Pirate Bay - the end?

Pirate Bay have announced that they are likely to be selling the business to the Swedish company Global Gaming Factory X AB according to the company's press release the transaction is schedule to complete for August 2009. Their CEO, Hans Pandeya, is quoted as saying:

"We would like to introduce models which entail that content providers and copyright owners get paid for content that is downloaded via the site"

I read that as meaning that the nature of the site will change dramatically, although Pirate Bay's own blog comments that if the new owners change the site dramatically, no-one will continue to use it.

Pirate Bay loses appeal

According to the Swedish Court Service website, the four defendants in the Pirate Bay case have lost their appeal. The Svea Court of Appeal decided that, despite some criticism of the way in which the judges in the trial had proceeded, the trial was fair.

I have yet to read a reasoned decision so I am relying on the press release. One line of reasoning seems to have gone as follows: the presiding judge was a member of two organisations operating in the field of intellectual property. Let us say, for the sake of argumen, that the judge’s membership of these organisations showed that he was in favour of the enforcement of intellectual property and would thus be supportive of rights holders. That does not, thought the court, prevent a fair trial because intellectual property rights are legal rights in Sweden as the law stands. Being in favour of them merely means being in favour of the law.

An analogous argument might be used in a case in which a judge who was in favour of private property rights and their enforcement should still be allowed to sit on a case of theft, or for eviction of trespassers.

Having said that the court appears to have thought that information like this (membership of relevant associations)  ought to have been available at the earliest stage, so that it can be properly dealt with then rather than on appeal.

I remain sceptical as to whether the judge (Tomas Norström) really was biased in any way. The Swedish Association for the Protection of Industrial Property and the Swedish Copyright Association do not look (to me) like industry organisations that pursue infringers of intellectual property, but rather more like the sorts of organisations that lawyers routinely get involved in for the better exchange of ideas and study of a subject.

Members are likely to have a lot of different affiliations, work against each other in practice on many occasions and the mere fact that A and B are both members of such an assocaition doesn’t mean they will even like each other. I certainly can’t stand the sight of some people in the same professional bodies as myself.

The trouble is I haven’t seen a good analysis of the two Swedish bodies to be sure. I look forward to reading the full decision of the Court of Appeal (if it becomes available) to make up my own mind.

Where does this leave the Pirate Bay four? If the press release is to be believed, there is no appeal but proceedings in the European Court of Human Rights are sure to follow.

Technorati Tags: pirate bay, copyright, P2P, music file sharing

Social Networking Sites and Data Protection

The Article 29 Data Protection Working Group has published its opinion on the relationship between the Data Protection Directive and Social Networking Sites (SNS).

A key point to take away is that operators of SNS are data controllers rather than merely data processors, so that they are more likely to be subject to European data protection law than if they were merely “data processors”.

Who is the working party?

The working party was set up by by the data protection directive as an advisory body. Its opinions are not legally binding, but they are likely to be persuasive and the Commission must respond them.

Key points

The response to the opinion (so far) has concentrated on the view that SNS operators are probably data controllers. I’ll have more to say about that at the end of this post.

For me the most interesting points are:

• SNS operators are usually data controllers
• … and so are many third party application providers
• … as indeed will be many users
• privacy should be the default setting
• release of profile information beyond a user’s selected friends should never be implicit
• third party applications should not by default be given access to all an individual’s profile information, but only what is necessary for that application to work

It seems to me that this signals a tougher line to SNS like facebook which will not be able to get away with, for example, a completely cavalier attitude to third party applications.

There are a couple of specific points of interest.

Users

Almost anything about someone is “personal data” but most individuals using an SNS won’t be subject to the Directive because it excludes processing “by a natural person in the course of a purely personal or household activity”.

The working group notes an increased use of SNS for other purposes such as for businesses or campaigning. Those would fall outside the household exception and such users would need to comply with the Act.

The Working Group makes three recommendations on this point:

- SNS providers provide adequate warnings to users about the privacy risks to themselves and to others when they upload information on the SNS - SNS users should also be reminded that uploading information about other individuals may impinge upon their privacy and data protection rights; - SNS users should be advised by SNS that if they wish to upload pictures or information about other individuals, this should be done with the individual’s consent.

Which seems entirely positive. Strictly speaking you don’t always need an individual’s permission to process their data, so the last point is not quite right, though it is good practice. What the Directive does require is that individual’s are notified of the processing, which could be done by a tagging system.

Having said that, the Directive was not (I think) written with uses of SNS in mind. I suspect that more difficulties will follow.

Controller vs Processor

The Directive makes a distinction between “controllers” on the one hand “processors” on the other. A controller is an entity which “alone or jointly with others determines the purposes and means of the processing of personal data.”

In the context of an SNS you might argue that it is the users of the site who decide the purpose and means of processing the data, the operator of the site provides nothing more than an environment for the users to do what they wish (post pictures, disclose information about themselves and so on). In other words, they are just a processor.

The Working Party thinks not. Amongst other things sites like facebook decide what use is to be made of data contributed to the site for the purposes of advertising and marketing.

This matters for two reasons: first because it is on the controller (not the processor) that most of the obligations of the directive are imposed; but second because the location of the controller affects whether or not the directive applies at all.

How far does the Directive reach?

The answer to that question applies in article 4 of the directive which states:

(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable; (b) the controller is not established on the Member State’s territory, but in a place where its national law applies by virtue of international public law; (c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.

The first two provisions give little difficult: if your processing is being carried out in/with or by an establishment of yours in a member state (or somewhere else that state’s law applies) then unsurprisingly you have to comply with the Directive.

The odd one is (c). The Working Group have previously in their opinion on search engines said that storing a cookie in a user’s browser amounts to “making use of” equipment (the user’s browser) so that wherever on the plant a data controller might be, if their processing of the data involves cookies they will be subject to the directive.

I am not entirely convinced by that argument. It would require any such site to have a designated representative in every member state from which anyone were to browse them (under article 4(2)). It also seems to me that what the directive means is that if you process the data in question in a member state then the directive applies to the processing of that data in that member state. A cookie will necessarily contain much personal data of itself.

Conclusion

The opinion seems to me to be useful. It is relatively short and an easy read. Let us hope that it contributes to the pressure on sites like facebook to put their house in order.

The Civil Procedure Rules

The Civil Procedure Rules (or CPR) are the rules governing the conduct of cases in the civil courts of England and Wales. An up to date version is available from the Ministry of Justice's website.

There's no getting away from it: there are a lot of rules and being familiar with them is difficult and something that lawyers, in particular litigators, are paid well to do. I do not advise anyone to try DIY litigation based on reading through the rules but I appreciate sometimes there is no option. There is absolutely no substitute for reading the rules. I see numerous questions asked on internet forums and in briefs sent to me which are easily resolved by reading the rules.

When do the rules apply?

• The rules do not (for the most part) apply to criminal cases which have their own set of rules (the Criminal Procedure Rules unsurprisingly)
• The rules only apply to proceedings in certain courts: county courts, the High Court and the Civil Division of the Court of Appeal.
• Tribunals, such as employment tribunals have their own rules of procedure
• Certain kinds of case (such as insolvency) are excluded by the rules: for a full list see CPR 2.1. There's more subtlety here. Some of these kinds of case piggy-back on the CPR. For example the insolvency rules incorporate chunks of the CPR.

Finding your way around the rules

The CPR is divided into numbered "parts" which are subdivided into "rules". For example rule 3 of part 5, written CPR 5.3 states that a signature required by the rules may be printed by computer. Most rules come together with one or more "practice directions" which tend to be more practical or detailed instructions on what to do in any particular situation. You should almost always read the practice direction that accompanies any rule.

Think of the rules as telling a story. The characters are:

• the Claimant - who has started proceedings
• the Defendant - who is the person being sued
• any Additional Parties - who have been brought in as additional Claimants or Defendants during proceedings

If you try reading through you will find yourself immediately confronted with a considerable amount of peculiar vocabulary used in a technical way by the court. Fortunately there is a glossary and an index.

The two most useful terms to know are:

• file - frequently a rule will require someone to "file" a document, this just means sending it to the court.
• serve - on the other hand means sending something to someone other than the court (usually another party)

General rules

Parts 1-6 contain some important general rules. Part 1 is all about the "overriding objective" which the court is supposed to bear in mind when it is deciding what to do.

The other parts are mostly self-explanatory, although Part 3 has a rather understated title. It deals with the things a court may do to manage a case. In practice a court may do almost anything, though whether it will is another matter.

Getting a case under way

Before you start a claim you should make sure you have complied with any pre-action protocol if there is no specific pre-action protocol for your case then you need to make sure you comply with the practice direction on pre-action conduct.

• A case is usually kicked off with a claim form (Part 7) though certain kinds of claim need to be started with a different kind of claim form (Part 8)
• The Defendant will need to decide how to respond the claim form (Parts 9-11)
• ... and then maybe file and serve a Defence (Part 15 - which also deals with how a Claimant can serve a "Reply" to the Defence).
• If the Defendant doesn't respond or file and serve a Defence in time then the Claimant might want to obtain judgment in default (Part 12) which the Defendant might then want to try to set aside (Part 13).
• In all this the Claimant and Defendant will be sending back and forth "statements of case", for example: the Claim Form, the Particulars of Claim, the Defence and maybe a Reply. There are unsurprisingly rules about what these should look like in Part 16
• Mistakes happen and sometimes it is necessary to correct (or completely alter) statements of case, for which see Part 17.
• The Claimant may have written an entirely unhelpful or confusing claim, or the Defendant a wholly inadequate Defence, there are sometimes ways to force the other side to say a little more by way of a Request for Further Information under Part 18.
• Bringing more parties into the claim (for example where the Defendant wants to get someone else to contribute to any damages they are forced to pay) is then dealt with under Part 19.
• Finally part 20 is a gem. It deals with a really crucial power that parties have at any time to make an offer (a kind of bet) with the other side. If the other party does not accept the offer but fails to beat it they may be punished in costs.

Continuing the case

Parts 21-22 give some more general information. Parts 23-30 deal with "interim" matters - things that may come up during the conduct of a case. CPR 23 is particularly important since it deals with applications to the court which are very common.

Parts 31-35 deal with evidence. CPR 36 is a crucial part dealing with how to make an offer (a kind of bet) to the other party to threaten them with costs sanctions if they don't beat it. CPR 38 is also vital to know about - it governs how you get out of a case. All this leads up to CPR 39 (the hearing) and CPR 40 (the judgment).

After judgment

The parts following deal with various matters that follow a judgment and also deal with certain kinds of specialist proceeding. The most crucial being:

• CPR 43-48 are all about costs. The amount you hope the other side will have to pay you for your legal costs (and of course vice versa).
• CPR 52 deals with appeals - relevant if you want to try to dispute the judgment or if you opponent does.
• CPR 70-79 deal with different methods of enforcing a judgment, though CPR 75-77 and 79 should not normally be relevant to you (if you are bringing proceedings under the Prevention of Terrorism Act 2005 you know more than I do).

Other rules

In the bad old days, before the CPR, the county courts had one set of rules and the supreme court (including the High Court and Court of Appeal) had another. The idea of the CPR was to unify the two systems into one. This has not quite happened and you will see that attached to the end of the CPR are two schedules: one for the Rules of the Supreme Court (RSC) and the other for the County Court Rules (CCR). These still apply but are likely only to be relevant when dealing with enforcement.

Some courts have, in addition to the CPR, their own Court Guides which give detailed instructions on what the court expects in litigation.

Useful Links

• Roger Horne has put together a site called YAWS which has rather more cross-referencing than the official website and also cross-references some case law that is available online.

Repeat infringers: reflections on the New Zealand internet blackout

An internet blackout¹ was called (to begin yesterday) in response to new laws² passed last year in New Zealand that would impose a condition on internet service providers³ to have a policy to deal with repeat infringers of copyright. While I agree that the new law is not well thought out or fit for purpose, much of the campaign against it overstates the position considerably.

For example I was told today that the new law meant:

if anyone alleges that you are using copyrighted material and you don't remove it on the basis of an unsubstantiated allegation your ISP MUST disconnect you.....

This is just plain wrong.

What's wrong with the repeat infringer law?

The offending provision states:⁴

92A Internet service provider must have policy for terminating accounts of repeat infringers

(1) An Internet service provider must adopt and reasonably implement a policy that provides for termination, in appropriate circumstances, of the account with that Internet service provider of a repeat infringer.

(2) In subsection (1), repeat infringer means a person who repeatedly infringes the copyright in a work by using 1 or more of the Internet services of the Internet service provider to do a restricted act without the consent of the copyright owner.

As a lawyer reading this section there are some obvious howlers.

There might not be accounts to terminate

I am struck by wondering what "accounts" the section is talking about. You should know that an "Internet service provider" (I'll use "ISP for short) is defined elsewhere⁵:

Internet service provider means a person who does either or both of the following things:

(a) offers the transmission, routing, or providing of connections for digital online communications, between or among points specified by a user, of material of the user’s choosing:

(b) hosts material on websites or other electronic retrieval systems that can be accessed by a user

So an ISP means someone who provides services on the internet as well as someone who provides the services of the internet. An ISP includes me (my wife gets to use the connection I pay for), my mother (she lets me use the internet when I visit her), Starbucks, public libraries, schools, anyone who hosts a website and so on.

Nothing in the definition of ISP says what an "account" might be. My wife doesn't have an account with me, customers of a cybercafe don't have "accounts" in any meaningful sense with the cafe and so on.

In short a classic legislative drafting error - an unstated assumption.

What happens if an ISP doesn't have such a policy?

Its all very well for a law to say you have to do something, but what if you don't? There appears to be no mention in the legislation. The equivalent rule⁶ in the US is a precondition for being able to take advantage of one of the DMCA's copyright safe harbors⁷. My guess is that the courts will decide that a copyright holder could sue for damages for breach of statutory duty caused by a failure to comply with s.92A. Much fun for lawyers, but a waste of time for the rest of us.

Does this policy have to be in writing?

I have a lot of policies, but I don't necessarily write them down. Since I am an ISP can I comply with this merely by having a clear idea of what I would do if I did have any "repeat infringers" using my services?

What's wrong with the protest?

So if I don't like the law, what's wrong with the protest against it? The problem is that much of what is being said is just plain wrong. I worry that will create just the kind of climate in which ISPs do the wrong thing (see above).

The petition statement suggested by Creative Freedom in NZ states

I don't want Guilt Upon Accusation laws that will force the termination of internet connections and websites without evidence, and without a fair trial.

What's wrong with this?

ISP's do not have to act on unsubstantiated allegations

There's nothing to require ISPs to do anything without evidence and/or a fair trial. S.92A does not say that an ISP cannot adopt a policy that it would only disconnect those for whom there has been a finding (by a court) that they had infringed copyright on numerous occasions using the ISP's facilities.

Now I suspect that such a policy might not be reasonable. A reasonable policy probably ought to build in a situation where the ISP knows or (more likely) has very strong evidence for the infringement which has not been contradicted by the alleged infringer.

ISP's aren't forced to terminate anway

There's no "force". S.92A specifically says that the policy must provide for termination "in appropriate circumstances". An ISP reasonably have a policy that it would not be appropriate to disconnect the accounts of the vulnerable, schools, hospitals and so on.

No guilt by association

The definition of infringer refers to the person doing the infringement not to anyone else. If a visitor to my house uses my wifi connection to repeatedly infringe copyright then it is they, not I, who is the infringer. There is no "Guilt Upon Accusation" principle built into the new law.

Clearly some of New Zealand's major commercial ISPs agree with the first two of these points. An industry association has proposed⁸ a (rather complex) draft policy which takes them into account.

The policy envisages that the ISP will receive notices from rights holders and pass them on to its customers. If these are not objected to (for example by the customer denying infringement) 3 times in 3 different months then a final warning is sent and, after that, a termination notice. The policy also envisages that the accounts of the vulnerable or essential service providers will not be disconnected.

Conclusion

There is nothing to stop a rights holder obtaining an injunction against an ISP to force it to disconnect a repeat infringer. Such action will cause the ISP inconvenience, expense and some legal risks if they refuse what is asked for. I suspect that many ISP legal departments may take a cautious view so that an aggressive rights holder can probably force any but the most robust ISPs into taking action against its customers who may be quite innocent.

Much better (in my view) either to give ISPs better protection in those circumstances so they aren't tempted to take the easy way out, or to permit ISPs to use policies they have devised for their own (not the rights owners') to avoid the need for injunctive relief.

Section 92A appears to be trying to do the latter, but in addition to the problems with it I have already explained, there's no connection between the policy and protection of the ISP from aggressive legal action from iSP's⁹.

The truth is the status quo is no good. A better system of ISP protection is needed for all our sake's (even those of us who are not ISPs). The repeat infringer policy is daft, and broken but not in the ways and for the reasons Creative Freedom suggest. Lets have some sensible debate about it please.

---

1. For more details see the creative freedom website ↩

2. The new laws are contained in the Copyright (New Technologies) Amendment Act 2008 and amend the existing Copyright Act 1994 ↩

3. As I explain, a surprising number of people are "Internet Service Providers" within the meaning of the Act. ↩

4. Section 92A of the Copyright Act 1994 which is inserted by S.53 of the 2008. The section is not in force yet because an order in council is needed to bring it into force. ↩

5. S.2(1) of the Copyright Act 1994, inserted by s.4(2) of the 2008 Act ↩

6. 17 USC s.501(i) ↩

7. I'm British so I say "harbour" but when talking about US legislation I spell it their way. ↩

8. The Telecommunications Carriers Forum are consulting on a proposed Copyright Code of Practice to comply with s.92A. ↩

9. Readers who have followed the discussion of the "repeat infringer" law in the United States will have a strong feeling of deja vu, with the difference that far from appearing to have learned from the lessons of the US, the New Zealand law actually appears to be rather more poorly drafted. ↩

Data retention and open wifi

The Data Retention (EC Directive) Regulations 2009 came into force yesterday (6 April 2009). A frequently asked question is: "I run an open wifi network will I have to log user's data?"

Do I need to retain data?

At first sight you would appear to be quite safe because the regulations do not apply to everyone. Check out regulation 10(1):

10.—(1) These Regulations do not apply to a public communications provider unless the provider is given a notice in writing by the Secretary of State in accordance with this regulation.

So until you get that letter from the Secretary of State (or some nice minion working on her behalf) you need to do nothing. But hang on, the Secretary of State would appear to have given herself a rather bigger job than anticipated, still in regulation 10:

(2) The Secretary of State must give a written notice to a public communications provider under paragraph (1) unless the communications data concerned are retained in the United Kingdom in accordance with these Regulations by another public communications provider.

So she must give that notice. Notice in passing that there's no particular penalty on her for failing to do so, so the only way to make her would be to bring proceedings for judicial review. An unlikely eventuality.

But am I really a public communications provider?

Well the law on data retention is meant to be a paper chase for lawyers. "public communications provider" is defined in regulation 2(e):

(e) “public communications provider” means—

(i) a provider of a public electronic communications network, or

(ii) a provider of a public electronic communications service;

and “public electronic communications network” and “public electronic communications service” have the meaning given in section 151 of the Communications Act 2003

So, turning to s.151 of the Communications Act 2003 we find that

“public electronic communications network” means an electronic communications network provided wholly or mainly for the purpose of making electronic communications services available to members of the public;

If you noticed that the s.151 also has a definition of what a "public communications provider" is and that its not quite the same as in the regulations. Well spotted. You will not find transparency or consistency here.

So it looks from s.151 very much like an open wifi, or a wifi supplied to customers in a cafe or other site is a "public communications provider". The Secretary of State will be busy.

But hang on, does that mean I have to get ID from customers?

Well, if I'm right and if the Secretary of State did decide to comply with her statutory duty would that not make life really quite hard for (say) an internet cafe that does not check the identity of its customers?

Some comfort can be found in regulation 3:

1. These Regulations apply to communications data if, or to the extent that, the data are generated or processed in the United Kingdom by public communications providers in the process of supplying the communications services concerned.

Notice that the regulations only apply to data that has been generated or processed. There's no obligation to create any data you don't already have.

That is just as well, if you check out the schedule to the regulations you will see that some of the data that is covered by the regulations doesn't seem to quite fit with the operation of many cybercafes etc that I know.

But that won't quite work as an answer. Some of the cybercafe's kit probably does at least process data mentioned in paragraph 13(1) of the schedule.

(a) The date and time of the log-in to and log-off from the internet access service, based on a specified time zone,

So it appears that if the regulations mean what they appear to say and an open wifi provider gets a regulation 10 notification they are going to have to keep 12 months' of data which would be a real pain. I promise not to tell the Secretary of State where you live.

CONTU

The National Commission on New Technology Uses of Copyrighted Works or CONTU was established by the United States Congress in 1974 to carry out a 3 year study on the extension of copyright to the (then) relatively new technologies such as computers and photocopiers. It reported in July 1978

An excellent study of the commission including its historical background is available at the digital law online site.