H264
BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £5, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | ||
High Court of Ireland Decisions |
||
You are here: BAILII >> Databases >> High Court of Ireland Decisions >> EMI Records (Ireland) Ltd & Ors -v- The Data Protection Commissioner & Anor [2012] IEHC 264 (27 June 2012) URL: http://www.bailii.org/ie/cases/IEHC/2012/H264.html Cite as: [2013] 1 CMLR 7, [2012] IEHC 264 |
[New search] [Printable version] [Help]
Judgment Title: EMI Records (Ireland) Ltd & Ors -v- The Data Protection Commissioner & Anor Neutral Citation: [2012] IEHC 264 High Court Record Number: 2012 167 JR Date of Delivery: 27/06/2012 Court: High Court Composition of Court: Judgment by: Charleton J. Status of Judgment: Approved |
Neutral Citation Number: [2012] IEHC 264 The High Court Commercial Judicial Review [2012 No. 167 JR] Between EMI Records (Ireland) Limited Sony Music Entertainment Ireland Limited Universal Music (Ireland) Limited and Warner Music Ireland Limited applicants and The Data Protection Commissioner respondent and Eircom plc notice party Judgment of Mr Justice Charleton delivered on the 27th day of June 2012 1.0 On Sunday 28 March 2010 all clocks in Ireland and around Europe went forward one hour at 01.00 hours for summer time. On Sunday 31 October 2010 all clocks in Ireland and Europe went back one hour at 02.00 hours for winter time. Eircom plc, the notice party and a major telecommunications and internet service company, ignored the winter time change. That piece of indolence led to this case. 1.1 For about the previous four months, from August 2010, Eircom had been operating a scheme under a settlement in a prior copyright infringement case whereby the plaintiffs in this case, hereafter referred to as the recording companies, were detecting on the internet those who were uploading their copyright in music and video; they then passed on information consisting only of copyright title, time and temporary IP address to Eircom. That company would then write to their subscribers and remind them that under the Eircom-subscriber contract they had agreed not to use internet access to infringe copyright. As was well publicised after that earlier litigation, after three such infringements the subscriber would lose a week of internet access and, after four, internet service from Eircom would be withdrawn altogether. This would not stop a subscriber seeking service from another internet service provider, of which there are more than a dozen in the State. Such information as to who might be deprived of internet service by any internet service provider is not put on any national register nor is there any equivalent collective internet service provider database. 1.2 Internet Protocol (“IP”) addresses are furnished in their millions by a central agency called Réseaux IP Européens (“RIPE”), an organisation based in Paris, to internet service providers. On subscribing for internet service, a customer gets a router box from a provider and this has a unique number known only to the parties to that contract. Day by day, providers assign IP numbers to their subscribers and these typically change every 24 hours. The Court was told that some large companies like to have a more lasting IP address, but there is no evidence of that here. When a subscriber uploads or downloads a track without copyright permission on a peer-to-peer swarm of internet users, a file hash attaches to each piece of the track and this has attached to it that temporary IP number. In Ireland, the recording companies, through an agency, are on the internet joining swarms and detecting any IP addresses that are uploading copyright material assigned by artists to them. Where an Eircom IP address appears, that agency notifies Eircom on behalf of the recording companies and pursuant to the agreement between the parties, the subscriber is identified by Eircom and is written to. At no stage do the recording companies know to whom that IP address was assigned on any particular day and at no stage do they seek to gain that information from Eircom. Rather, any step that is thereafter taken remains confined to the privacy of the internet service provider and subscriber contract. 1.3 When Eircom did not change its clocks for a period of months from October to December 2010, some 391 subscribers were notified in the wrong that they had uploaded copyright material in breach of contract. On 9 December 2010, one particular subscriber received a contract breach notification incorrectly. On 17 January 2011, that subscriber wrote to the Data Protection Commissioner, the respondent herein. Correspondence then ensued with Eircom. That company acknowledged that a mistake had been made. The clocks were changed. On being informed of this, the particular made an additional complaint that a breach of privacy had occurred in that no permission had been given to the recording companies to monitor his internet activity; even though they had not done so in fact since that subscriber had never uploaded copyright material. The subscriber complained that there was an ongoing breach of data protection law and requested that “action is taken against Eircom … to the fullest extent of the law”. 1.4 Action was indeed taken. As to whether it was lawful is the issue in this judicial review. By a notice dated 11 January 2012, Eircom was directed by the Data Protection Commissioner to cease its scheme with the recording companies. Issues 2.1 A complicating issue in this judicial review, which would ordinarily be a simplifying factor, is that the subject matter of the notice was dealt with in a previous judgment of the Court, namely: EMI Records (Ireland) ltd v Eircom Ltd [2010] 4 IR 349. The Data Protection Commissioner makes a number of points in argument. In respect of the earlier judgment, he says that he was not present, and he was not because he declined to participate citing cost as the factor; he says that his absence from the case was not his fault; he says that the judgment does not bind him; he says that the Court was wrong in the judgment in which he deigned not to participate; he argues that the law has changed since that decision was delivered; he says he has given reasons for his decision in the notice; he says that if he did not, the reasons were obvious; he says that people should come and talk to him; and he says that he is not obliged to give advice to those who might come and talk to him. 2.2 The Court gave the recording companies, Eircom and the Data Protection Commissioner the option of stating questions in this case to the Court of Justice of the European Union. All declined. This judgment is subject to an appeal to the Supreme Court. The Court is entitled to stay any order that can be stayed to allow any party to exercise the option of appeal. History 3.1 Meanwhile, the Data Protection Commissioner had become involved in discussions with Eircom over the period 11 May 2009 to 17 December 2009 specifically concerning the settlement and the protocol. He was concerned about three specific questions. At his request, Kelly J re-entered the case so that data protection issues could be decided by the High Court. The Data Protection Commissioner set out a list of the three questions on which he had concerns. Notably, he did not set out any other issues including ones which are now the subject of the notice in question in this case and notwithstanding the fact that those issues existed in law at that time, albeit under a different format. On 15 January 2010 the Data Protection Commissioner wrote a formal letter to Eircom as to his concerns. These issues were fixed by Kelly J for hearing. The Data Protection Commissioner sought an assurance in advance of the hearing that the parties would pay for his costs and/or would not seek costs against him. When that assurance was not forthcoming he declined to appear at the hearing because, he said, he was not funded for that role. It is obvious that the Data Protection Commissioner, having an important role by statute, ought to be properly and appropriately funded to take part in litigation that is central to the functions of his office. It is wrong that he was not so funded by those responsible. On 16 April 2010, having heard the parties attending, this Court gave judgment on the data protection issues. In August 2010 the protocol commenced. Meanwhile, the recording companies had issued proceedings against UPC, another major internet service provider. That case did not settle but was decided by the High Court. 3.2 On 11 October 2010 this Court gave judgment declining to grant injunctive relief to the recording companies, see EMI Records (Ireland) Ltd & Ors v UPC Communications Ireland Ltd [2010] IEHC 377. The reasoning of the Court was straightforward. Section 40(4) of the Copyright and Related Rights Act 2000 provides that where an owner of copyright notifies a party who makes available facilities for enabling the making available to the public of copies of a work “that those facilities are being used to infringe the copyright in that work and that person fails to remove that infringing material as soon as practicable thereafter that person shall also be liable for the infringement.” At the time of the passing of the Copyright and Related Rights Act 2000, Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce in the Internal Market (“E-Commerce Directive”) had been passed. Article 22 of that directive gave the State up to 17 January 2002, to implement its terms. The Copyright and Related Rights Act 2000 was passed in light of draft legislation and in anticipation of what would become Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2011 on the harmonisation of certain aspects of copyright and related rights in the information society (“Copyright Directive”). Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (“Framework Directive”) was passed on 7 March 2002. The Communications Regulation Act 2002, allowing for regulation of internet service providers by The Commission for Communications Regulation, was passed in the year 2002. This was followed by the European Community (Directive 2000/31 EC) Regulations 2003 (S.I. No. 68 of 2003). Article 14 of the E-Commerce Directive provides, at subpara. 3, that the defences described in that article are not to prevent a court, in accordance with the Member State’s legal systems, from requiring “the service provider to terminate or prevent an infringement”. A similar wording is contained in other directives. The wording used in the European directives refers to interruption, diversion and blocking. In particular, Recital 46 of the E-Commerce Directive provides that: “… upon obtaining actual knowledge or awareness of illegal activities [the internet service provider] has to act expeditiously to remove or to disable access to information …”. The E-Commerce Directive has specific reference to the possibility of an injunction in Recital 45: The limitations of the liability of intermediary service providers established in this Directive do not affect the possibility of injunctions of different kinds; such injunctions can in particular consist of orders by courts or administrative authorities requiring the termination or prevention of any infringement, including the removal of illegal information or the disabling of access to it. 3.3 Article 12, entitled “Mere Conduit”, imposes the following obligation on Member States:
(a) does not initiate the transmission; (b) does not select the receiver of the transmission; and (c) does not select or modify the information contained in the transmission. 2. The acts of transmission and of provision of access referred to in paragraph 1 include the automatic, intermediate and transient storage of the information transmitted in so far as this takes place for the sole purpose of carrying out the transmission in the communication network, and provided that the information is not stored for any period longer than is reasonably necessary for the transmission. 3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement. 3.5 The three questions asked by the Data Protection Commissioner in the proceedings inspired by him, but in which he did not participate, were:
2. Having regard to s. 2A(1) of the Data Protection Act 1988, as amended, and assuming for current purposes that the processing by the defendant of “personal data” in the context of the third of the three steps envisaged by the graduated response scheme proposed under the terms of this settlement (i.e. the termination of an internet user's subscription) is “necessary for the purposes of the legitimate interests pursued by the defendant”, does such processing represent “unwarranted processing by reasons of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”? 3. Having regard to ss. 2A(1) and 2B(1) of the Data Protection Act 1988, as amended, is it open to the plaintiffs and/or the defendant to implement the graduated response process set out in the terms of the settlement including, in particular, the termination of an internet user's subscription under step 3 of that process, in circumstances where:- (a) in doing so they would be engaged in the processing of personal data and/or sensitive personal data (in so far as the data can be considered to relate to the commission of a criminal offence), including the provision of such data from one private entity to another private entity; (b) the termination of an internet user's subscription by the defendant would be predicated on the internet user in question having committed an offence (i.e. the uploading of copyright-protected material to a third party by means of a peer to peer application) but without any such offence having been the subject of investigation by an authorised body; and, further, without any determination having been made by a court of competent jurisdiction, following the conduct of a fair and impartial hearing, to the effect that an offence had in fact been committed. 3.7 In defence of this application to quash the notice of 11 January 2012, counsel for the Data Protection Commissioner submits that: the relevant legislation has since changed, that is correct but he accepts that the legislation was there in similar form previously; that matters have moved from the theoretical to the practical with the complaint; that the Eircom contract with its subscribers should have been changed but was not changed, a matter that could previously have been argued by the Data Protection Commissioner but was not; that privacy law has been breached; and that the case law of the Court of Justice of the European Union has developed so as to make the prior judgment of the Court on data protection issues now irrelevant. The case apparently referred to in correspondence by the Data Protection Commissioner as changing the entire legal landscape on copyright protection was Case C-70/10 Scarlet Extended v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM). The Notice
2. Regulation 6 of the Regulations in that eircom has failed (or is failing) to ensure that traffic data relating to subscribers and users processed and stored for the purpose of the transmission of a communication (including, in particular, traffic data comprising IP addresses assigned by eircom to a subscriber at a particular point in time) is erased or made anonymous when it is no longer needed for that purpose save to the extent that such data may be retained and processed and/or stored for a purpose prescribed in the Regulations; 3. Sections 2(1)(a) & 2D of the DP Acts in that eircom has failed (or is failing) to provide subscribers with information necessary to render the obtaining and/or processing of their personal data “fair” for the purposes of said Section 2(1)(a). 4. Section 2(1)(b) of the DP Acts in that eircom has failed (or is failing) to comply with the requirement that personal data obtained and/or processed by or on behalf of eircom shall be accurate, eircom having incorrectly identified particular subscribers as persons who had engaged in illegal peer to peer file sharing using IP addresses assigned to eircom; 5. Section 2(1)(c)(i) of the DP Acts in that eircom has obtained (or is obtaining) personal data in respect of subscribers other than for one or more specified, explicit and legitimate purposes; 6. Section 2(1)(c)(ii) of the DP Acts in that eircom has further processed (or is further processing) personal data in respect of subscribers in a manner incompatible with the purpose for which that data was obtained and is retained; 7. Section 2A(1) of the DP Acts in that eircom has processed (or is processing) personal data of a subscriber without the subscriber’s consent and/or without meeting any one or more of the other conditions specified in that Section; 8. Section 2B of the DP Acts in that eircom has processed (or is processing) sensitive personal data, namely data relating to the commission or alleged commission of offences further to Section 140 of the Copyright and Related Rights Act 2000, without complying with the requirements of Sections 2 and 2A of the DP Acts and/or without meeting one or more of the conditions specified in Section 2B(1)(b) thereof.
(ii) pending such steps being taken, to cease forthwith the obtaining and/or processing of subscriber data in the context of the implementation of the Protocol, including, for the avoidance of doubt, the receipt of subscriber data from, or the transmission of subscriber data to, any other party to the Protocol or their servants or agents; and, (iii) take steps to destroy and/or erase any and all subscriber data processed by eircom in the context of the implementation of the Protocol within 60 days of receipt of this Notice. Curial deference When judicially reviewing a decision of an expert body the courts must exercise an appropriate measure of restraint. The nature of Judicial Review of expert bodies was addressed in Henry Denny & Sons (Ireland) Ltd. v. Minister for Social Welfare [1998] 1 IR 34. Hamilton CJ stated that:
The Courts in England have, however, indicated very strongly that they will pay great attention to the decision of a specialist officer like the Controller. No doubt the degree of such attention will vary with the length of time he has held his office and his consequent experience, and the qualifications and the known ability of the officer. If the English courts went to the extent of accepting his view as the exercise of a judicial discretion by which the Court should be bound, we could not follow them in this country, as that would, in my opinion, be contrary to a constitutional principle which binds us, and which we must be jealous to maintain. In my opinion, therefore, while we read the views of the Controller with respect and in the present case with admiration of the clarity and ability of his statement of them, we are quite free to form our own opinion untrammelled by them. 5.2 It must be emphasised that curial deference cannot possibly arise where by statute reasons for a decision are required but none are given. Nor can curial deference ever be a factor in judicial review where a mistake of law puts a tribunal outside the jurisdiction conferred on it by statute. In appropriate cases, where errors occur even on those issues the general discretion as to judicial review may be invoked depending on the precise circumstances in appropriate cases. The principle of curial deference on issues of fact and decisions on the appropriate balancing of competing interests has, however, nothing to do with any case such as this one which concerns the obligation to give reasons for a decision and the proper interpretation of powers conferred by statute on an administrative official. Peer-to-peer copying
(a) The user downloads and installs on his or her computer a piece of software, for example µTorrent (also known as uTorrent). This software is easily found using an internet search engine and is downloaded for free without any personal identification required. (b) Once the software is installed on a computer, whenever that computer connects to the internet it becomes part of a P2P network or system consisting of many other computers using the same software. P2P software often installs itself so that it runs in the background whenever the computer is started. (c) A user locates files for download in different places depending on the P2P technology in use. Bittorrent users may use The Pirate Bay because it is simple to search and find music, video, games and software. (d) Once a user is a participant in a P2P network, he or she can download files hosted and being made available by other users of the P2P network. At the same time the user’s computer acts as an uploader, making the files that it has locally available to others. The files are not stored or hosted on a central server. Instead, each computer that is part of the network can act as a mini-server from which other P2P users on the network can download files. (e) P2P technology distributes large data files by breaking them up into small pieces (chunks) and sends them over the internet to the requesting user. The P2P software may request chunks of the file from different members of the P2P network. When all the data is received by the user's computer, the file is reassembled as a whole. (f) Because of their organisation, where users in a P2P network will generally act both as a client and a server (i.e. uploader as well as downloader), each participant provides resources to the network such as bandwidth, storage space and computing power, thereby increasing capacity as the network grows. P2P networks scale well as they grow in size and are resilient where there is no central component. Privacy 7.1 Desiring that an activity remain undetected and having an entitlement to privacy are two entirely different concepts. Some activities are naturally private according to the notions of decent thinking. Sometimes the affairs that we share with others are private from the nature of what we communicate or the circumstances in which we share. Privacy may be described as the bundle of expectations held by reasonable citizens that actions which we legitimately shield from others, or communications in confidence, will be respected through not being enquired into as matters we are entitled to shield from others, or where communicated, disseminated outside the sphere within which the trust of others, arising through contract or the reposing of that trust, is expected not to be betrayed. Breach of privacy is thus the unwelcome intrusion of others into aspects of living that are particularly personal to the individual or into information shared in confidence. In Scarlet Extended, Advocate General Cruz Villalón appeared to endorse the idea that anonymity is essential for the preservation of what he called the right to privacy on the internet. In his opinion of 14 April 2011 at paragraph 73 he said:
7.3 No evidence was offered in this case as to the application of privacy in these circumstances. Due to the lack of reasons in the notice of 11 January 2012, the motivation behind the condemnation by the Data Protection Commissioner of any music company participating, with a view to protecting its own interest in copyright, in a peer-to-peer swarm devoted to illegal uploading and downloading is not clear. Nor is it clear as to how privacy might come into the matter at all. This issue was analysed with the benefit of opposing argument and evidence by this Court in EMI Records (Ireland) Ltd & Ors v UPC Communications Ireland Ltd [2010] IEHC 377. I quote the appropriate paragraphs from that judgment:
67. The right to privacy has been said to encapsulate the ‘right to be left alone’ (per Walsh J. in his dissenting judgment as a judge of the European Court of Human Rights in Dudgeon v. United Kingdom (1981) 4 EHRR 149) or as “the fundamental value of personal autonomy” (per Sedley L.J. in Douglas v. Hello! [2001] 1 Q.B. 967 at para. 126) – the right of the individual to exercise control over information, possessions and conduct of a personal nature and, as an obvious corollary, the right to prevent others from accessing this information. On an international level this State is a signatory to various treaties which clearly enumerate the right to privacy. The most important of these is contained in Article 8 of the European Convention on Human Rights which provides, inter alia, that “[e]veryone has the right to respect for his private and family life, his home and his correspondence”. This right to ‘be left alone’ has spawned a considerable amount of data protection legislation, most noticeably at a European level (See, for example, Parliament and Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data O.J. L 281 23.11.1995 [“the Data Protection Directive”]) and on a domestic level, principally through the Data Protection Act 1988, as amended. 68. I find it impossible to recognise as a matter of constitutional law, that the protection of the entitlement to be left in the sphere of private communications could ever extend to conversations, emails, letters, phone calls or any other communication designed to further a criminal enterprise. Criminals leave the private sphere when they infringe the rights of other, or conspire in that respect. Legislative intervention may mean detection involves a statutory infringement: leaving the admission of evidence to be decided on the balance of respect for the law and the seriousness of what is involved. In the case of internet file sharing to infringe copyright, I am of the view that there are no privacy or data protection implications to detecting unauthorised downloads of copyright material using peer-to-peer technology; (see, EMI Records (Ireland) Limited v. Eircom Limited [2010] IEHC 108, (Unreported, High Court, Charleton J., 16th April, 2010). In this regard, I am taking into account the fact that the process of detection through DtecNet is essentially anonymous. As previously emphasised, a communication between the recording companies and an internet service provider, having used the facilities offered by the DtecNet, that in a particular month a certain one hundred subscribers downloaded an average of twenty copyright protected tracks each, illegally, giving a date and time and the IP address, discloses no information publicly. The recording companies do not thereby harvest the names and addresses of infringers of copyright for data purposes, or for future communication or for evidence in a potential criminal case. They get nothing apart from a set of numbers. As between UPC and their customers, any solution to this illegal activity is conducted privately as between them. They already know each other, as they are joined by a contract. That communication is within the range of matters over which an internet service provider is entitled to deal with its customer. The abuse of an internet service for copyright theft is a serious matter from the point of view of the general enforcement of copyright protection. An internet service provider is entitled to have a policy against it. In this instance, it is apparent that UPC pretends to have such a policy. The existence of a genuine anti-piracy policy would enhance the public standing of any corporation and is a matter in respect of which they have an interest. Enforcing a private contract, in this context, does not have privacy implications. Any form of blocking on that customer and internet service provider basis does not carry a privacy implication. If the response is a graduated one, as opposed to a blocking of communications merely on a basis of identifying its nature and the relevant IP number, no privacy implication arises. As Professor Nixon put it:- “If to achieve the goal of identifying that you have to do other things, like store the IP addresses of where it came from and where it went to, and various other things, and you are spotting those for infringing and non infringing uses, then I would start to worry about that information being stored, and how it is being used, for what purposes… In a graduated response, they are not, the DtecNet guys are looking at every communication that goes through the UPC network. What they are doing they are joining a particular stream of communications that is in this peer-to-peer network, which has by default at this moment in time, lets say 60%, 70%, 90% of the people who are on it are sharing infringing material, and you pick those people and you store the information. Now I don’t think so - I think that is reasonable… nobody is exposing anything in these networks, apart from the fact that they have an IP address, some made up user name, and the files that they are infringing, or the files they are not infringing. So, that information is made publicly available [over the network anyway] so, that is fine.” 69. Mr. Sehested had a similar view. He said:- “I mean all of the information that we capture is publicly transmitted information that anyone with an internet communication and a peer-to-peer programme, that is freely downloadable, would be able to capture. Again all the files that we capture here are files that are actively made available by the users… [i]n this case specifically we are solely looking for sound recording. So we only look for content that is part of that file that we have been given to monitor for.” 70. That evidence is the basis of my conclusion that the right of privacy is not engaged by the scrutiny of files publicly made available for copyright theft on the internet and nor is it engaged by deep packet inspection for the purpose of detecting and diverting or disenabling such transmissions. 7.5 What is argued for here by the Data Protection Commissioner is that all of the contracts entered into by Eircom with its subscribers should be disavowed and a new contract circulated for acceptance or rejection on the basis of the protocol. Such a course would be unnecessary. The contract already contains the relevant clause and with it the clear implication that reliable information as to breach may be notified in a reasonable way to the relevant customers. If these subscribers find themselves in having to search out another internet service provider, that would occur only after four breaches of the copyright of others and in the context of having a full opportunity to offer an explanation and in the context of appropriate exceptions as to health and other important factors. I am not considering here any issue as to recourse to a judicial process before the termination of internet access between one individual subscriber and that subscriber’s then internet service provider. 7.6 In summary, peer-to-peer sharing is no more a breach of privacy than any other form of participation in copyright infringement by any of the participants. The Court of Justice of the European Union
8.1 In case C-275/06 Productores de Música de Espaòa (Promusicae) v Telefónica de Espaòa SAU, Promusicae, a non-profit body representing the interests of music and video producers and publishers, asked the relevant court in Spain for Telefónica to be ordered to disclose the identities and physical address of certain persons whom it provided with internet access and whose IP addresses and the date and time of their connection were known. Promusicae wanted to target users of a peer-to-peer file exchange programme, who it said were engaging in unfair competition and the infringement of intellectual property rights. The first instance court granted the order sought. That order was appealed and a question referred to the Court of Justice of the European Union for a preliminary ruling. The question referred was:
8.2 The Treaty on the Functioning of the European Union (“the Treaty”) makes three specific references to intellectual property rights. Article 118 of the Treaty, which concerns the approximation of laws, provides that the European Parliament and the Council shall establish measures for the uniform protection of intellectual property rights throughout the European Union. Article 207 of the Treaty, which concerns the common commercial policy, explicitly provides that the common commercial policy shall be based on uniform principles which have regard for, inter alia, the commercial aspects of intellectual property. Finally, article 262 of the Treaty, which concerns the Court of Justice of the European Union, provides that the Court may be vested with the jurisdiction to resolve disputes relating to acts adopted under the treaties which create European intellectual property rights. 8.3 In case C-461/10 Bonnier Audio AB v Perfect Communication Sweden AB at issue was the interpretation of Articles 3 to 5 and 11 of Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, and of Article 8 of Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights. This case was directly relevant to the issues which concerned the Data Protection Commissioner. At issue was a Swedish law which provided for disclosure of retained data from an intermediary where copyright infringement was sought to be pursued and where conditions of law entitled an author or a successor in title to apply to court. Such an order was not to be granted except under conditions of balancing the “nuisance or other harm which the measure entails for the person affected by it or for some other conflicting interest” and prevented disclosure that persons “close to him” had “committed a criminal act”. Directly relevant was article 6 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). This law was in force when the Data Protection Commissioner first became involved in discussions on the settlement protocol in the EMI v Eircom case. This provides:
2. Traffic data necessary for the purposes of subscriber billing and interconnection payments may be processed. Such processing is permissible only up to the end of the period during which the bill may lawfully be challenged or payment pursued. 3. For the purpose of marketing electronic communications services or for the provision of value added services, the provider of a publicly available electronic communications service may process the data referred to in paragraph 1 to the extent and for the duration necessary for such services or marketing, if the subscriber or user to whom the data relate has given his/her consent. Users or subscribers shall be given the possibility to withdraw their consent for the processing of traffic data at any time … 5. Processing of traffic data, in accordance with paragraphs 1, 2, 3 and 4, must be restricted to persons acting under the authority of providers of the public communications networks and publicly available electronic communications services handling billing or traffic management, customer enquiries, fraud detection, marketing electronic communications services or providing a value added service, and must be restricted to what is necessary for the purposes of such activities. 6. Paragraphs 1, 2, 3 and 5 shall apply without prejudice to the possibility for competent bodies to be informed of traffic data in conformity with applicable legislation with a view to settling disputes, in particular interconnection or billing disputes.
52 It must be held that the communication sought by the applicants in the main proceedings constitutes the processing of personal data within the meaning of the first paragraph of Article 2 of Directive 2002/58, read in conjunction with Article 2(b) of Directive 95/46. That communication therefore falls within the scope of Directive 2002/58 (see, to that effect, Promusicae, paragraph 45). 53 It must also be noted that, in the main proceedings, the communication of those data is required in civil proceedings for the benefit of a copyright holder or his successor in title, that is to say, a private person, and not for the benefit of a competent national authority. 54 In that regard, it must be stated at the outset that an application for communication of personal data in order to ensure effective protection of copyright falls, by its very object, within the scope of Directive 2004/48 (see, to that effect, Promusicae, paragraph 58). 55 The Court has already held that Article 8(3) of Directive 2004/48, read in conjunction with Article 15(1) of Directive 2002/58, does not preclude Member States from imposing an obligation to disclose to private persons personal data in order to enable them to bring civil proceedings for copyright infringements, but nor does it require those Member States to lay down such an obligation (see Promusicae, paragraphs 54 and 55, and order in LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten, paragraph 29). 56 However, the Court pointed out that, when transposing, inter alia, Directives 2002/58 and 2004/48 into national law, it is for the Member States to ensure that they rely on an interpretation of those directives which allows a fair balance to be struck between the various fundamental rights protected by the European Union legal order. Furthermore, when implementing the measures transposing those directives, the authorities and courts of Member States must not only interpret their national law in a manner consistent with them, but must also make sure that they do not rely on an interpretation of them which would conflict with those fundamental rights or with the other general principles of European Union law, such as the principle of proportionality (see, to that effect, Promusicae, paragraph 68, and order in LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten, paragraph 28). 57 In the present case, the Member State concerned has decided to make use of the possibility available to it, as described in paragraph 55 of this judgment, to lay down an obligation to communicate personal data to private persons in civil proceedings. 58 It must be noted that the national legislation in question requires, inter alia, that, for an order for disclosure of the data in question to be made, there be clear evidence of an infringement of an intellectual property right, that the information can be regarded as facilitating the investigation into an infringement of copyright or impairment of such a right and that the reasons for the measure outweigh the nuisance or other harm which the measure may entail for the person affected by it or for some other conflicting interest. 59 Thus, that legislation enables the national court seised of an application for an order for disclosure of personal data, made by a person who is entitled to act, to weigh the conflicting interests involved, on the basis of the facts of each case and taking due account of the requirements of the principle of proportionality. 60 In those circumstances, such legislation must be regarded as likely, in principle, to ensure a fair balance between the protection of intellectual property rights enjoyed by copyright holders and the protection of personal data enjoyed by internet subscribers or users. 61 Having regard to the foregoing, the answer to the questions referred is that: Directive 2006/24 must be interpreted as not precluding the application of national legislation based on Article 8 of Directive 2004/48 which, in order to identify an internet subscriber or user, permits an internet service provider in civil proceedings to be ordered to give a copyright holder or its representative information on the subscriber to whom the internet service provider provided an IP address which was allegedly used in an infringement, since that legislation does not fall within the material scope of Directive 2006/24; it is irrelevant to the main proceedings that the Member State concerned has not yet transposed Directive 2006/24, despite the period for doing so having expired; Directives 2002/58 and 2004/48 must be interpreted as not precluding national legislation such as that at issue in the main proceedings insofar as that legislation enables the national court seised of an application for an order for disclosure of personal data, made by a person who is entitled to act, to weigh the conflicting interests involved, on the basis of the facts of each case and taking due account of the requirements of the principle of proportionality. 8.6 Case C-70/10 Scarlet Extended S.A. v. Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM) involved a Belgian group called SABAM, representing authors, composers and publishers, initiating proceedings against an internet service provider called Scarlet. The group claimed an entitlement to a blocking order to bring to an end the illegal downloading of protected works by means of peer-to-peer use of the Scarlet server. The relevant Belgian legislation provided that where a third party uses the services of an intermediary to infringe the intellectual property of another, the courts can order the intermediary to bring the infringement to an end. In 2004, the President of the court of first instance found that copyright had been infringed and appointed an expert to assess the feasibility of the technical solutions proposed by SABAM. The expert identified one possible solution, namely CopySense produced by a firm called Audible Magic, but expressed reservations as to its capacity to deal with high volumes of traffic, the high acquisition and operating costs of the system and its potentially short technical duration of three years. The Court granted an injunction imposing that technical solution. On a referral of relevant questions to the Court of Justice of the European Union, Scarlet argued that the injunction would constitute a general obligation to monitor contrary to Article 15 of the E-Commerce Directive, that it would be contrary to the mere conduit defence in Article 12 of the E-Commerce Directive and, finally, that it would violate fundamental rights in particular the rights to privacy, confidentiality of correspondence and freedom of expression. From the text of the judgment, it is clear that the Court was concerned with the breadth of the injunction which it considered would impose on Scarlet a general monitoring obligation contrary to Article 15 of the E-Commerce Directive. Further, the Court did not consider that the order properly balanced the property rights enjoyed by the copyright owners against Scarlet’s right to conduct its business. The Court was particularly concerned that the expense of installing the technology required would fall solely on Scarlet, contrary to Article 3 of the Enforcement Directive, which requires that remedies not be unnecessarily complicated or costly. The Court also considered that a filtering system would infringe the rights of Scarlet’s users since it would involve the collection and identification of users’ IP addresses contrary to Article 8 of the European Convention on Human Rights and could potentially lead to a blocking of lawful communications thus undermining the freedom of information contrary to Article 11. 8.7 Very similar questions arose in another referral from the courts of Brussels to the Court of Justice of the European Union in Case C-360/10 Belgische Vereniging van Auteurs, Componisten en Uitgevers CVBA (SABAM) v Netlog NV. This time the blocking order was sought against a social networking site. The injunction in question required what was described as “the installation of an expensive general monitoring system”. That system seems also not to have been sufficiently tested. Such an order was a serious imposition on the hosting service provider’s right to conduct a business. The Court held that it infringed the fundamental rights of the users to protection of their personal data and their freedom to impart information; in such circumstances, the rights of the copyright owners must give way. It is clear, however, from paragraphs 41 to 51 of the judgment that it is not at all in the instance of every application for an order to prevent copyright infringement that competing rights will require the refusal of an injunction in support of copyright: The protection of the right to intellectual property is indeed enshrined in Article17(2) of the Charter of Fundamental Rights of the European Union (“the Charter”). There is, however, nothing whatsoever in the wording of that provision or in the Court’s case-law to suggest that that right is inviolable and must for that reason be absolutely protected ... As paragraphs 62 to 68 of the judgment in Case C 275/06 Promusicae [2008] ECR I 271 make clear, the protection of the fundamental right to property, which includes the rights linked to intellectual property, must be balanced against the protection of other fundamental rights. More specifically, it follows from paragraph 68 of that judgment that, in the context of measures adopted to protect copyright holders, national authorities and courts must strike a fair balance between the protection of copyright and the protection of the fundamental rights of individuals who are affected by such measures. Accordingly, in circumstances such as those in the main proceedings, national authorities and courts must, in particular, strike a fair balance between the protection of the intellectual property right enjoyed by copyright holders and that of the freedom to conduct a business enjoyed by operators such as hosting service providers pursuant to Article 16 of the Charter ... In the main proceedings, the injunction requiring the installation of the contested filtering system involves monitoring all or most of the information stored by the hosting service provider concerned, in the interests of those rightholders. Moreover, that monitoring has no limitation in time, is directed at all future infringements and is intended to protect not only existing works, but also works that have not yet been created at the time when the system is introduced. Accordingly, such an injunction would result in a serious infringement of the freedom of the hosting service provider to conduct its business since it would require that hosting service provider to install a complicated, costly, permanent computer system at its own expense, which would also be contrary to the conditions laid down in Article 3(1) of Directive 2004/48, which requires that measures to ensure the respect of intellectual-property rights should not be unnecessarily complicated or costly ... In those circumstances, it must be held that the injunction to install the contested filtering system is to be regarded as not respecting the requirement that a fair balance be struck between, on the one hand, the protection of the intellectual-property right enjoyed by copyright holders, and, on the other hand, that of the freedom to conduct business enjoyed by operators such as hosting service providers ... Moreover, the effects of that injunction would not be limited to the hosting service provider, as the contested filtering system may also infringe the fundamental rights of that hosting service provider’s service users, namely their right to protection of their personal data and their freedom to receive or impart information, which are rights safeguarded by Articles 8 and 11 of the Charter respectively. Indeed, the injunction requiring installation of the contested filtering system would involve the identification, systematic analysis and processing of information connected with the profiles created on the social network by its users. The information connected with those profiles is protected personal data because, in principle, it allows those users to be identified … Moreover, that injunction could potentially undermine freedom of information, since that system might not distinguish adequately between unlawful content and lawful content, with the result that its introduction could lead to the blocking of lawful communications. Indeed, it is not contested that the reply to the question whether a transmission is lawful also depends on the application of statutory exceptions to copyright which vary from one Member State to another. In addition, in some Member States certain works fall within the public domain or may be posted online free of charge by the authors concerned ... Consequently, it must be held that, in adopting the injunction requiring the hosting service provider to install the contested filtering system, the national court concerned would not be respecting the requirement that a fair balance be struck between the right to intellectual property, on the one hand, and the freedom to conduct business, the right to protection of personal data and the freedom to receive or impart information, on the other ... 8.8 A series of cases in England and Wales have made it clear that injunctive relief in aid of copyright protection on the internet can be granted in circumstances where there is a clear focus to the relief sought, unlike the unlimited order sought in Scarlet Extended, and where the balance of burdens and costs are proportionate. In Dramatico Entertainment Ltd and Others v British Sky Broadcasting Ltd and Others [2012] EWHC 268 (Ch) Arnold J described internet copyright infringement through the website The Pirate Bay, previously referenced in this judgment, as “vast in scale”. When its founders, earning substantial revenues through online advertising, were convicted in Sweden on charges of criminal copyright infringement, they fled to other countries. Arnold J found that of the top 75 music albums available as of December 2011, 72 were available through The Pirate Bay. Access to that site was injuncted through the intermediaries of the main internet service providers in Britain. Part of the reasoning was that although they were conduits, authorisation of copyright infringement can occur where the action of the party charged goes beyond mere enablement, assistance or even encouragement. Participation occurs where there is a grant, or purported grant, of the right to do the tort complained of. This may be found on an analysis of the relationship between the alleged authoriser and the primary infringer; the equipment or other material supplied as a means to infringe; whether it was inevitable that such would be so used; the degree of control which the supplier retained; and whether that supplier had taken any steps to prevent infringement: see Kitchin J in Twentieth Century Fox Film Corporation & Ors v Newzbin Ltd [2010] EWHC 608 (Ch) at paragraphs 85-89. In addition, joint commission of a tort could occur where there is more than mere knowing assistance or facilitation to the degree that the party charged became so involved in the tort as to make it his own; same judgment at paragraphs 103-111. Arnold J held that an injunction was required shutting off access through intermediaries to The Pirate Bay and that same was mandated by European copyright law. That decision, and the others referenced hereafter, make it clear that there is an interest in data protection law terms in internet service providers not only in abiding by their own contract with subscribers but also in avoiding potential liability for, or the grant of an injunction in respect of, copyright infringement. 8.9 The previous year in Twentieth Century Fox Film Corporation & Ors v British Telecommunications plc (Newzbin 2) [2011] 1981EWHC (Ch), Arnold J injuncted the access of BT internet customers to sites called Newzbin 1 and Newzbin 2. These sites were being used to infringe cinema and other copyright. These injunctions required the addition of technology called Cleanfeed onto the computer systems of these firms; though the internet service provider was not required to adopt deep packet inspection based blocking utilising detailed analysis. A similar approach to balancing the proportionality of the order sought judged in the context of the mischief at issue and the competing rights and the burdens and benefits to the parties was taken by Arnold J in Golden Eye (International) Ltd & Ors v Telefónica UK Ltd [2012] EWHC 723 (Ch) in another, but relevant, context. In Australia a different view was taken of authorisation of breach of copyright in terms of the facts both at trial and on appeal to the High Court of Australia in Roadshow Films Pty Ltd v iiNet Ltd [2012] HCA 16. 8.10 To sum up, it is clear that the state of the law was regrettably misconstrued by the Data Protection Commissioner. In that respect, he is not to be faulted as the law is complex. The law does not, however, set intellectual property rights at nought because of the involvement of the internet. In due course, clarity may be brought to the law by a comprehensive ruling where an appropriate case arises before the Court of Justice of the European Union. In the meanwhile, the nature of the injunction sought; the limitation to and the duration of any monitoring; the breadth or narrowness of the scope of any order; the nature of the equipment to be used; the potential for the interference of that equipment with the proper use of the existing systems of the intermediary; the balance of the burden between the parties as to equipment, personnel and cost; the intrusiveness of any remedy into legitimate privacy and the entitlement to communicate; and any potential data protection impingements, together constitute the main factors in a court determining where the proportionality of an injunctive remedy to the mischief of the improper use of intellectual property online is to be struck or whether, on the other hand, an injunction application is to be refused, despite legal compliance, on discretionary grounds. Criminal conviction 10.1 The receipt of a letter by an Eircom subscriber pointing out that someone having access to the internet has downloaded a copyright track or video is not an allegation that the subscriber has committed a criminal offence. The recording companies have no interest in seeking out information from Eircom as to who that subscriber might be. Any serious criminal lawyer considering a prosecution would need to know how many persons might potentially have had access to computers within the house at that particular time of the download or upload. An infringement of copyright could be accidental, could be initiated by an employee, remembering that there is no vicarious responsibility in criminal law, or by a child under the age of responsibility. The particular mental element must be shown to be present by compelling proof: otherwise there is no criminal offence. The Data Protection Commissioner seems to take a clear view that criminal remedies should be kept separated from civil redress for copyright. While that view is commendable, the protocol has nothing to do with accusing anyone of a crime. Reasons 11.1 It follows that counsel for the Data Protection Commissioner was put in an impossible position in being required to argue, as inventively he did, that reasons had been given within the notice of 11 January 2012. The notice contains no reasons whatsoever. There is no warrant from the relevant legislation to overturn a series of decisions of the courts in judicial review whereby reasons are required for administrative actions which settle the entitlements of citizens pursuant to a legislative mandate. In some instances, reasons are simply required by legislation. This is one of those cases. The courts cannot overturn that legislation but are required to implement it. In other cases, an entitlement to reasons may be argued to be a legal right by those whose rights are overturned or gravely affected by an administrative or quasi-judicial decision. Where a licensing authority refuses to grant a permit but fails to give reasons, the applicant for the licence will have no means of knowing what it was she or he did wrong and what it might be that she or he would be required to do correctly in order to be permitted, for example, to open a business legitimately, to operate a fishing trawler or to otherwise pursue permission for an activity that is licensed on meeting specified conditions that are for the benefit of the entire community. Since access to the courts is a constitutionally guaranteed right, an applicant for permission, or a party prevented from an otherwise lawful activity by reason of a decision, is entitled to challenge that decision by judicial review and has an entitlement not to be impeded by the mysterious recitation of reference to legislation of a primary or secondary kind without any real knowledge as to why a decision was taken. 11.2 Sometimes the requirement for reasons can be met in terse terms. A useful test is whether a reasonable person who has heard the entire of the case, or a person who has read all of the relevant papers, would on hearing or reading the decision or judgment be apprised of the reasons for the decision. Regularly, convictions take place in the criminal courts on the basis that a jury accepted the prosecution case and rejected that of the accused, if any. In the District Court, it is perfectly lawful for a judgment to be given in one sentence of a kind which indicates that, for example, in a civil case the evidence of one driver is much more reliable than that of the other because his evidence was more honest, or in a criminal case that the evidence of a particular witness for the defence has made the judge reasonably doubt the prosecution case. In some kinds of administrative procedure, an inspector or other official would do the groundwork before a decision is taken. Planning is an example. A reference in a decision to refusing or accepting the reasons given by such a person clearly mandates the underpinning of the decision with sufficient material to enable judicial review and to inform the citizen. Reasons are not to be judged as inadequate on the terms in which they are put but instead are to be assessed by reference to what a reasonable person with full knowledge of the background would conclude by reading the relevant text.
11.3 The authorities merely amplify the propositions just set out. This Court has no intention of adding to what are clear principles that are upheld on an invariable basis that is fundamental to the decision making in judicial review. In Sister Mary Christian & Ors v Dublin City Council [2012] IEHC 163, Clarke J at paragraphs 8.15-8.16 summarised the relevant rules in this way:
“In O’Donoghue v. An Bord Pleanála [1991] I.L.R.M. 750 Murphy J. said at p. 757:- ‘It is clear that the reason furnished by the Board (or any other tribunal) must be sufficient first to enable the courts to review it and secondly to satisfy the persons having recourse to the tribunal that it has directed its mind adequately to the issue before it. It has never been suggested that an administrative body is bound to provide a discursive judgment as a result of its deliberations …’
8.16 It is, of course, the case that Kelly J., in Mulholland, was concerned with reasons required to enable a person to consider a statutory appeal within the planning system. However, in Meadows v. Minister for Justice [2010] 2 IR 701, at p. 732, Murray C.J. (part of the majority in that case) suggested that the failure of the Minister in question to supply adequate reasons meant that the applicant’s “constitutional right of access to the courts to have the legality of an administrative decision judicially reviewed could be rendered either pointless or so circumscribed as to be unacceptably ineffective”. While Meadows was, of course, a case in the immigration field, there is no reason why, at the level of principle, the comments of Murray C.J. are not applicable in an appropriate way in respect of any other type of statutory or administrative decision. The underlying rationale of cases such as Meadows (in that respect) and Mulholland is that decisions which affect a person’s rights and obligations must be lawfully made. In order to assess whether a relevant decision is lawful, a party considering a challenge, and the court in the event of a challenge being brought, must have access to a sufficient amount of information to enable an assessment as to lawfulness to be made. What that information may be, may vary enormously depending on the facts under consideration or the nature of the decision under challenge. However, the broad and underlying principle is that the court must have access to sufficient information to enable the lawfulness of the relevant measure to be assessed. Alleged mis-invocation of jurisdiction 12.1 It is not impressive that the Data Protection Commissioner, when Eircom appealed that notice pursuant to statute to the Circuit Court, sought to impede the joinder of the recording companies. His reasons were again costs, apparently. The appeal, although lodged, has not been substantively progressed by any of the parties. In the context of an application by the recording companies to be joined, by affidavit dated 31 January 2012, the Data Protection Commissioner swore:
Once it is determined that an order of certiorari may be granted, the court retains a discretion in all the circumstances of the case as to whether an order of certiorari should issue. In considering all the circumstances, matters including the existence of an alternative remedy, the conduct of the applicant, the merits of the application, the consequences to the applicant if an order of certiorari is not granted and the degree of fairness of the procedures, should be weighed by the court in determining whether certiorari is the appropriate remedy to attain a just result. 12.3 Similarly, in the earlier decision of McGoldrick v An Bord Pleanála [1997] 1 IR 497 at 509 Barron J stated that:
Opposing views 13.1 There is undoubtedly a tension between legitimate expectations of freedom and the entitlement not to have overturned the right to reasonable remuneration for creative endeavor. However, intellectual property rights that have been part of the legal landscape in this jurisdiction since 1710, and that tension can only be resolved by considered political action. Such legislation as currently binds the citizens of this State, and the balance which has so far been struck between copyright and other competing rights, is a matter for administrative and judicial implementation. The duty of the courts is to apply that law in the manner in which it is found. In terms of public administration through quasi-judicial decision-making and the promulgation of appropriate administrative rulings, the task faced is identical and the requirement for legal certainty demands strict compliance. Result 14.1 I will hear submissions as to a stay to facilitate any appeal to the Supreme Court, the referral of questions to the Court of Justice of the European Union having been rejected by all parties, and as to costs and as to the possible measurement thereof.
|