16.10.10 Weekly Cyber-Law News Round-Up

Another exciting week in the world of cyber-law with BT & Talk Talk being granted judicial review in relation to the Digital Economy Act, many proposals for legal measures from the Commission/Parliament relating to data protection and privacy, and the Parliament`s objection to the use of trademarks as Adwords. CyberPanda wonders what the impact of this opposition will mean in practice when it comes to the laws relating to keywords. Here is my personal pick of the week:

Copyright

·         Larry Lessig Calls For #WIPO To Lead Overhaul Of #Copyright System | IP Watch http://bit.ly/9qAHtp

·         Court Recognizes That DMCA Process Goes Against Basic Copyright Concepts” http://bit.ly/dos8eu

Digital Economy Act

·         Court grants fourth ground for Digital Economy review http://is.gd/h9rzM

·         Future of Digital Economy Act 'in limbo' until next year, say lawyers http://ow.ly/38j13

·         BT & TalkTalk granted judicial review of Digital Economy Act- what does it mean for file sharers? http://bit.ly/92lvxf

Data Protection & Privacy

·         Call to enforce EC strategy for data protection http://ow.ly/3a3IS #dataprotection #in

·         Summary of Draft Department of Commerce Privacy Green Paper http://ow.ly/3a2RK

·         Facebook, Background Checks and Job Applications http://bit.ly/9yyhN5 #privacy

·         Police recruits screened for digital dirt on Facebook, etc. http://usat.ly/avu0uQ #privacy

·         Swedes' emails to be stored for six months http://ht.ly/38lH2

·         Comparative Chart: Divergencies between Data Protection Laws in the EU. http://bit.ly/c0jbCp

·         Dangers of the Commission`s proposal to include the right to be forgotten in data protection laws http://ow.ly/38J6r

·         European Parliament proposes tough behavioural ad rules http://ow.ly/38j4c

·         Information Commissioner says new laws that impact on privacy should undergo post-legislative scrutiny http://bit.ly/cR1Jdj

·         ECJ holds unqualified legal requirement to disclose personal data on website violates right to privacy and data... http://j.mp/9nXWAC

Censorship

·         Palestinian blogger arrested for criticism of Islam on Facebook - Global Voices Advocacy - http://goo.gl/qUao6 #censorship

Unfair Competition

·         European Parliament joins French traders in opposing use of rival brands as keywords http://ow.ly/39QkR

Topware Interactive and the ISP6

It has been reported that Topware Interactive, a computer game developer, has obtained a high court order compelling ISPs in the UK to reveal the identities of users who are suspected of illegal file sharing online.

CyberPanda is eager to know which ISPs other than BT and Virgin Media are involved. In addition, CyberPanda is also eager to learn what specific information will be disclosed and on what facts are taken into account, before a decision is made that a specific user might be involved in illegal file sharing. The danger here of course is that orders might be obtained against users on the basis of very flimsy factual evidence. CyperPanda is not suggesting that this happened here but it might very well happen in the future unless the necessary caveats are drawn out when the order is made, relating to how the determination of whether or not a user is a suspect, is made.

It will be interesting to see how this matter progresses and whether users will accept settlement offers or would prefer to go to trial despite the hefty award of damages that might be made against them. It will also be interesting to see which companies (and in particular from the music indsutry) will follow suit.

Disclaimer: The rights in the image used above are owned by a third party. Click here to access the image in its original context.

Six degrees of separation between you and the advertisers.

The EU Commissioner, Viviane Reding, as asked the UK Government to clarify whether the use of the Phorm system is in breach of EU data protection laws in May 2008. the Government has to respond by August 2008.

Phorm is a digital technology company which has launched Open Internet Exchange ('OIX') and Webwise, which enable targeted advertising, based on the browsing habits of the users. Phorm has been in talks with some of the biggest ISPs in the UK; namely BT, Virgin Media; and TalkTalk, to this end. The attraction for ISPs and advertisers is clear as the closer the match the better. Advertisers are able to reach their target audience and the platform gets more revenue as the chances of the advertisements being clicked on by the end-user is far greater.

A quick read through the website of Phorm seems to suggest that this is a perfectly harmless activity which will improve the web experience of the user drastically. One has to wonder when an advertisement has improved the experience of its audience. Most of the time, online advertisements (just like their offline counterparts) are unwelcome at worst and informative at its best. But one struggles to see how they can stretch to improve the experience per se. The inflation of the experience as well as the constant use of the phrase 'protection of users` privacy' on the Phorm website, is a clear design by the company to hide the true nature of the surveillance taking place here.

Basically, Phorm will have equipment at ISPs which track the activities of the end user. Thus, it will note down the URL visited, search terms used and other relevant information. The IP address of the user is not captured, but a cookie with a unique number is installed on the browser of the end user.

The data collected is categorised and used to create the profile of the user. Hence, when the user visits a webpage whose adverts emanate from OIX, s/he is directed to adverts targeted to his/her profile.

BT is apparently considering starting a trial of the service in the near future. There have also been rumours of 'secret trials' having been conducted without the consent/knowledge of the end user.The Information Commission ruled in May that no action would be taken against BT as it was difficult to explain to users what was being done. However, it also ruled that any future use should only go ahead, with the consent of the users. The flaw in this ruling is quite apparent: surely the inherent difficult in explaining to the end-user what is being done, is still present: so it is very hard to understand how the nature of the difficulty has evolved so that now an explanation is more feasible.

The dangers inherent in this initiative (breach of privacy, breach of data protection etc) are very much apparent and it is very hard to see how the Government will be able to persuasively rationalise them. In addition, it is also very difficult to see the Commission approving of such a scheme. However, in the meantime, this does not put a stop to the launch of the Phorm initiative by the ISPs in the UK, which of course means that the end-user will be incredibly vulnerable until the Commission reaches a decision. A far better option, would have been to ask the ISPs not to launch this initiative until the Commission`s findings.

Disclaimer: This image is subject to copyright. Click here to access original image.

What the ISP6 are not telling you

The six biggest ISPs in the UK namely, BT, Virgin, Orange, Tiscali, BSkyB and Carphone Warehouse ("ISP6") have today signed a Memorandum of Understanding ("the Memo") drawn up by the Department for Business, Enterprise & Regulatory Reform (BERR) in the UK to deal with illegal file sharing of music and films online. The Memo has also been signed by the British Phonographic Industry, the Motion Picture Association (MPA) and endorsed by the Anti-Film Theft Taskforce.

The immediate effect of the Memo is that net-users engaging either knowingly or unknowingly in illegal file sharing online are now liable to receive a letter from their ISP informing them of the breach in question. The interesting point is really the number of actors involved before a user can be identified. The BERR is quick to point out that there is no policing of the accounts of net-users and is very quick to rationalise the nature of the "surveillance" at play before a net-user is identified. It describes the process in the following words:

"ISPs do not monitor individual accounts. Letters to customers are generated by rights holders identifying material available on file-sharing websites which they believe breaches copyright. During this process, it is possible for rights holders to identify the IP address. Rights holders then alert ISPs who can isolate the details of the user’s account of that IP address and send a letter. The letter informs the customers that their account has been used to share copyrighted material without permission and points customers towards legal alternatives. At no stage is a consumer’s personal web browsing monitored. "

This rationalisation, however, does not hide the level of "surveillance" at play here before illegal activities online can be tracked down. Two issues are raised by this quote. The first one is raised by the second line in the above quote which states that right holders are able to identify the IP addresses of users. It is not uncommon for an IP address to contain information which can identify the user. This all depends on the information you have given to the ISP when creating your account. But at the very least, most of us do give our surnames away when creating an account with an ISP. The worrying fact here is that such information can be included in the IP address. The right owner may thus be able to identify the user.

The second issue raised by this quote relates to the process by which ISPs can identify IP addresses. This process is not explained and this raises a lot of concerns for the net-users. If I bought a CD from HMV and the latter was later able to track down my address, the question would arise as to how this was made possible. In the interests of openness, transparency and fairness, the nature of this process should be disclosed to the public to ensure that we are aware of how this information is being gathered. I am not against this initiative in theory, however, Ithink a greater level of transparency and openness is required.

This brings me to my second point: what happens after the letter is sent to the net-user? It seems that the Government is in favour of various sanctions as slowing down the internet connection of the user, the three strikes you are out approach etc. The ISPs so far have not agreed to any of these sanctions. Hence, there is a lack of clarity as to the next step in this process which is the most crucial one: the sanction. It is abundantly clear that few net users will be deterred from engaging in illegal file online if they only get a letter from their ISPs. A more robust approach, as with every prohibitive legal framework, is required and in this instance, the nature of the sanction itself is the key to effective and real action against illegal file sharing online.

In all fairness, one has to note that the Government has also launched a consultation today on the legislative options to tackle illegal file sharing of film and music online. But in my view, a range of sanctions should have been agreed amongst all the relevant parties before this agreement was publicised. A regulatory framework is much more effective and acts as a deterrent if the key elements of the framework, namely, rights, obligations, sanctions etc are clearly identified at the time of imposition on the relevant persons. CyberPanda will keep you posted on how this initiative evolves and whether or not these concerns are addressed.

Clamping down online IP crime.

My attention has been caught by the relatively recent release of a strategy paper by the Department Department of Culture, Media and Sport entitled "Creative Britain: New Talents for the New Economy."

The strategy paper recognises the need for "a balanced IP framework relevant to today’s world... [the] need [for] new business models which recognise changes in technology – and their democratisation of content – yet capture the value provided by content producers and distributors. "The strategy paper forcefully makes the point that the Government is determined to tackle "IP crime" by adopting several measures as educating creators on their IP rights, voluntary agreements between ISPs and content owners and / or more formal regulatory framework to deal with IP crime which reflects the changes in the business models.

In the first instance, the Government would prefer voluntary agreements between ISPs and right owners . However, the Government has made it clear that if this does not materialise itself, it will legislate in this area as it sees fit. The Government anticipates the new regulatory framework to be in place sometime in 2009, so CyperPanda will be watching this space.

It also appears that the British Government is working in collaboration with the French Government on this matter. This, of course, does not mean that the French measures will be adopted here but it will be interesting to observe how the regulatory framework will evolve in France as well.

It is undeniable that ISPs should bear some responsibility for the materials that are published on their websites. However, the nature and extent of their responsibility should be a realistic reflection of what they can do rather than an unrealistic reflection of ISPs as cyberpolicemen. The Government needs to think carefully how to balance the responsibility between ISPs, content owners and other stakeholders and ensure that the ensuing framework is a realistic reflection of what can be done by each stakeholder to combat online IP crime .