English Court of Appeal upholds the Digital Economy Act; slaps down the European Data Protection Supervisor

Today the English Court of Appeal handed down its judgment in British Telecommunications plc and TalkTalk Telecom Group plc v Secretary of State for Culture, Olympics, Media and Sport [2012] EWCA Civ 232. BT and TalkTalk had sought judicial review of the Graduated Response provisions of the Digital Economy Act 2010 (DEA) and the statutory instrument dealing with the costs of the process. On 20 April 2011, Mr Justice Kenneth Parker had handed down a judgment rejecting all the ISPs' complaints about the DEA, but striking down part of the costs order (see my post of that date). Today the Court of Appeal dismissed the ISPs' appeal in respect of the DEA, but struck down a slightly wider portion of the costs order. In the course of doing so, they made some important observations about the consistency of Graduated Response with the EU's data processing rules, giving a no doubt unintentional sideswipe to Peter Hustinx, the ubiquitous European Data Protection Supervisor.

The ISPs' challenge to the DEA on appeal was as follows:

(1) the DEA was a "draft technical regulation" that should have been notified to the European Commission under the Technical Standards Directive 98/34/EC. Rejecting this, the Court of Appeal held that it was the Code of Initial Obligations, on which Ofcom has been working, that was the "technical regulation". The DEA itself was more in the nature of enabling legislation which did not produce binding legal effects on individuals.

(2) the DEA was incompatible with the Electronic Commerce Directive 2000/31/EC, because (a) it would render ISPs potentially "liable for the information transmitted", contrary to the "safe harbour" in Article 12; and (b) it amounted to a restriction on the freedom to provide information society services from other Member States within the field exclusively governed by the Directive. The Court of Appeal held that the DEA did not make the ISPs liable for the "information transmitted" - that referred to liability arising from the "information", such as copyright infringement liability, not regulatory obligations. In any case, the Directive explicitly provided that it did not "affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement". That was exactly what the DEA did. On the preemption point, the Court observed that the Annex to the Directive explicitly excluded "copyright" from the exclusive field of the Directive.

(3) the DEA was incompatible with the Data Protection Directive 95/46/EC (DPD) and the Privacy and Electronic Communications Directive 2002/58/EC (PECD). As to the DPD, right holders using the procedure would violate the data processing rights of subscribers by gathering their IP addresses and information about their allegedly infringing activity. However, the Court of Appeal rejected the proposition that there would be any illegality in such evidence collection, as processing is permitted under the DPD if it "is necessary for the establishment, exercise or defence of legal claims" (Article 8(2)(e)) - which was the present case. As for the PECD, which regulates the processing of "traffic data", any processing fell within an exception under Article 15. Referring to the ECJ decision in Productores de Musica de España (Promusicae) v Telefonica de España Case C-275/06, the Court of Appeal held that the processing of traffic data was permitted for the purpose of the protection of the rights and freedoms of others, including the protection of the right to property. The DEA was enacted for that purpose and its operation entailed no impermissible data processing.

(4) the DEA was inconsistent with the Authorisation Directive 2002/20/EC (as amended in 2009) on the freedom to operate in the telecommunications sector. The ISPs contended that the copyright protection provisions fell within the Directive's definition of a "general authorisation" and so should have been included in the general licensing arrangements for ISPs, not in separate legislation; and that in any case the copyright protection provisions were conditions attached to the ISPs' general authorisation that fell outside the list of conditions permitted under the Directive. The Court of Appeal held that there was no obligation to include all authorisation provisions in the "general authorisation", at least in relation to national measures intended "to pursue general interest objectives, in particular relating to content regulation and audio-visual policy" (referring to Article 1(3) of the Framework Directive 2002/21/EC on telecoms regulation); and in any case the DEA fell within the list of permitted conditions set out in the Annex to the Authorisation Directive, being " Restrictions in relation to the transmission of illegal content, in accordance with [the Electronic Commerce] Directive 2000/31/EC". BT and TalkTalk also attempted to argue that it was discriminatory and disproportionate to exclude smaller ISPs and mobile providers from the scheme. The ISPs affected have some 93.4% of the market, so the Court gave this short shrift.

The Court of Appeal therefore rejected all the ISPs' arguments relating to the substance of the DEA. On the question of the costs of operating the procedure, they agreed with the ISPs that it was inconsistent with the Authorisation Directive to impose on them any of the costs of the appeals body set up to handle subscriber appeals. It had been intended that ISPs would bear 25% of those costs. Now right holders will presumably be expected to fund 100%. 

And what about the European Data Protection Supervisor, Peter Hustinx? The EDPS, a crusader for ever-widening application of data privacy rules, issues Opinions on matters of public policy, whether requested to do so or not. In June 2010 he saw fit to issue an Opinion "on the current negotiations by the European Union of an Anti-Counterfeiting Trade Agreement (ACTA)". 

The Opinion recites that "the EDPS particularly regrets that he was not consulted by the European Commission on the content of such an agreement." Nothing daunted, Mr Hustinx issued his Opinion anyway, expatiating on the data privacy and human rights evils of the Graduated Response, which at that time some thought might be included in the treaty (it was not, as it turned out). 

The judicial view is one of the many hardships that data privacy officials have to bear in the course of their important work. In the BT case, the Court of Appeal did refer to the Opinion of the EDPS. Suffice it to say, it did not carry the day:

"I should mention for completeness that the appellants placed reliance in this context on an Opinion dated 22 February 2010 of the European Data Protection Supervisor ("the EDPS") on then current negotiations by the EU of an Anti-Counterfeiting Trade Agreement with third countries. We were told by [Counsel] that the Opinion was provided by the EDPS of his own motion and was based on the EDPS's own understanding of what was then proposed. At paragraph 52 of the Opinion, in relation to the possible imposition on ISPs of a "three strikes internet disconnection policy", the EDPS acknowledged that the collection of targeted, specific evidence, particularly in cases of serious infringements, might be necessary to establish and exercise a legal claim, but he cast doubt on the legitimacy of wide-scale investigations involving the processing of massive amounts of data of internet users. It is not clear that he had Article 8(2)(e) of the DPD specifically in mind, but if he did it is difficult to see why the applicability of that provision should depend on the scale of the operation. In any event the view expressed by the EDPS is not binding on us and it does not cause me to alter my own view that the processing in this case would fall within Article 8(2)(e)."

HADOPI boosts legitimate sales

On 23 January 2012, the International Federation of the Phonographic Industry published its Digital Music Report 2012. Alongside news about the state of the online music business, the report referred to new research on the effect of the French HADOPI laws. In "The Effect of Graduated Response Anti-Piracy Laws on Music Sales: Evidence from an Event Study in France", US academics Brett Danaher and others examine iTunes sales data in France in the context of the enactment of the HADOPI laws. In a rather persuasive analysis, they find that HADOPI resulted in an increase in iTunes sales of some 22.5% for individual songs and 25% for albums. 

This research is unusual in that, on the basis of a powerful dataset, the academics were able to estimate the effect of enforcement measures on revenues. Almost all the prior research focused on the less immediate question whether illegal file sharing damaged legitimate sales.  Apart from oft-quoted (but discredited) papers by Oberholzer-Gee and Strumpf (2005 version), that research generally found a substantial effect on legal sales. However, unless enforcement makes a difference to sales, the question of damage is merely of academic interest to business people. The Danaher paper points out that its conclusions probably represent a minimum effect on the legitimate market, as there are legal music services other than iTunes which could be expected also to have benefited from HADOPI.

It will be interesting to see whether this transparent research will have any impact on the debate about online piracy, which has a theological, rather than a scientific, character. 

EU judges set Belgian court straight on filtering

The Treaty on the Functioning of the European Union - once the Treaty of Rome - provides that the Court of Justice of the European Union "shall have jurisdiction to give preliminary rulings concerning... the interpretation of the Treaties" (Article 267). It is interesting to bear this definition of its jurisdiction in mind when considering the decision handed down today in Case C-70/10, SABAM v Scarlet Extended SA, referred from the Belgian court.

It was in 2004 that SABAM, a music collecting society, obtained a decision from the Brussels Tribunal de première instance entitling it in principle to an injunction against Scarlet, an ISP, requiring it to prevent the mass pirating of works of its repertoire through peer-to-peer file-sharing. In 2007, following a report by a court-appointed expert and some procedural wrangling, a further judgement was handed down which required the ISP to implement a filtering mechanism based on (highly accurate) fingerprinting technology (the method specifically considered was that of Audible Magic). The Belgian courts approached the whole case with a mixture of insouciance and common sense which was almost bound to lead to a reference, and so it did... 

The defendant appealed to the Cour d'Appel de Bruxelles, which in January 2010 referred to the EU Court certain questions of interpretation under Article 267 of the Treaty, namely whether the relevant Directives and the European Convention on Human Rights permitted a Member State to authorise a court to issue an injunction requiring an ISP "to install, for all its customers, in abstracto and as a preventive measure, exclusively at the cost of that ISP and for an unlimited period, a system for filtering all electronic communications, both incoming and outgoing, passing via its services, in particular those involving the use of peer-to-peer software, in order to identify on its network the movement of electronic files containing a musical, cinematographic or audio-visual work in respect of which the applicant claims to hold rights, and subsequently to block the transfer of such files"; and if so, do the Directives require the national court "to apply the principle of proportionality"? 

Today the EU Court handed down a brief judgment giving its answer. The implications of its lapidary remarks will reverberate through national courts in the coming years.

The EU Court confirmed that a national court may order an ISP to take action to terminate infringements and also to prevent future infringements (confirming that the principle expressed in the recent Case C‑324/09, L'Oréal and others, applies to copyright cases as it does to trade marks). However, the implementation of a filtering system would amount to the general monitoring of Internet traffic, contrary to Article 15 of the Electronic Commerce Directive. Also, as previously decided in Case C‑275/06, Promusicae, the protection of intellectual property under Article 17 of the European Charter of Fundamental Rights was not absolute, but had to be balanced against other fundamental rights, such as the freedom of Scarlet "to carry on a business" (Article 16, Charter). The injunction would require the ISP "to install a complicated, costly, permanent computer system at its own expense", was not subject to any limitation in time and applied to works not yet in existence.

Yet further, the operation of the system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses. The addresses were protected personal data because they allowed those users to be precisely identified. The system might also block lawful communications, contrary to the freedom to receive and impart information (Article 11, Charter).

The Court concluded that "in adopting the injunction requiring the ISP to install the contested filtering system, the national court concerned would not be respecting the requirement that a fair balance be struck between the right to intellectual property, on the one hand, and the freedom to conduct business, the right to protection of personal data and the freedom to receive or impart information, on the other." The law must be interpreted as precluding "an injunction made against an ISP which requires it to install the contested filtering system".

The Court does not share with the reader its analysis of data protection law or the reasons why compliance with a court order would involve any infringement of the privacy rights of users (a matter of Belgian law). It also spares the national court the tiresome business of deciding on the facts whether the filtering system would unduly block non-infringing communications by the ISP's customers. It is hard to imagine the Belgian court's informing the EU Court that in reaching conclusions on these matters it had exceeded its jurisdiction; but perhaps there is somewhere a Bruxellois equivalent of the UK's late, lamented Mr Justice Laddie.

Given the fact-specific nature of the questions, right holders will not feel completely downcast by the outcome. The relief obtained by SABAM was always a bit too good to be true. However,  the Court's comments on monitoring, data privacy and freedom of expression create obstacles for deploying against piracy the ISPs' traditional, if unpublicised, methods of controlling their subscribers' behaviour.

Sarkozy reaffirms commitment to the Graduated Response

Attending the Forum d'Avignon on 18 November 2011, President Sarkozy gave a remarkably detailed and impassioned defence of le droit d'auteur and the lois HADOPI. He identified the proprietary nature of copyright as the root of the independence and dignity of the artist: without respect for copyright there would be no more creativity. Culture was fundamental to the French response to the economic crisis: unlike other countries, the government was seeking to increase investment, not cut it. It was necessary to reconfigure the economic model of creativity from A to Z and he was committed to doing so.

The President repudiated the arguments with which, he said, he had first been met when proposing the idea of  preserving respect for copyright: he would lose the election if he pursued such an unpopular line; and the battle against piracy was already lost in any case. These arguments had been shown false by events: he was elected president; after only a few months since the implementation of HADOPI, the level of peer-to-peer piracy had dropped by 35%; and day-by-day more countries were adopting comparable arrangements - the US, New Zealand, South Korea (interestingly, he failed to mention the UK). As technology developed, he was ready to consider introducing a third HADOPI law, in particular to address the problem of illegal streaming, which no one could justify.

The following day, 19 November 2011, the Conseil d'Etat handed down four decisions rejecting complaints brought against the constitutionality of certain decrees implementing the lois HADOPI. The complainant in three of the cases was the ISP, French Data Network; in one, various Apple companies. The same day the Elysée duly announced that the President of the Republic took note with pleasure of these decisions and the apparent reduction in piracy following introduction of HADOPI. 

Pirates and ISPs must presumably be hoping for a victory by François Hollande in the May 2012 presidential elections. It is hard to imagine a stronger or more public commitment to the Graduated Response than that of M. Sarkozy over recent days.

Site Blocking - UK, Finland and the USA

Wednesday, 26 October 2011 was an interesting day for ISPs and the protection of content online. 

On that day, Mr Justice Arnold gave his supplementary judgment in the Newzbin2 case in London, granting an injunction to require British Telecom to use IP address re-routing and DPI-based URL blocking to prevent access to the Newzbin2 pirate facilitator site. BT would have to cover the rather limited cost of implementation (£5,000, plus £100 for each revision of the black-list).

On the same day, the District Court in Helsinki ordered ISP Elisa to block access to the notorious BitTorrent file-sharing site, the Piratebay. It appears that the court directed Elisa to use both URL and IP-number blocking from 18 November, on pain of a 100,000 euro fine. Elisa says it will appeal. (The Court of Appeal in Antwerp also granted a blocking order (DNS blocking only) against the two leading Belgian ISPs on 26 September 2011.)

And in the US, Rep. Lamar Smith introduced his Stopping Online Piracy Act (H.R. 3261) in the House. Like its counterpart in the Senate (the PROTECT IP Act (RS. 968), the Act would allow the US Attorney General to bring an action against the registrant of a domain name relating to a foreign pirate site or the owner or operator of that site for an injunction to prevent the infringing activity. If served with that order, an ISP would have to "take technically feasible and reasonable measures designed to prevent access by its subscribers located within the United States to the foreign infringing site". 

Similarly, search engines would have to take "technically feasible and reasonable measures... designed to prevent the foreign infringing site that is subject to the order, or a portion of such site specified in the order, from being served as a direct hypertext link". Online advertising agencies or online payment processors would have to cease providing services to such sites. Right holders will be able to bring such actions against payment processors and advertising agencies, but not against ISPs and search engines.

None of these measures implements the Graduated Response as such, which tends to support the view that right holders have decided that site-blocking is a more appropriate or more pressing legislative intervention. As previously mentioned, in the US right holders have been able to agree a voluntary GR scheme with the major ISPs, something that has hitherto proved impossible elsewhere. At the same time, the rise of non-peer to peer sources of piracy such as Rapidshare and Megaupload has perhaps given site-blocking greater relevance.

One direct link to the GR, however, is an interesting aside by Mr Justice Arnold in his judgment of 26 October. Following the recent (and dubious) fashion for informal attempts by non-parties to influence proceedings in English courts, various people (including ISP TalkTalk) sent communications to the judge following BT's defeat. One, an alleged BT subscriber, applied to be sought to be joined as a respondent in the proceedings. 

That applicant made various submissions, including that "a form of order that is more targeted at infringers should be adopted". He proposed "a system of warning notices to subscribers inspired by the Digital Economy Act 2010 and Ofcom's draft Initial Obligations Code." Arnold J said: "I doubt that an order in that form would comply with the United Kingdom's obligations under Article 8(3). In any event, BT has not suggested that such an order should be made in preference to the order sought by the Studios and I have already decided to make an order substantially in the form sought by the Studios." 

The judge's remark that a GR system would not rise to the level of the relief to which a right holder is entitled under Article 8(3) of the 2001 Directive is interesting. It suggests that even if ISPs cooperate in the much-delayed implementation of the UK's the Digital Economy Act, they will still find themselves hauled into court to block pirate sites. Perhaps this will be an incentive to them to craft a voluntary scheme in cooperation with right holders that represents a commercial settlement of all aspects of the content protection issue. However, UK ISPs had the opportunity to agree a system of Graduated Response back in 2007-8 when the Motion Picture Association reached out to them. Ultimately, they preferred conflict to compromise. TalkTalk's attempt to intervene (without intervening) in the Newzbin2 case suggests that that remains their preference.

HADOPI - Bon Anniversaire?

Today the Haute Autorité pour la Diffusion des oeuvres et la protection des droits sur Internet, universally known as Hadopi, published its first "Rapport d'Activité", detailing the activities of the agency over the last 18 months. An imposing 148 pages, the report describes the history, activities and legislative background of Hadopi, charged with the implementation in France of the Graduated Response, land of its birth. 

Hadopi began sending notifications to suspected infringers on 1 October 2010, so the Réponse Graduée is now 1 year old. The scale of Hadopi's activities is considerable. In the period 1 October 2010 to 30 June 2011, it was notified of 18,429,234 alleged infringements by right holders, an average of 71,613 per day. It made 1,023,079 requests to ISPs to identify subscribers, of which 911,970 were identified. The 11% of cases in which there was no identification is put down to various causes, such as duplications resulting from changed dynamic IP addresses. 470,935 "first notices" were sent out and 20,598 "second notices". It does not appear that any subscribers have yet been referred to the Public Prosecutor following a third detection.

The report provides data on the evolution of the notice-sending effort. Having begun in September 2010 with a few hundred identification requests to ISPs, from 18 October 2010 Hadopi sent some 2,000 requests a day to ISPs, stepping up to 4,500 a day on 20 January 2011. From 12 May 2011, the Authority was sending 11,500 identification requests per day. These figures are an indicator of the capacity of ISPs to handle volumes of requests.

Hadopi has carried out public surveys on its work. In late March 2011, 41% of Internet users who were at all aware of Hadopi's existence said that the agency's existence encouraged them to change their activities online. This was an increase of 16% on a similar survey carried out by Hadopi in late October/early November 2010. Of those admitting unlawful Internet use, 44% said that they were very much or somewhat encouraged to change their behaviour as a result of Hadopi. The Secretary General of Hadopi, Eric Walter, suggests that these results are consistent with industry figures showing a decline in peer-to-peer infringement, but whether this is because absolute levels of infringement are falling or rather that users are moving to other methods of infringement remains to be determined. The agency is developing its statistical and technical efforts to obtain more informative data and a quantitative assessment is promised for the agency's second report. 

Much more could be drawn from the report, for example as to the agency's programme of issuing "labels" of approval for legitimate content sites. The scale and detail of the French effort is remarkable, whatever one thinks of its value.

UK DEA creeps forward without site-blocking

Yesterday the UK Government published its response to the report of the Hargreaves Review of Intellectual Property and Growth. Though more persuasive than the report itself, the response essentially accepts the Google-inspired reforms proposed by Hargreaves. Without irony, the response prefaces its radical proposals by saying, "The Review identifies two particular difficulties in the IP field: a near-total lack of high-quality evidence on some issues and an overabundance of effective lobbying." Your lobbynomics, my evidence...

Apart from expressing a general disdain for enforcement, however, Hargreaves (and hence the response) had little to say about the Digital Economy Act, the basis for the impending UK Graduated Response. One point does emerge, however: following receipt of a hand-wringing study by OFCOM, the Government will not bring into force the site-blocking provisions of the DEA. Given the reputed opposition of the security services, this blogger always expected the section to remain a dead letter, and so it has proved. (One wonders whether they will seek to undermine the use of section 97A of the 1988 Act for the same purpose.) 

As a consolation, the Government indicates in its new IP Crime Strategy that the UK Intellectual Property Office will "draw together existing work and develop an action plan on tackling counterfeiting and criminal piracy online", including pirate web sites. Given the substantial failure of the 2004 IP Crime Strategy, blamed by some on the UK IPO's lack of enthusiasm, right holders may find this less than reassuring.

Most important for this blog was the paper also published yesterday by the Department of Culture, Media and Sport: Next steps for implementation of the Digital Economy Act. This contains the welcome news of a change of position on subscriber appeals. It is now intended that there will a returnable £20 fee for the making of an appeal against a notification letter. This should discourage vexatious appeals. 

Traditionally the friend of the content industries, DCMS adopts a more positive tone towards the concerns of the copyright sector. It states that OFCOM's initial obligations code (the implementation of the notification system) will be published "soon". DCMS hopes that the first notification letters will be sent to subscribers "by the end of 2012".