BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £5, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | ||
England and Wales High Court (Chancery Division) Decisions |
||
You are here: BAILII >> Databases >> England and Wales High Court (Chancery Division) Decisions >> Mircom International Content Management & Consulting Ltd & Ors v Virgin Media Ltd & Anor [2019] EWHC 1827 (Ch) (16 July 2019) URL: http://www.bailii.org/ew/cases/EWHC/Ch/2019/1827.html Cite as: [2019] EWHC 1827 (Ch), [2019] WLR(D) 408 |
[New search] [Context] [View without highlighting] [Printable PDF version] [View ICLR summary: [2019] WLR(D) 408] [Help]
BUSINESS AND PROPERTY COURTS OF ENGLAND AND WALES
INTELLECTUAL PROPERTY LIST (ChD)
Fetter Lane, London, EC4A 1NL |
||
B e f o r e :
(sitting as a High Court Judge)
____________________
MIRCOM INTERNATIONAL CONTENT MANAGEMENT & CONSULTING LTD AND OTHERS | Claimants in claim no. BL-2019-000273 | |
GOLDEN EYE INTERNATIONAL LTD AND OTHERS | Claimants in claim no. BL-2019-000037 | |
- and - | ||
(1) VIRGIN MEDIA LIMITED | ||
(2) PERSONS UNKNOWN | Defendants |
____________________
Jaani Riordan (instructed by in-house solicitors for Virgin Media Limited)
Hearing date: 14th June 2019
____________________
Crown Copyright ©
Mr Recorder Douglas Campbell QC:
Introduction
(a) Does the correct legal approach to such claims remain that set out in the 2012 Golden Eye litigation? See Golden Eye (International) Ltd v Telefónica UK Ltd, [2012] EWHC 723 (Ch), [2012] RPC 28 (Arnold J); Golden Eye (International) Ltd v Telefónica UK Ltd (Open Rights Group intervening) [2012] EWCA Civ 1740, [2013] Bus LR 414, (Court of Appeal).
(b) Does the Applicants' evidence as served justify the order sought? If not, should I make the order sought on the basis of the Applicants' proposal for rectification thereof?
The claims generally
Does the correct legal approach to such applications remain that set out in the 2012 Golden Eye litigation?
1) The Court of Appeal approved the vast majority of the judgment below, subject to one point dealt with separately below.
2) For instance the conditions which have to be satisfied in order for the Court to grant Norwich Pharmacal relief are set out in paragraphs 81-85 of the first instance judgment, see also paragraph 7 on appeal.[1] All of these conditions are important but the relevant balancing exercise forming part of the proportionality assessment "is a matter of considerable importance" (see paragraph 18 of the appeal judgment).
3) Both judgments accept that the persons identified by a Norwich Pharmacal order will have their privacy and data protection rights invaded and they may be exposed to proceedings for infringement, may be caused embarrassment and may consider it not cost effective for them to defend any claim even if innocent (para 119 below, para 20 on appeal).
4) That said, with appropriate amendments made to the proposed letter that was to be sent to persons identified by the order (such amendments having been identified by Arnold J),[2] it was proportionate to make such an order (see paragraph 145 below, paragraph 23 on appeal).
5) A key reason why it was just to make such order was Arnold J's finding that the Claimants did have a genuine intention to try to obtain redress for the infringement rather than to set up a money-making scheme designed to embarrass and coerce as many people as possible (regardless of whether they were actual infringers) into making the payments demanded (see paragraphs 112-113 below, 14 on appeal).
6) This last point leads me to the one matter on which the Court of Appeal differed from Arnold J. The Court of Appeal held that given his finding that all of the Claimants were genuinely intending to vindicate their intellectual property rights, he should not have refused relief for the other Claimants (see paragraphs 25-28 on appeal).
7) One of the amendments made to the proposed letter by Arnold J was the removal of the figure of £700 sought in settlement, which was said to be "unsupportable" and "arbitrary" (see paragraphs 131-138 below, paragraph 22 on appeal).
8) The proposed letter also acknowledges, as did the Applicants before me, that the registered owners identified may not necessarily be responsible for the actual infringement for various reasons (see eg paragraphs 27, 103, 106 below, and paragraph 9 on appeal). That is to say, there will be "an unknown percentage of errors" in identification.
1) Because of the Supreme Court's judgment in Rugby Football Union v Viagogo [2012] UKSC 55.
2) Because of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (more commonly known simply as "the GDPR") and the Data Protection Act 2018 ("DPA 2018").
Has Viagogo changed the approach to be taken?
1) First, Viagogo was decided after the first instance decision but before the appeal and there is no reason to suppose that the Court of Appeal was unaware of it.
2) Secondly, the approach set out by Arnold J in Golden Eye at [117] (and later itself approved by the Court of Appeal) was expressly approved as a "correct statement" by Lord Kerr JSC[3] in Viagogo at [44]-[45].
3) Thirdly Lord Kerr JSC did note that the applicant's motive in Viagogo was the "entirely worthy" one of seeking to promote the sport of rugby and ensuring that members of the public could attend rugby matches (see [45]), but that merely meant that Viagogo was a more attractive case on the facts. Lord Kerr did not say or suggest that the result in Golden Eye was wrong.
What is the impact of the GDPR?
(a) First, are the raw IP addresses (ie the data which the Applicants already possess) "personal data" within the meaning of Art 4(1) GDPR?
(b) Secondly, if disclosure is provided as sought are the Applicants thereby "data controllers" within the meaning of Art 4(7) or merely "data recipients" within the meaning of Art 4(9)?
(c) Thirdly, does it make a difference that the Applicants have agreed to provide the following undertaking namely "The First Applicant undertakes within 14 days of the date of this Order to register as a data controller with the Information Commissioner's Office in the United Kingdom, and to appoint a data protection officer who is domicile and ordinarily resident in the United Kingdom and meets the requirements of the General Data Protection Regulation".
Legal context:
(26)The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
For the purposes of this Regulation:(1)
'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(7)
'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
(9)
'recipient' means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
"46 Thus, as the Advocate General stated essentially in point 68 of his Opinion, that would not be the case if the identification of the data subject was prohibited by law or practically impossible on account of the fact that it requires a disproportionate effort in terms of time, cost and man-power, so that the risk of identification appears in reality to be insignificant.47 Although the referring court states in its order for reference that German law does not allow the internet service provider to transmit directly to the online media services provider the additional data necessary for the identification of the data subject, it seems however, subject to verifications to be made in that regard by the referring court that, in particular, in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.
48 Thus, it appears that the online media services provider has the means which may likely reasonably be used in order to identify the data subject, with the assistance of other persons, namely the competent authority and the internet service provider, on the basis of the IP addresses stored.
49 Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person."
Analysis
Would the Applicants be "data controllers" within the meaning of Art 4(7) or merely "data recipients" within the meaning of Art 4(9)?
Information required to be disclosed by law etc or in connection with legal proceedings…
(2)The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.
(3)The listed GDPR provisions do not apply to personal data where disclosure of the data—
(a)is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),(b)is necessary for the purpose of obtaining legal advice, or(c)is otherwise necessary for the purposes of establishing, exercising or defending legal rights,to the extent that the application of those provisions would prevent the controller from making the disclosure.
The "listed GDPR provisions" are identified at Schedule 2, part 1, paragraph 1 of the 2018 Act and refer to major parts of the GDPR. So the GDPR is disapplied for many purposes connected to legal proceedings anyway.
Does the Claimants' evidence as served justify the order sought?
"Overall, it seems to me that the Claimants' evidence is sufficiently cogent to establish a good arguable case that (1) P2P filesharing of the Claimants' copyright works took place via the IP addresses and at the dates and times identified by Mr Torabi, and (2) many, but not all, of the subscribers to whom those IP addresses were allocated by O2 at those dates and times were the persons engaged in such filesharing."
a) Various defects in the fact evidence of Mr Becker (for Golden Eye) and Mr Hoffmann (for Mircom). The main one was that the list of IP addresses now relied upon is not in evidence at all.
b) Various defects in the expert evidence of Mr Fieser, Mr Paige, and Dr Sarre.
c) Various defects in the licence agreements upon which Mircom and Golden Eye rely.
d) The fact that the evidence of file sharing was gathered in Germany.
e) The evidence showed was a greater risk of "false positives", ie incorrect identifications, today than there had been in 2012.
The evidential points
Defects in fact evidence
a) Mr Hoffmann's witness statement is dated 26th February 2018. In paragraph 1 he explains that Mircom seeks disclosure "of the names and addresses of the subscribers associated with the IP addresses listed in a spreadsheet attached as Exhibit 1". But there was no Exhibit 1.
b) In a witness statement dated 26 June 2018, Mr Wagner purported to exhibit a spreadsheet marked "MWH1", described as a spreadsheet setting out the IP addresses of subscribers for the period 27 February to the dates shown on the spreadsheet. This cannot be the same as Mr Hoffmann's own intended Exhibit 1 since it post-dates Mr Hoffmann's witness statement. Further this exhibit does not even set out any IP addresses, merely information including an "infringement ID" which appears to be date-related.
c) In any event even exhibit MWH1 is not what is sought. Mircom actually seeks the names and addresses of a spreadsheet which was sent to Virgin by email on 7 June 2019. This spreadsheet is not in evidence, nor is there any explanation of how it was produced.
d) Finally Virgin claimed there were a number of evidential difficulties in the new spreadsheets. For instance it was said that in some instances a film had only been partly downloaded, and that this meant there was no infringement; and in some cases the spreadsheet referred to films not tied to any licensee.
Defects in expert evidence
a) Mircom relied on the evidence of Dr Sarre and Mr Fieser. Dr Sarre's report is said to show that the software used to identify infringement, namely "FileWatchBT" is reliable. However Dr Sarre's report was "commissioned by telephone" by a Mr Eichner on 1st April 2010, so the instructions are not documented and the report itself is dated 3rd May 2010. I do not accept that I should simply assume that a 9 year old expert report remains up to date, particularly one given in the field of computer software.
b) There are a number of reasons why Dr Sarre's report does not comply with CPR Part 35, but one is the lack of a statement of truth. I was shown a separate statement of truth dated January 23, 2014 (ie nearly 4 years after the report, and also over 5 years old today). This statement of truth refers at paragraph 5 to "the trial" but nobody seemed to know what trial, if any, Dr Sarre meant.
c) Mr Fieser gave a statement dated 20th December 2017 in which he claimed that FileWatchBT had not materially changed between 3 May 2010 and the date of his statement (which is, of course, over 18 months ago now). However Mr Fieser also said that this software was used to identify "the alleged infringing IP addresses and their acts of infringement set out in Exhibit 1 to Mr Hoffmann's statement". I have no idea what Mr Fieser meant by this since, as stated above, I have not seen any such Exhibit 1.
d) Golden Eye relied on the evidence of Mr Paige dated 19th August 2016, but if anything this is even worse. There is no statement of truth; no clarity as to what his instructions were; his evidence refers to static IP addresses, not dynamic ones; and his evidence appears to relate to a software program called "Observer". Yet Mr Fieser gave a statement (also unsupported by a Statement of Truth) dated 1st December 2017 in which he seemed to think the software mentioned in Mr Paige's report was called "International IP Tracker". Virgin also drew my attention (without comment by the Applicants) to evidence from Ms Griffin, Senior Legal Counsel of Virgin, suggesting that Mr Paige was a former detective who was arrested and dismissed after receiving a controlled substance.
e) It also appeared that Golden Eye was no longer licensed to use the software (now called "IPP") which it claimed to have used to identify the list of potential infringers.
Various defects in the licence agreements upon which Mircom and Golden Eye rely.
The fact that the evidence of file sharing was gathered in Germany.
Greater risk of false positives?
The genuine intention point
Conclusion
1. This order shall not take effect for the benefit of the Mircom Applicants unless, by 4.30pm on 8 July 2019, the Mircom Applicants serve the following documents on the Respondent:
(a) A statement of truth from Dr Frank Sarre conforming with that required by CPR Part 35 PD 3.3, which confirms that the content of his report at B/167 of the application bundle reflects his present opinion in respect of "FileWatchBT".(b) A statement of Mr Michael Eichner, in the same terms as that at B/237 of the application bundle, save that it shall formally exhibit a list of IP addresses obtained by use of "FileWatchBT" and shall be appended by a CPR compliant statement of truth.
2. This order shall not take effect for the benefit of the GEIL Applicants unless, by 4.30pm on 8 July 2019, the GEIL Applicants serve the following documents on the Respondent:
(a) A current licence agreement between Golden Eye (International) Limited and IPP International UG (haftungsbeschraenkt) ("IPP") for use of IPP's monitoring and detection software ("the Software").(b) A statement of truth from Mr Patrick Paige conforming with that required by CPR Part 35 PD 3.3, which confirms that the content of his report at C/308 of the application bundle reflects his present opinion in respect of the Software.
(c) A statement of Mr Tobias Fieser in the same terms as that at C/318 of the application bundle, save that it shall formally exhibit a list of IP addresses obtained by use of the Software and shall be appended by a CPR compliant statement of truth.
3. The Applicants shall have permission to apply in the event that they seek any variation of orders (1) and (2)[5].
Note 1 Note that despite the reference to “arguable wrongs” in the list of conditions to be satisfied, the test actually applied at first instance was “good arguable case”: see paragraph 105. Both parties accepted that “good arguable case” was the test I should apply: see also Flaux J in Ramilos v Buyanovsky [2016] EWHC 3175 (Comm) at [23]. [Back] Note 2 In 2012, the Patents County Court (as it then was) did not have a Small Claims Track, whereas now it does: see the first instance judgment at paragraph 110. This track would now be generally suitable for claims up to £10 000: see CPR Part 63.27(1)(b). [Back] Note 3 With whom Baroness Hale, Lord Clarke, Lord Reed, and Lord Phillips all agreed. [Back] Note 4 Virgin had another go at this in their first round of unsolicited post-hearing submissions. I accept the Applicants’ submission that this is too late. I also reject Virgin’s explanation for failing to make these submissions at the hearing, namely that“it was not possible to address it adequately in the time available at the hearing”. Virgin had half a day of time at the hearing, the same as the Applicants. [Back] Note 5 Included to take account of the possibility that one of the individuals may be incapacitated or otherwise unavailable. [Back]