not going to think about what he ought to be able to do or what he might get away with: working through the law will be enough for one post. Let us also assume that someone owns the copyright in the book being read.

Contract

John's first difficulty is that if he "bought" the e-book he may well be bound by a contract with the distributor. For example the mobipockets terms of trade (which are written in appallingly broken English) appear to prevent him format shifting since they say, under section 5 "Terms of Product or Service Use/Loadings":

You admit and you accept that the product or the service bought is exclusively readable on the PDA corresponding to the PID you registered on the Site at the inscription moment.

and further under section 9 "Property Rights":

Every elements you will find on the Site in particular the texts, the information, the images, the softwares, the logos and other distinctive signs etc. may be protected by property rights in particular copyrights. By the way you promise not to reproduce, copy, sell, resell, rent or exploit etc. whole or part of these elements in a commercial or other purpose, unless you have allowed to do it by the beneficiary.

These terms appear to prohibit John from copying an e-book to another device. If he does so he will be in breach of contract.

But at Christmas many of John's e-books were probably bought for him by his friends and family. Most legal systems won't enforce a contract against someone who was not a party to it (except in certain exceptional circumstances). In particular I think this is true in French law — the law selected by the mobipockets terms of service. John would therefore not be bound by the e-book's terms of service.

Copyright

John's second difficulty occurs if the book is subject to copyright. As a general rule John may only copy it with the permission (direct or indirect) of the copyright owner. The exceptions to the rule, most of which fall under the heading of "fair dealing" (a poor, stunted relation of the United States concept of "fair use"), are few and far between and most certainly don't include format shifting and backup.

That permission, or as we lawyers prefer to say licence, will usually come with strings attached restricting John to certain kinds of copying. For most e-books this will not include format shifting, though backup may be permitted. If John format shifts he risks doing so without a licence and thus infringing copyright.

Digital Rights Management

In practice this is all rather theoretical: no-one seems to take a blind bit of notice and format shifting particularly of recorded music in breach of its owner's copyright is the rule rather than the exception. Publishers have responded by adopting an asortment of technical measures to try to control what their customers are able to do with works that they have "bought". For example by adding region codes to DVD's so as to partition the world market, or in the case of e-books by adopting various format restrictions such as Amazon's AZW file format.

If reading E. E. "doc" Smith taught us anything it was that, given time, pretty much any technology can be beaten. The other side will invariably find a way around it. This appears to be true with DRM as with anything else. John will almost certainly be aware that the DRM used by the Amazon kindle has been hacked.

Legal protection of DRM

The next round in this rather sorry conflict between the desire of publishers to control the use of their works after they have been sold and their customers' understandable wish to be able to freely use what they have "bought" comes with the signing of the WIPO Copyright Treaty (a.k.a the WCT) on December 20 1996. Article 11 specifically requires parties to the treaty to take steps to prevent John getting around the DRM on his e-books:

Article 11
Obligations concerning Technological Measures
Contracting Parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law.

If you read this carefully you will see that there is no need to protect against the circumvention of a technological measure where that measure is being used to restrict an act that is permitted by law. In other words the states that are parties to the WCT do not need to enact laws that prohibit John from getting around DRM which is stopping him from doing something he is otherwise allowed to do: for instance if the e-book is not subject to copyright; or if he lives in a country (like France) where there is a private copying exemption or (if he lived in the US) where what he is doing would be fair use and so on.

The European Union legislative response to the WCT came on 22 May 2001 with Directive 2001/29/EC sometimes known as the Copyright Directive or the Information Society Directive. The directive is much less generous than the WCT. The definition of "technical measure" found in article 6(3) is even less easy to read than article 11 of the WCT, for reference (though feel free to skim over it):

For the purposes of this Directive, the expression "technological measures" means any technology, device or component that, in the normal course of its operation, is designed to prevent or restrict acts, in respect of works or other subject-matter, which are not authorised by the rightholder of any copyright or any right related to copyright as provided for by law or the sui generis right provided for in Chapter III of Directive 96/9/EC.

So, a "technological measure" is anything which prevents an act not authorised by the owner of copyright (or some similar right) even if that act would otherwise be permitted by law. In this way the directive is going much further than the WCT. Article 6(4) does permit members states of the EU to incorporate some relief for anyone who is prevented from some otherwise lawful uses of their work by technological measures, but as we shall see article 6(4) does not sweeten things nearly as much as one might hope.

The directive enters English law on 31 October 2003 as a number of new sections in the Copyright Designs and Patents Act 1998. Section 296ZA attempts to prevent the circumvention of DRM ("technological measures"). It does this by making the circumvention of DRM the equivalent of copyright infringement. It permits not only the copyright owner, but also the publisher (strictly speaking the person who issues to or communicates to the public the protected work) to sue the person circumventing the DRM. Amazon could pursue John, alongside the owners of any copyright in any e-book he format shifts.

What if John wants to do something he would otherwise be permitted to do (for example that would be fair dealing for the purposes of private study)? In other words how has the UK tried to prevent DRM being used in an overly powerful way? Answer: they can complain about it. Section 296ZE permits them to issue a notice to the Secretary of State. The Secretary of State may then (but is entirely free not to) order the copyright owner or any exclusive licensee of the work to do something about it. As far as I know, the Secretary of State has never done so.

The real target of section 296ZA will not be John who after all is doing things in the privacy of his own home.Anyone who works out how to get around (say) Amazon's DRM and publishes that information on the web will also have circumvented a technological measure and will make a much more attractive target, not least because Amazon et al will have a much easier time in proving that they have suffered significant damages as a result of the circumvention.

Two small brighter points appear: first s.296ZF, defining a "technological measure", makes it clear that they only apply to a "copyright work". There should be no pentalty for getting around DRM attached to an out of copyright work. Second, only "effective" technological measures are protected. It would be marvellous, though I think unlikely, if the European Court of Justice accepts the literal meaning of that word so that once there is a widely known exploit that will crack any particular DRM we are all free to use it.

In conclusion: if John wants to avoid infringing any legal rights, he will only be able to format shift, take backups or otherwise copy material if permitted to do so by the copyright owner. Whether a company that digitised (say) the Complete Works of Shakespeare could claim that in doing so it gained a new copyright over the digitised version is another (and much more complicated) story. For now, Happy Christmas.

Government wants new powers to block wikileaks and squeeze web tv

2009-12-10T21:47:00.001Z

Just over a week ago I wrote a fairly dry legal analysis of the Digital Economy Bill. I spotted an extremely serious provision — clause 11 — in the version being discussed in the House of Lords. Having looked at the amendments (which you can find on the Bill's document page) I am worried that no-one in Parliament appears to be taking the problem seriously.

What is the problem with clause 11 that I am getting so alarmed about it? It amends the Communications Act 2003 to insert a new section 124H which would, if passed, give sweeping powers to the Secretary of State. It begins:

(1) The Secretary of State may at any time by order impose a technical obligation on internet service providers if the Secretary of State considers it appropriate in view of—

Pausing there. Note that this says nothing at all about copyright infringement. For example the power could be used to:

order ISP's to block any web page found on the Internet Watch Foundation's list
block specific undesireable sites (such as wikileaks)
block specific kinds of traffic or protocols, such as any form of peer-to-peer
throttle the bandwidth for particular kinds of serivce or to or from particular websites.

In short, pretty much anything.

I do not exagerrate. The definition of a "technical obligation" and "technical measure" are inserted by clause 10:

A "technical obligation", in relation to an internet service provider, is an obligation for the provider to take a technical measure against particular subscribers to its service.

A "technical measure" is a measure that— (a) limits the speed or other capacity of the service provided to a subscriber; (b) prevents a subscriber from using the service to gain access to particular material, or limits such use; (c) suspends the service provided to a subscriber; or (d) limits the service provided to a subscriber in another way.

As you can see blocking wikileaks is simply a matter of applying a technical measure against all subscribers of any ISP.

Surely something must limit this power you ask? It seems not. The Secretary of State may make an order if "he considers it appropriate" in view of:

(a) an assessment carried out or steps taken by OFCOM under section 124G; or (b) any other consideration.

Where "any other consideration" could be anything. To their credit the Tories do seem to have realised that this particular alternative is overly permissive. Lord Howard of Rising and Lord de Mauley have proposed (in the first tranche of amendments proposed that the "or" be replaced by an "and".

What astonishes me is that there is no obligation for the Secretary of STate to even publish such an order, let alone subject it to the scrutiny of Parliament, yet he could fundamentally change the way the internet operates using it. Other orders made under other parts of the Bill will have to be made by statutory instrument and most will require Parliamentary approval. Not this one.

The only other amendment that has so far been tabled that might restrict the powers of the Secretary of State under clause 11 appears in a third tranche proposed by the liberal democrat Baroness Miller of Chilthorne Domer which deletes the paragraph (b) from the definition of a technical measure (i.e. "limits the service provided to a subscriber in another way") which does put some bounds, although not very tight bounds on what an imaginative Secretary of State might do.

The government is not at all imaginative. In their explanatory notes they envisage:

The government envisages that the criteria for taking a technical measure against a particular subscriber would be the same as the criteria used to determine whether the subscriber' s alleged infringements are included in a copyright infringement list under the initial obligations. So a technical measure would be applied if a subscriber had been linked to a number of CIRs sufficient to place them on a serious infringers list.

Note very well: they expect to use the power against the guilty and the innocent (of copyright infringement) equally.

The problem, I think, is that people are skim-reading the Bill and thinking that this part has to do with copyright infringement. Clause 11 is nestled between provisions about notifications of copyright infringement (the "strikes" idea) and the technical obligations code. People seem to be assuming that the Clause 11 power will only get used in that context but there is nothing in the Bill to make that so. As fellow blogger Julian Todd pointed out the government froze the funds in the Landsbanki bank using powers contained in the Anti-terrorism, Crime and Security Act 2001. A future government might well think "that's a useful power" and use it for almost anything. Let us hope that the Lords wake up to this fast. I have much less hope of the Commons.

National Portrait Gallery: is there a database right?

2009-08-04T10:45:00.003+01:00

I have already written about the National Portrait Gallery's legal threat against Mr Coetzee, an editor of wikipedia. I considered only the validity of the gallery's copyright claim. What about its claim that Mr Coetzee infringed the gallery's database right?

The database right is a based on the EC Directive 96/9/EC, transposed into English law by the Copyright and Rights in Databases Regulations 1997.

The directive defines a "database" as:

a collection of independent works, data or other materials arranged in a systematic or methodical way and individually accessible by electronic or other means

That's a pretty broad definition and covers anything you might think of as a "database". The photographs of paintings are independent works (even if they are not subject to copyright protection) and the gallery seem to have arranged them in a systematic way so that they are accessible by electronic means. That just tells us what a "database" is. In order to obtain the protection of the database right, the maker of the database must show:

that there has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents to prevent extraction and/or re-utilization of the whole or of a substantial part, evaluated qualitatively and/or quantitatively, of the contents of that database

That is actually 6 different conditions, all neatly packed up in the compression system that is legal drafting. First the maker of the database must show that there has been some substantial investment, which can be of two kinds, either quantitative or qualitative; and second that investment can be in one of three things: obtaining, verification or presentation.

What sort of investment counts? Here the decision of the European Court of Justice in Fixtures Marketing v OPAP C-444/02 comes into play. The top divisions in English and Scottish football drew up fixture lists for the matches to be played in the various divisions during each season. Fixtures Marketing Limited had been assigned the rights to manage this information outside the United Kingdom. OPAP repeatedly extracted the names of pairs of football teams playing against each other and displayed them on its website. Fixture Marketing were obviously unhappy about this and sued. The question of what was a database and how was it infringed was referred to the European Court of Justice.

The court held that "investment in ... the obtaining ... of the contents" referred to resources used to seek out independent materials that already existed and to collect them into the database and not the resources used to create the independent materials in the first place. The purpose of the database right was (thought the court) not to protect the creation of materials that went into the database but to protect the creation of the storage and processing systems for the database.

As support for this view the court pointed out that recital 19 of the directive states that the compilation of several recordings of musical performances on a CD does not represent a substantial enough investment to be eligible. The investment in the music is not enough.

The relevance of this case to the NPG is obvious. One suspects a great deal of the investment in creating the photograph database was in taking and making the photographs. That, on the authority of Fixtures Marketing is irrelevant.

As for verification and presentation, the court seems to have required that any investment that forms a part of the creation of the independent materials would also have to be disregarded. For example, on verification the court said:

The professional football leagues do not need to put any particular effort into monitoring the accuracy of the data on league matches when the list is made up because those leagues are directly involved in the creation of those data. The verification of the accuracy of the contents of fixture lists during the season simply involves, according to the observations made by Fixtures, adapting certain data in those lists to take account of any postponement of a match or fixture date decided on by or in collaboration with the leagues. Such verification cannot be regarded as requiring substantial investment.

Of course I have no idea exactly what work went in to the NPG's database, but I think it is here that they come unstuck. In their letter to Mr Coetze the gallery's solicitors use the time honoured tactic of proof by assertion:

Our client’s website includes a searchable database of over 60,000 carefully chosen, curated and watermarked images. There can therefore be no doubt that our client’s database of images is a “database” for the purposes of s.3(A)(1) of the CDPA.

If, as seems to be the case, the gallery had set aside funds to digitise its collection, those funds and the investment they represent would have to be ignored. The "carefully chosen" images would be just those images that the gallery had chosen to digitise, creating a database from that collection would not necessarily represent the substantial investment the directive envisages. I have no idea whether the "curated" refers to the paintings (in which case it is irrelevant) or the images (in which case I don't know what curating a digital image might mean). The watermarking would surely form a part of the gallery's effort in creating the digital images in the first place and also have to be disregarded.

There's too little information to be able to assess how good the gallery's claim might be, but whether they have a database right at all is open to some considerable doubt.