Where now for File Sharing?
In April 2010, Mr. Justice Charleton delivered the High Court judgment in the case of EMI & Others v eircom. The case was significant as it represented the first judicial analysis of the Data Protection Acts in the context of the competing rights afforded by Irish law to owners of intellectual property rights. It was also regarded as a victory for rightsholders in the battle against Internet piracy. However, the victory was short lived as, on 11 October 2010, the Irish record industry failed in its application to injunct the TV and broadband provider UPC so as to force it to disconnect illegal filesharers from their Internet accounts.
In 2008, proceedings were launched by EMI, Sony, Universal and Warner, seeking to compel eircom to address the abuse of the Internet by peer to peer copyright infringers. The case was the first in a series of cases brought against Irish Internet service providers. After eight days of evidence, the parties agreed the terms of a settlement which was filed with the High Court.
Under the settlement, eircom agreed to adopt a so called ‘graduated response’ or ‘three strikes’ approach to illegal filesharers which could ultimately lead to disconnection of the customer’s Internet service. As this approach would require eircom to receive and process information about its customers in respect of alleged illegal filesharing, the settlement terms were subject to compliance with the Data Protection Acts 1988 and 2003 (DPAs). Accordingly, the parties engaged with the Office of the Data Protection Commissioner and the Commissioner ultimately challenged the terms on the grounds that the settlement did not conform with the DPAs.
The Commercial Court was called upon to rule on whether or not the settlement terms could be implemented lawfully.
The settlement terms required the parties to agree a Protocol to govern the procedure to be followed in relation to the ‘three strikes’ process. The first step would be to inform the Internet user (i.e., the bill payer at the IP address detected) that they have been detected infringing copyright and requesting them to desist, while warning of the consequences of a failure to do so. Upon a second infringement, another written warning would issue to the Internet user. When a third infringement is notified to eircom, a review of all evidence would be conducted and a termination notice issued. The customer would be entitled to make representations to eircom at that point. The first and second steps would be largely automated, while the third step, disconnection, would involve a human element.
Data Protection Implications
In the eyes of the Data Protection Commissioner, the settlement terms and the Protocol raised three data protection issues.
The first issue was whether or not an IP address, in the hands of EMI or its agents, constituted 'personal data' for the purposes of the DPAs in which case EMI or its agents would be required to comply with the specific requirements of sections 2, 2A, 2B, 2C and 2D of the DPAs. On this issue, Mr. Justice Charleton considered the definition of 'Personal Data' in section 1 of the DPA being “data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller.”
Applying this definition to the facts, Mr. Justice Charleton felt that in order for the IP addresses and other information obtained by the plaintiffs to constitute 'personal data', it must be probable that further information would come into their possession which would identify the individual end users. Under the Protocol, the information which might be acquired by the plaintiffs or their agents would identify only the Internet service provider and not the individual user. Accordingly, the judge did not feel that it was 'likely' that further information could come into the possession of the plaintiffs which would identify the individual user and therefore no 'personal data' would be in the hands of the plaintiffs.
In short, the identification of an IP address without any associated information that would be likely to identify the individual Internet user was not 'personal data' within the hands of the copyright owners.
The second issue considered by the court was whether or not the termination of an Internet user’s subscription was “necessary for the purposes of the legitimate interests pursued by [eircom]”, or if it represented “unwarranted [processing] by reasons of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”.
Justice Charleton approached this issue by reference to the principle of proportionality and a balancing of the right of owners of copyright to have the fruits of their labour protected versus any right an Internet user might have to access the Internet and not to have that access terminated. The judge recognised that the protections afforded to copyright were not limited to those provided under the Copyright and Related Rights Act 2000, but that protection of copyright was also a fundamental right afforded protection by Articles 40.3.2 and 43.1 of the Constitution. This being the case, it was not only legitimate for eircom to pursue a policy which would afford protection to copyright, but the court would expect eircom to do so.
As to the termination of subscriber accounts, the judge noted that the eircom subscriber contract provided that customers may not use the facility to create, host or transmit material which infringes the intellectual property rights, including copyright, of another, while also allowing for termination of the agreement upon breach of its terms. On the basis that subscribers consented to these terms, along with the level of protection afforded to copyright, the judge was satisfied that there was nothing disproportionate about this course of action.
The final issue related to whether it was open to EMI and/or eircom to implement the graduated response process, set out in the terms of the settlement, having regard to the criminal implications of copyright infringement. In dealing with this issue, Justice Charleton considered that section 140 of the Copyright and Related Rights Act 2000 provides a criminal penalty for the infringement of copyright. While this is so, the judge noted that entitlement to copyright has also been part of the civil code of law since the earliest days of it being enshrined in legislation, and as such, infringement of copyright is an offence in respect of which both civil liability and criminal responsibility may coincide. On the basis of the evidence, the court was satisfied that neither the plaintiffs nor the defendants had any interest in alleging the commission of a criminal offence by the Internet user. All that was relevant to those parties were the external facts, being the infringement of copyright and the absence of consent, and the knowledge, intention, recklessness or otherwise of the downloader was irrelevant. The judge was satisfied that the parties to the settlement were concerned only with the civil side of copyright infringement, and as such this third element of criminal liability was not in fact in issue.
The UPC Decision
UPC chose not to adopt a 'three-strikes' policy and, before the same High Court judge as in the eircom case, Justice Charleton, they successfully resisted the attempted imposition of a 'three strikes' model. While the court was highly critical of the “scandal” of unlawful filesharing, the judge felt that the Copyright and Related Rights Acts 2000 failed to make proper provision for the blocking, diverting or interrupting of Internet users who were intent on breaching copyright. Accordingly, while injunctions directing UPC to act against piracy were merited on the facts of the case, the lack of any provision in the 2000 Act prevented the granting of the orders sought.
Speaking after the judgment, the chief executive of the Irish Music Rights Association (IRMA) called on the government to introduce new legislation and suggested that IRMA members may seek compensation for loss of earnings. In response, a spokeswoman for Minister for Communications, Energy and Natural Resources said the Minister was committed to resolving the issue but that there was a “fine balancing act” between freedom of access to the Internet and the rights of music artists and record companies.
The eircom decision represented an outright victory for the music industry and a ringing judicial endorsement for the negotiated settlement terms reached between the industry and eircom. Arising from that case, there will be implications for future enforcement of data protection laws as now, for the first time, the High Court has provided an interpretation of difficult issues around the scope of 'personal data', 'sensitive personal data' and the 'legitimate interests' of data controllers. The decision will be a disappointment to the Article 29 Working Party who has previously challenged the ability to implement a 'three strikes' policy in a manner that could accord with the data protection Directive.
However, on the broader issue of filesharing, the UPC case is a major reversal for the music industry and it would not be surprising to see new legislation in the short term to specifically extend the remedies under the Copyright & Related Rights Act 2000 to more specifically address the issue.