27 June, 2017

Copyright Mutiny - The Pirate Bay is Communicating Works to the Public, says CJEU

Internet piracy has become a very common thing in the 21st century, and websites providing access to infringing materials, specifically torrent files, are booming. While these sites don't host material themselves, they provide links to files shared by the users themselves, potentially therefore facilitating this action. Rightsholders have, arguably rightfully so, been irate about this sharing of content, and have sought to challenge and shut down these websites. A case has been raging in Europe for some time (discussed more here), with both rightsholders and website hosts undoubtedly waiting for its conclusion, which is finally here after the CJEU handed down its judgment in mid-June.

By way of a short primer, the case of Stichting Brein v Ziggo BV and XS4All Internet BV concerns the communication to the public of copyright protected works. In the matter, Stichting Brein, a foundation that protects the interests of copyright holders, took two of ISPs to court seeking to force them to block access to the website The Pirate Bay (TBP). The site, for those unfamiliar with it, gives access to both torrent and magnet files, both of which are used in the facilitation of P2P connections, linking to particular files on the computers of users sharing those files, downloading them in small parts from the users as a collective. The CJEU therefore had to determine whether the ISPs could be compelled to block access to TBP.

As discussed above the matter hinged on whether TBP communicated the works to the public under Article 3(1) of the InfoSoc Directive. With this, the Dutch Supreme Court sought answers to two questions.

The first question, as summarized by the CJEU, asked "… whether the concept of ‘communication to the public’, within the meaning of Article 3(1)… should be interpreted as covering… the making available and management, on the internet, of a sharing platform which, by means of indexation of metadata relating to protected works and the provision of a search engine, allows users of that platform to locate those works and to share them in the context of a peer-to-peer network".

The CJEU set out what amounts to a communication to the public, which comprises of an 'act of communication' that happens to 'a public.

An 'act of communication' has to be assessed under a number of interdependent criteria that need to be fulfilled for the act to be deemed as one of communication. Among these criteria lie the indispensable role of the user and the nature of their intervention: "That user makes an act of communication when he intervenes, in full knowledge of the consequences of his action, to give his customers access to a protected work, particularly where, in the absence of that intervention, those customers would not be able to enjoy the broadcast work, or would be able to do so only with difficulty". In essence, if a user (or a website in this case) intervenes, with full knowledge of doing so, and gives access to copyright protected works that would otherwise be unavailable to the end-users, they would be making an act of communication. The users can also access the works whenever and wherever they please.

Thomas' new online venture would have to
end before it even began...
A 'public' amounts to an indeterminate number of potential viewer, although the number would have to be fairly large. The communication above would also have to happen through a new technical means, not employed by the original communicator (if done so at all initially), to a 'new public', i.e. "…a public that was not already taken into account by the copyright holders when they authorised the initial communication of their work to the public". Finally, the profit-making nature of the communication, if any, is not wholly irrelevant to this assessment.

Following previous decisions, including in Svensson, BestWater and Stichting Brein, the Court established that "…any act by which a user, with full knowledge of the relevant facts, provides its clients with access to protected works is liable to constitute an ‘act of communication’ for the purposes of Article 3(1)".

TBP's platform offers the files for download when and wherever the end-user wants to using the torrent and magnet files provided in their index. Additionally, the Court saw that, while the files were uploaded onto the site by its users and not TBP, "…by making available and managing [the] online sharing platform… intervene, with full knowledge of the consequences of their conduct, to provide access to protected works, by indexing on that platform torrent files which allow users of the platform to locate those works and to share them within the context of a peer-to-peer network". Clearly, TBP's heavy role in the management of the index of the files plays an integral part in the copying of those files by the users. Without them the users would not, potentially at least, have access to the files, making TBP's role essential in the process.

Finally, the Court rejected that TBP only merely provided the physical facilities enabling or making the communication, as the website made the location and access to the files easier through its indexing and search facilities, while actively pruning the collection of files on their website to exclude dead or faulty links.

The Court concluded that the making available and management of an online sharing platform like TBP must be considered to be an act of communication.

The second hurdle therefore was whether this was done to a 'public'. In order to determine this, the Court has to consider both how many persons have access to the same work at the same time and how many of them have access to it in succession.

Many subscribers of both ISPs' services had accessed and downloaded files from the TBP website. The 'public' concerned also included all of the 'peers' on the torrent system, which amounts to, at a given time, potentially tens of millions of users. The communication therefore does happen to an indeterminate amount of people, involving a large amount of individuals – falling in the definition of a 'public' under the Directive. The users of the website would also not have been considered by the original communicators of the works, therefore being a 'new public'.

The Court ultimately concluded that: "…the concept of ‘communication to the public’, within the meaning of Article 3(1)… must be interpreted as covering… the making available and management, on the internet, of a sharing platform which, by means of indexation of metadata referring to protected works and the provision of a search engine, allows users of that platform to locate those works and to share them in the context of a peer-to-peer network".

The decision is a very important one, and sets the tone for the enforcement of copyright against torrent websites all over the Internet, not just TBP. Clearly, the Court placed a heavy emphasis on the active management of the website, its index, and the provision of the facilities to easily search and download infringing materials from the website. This writer would agree with this assessment, since, should a very active facilitation of copyright infringement be included under Article 3, this would open up the field for a tremendous amount of abuse as a result. It will remain to be seen how this decision will impact these websites, but it is clear that rightsholders will welcome this decision with open arms. 

Source: IPKat

22 June, 2017

Printing on the Wall - US Supreme Court Rules on Patent Exhaustion

Discussed on this blog only a few weeks ago, the US Supreme Court decision in Lexmark can have huge ramifications for both patent holders and sellers of those products all over the world. When and if at all patent rights exhaust after the sale of a product, be it in the US or abroad, is an important question and will set clear boundaries for both buyers and sellers, potentially impacting the price and availability of products and services all over the world. Many IP practitioners have been waiting for the decision by the Supreme Court, who released it only some weeks ago.

By way of a brief primer, the case of Impression Products Inc. v Lexmark International Inc. concerned the resale of printer ink cartridges, for which Lexmark owned several patents, which they also designed and manufactured. Impression Products bought used cartridges both abroad and in the US, refilled them and resold them; however, Lexmark set conditions on the cartridges during their sale, preventing their reuse and resale by other companies. Lexmark took Impression to court, and the matter ended up with the Supreme Court, who were set to decide a major point of patent law, as to when patent rights have been exhausted (if at all) after the sale of the product containing the patent rights.

The first question the Court tackled was whether the sale of the cartridges in the US did indeed exhaust their rights in the patented aspects of the goods. 35 USC section 154(a) confers the right to make and sell patented products, but the provision does not set any express limitations on the right. However, case law has established that "[w]hen a patentee chooses to sell an item, that product “is no longer within the limits of the monopoly” and instead becomes the “private, individual property” of the purchaser, with the rights and benefits that come along with ownership". The law therefore has limits on the control that a patent holder can exert on products within their monopoly. After discussing the historical context of patent exhaustion, the Court swiftly determined that "…Lexmark cannot bring a patent infringement suit against Impression Products to enforce the single-use/no-resale provision accompanying its Return Program cartridges. Once sold, the Return Program cartridges passed outside of the patent monopoly, and whatever rights Lexmark retained are a matter of the contracts with its purchasers, not the patent law".

This rationalisation makes sense to this writer, since a near perpetual, inexhaustible patent right in products, even post-sale, could have huge ramifications on the resale market, and potentially even anti-competitive uses (which the prevention of the resale of cartridges by a competitor could be construed as). The Court summarised its position on this: "…patent exhaustion is uniform and automatic. Once a patentee decides to sell—whether on its own or through a licensee—that sale exhausts its patent rights, regardless of any post-sale restrictions the patentee purports to impose, either directly or through a license".

The Court then moved onto the issue of the importation and sale of cartridges bought abroad. This question has not been addressed much under patent legislation, but has been discussed in the Supreme Court decision in Kirtsaeng, which established that the first sale of a copyright protected work would exhaust the rights in that work, even if imported from abroad and sold in the US (having been initially made and sold lawfully).

The Supreme Court faced the wrath of
patent holders after the decision
Under the common law concept of exhaustion, as discussed in Kirtsaeng, there is no territorial restriction on the fact. A sale abroad would be, arguably, exhaustion of rights within the US, and would therefore allow the importation of those goods into the US without infringement. According to the court, the copyright concept of exhaustion would not be distinguishable from patent exhaustion, as this would "…differentiating the patent exhaustion and copyright first sale doctrines would make little theoretical or practical sense [as] …the two “share a strong similarity and identity of purpose". The person buying the goods abroad is not buying the patented rights, according to the court, and that "…exhaustion is triggered by the patentee’s decision to give that item up and receive whatever fee it decides is appropriate". The court therefore concluded that Lexmark's rights were exhausted when the cartridges were sold abroad, and Impression would not be infringing their rights by importing the goods to the US.

Justice Ginsburg was the only judge to dissent. In her view, patent rights were purely territorial, and that "…[b]ecause a sale abroad operates independently of the US patent system, it makes little sense to say that such a sale exhausts an inventor’s US patent rights". This would open the door for competitors to potentially sell those patented products in the US with no legal recourse by the patent holder. Arguably, Justice Ginsburg's perspective is wholly justifiable, and this writer would raise concerns over this fact as well. If patent rights are fully exhausted in the event of a foreign sale, there would be very few restrictions on doing exactly the above by competitors. Finally, she disagreed with the majority's application of Kirtsaeng with patent rights, as "…[a]lthough there may be a “historical kinship” between patent law and copyright law… the two “are not identical twins". The legislative framework for copyright and patents does differ, and a straightforward application of copyright concepts to patents might not be possible as the law stands today.

The decision is a very important one, and will have clear and strong implications to patent holders who rely on the retention of rights in the US, irrespective of where the products were sold. Time will only tell whether this opens the Pandora's Box of reselling "infringing" products in the US; however, this writer is certain that other avenues will be used for the sale of patented products, such as contractual vehicles, rather than relying on pure rights retention.

08 June, 2017

A Collective Effort - The Impact of the GDPR on Collective Management Societies

This article was kindly drafted by Axel Beelen, who writes the blog IP News (focusing on EU and Belgian IP developments). He can also be found on Twitter here. He is also a data protection specialist.

The rules surrounding personal data are about to change on 25 May 2018 when the new General Data Privacy Regulation (GDPR) will enter into force. Because collective management organisations (CMOs) process their members' personal data, they will have to be compliant with the GDPR next year. Fines can be very high in the case of non-compliance. Below you will find the key points introduced in the GDPR concerning CMOs.

Data-subjects’ rights enlarged and more defined

The processing of personal data is lawful only if, and to the extent that, it is permitted under the GDPR. If the data controller (here the CMO) does not have a lawful basis for a given data processing activity (and no exemption or derogation applies) then that activity is prima facie unlawful. A lawful basis would be the consent of the data subject to do so, contractual necessity, compliance with legal obligations, the vital interests of the data subject, necessary for public interest or the legitimate interests of the data controller.

The "legitimate interests" lawful basis, under Article 6, is the more difficult to understand. It requires the balancing of the legitimate interests of the CMO against the interests and fundamental rights of the data subject (the rightholder).

To be a member of a CMO, rightholders (for example, authors, publishers, artists and producers) enter into an agreement with the CMO. This contract will generally be the lawful basis for the future processing of the rightholder’s data.

Members must be informed before any processing

The GDPR requires that the members of the CMOs have to be clearly and fully informed about their set of rights, including new rights that have been introduced, before the collection and processing of their personal data. CMOs are strongly advised to adapt their privacy provisions, communications and information to meet the requirements of the GDPR.

CMOs will also need to ensure that they have effective systems in place to enable them to give effect to these rights without any costs to the rightsholders. In the case of non-compliance, fines can be very steep: €20 million or up to 4% of the total worldwide annual turnover of the CMO for the preceding financial year.

CMSs have gone through quite the change,
even before the GDPR (Source: Oatmeal)
The GDPR expands the existing set of rights provided in the 1995 Data Protection Directive, and creates several entirely new rights increasing the ability of members of CMOs to better control their personal data. CMOs must provide any requested information in relation to any of the rights of their members within one month of receiving such a request. Only where CMOs receive large numbers of requests, or especially complex requests, may the time limit be extended by a maximum of two further months. Internal policy enabling the CMO to quickly reply to a member request will need to be written.

Members’ rights under the new GDPR

In a nutshell, members have the following rights under Articles 12-22:

  • Right of access: members of CMOs (as data subjects) have the right to obtain information relating to (i) confirmation of whether, and where, CMOs are processing their personal data, (ii) the purposes of the processing, (iii) the categories of data being processed, (iv) the categories of recipients with whom the data may be shared, (v) the period for which the data will be stored, (vi) the existence of the rights of erasure, rectification and restriction of processing and to object to processing, (vii) the existence of the right to complain to the DPA, (viii) the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on data subjects. Additionally, members may request a copy of the personal data being processed by their CMO;
  • Right of rectification regarding any inaccurate personal data possessed by the CMO;
  • Right to erasure (the "right to be forgotten"): following the Google Spain ECJ ruling of 2014, the GDPR now allows data subjects to request that their personal data be erased if (e.g.) the data are no longer needed for their original purpose (and no new lawful purpose exists) or the data subject exercises the right to object, and the controller has no overriding grounds for continuing the processing;
  • Right to restrict processing;]
  • Right of data portability: members will now have the right to receive a copy of their personal data in a commonly used machine-readable format, and request that these data are transmitted directly to another data controller (which could be another CMO). This new right has been the subject of Guidelines written by the Article 29 Working Party (Article 29 WP consists of representatives of the national supervisory authority in data protection);
  • Right to object to processing for the purposes of direct marketing (including profiling); and
  • Right to not be evaluated on the basis of automated processing: members have the right not to be subject to a decision based solely on automated processing which significantly affects them (including profiling). Such processing is permitted where (i) it is necessary for entering into or performing a contract with the data subject provided that appropriate safeguards are in place, (ii) it is authorised by law or (iii) the data subject has explicitly consented and appropriate safeguards are in place.
CMOs shall provide the data subject with all of this information at the time when personal data of the members are obtained.

A DPO to supervise the personal data activities

CMOs will have to appoint a Data Protection Officer (DPO) to supervise their personal data processing activities. CMOs will have to involve the DPO properly and in a timely manner in all issues which relate to the protection of personal data.

Each CMO will ensure that its DPO does not receive any instructions regarding the exercise of those tasks. The DPO cannot be dismissed or penalised by his CMO for performing his tasks. The DPO will directly report to the highest management level of his company. A DPO can be an employee of the CMO or an outside consultant.

The DPO may be contacted by the members with regard to all issues relating to processing of their personal data and to the exercise of their rights under the GDPR.

Conclusion

 For many collective management organisations, compliance with this new GDPR will be very challenging and expensive. They would be well advised to urgently carry out a legal assessment of the current status of their compliance in order to ascertain any gaps. CMOs will then need to implement adequate solutions and monitor their suitability. All of that before May 25th next year.