National Portrait Gallery: is there a database right?

I have already written about the National Portrait Gallery's legal threat against Mr Coetzee, an editor of wikipedia. I considered only the validity of the gallery's copyright claim. What about its claim that Mr Coetzee infringed the gallery's database right?

The database right is a based on the EC Directive 96/9/EC, transposed into English law by the Copyright and Rights in Databases Regulations 1997.

The directive defines a "database" as:

a collection of independent works, data or other materials arranged in a systematic or methodical way and individually accessible by electronic or other means

That's a pretty broad definition and covers anything you might think of as a "database". The photographs of paintings are independent works (even if they are not subject to copyright protection) and the gallery seem to have arranged them in a systematic way so that they are accessible by electronic means. That just tells us what a "database" is. In order to obtain the protection of the database right, the maker of the database must show:

that there has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents to prevent extraction and/or re-utilization of the whole or of a substantial part, evaluated qualitatively and/or quantitatively, of the contents of that database

That is actually 6 different conditions, all neatly packed up in the compression system that is legal drafting. First the maker of the database must show that there has been some substantial investment, which can be of two kinds, either quantitative or qualitative; and second that investment can be in one of three things: obtaining, verification or presentation.

What sort of investment counts? Here the decision of the European Court of Justice in Fixtures Marketing v OPAP C-444/02 comes into play. The top divisions in English and Scottish football drew up fixture lists for the matches to be played in the various divisions during each season. Fixtures Marketing Limited had been assigned the rights to manage this information outside the United Kingdom. OPAP repeatedly extracted the names of pairs of football teams playing against each other and displayed them on its website. Fixture Marketing were obviously unhappy about this and sued. The question of what was a database and how was it infringed was referred to the European Court of Justice.

The court held that "investment in ... the obtaining ... of the contents" referred to resources used to seek out independent materials that already existed and to collect them into the database and not the resources used to create the independent materials in the first place. The purpose of the database right was (thought the court) not to protect the creation of materials that went into the database but to protect the creation of the storage and processing systems for the database.

As support for this view the court pointed out that recital 19 of the directive states that the compilation of several recordings of musical performances on a CD does not represent a substantial enough investment to be eligible. The investment in the music is not enough.

The relevance of this case to the NPG is obvious. One suspects a great deal of the investment in creating the photograph database was in taking and making the photographs. That, on the authority of Fixtures Marketing is irrelevant.

As for verification and presentation, the court seems to have required that any investment that forms a part of the creation of the independent materials would also have to be disregarded. For example, on verification the court said:

The professional football leagues do not need to put any particular effort into monitoring the accuracy of the data on league matches when the list is made up because those leagues are directly involved in the creation of those data. The verification of the accuracy of the contents of fixture lists during the season simply involves, according to the observations made by Fixtures, adapting certain data in those lists to take account of any postponement of a match or fixture date decided on by or in collaboration with the leagues. Such verification cannot be regarded as requiring substantial investment.

Of course I have no idea exactly what work went in to the NPG's database, but I think it is here that they come unstuck. In their letter to Mr Coetze the gallery's solicitors use the time honoured tactic of proof by assertion:

Our client’s website includes a searchable database of over 60,000 carefully chosen, curated and watermarked images. There can therefore be no doubt that our client’s database of images is a “database” for the purposes of s.3(A)(1) of the CDPA.

If, as seems to be the case, the gallery had set aside funds to digitise its collection, those funds and the investment they represent would have to be ignored. The "carefully chosen" images would be just those images that the gallery had chosen to digitise, creating a database from that collection would not necessarily represent the substantial investment the directive envisages. I have no idea whether the "curated" refers to the paintings (in which case it is irrelevant) or the images (in which case I don't know what curating a digital image might mean). The watermarking would surely form a part of the gallery's effort in creating the digital images in the first place and also have to be disregarded.

There's too little information to be able to assess how good the gallery's claim might be, but whether they have a database right at all is open to some considerable doubt.

National Portrait Gallery: photographs of paintings

There's been quite a bit of discussion about a legal threat made against a wikipedia administrator Derrick Coetzee. What he is accused of doing is of having accessed the National Portrait Gallery (NPG)'s website and downloaded some 3,300 high resolution images from its database. Solicitors acting for NPG have alleged 4 different causes of action:

• breach of contract
• unlawful circumvention of technical measures
• infringement of NPG's database right
• infringement of copyright

I'm not going to discuss the first 3 claims (if anyone is interested please let me know and I can write about them in another post). I will say that the first two claims seem hopeless to me to the point of being misconceived while the database claim depends on some facts about the NPG database and its extraction that I do not know.

There's also a question about jurisdiction. Mr Coetze appears to be based in the United States, the NPG is claiming under English law. Assume for the moment that that is not a problem.

In this post I'll try to explain what I think the legal controversy is all about. Obviously there's a huge debate about policy, both for the general question of whether photographs of paintings should be the subject of copyright in themselves, and also whether the NPG itself should or should not be allowing organisations like wikipedia to use its stock of digitised photographs. I'll leave that debate to another forum.

Introduction

The problem starts with the requirement of s.1(1)(a) of the Copyright Designs and Patents Act 1988, which states that copyright "subsists" in an original literary, dramatic, musical or artistic works. If the work is not original then it cannot be the subject of copyright.

What does "original" mean? Everyone seems to agree that it doesn't cover the same ground as the terms "novel" or "inventive" do from patent law. Roughly speaking: copyright not about ideas but the expression of those ideas: you can copy the idea but not the expression.

In English law there seems to be two strands of thought on what "original" means:

• "Original" implies "not copied". An author may adapt something that already exists but they must put enough "independent skill and labour" into that adaptation to result in something that is "original".
• "Original" means that sufficient" independent skill and labour" has gone into the work. It really doesn't matter if its an identical copy of something that already exists provided that enough originality has gone into the copying.

Strand 1: "original" means "not copied"

An early, and classic attempt to get to grips with originality came in University of London Press Ltd v University Tutorial Press Ltd (1916). The court was considering whether university examination papers were "original". Peterson J said:

The word “original” does not in this connection mean that the work must be the expression of original or inventive thought. Copyright Acts are not concerned with the originality of ideas, but with the expression of thought, and, in the case of “literary work", with the expression of thought in print or writing. The originality which is required relates to the expression of the thought. But the Act does not require that the expression must be in an original or novel form, but that the work must not be copied from another work - that it should originate from the author.

No-one had suggested that the examination papers were direct copies of anything, but that the examiners had drawn on the general stock of knowledge in mathematics and so the papers were not "original". That means that the case did not directly concern whether or not there can be "original copying". Strictly speaking that part of the judgment is what lawyers call an obiter dicutum — something that is said in passing but which does not have binding authority on future cases (though it can be pretty persuasive).

In British Northrop Limited v Texteam Blackburn (1973), Megarry J cited University of London and added:

A drawing which is simply traced from another drawing is not an original artistic work: a drawing which is made without any copying from anything originates with the artist.

Again the case was actually about whether drawings were original enough, so again this is strictly an obiter dictum.

The saga continues: Northrop was approved by the Court of Appeal in Merlet v Mothercare (1986) (concerning copies of designs for a baby's rain cape) but again the main question was whether the designs were original enough.

The first strand of thought in English law culminates in the case of Interlego v Tyco Industries(1988) in which Lord Oliver said:

It takes great skill, judgment and labour to produce a good copy by painting or to produce an enlarged photograph from a positive print, but no one would reasonably contend that the copy painting or enlargement was an "original" artistic work in which the copier is entitled to claim copyright. Skill, labour or judgment merely in the process of copying cannot confer originality.

This decision comes with a health warning: it was made by the Judicial Committee of the Privy Council. Its decisions, though strongly persuasive, are not binding on English courts.

Strand 2: "original" means "with independent skill...."

The other strand of thought can be seen in the House of Lords decision in Walter v Lane (1900). The Times employed reporters who took a verbatim note of speeches made by Lord Rosebery, and transcribed the notes into copy that was published in the newspaper. The Times claimed copyright on the reports.

One of the issues before the court was whether the reporters were the "authors" of the reports. The House of Lords decided that they were.

At first sight this is a fairly unpromising authority since, at that time, copyright in works of literature did not have an originality requirement. Indeed Lord Halsbury was quite scathing about the use of the word "original" in the Court of Appeal. For that reason a succession of High Court judges have questioned whether or not Walter v Lane is still good law but the question was not decided until Express Newspapers v News (UK) (1990) when Sir Nicholas Browne-Wilkinson decided that Watler v Lane was good law after all.

In Express Newspapers there had been a relatively long interview (at least 8 hours according to the report) with a member of the Royal Family, excerpts of which had been reproduced by the newspaper. So the situation differed a little from the reporter taking down a speech situation in Walter v Lane.

The Court of Appeal gave its seal of approval to Walter v Lane in Sawkins v Hyperion Records(2005). The court made clear its strong disagreement with the first strand of authorities culminating in Interlego.

Most relevant for the NPG claim is that the court adopted a statement from a text called The Modern Law of Copyright which directly addresses the "picture of a picture" question (apologies for the long quotation but it is worth reading through):

However, whilst the remarks made in Interlego may be valid if confined to the subject matter then before the Privy Council, they are stated too widely. The Privy Council was there considering fairly simple technical drawings. This is a rather special subject-matter. While the drawing of such a work is more laborious than it looks, it is a fact that any competent draftsman (perhaps, any conscientious amateur) who sets out to reproduce it exactly will almost certainly succeed in the end, because of the mathematical precision of the lines and measurements. This should be contrasted with, eg a painting by Vermeer, where it will be obvious that very few persons, if any, are capable of making an exact replica. Now, assume a number of persons do set out to copy such a painting, each according to his own personal skill. Most will only succeed in making something which all too obviously differs from the original – some of them embarrassingly so. They will get a copyright seeing that in each instance the end result does not differ from the original yet it took a measure of skill and labour to produce. If, however, one of these renders the original with all the skill and precision of a Salvador Dali, is he to be denied a copyright where a mere dauber is not? The difference between the two cases (technical drawing and old master painting) is that in the latter there is room for individual interpretation even where faithful replication is sought to be attempted while in the former there is not. Further, a photographer who carefully took a photograph of an original painting might get a copyright and, if this is so, it is rather hard to see why a copy of the same degree of fidelity, if rendered by an artist of the calibre aforementioned, would not be copyright.

This statement (and Sawkins in general) make me somewhat nervous.

The logic seems to go: applying some (but not enough) skill to copying a painting exactly results in a copyright, therefore the application of considerable skill ought to. But exactly the question we are asking is: is skill all by itself the criterion, or does that skill have to produce something new? The statement in Sawkins seems to do nothing but beg that question and thus resolve nothing.

Furthermore, the case concerned a musicologist who produced modern performing versions of the work by the French composer de Lalande. Far from being an exact copy, considerable work was involved, which included writing parts that were missing from the original. To my inexpert eye it seems to me that Mr Sawkins's work was "original" in the sense of not being a copy. A French court considering the same works agrees with my conclusion. Arguably the interesting discussion about paintings and photographs by Lord Justice Jacobs in Sawkins is also obiter dicta.

I also have great difficulty with Walter v Lane for a completely different reason. In English law a work does not become subject to copyright until it is recorded in some permanent form ("fixation"). It is normally accepted that the person recording a work might not be the author. Where an author dictates to a secretary (for example) there is no doubt that the work is the author's not their secretary's. It is very common in the modern music industry for musicians to jam together to produce a work but for the recording to be done by someone else. Again no-one supposes that the musicians are not the authors of the work. That principle does not seem to sit well with Walter v Lane.

Even in Sawkins it is recognised that a slavish copy would not be original. The question would be one of degree.

Is it different for photographs anyway?

I have been deliberately ignoring a direct authority from way back in the nineteenth Century — Graves' Case (1869). The court of the Queen's Bench had to deal with a case involving 3 photographs of engravings. Under the Fine Arts Copyright Act 1862 originality was a criterion for copyright. Blackburn J said:

All photographs are copies of some object such as a painting or statue. And it seems to me that a photograph taken from a picture is an original photograph, in so far that to copy it is an infringement of this statute.

Ooops.

The difficulty with Graves' Case is that it does not explain what "original" does mean for a photograph. It seems reasonable to assume that some photographs must not be original, otherwise there would be no need to restrict copyright to original ones. Nor is it clear from the report what kind of photographs they were and how they were taken.

Conclusion

As far as I can see, the authorities look bad for Mr Coetze but not by any means hopeless. If I had to argue the case for him, I might proceed as follows:

• Walter v Lane is not good law because it did not consider the question of originality
• National Express and Sawkins address works which are not exact copies and so any statements within them are obiter.
• In Walter v Lane and National Express there was no existing "work" to copy (since they both deal with words that had been said but not written down and therefore fixed).
• London University Press has (via Northrop) been adopted by the Court of Appeal and so is at least as good an authority as Sawkins although strictly speaking they are all obiter
• Graves' Case is a ruling on the particular facts of the case which cannot be easily determined from the report so we cannot tell what criteria were applied by the court making it a problematic authority
• Lord Oliver's view in Interlego should be strongly persuasive
• Other jurisdictions with which we are closely connected (eg much of the EU) and with which there is considerable trade (the United States) do not accept that a photograph of a painting which attempts to be as faithful to the original as possible can command copyright, hence as a matter of comity our law should be developed in that way.

I have not given the subject a great deal of thought, and it may be that there is more to be found by a more thorough search, but it seems to me that Mr Coetze's position is not ideal, but nor is it hopeless.

Post codes and the database right

At opentech 2009 Harry Metcalfe presented the idea for a site (which I will call Ernest Marples) to convert postcodes into latitude and longitude pairs. Ingeniously, the site does not store any data itself, instead it scrapes a number of other sites for the information and returns the result. Does this get around the Royal Mail's database right in the postcode database? Sadly, I do not think it does.

Let us ignore for the moment whether the site breaches any terms and conditions of the sites that it is scraping for its data. The identity of those sites is a secret so although there amy be a question mark over the legality of the scraping, to say any more would be to theorise without data. Instead I want to focus on the database right.

In the 1990's it became clear that, in a number of EC/EU member states, that collections of information could not necessarily be protected by copyright. For example in the Dutch case of Van Daele v Romme a publisher was unable to prevent the copying of all the words in its dictionary. A similar position was reached in the United States where the Supreme Court decided in Feist that a telephone directory could not be subject to copyright.

The eventual result was Directive 96/9/EC of the European Parliament and of the Council on the legal protection of databases. Chapter III of the directive creates a thing called the "sui generis right". The core of that right can be found in article 7(1):

Member States shall provide for a right for the maker of a database which shows that there has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents to prevent extraction and/or re-utilization of the whole or of a substantial part, evaluated qualitatively and/or quantitatively, of the contents of that database.

As you can see a lot of alternatives are being packed in. If all that you remember is that the focus is substantial investment you will not go far wrong. Roughly speaking, lots of investment implies protection. To unpack a little: the substantiality of the investment can be qualitative (it took real skill to select just these poems) or quantitative (we spent many person years walking to every grid point and photographing it). That investment can be in verification and presentation as well as collection.

The right allows a rights holder to prevent either:

• extraction; or
• reutilisation

Of a substantial part of the database.

Ernest Marples is not extracting a substantial part of the database, but I'm less sure about re-utilisation. The term "re-utilization" is defined in article 7(2)(b) to mean:

any form of making available to the public all or a substantial part of the contents of a database by the distribution of copies, by renting, by on-line or other forms of transmission.

Is that what Ernest Marples site is doing? On the one hand Ernest Marples only hands out single (postcode, co-ordinate) pairs and so it could be argued that it is not making the whole of the database available at any one time. On the other hand a member of the public can query any postcode and Ernest Marples is almost certain to be able to return a result for it.

It may be that the drafters of the directive saw Ernest Marples coming because they added an additional form of infringement in article 7(5):

The repeated and systematic extraction and/or re-utilization of insubstantial parts of the contents of the database implying acts which conflict with a normal exploitation of that database or which unreasonably prejudice the legitimate interests of the maker of the database shall not be permitted.

Roughly speaking: lots of insubstantial extractions etc may add up to a substantial one. When exactly? That was just the question that the Swedish Supreme Court in Fixures Marketing v AB Svenska and the Court of Appeal of England and Wales in British Horseracing Board v William Hill wanted to know. The European Court of Justice explained to them that the purpose of article 7.5 is exactly to prevent someone getting around 7.1. If the effect of the repeated extractions or re-utilzations would have the same negative effect on the maker of the database as a breach of 7.1 (if all the extractions etc had been done all at once), then that is a breach of 7.5.

I think Ernest Marples is probably caught by 7.5 even if he gets away with avoiding 7.1. Article 8 does provide a defence for lawful users of the database but that is even more fraught a line of argument (if you thought 7 was badly drafted, have a read of 8 and try and work out what its meant to do). There is some doubt, but not enough to make Ernest Marples's method your business plan.

As Harry explained at opentech, part of the purpose of the site is political. There is a strong body of opinion that the Royal Mail should not have a monoploy on this extremely important database. If Ernest Marples is sued that will generate terrible publicity for the Royal Mail (as it should).

Tags: postcode, database right, databases

Data protection: new tiered notification fees

For most of my clients I expect this is a non-event, but it is interesting nonetheless. Fees for notifying the information commissioner are now tiered. Tier 2 consists of organisations with a turnover of £25.9 million or more; or 250 or more members of staff. Charities and small occupational pension schemes escape tier 2 and come under tier 1, as do the rest of us.

The practical effect is that, as from 6th July 2009, tier 2 processors pay a notification fee of £500+VAT, while tier 1 processors continue to pay £35+VAT.

The thinking appears to be that bigger organisations require more regulatory supervision and so should pay more. I'm not sure that's right - surely it depends on the organisation? The reverse might well be true in some fields. As always the numbers (35, 250, 500, 25.9 million) presumably do have a rationale but its not clear to me. Maybe some manipulation of them gives the fine structure constant.

Law changed courtesy of the Data Protection (Notification and Notification Fees) (Amendment) Regulations 2009.

Pirate Bay - the end?

Pirate Bay have announced that they are likely to be selling the business to the Swedish company Global Gaming Factory X AB according to the company's press release the transaction is schedule to complete for August 2009. Their CEO, Hans Pandeya, is quoted as saying:

"We would like to introduce models which entail that content providers and copyright owners get paid for content that is downloaded via the site"

I read that as meaning that the nature of the site will change dramatically, although Pirate Bay's own blog comments that if the new owners change the site dramatically, no-one will continue to use it.

Pirate Bay loses appeal

According to the Swedish Court Service website, the four defendants in the Pirate Bay case have lost their appeal. The Svea Court of Appeal decided that, despite some criticism of the way in which the judges in the trial had proceeded, the trial was fair.

I have yet to read a reasoned decision so I am relying on the press release. One line of reasoning seems to have gone as follows: the presiding judge was a member of two organisations operating in the field of intellectual property. Let us say, for the sake of argumen, that the judge’s membership of these organisations showed that he was in favour of the enforcement of intellectual property and would thus be supportive of rights holders. That does not, thought the court, prevent a fair trial because intellectual property rights are legal rights in Sweden as the law stands. Being in favour of them merely means being in favour of the law.

An analogous argument might be used in a case in which a judge who was in favour of private property rights and their enforcement should still be allowed to sit on a case of theft, or for eviction of trespassers.

Having said that the court appears to have thought that information like this (membership of relevant associations)  ought to have been available at the earliest stage, so that it can be properly dealt with then rather than on appeal.

I remain sceptical as to whether the judge (Tomas Norström) really was biased in any way. The Swedish Association for the Protection of Industrial Property and the Swedish Copyright Association do not look (to me) like industry organisations that pursue infringers of intellectual property, but rather more like the sorts of organisations that lawyers routinely get involved in for the better exchange of ideas and study of a subject.

Members are likely to have a lot of different affiliations, work against each other in practice on many occasions and the mere fact that A and B are both members of such an assocaition doesn’t mean they will even like each other. I certainly can’t stand the sight of some people in the same professional bodies as myself.

The trouble is I haven’t seen a good analysis of the two Swedish bodies to be sure. I look forward to reading the full decision of the Court of Appeal (if it becomes available) to make up my own mind.

Where does this leave the Pirate Bay four? If the press release is to be believed, there is no appeal but proceedings in the European Court of Human Rights are sure to follow.

Technorati Tags: pirate bay, copyright, P2P, music file sharing

Social Networking Sites and Data Protection

The Article 29 Data Protection Working Group has published its opinion on the relationship between the Data Protection Directive and Social Networking Sites (SNS).

A key point to take away is that operators of SNS are data controllers rather than merely data processors, so that they are more likely to be subject to European data protection law than if they were merely “data processors”.

Who is the working party?

The working party was set up by by the data protection directive as an advisory body. Its opinions are not legally binding, but they are likely to be persuasive and the Commission must respond them.

Key points

The response to the opinion (so far) has concentrated on the view that SNS operators are probably data controllers. I’ll have more to say about that at the end of this post.

For me the most interesting points are:

• SNS operators are usually data controllers
• … and so are many third party application providers
• … as indeed will be many users
• privacy should be the default setting
• release of profile information beyond a user’s selected friends should never be implicit
• third party applications should not by default be given access to all an individual’s profile information, but only what is necessary for that application to work

It seems to me that this signals a tougher line to SNS like facebook which will not be able to get away with, for example, a completely cavalier attitude to third party applications.

There are a couple of specific points of interest.

Users

Almost anything about someone is “personal data” but most individuals using an SNS won’t be subject to the Directive because it excludes processing “by a natural person in the course of a purely personal or household activity”.

The working group notes an increased use of SNS for other purposes such as for businesses or campaigning. Those would fall outside the household exception and such users would need to comply with the Act.

The Working Group makes three recommendations on this point:

- SNS providers provide adequate warnings to users about the privacy risks to themselves and to others when they upload information on the SNS - SNS users should also be reminded that uploading information about other individuals may impinge upon their privacy and data protection rights; - SNS users should be advised by SNS that if they wish to upload pictures or information about other individuals, this should be done with the individual’s consent.

Which seems entirely positive. Strictly speaking you don’t always need an individual’s permission to process their data, so the last point is not quite right, though it is good practice. What the Directive does require is that individual’s are notified of the processing, which could be done by a tagging system.

Having said that, the Directive was not (I think) written with uses of SNS in mind. I suspect that more difficulties will follow.

Controller vs Processor

The Directive makes a distinction between “controllers” on the one hand “processors” on the other. A controller is an entity which “alone or jointly with others determines the purposes and means of the processing of personal data.”

In the context of an SNS you might argue that it is the users of the site who decide the purpose and means of processing the data, the operator of the site provides nothing more than an environment for the users to do what they wish (post pictures, disclose information about themselves and so on). In other words, they are just a processor.

The Working Party thinks not. Amongst other things sites like facebook decide what use is to be made of data contributed to the site for the purposes of advertising and marketing.

This matters for two reasons: first because it is on the controller (not the processor) that most of the obligations of the directive are imposed; but second because the location of the controller affects whether or not the directive applies at all.

How far does the Directive reach?

The answer to that question applies in article 4 of the directive which states:

(a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable; (b) the controller is not established on the Member State’s territory, but in a place where its national law applies by virtue of international public law; (c) the controller is not established on Community territory and, for purposes of processing personal data makes use of equipment, automated or otherwise, situated on the territory of the said Member State, unless such equipment is used only for purposes of transit through the territory of the Community.

The first two provisions give little difficult: if your processing is being carried out in/with or by an establishment of yours in a member state (or somewhere else that state’s law applies) then unsurprisingly you have to comply with the Directive.

The odd one is (c). The Working Group have previously in their opinion on search engines said that storing a cookie in a user’s browser amounts to “making use of” equipment (the user’s browser) so that wherever on the plant a data controller might be, if their processing of the data involves cookies they will be subject to the directive.

I am not entirely convinced by that argument. It would require any such site to have a designated representative in every member state from which anyone were to browse them (under article 4(2)). It also seems to me that what the directive means is that if you process the data in question in a member state then the directive applies to the processing of that data in that member state. A cookie will necessarily contain much personal data of itself.

Conclusion

The opinion seems to me to be useful. It is relatively short and an easy read. Let us hope that it contributes to the pressure on sites like facebook to put their house in order.