Sunday 15 December 2019

Internet legal developments to look out for in 2020

Never mind Brexit, what is coming up on the UK internet legal scene in the coming year? The highlight of 2020 is of course the January publication of the 5th edition of Internet Law and Regulation :-). That apart, here are some cases and legislation to look out for. (In accordance with long tradition this feature does not cover data protection.)


DSM Copyright Directive Member States’ implementation of the Digital Single Market Copyright Directive is due by 7 June 2021. This includes the so-called snippet tax (the press publishers’ right) and the Article 17 rules for online sharing service providers (OSSPs).

A CJEU challenge to Article 17 by the Polish government (Poland v Parliament and Council, Case C-401/19) is pending. Poland argues that Article 17 makes it necessary for OSSPs, in order to avoid liability, to carry out prior automatic filtering of content uploaded online by users, and therefore to introduce preventive control mechanisms. It contends that such mechanisms undermine the essence of the right to freedom of expression and information and do not comply with the requirement that limitations imposed on that right be proportionate and necessary.

SatCab Directive The EU Directive extending the country of origin provisions of the Satellite and Cable Broadcasting Directive to online radio and news broadcasts was adopted in April 2019 and has to be implemented by 7 June 2021.

Linking and communication to the public In the UK case of Warner Music/Sony Music v TuneIn permission has been granted to both sides to appeal the High Court’s judgment of 1 November 2019.

Pending CJEU copyright cases Several copyright references are pending in the EU Court of Justice. Judgment in the Dutch Tom Kabinet case on secondhand e-book trading (Case C-263/18) is due was delivered on 19 December 2019. The CJEU decided against Tom Kabinet, holding that its service was a communication to the public, not a distribution subject to exhaustion of rights.
The YouTube and Uploaded cases (C-682/18 Petersongs v YouTube and C-683/18 Elsevier v Cyando) pending from the German Federal Supreme Court include questions around the communication to the public right, as do C-392/19 VG Bild-Kunst v Preussischer Kulturbesitz (Germany, BGH), C-442/19 Brein v News Service Europe (Netherlands, Supreme Court) and C-597/19 Mircom v Telenet (Belgium).
Questions about injunctions against intermediaries are also raised in C-682/18 Petersongs v YouTube, C-442/19 Brein v News Service Europe and C-500/19 Puls 4 TV.
C-264/19 Constantin Film v YouTube asks questions about the permissible scope of court orders against intermediaries requiring provision of information about alleged infringers to rightholders under the IP Enforcement Directive.
Intermediary liability

The UK government published its Online Harms White Paper on 8 April 2019. The subsequent Conservative manifesto for the December 2019 election promised to legislate for online safety, while at the same time defending freedom of expression and in particular recognising and defending the invaluable role of a free press. The government’s response to its consultation on the White Paper was originally due to be published before the end of 2019. The Queen’s Speech immediately before the election indicated that draft legislation would be subject to the pre-legislative scrutiny process.

The German Federal Supreme Court has referred two cases (YouTube and Uploaded  – see above) to the CJEU asking questions about (among other things) the applicability of the ECommerce Directive hosting protections to UGC sharing sites. C-442/19 Brein v News Service Europe (Netherlands, Supreme Court) and C-500/19 Puls 4 TV (Austria, Supreme Court) also ask questions around the Article 14 hosting protection, including whether it is precluded if communication to the public is found.

On 19 December 2019 the CJEU issued its AirBnB (C-390/18) judgment on the scope of the eCommerce Directive, holding that the kind of service provided by AirBnB is an information society service within the scope of the Directive. It also held that in criminal proceedings with an ancillary civil element, it is a defence to measures restricting an information society service incoming from another Member State that the measures had not been notified to the European Commission and the Member State concerned under Article 3(4) of the Directive.

The new European Commission is proposing a Digital Services Act, starting with a public consultation in early 2020. This will include a review of the ECommerce Directive liability shields.

On 12 September 2018 the European Commission published a Proposal for a Regulation on preventing the dissemination of terrorist content online. This followed its September 2017 Communication on Tackling Illegal Content Online and March 2018 Recommendation on Measures to Effectively Tackle Illegal Content Online. It is notable for proposing one hour takedown response times and for the ability for Member States to derogate from the ECommerce Directive Article 15 prohibition on imposing general monitoring obligations on conduits, caches and hosts. Discussions on the proposed Regulation continue.

Cross-border liability and jurisdiction

In the law enforcement field the EU has proposed a Regulation on EU Production and Preservation Orders (the ‘e-Evidence Regulation’) and associated Directive that would set up a regime for some cross-border requests direct to service providers. The UK has said that it will not opt in the Regulation.
The US and the UK signed a Data Access Agreement on 3 October 2019, providing domestic law comfort zones for service providers to respond to data access demands from authorities located in the other country. Final implementation in each country awaits completion of review by the US Congress and the UK Parliament. The EU will commence negotiations with the USA for an EU-wide agreement.
Discussions continue on a Second Protocol to the Cybercrime Convention, on evidence in the cloud.

State surveillance of communications

The UK’s Investigatory Powers Act 2016 (IP Act), has come into force, including amendments following the Watson/Tele2 decision of the CJEU. The government has said that it will introduce ‘thematic’ certification by the Secretary of State of requests to examine bulk secondary data of individuals believed to be within the British Islands.

A pending reference to the CJEU from the Investigatory Powers Tribunal in litigation brought by Privacy International (Case C-623/17) raises questions as to whether the Watson decision applies to national security, and if so how; whether mandatorily retained data have to be held within the EU; and whether those whose data have been accessed have to be notified.

Liberty has a pending judicial review of the IP Act bulk powers and data retention powers. It has been granted permission to appeal to the Court of Appeal on the question whether the data retention powers constitute illegitimate generalised and indiscriminate retention. Other aspects (including bulk powers) are stayed pending the Privacy International reference to the CJEU or (a challenge based on the Human Rights Act) were refused by the Divisional Court.

The IP Act (in particular the bulk powers provisions) may be indirectly affected by other cases pending in the CJEU: Schrems 2 (C-311/18), challenges by La Quadrature de la Net to the EU-US PrivacyShield (T-738/16) and to the French data communications data retention regime (C-511/18 and C-512/18), and a challenge to the Belgian communications data retention regime (C-520/18); in the European Court of Human Rights (in which Big Brother Watch and various other NGOs challenge the existing RIPA bulk interception regime) and by a pending domestic judicial review by Privacy International of an Investigatory Powers Tribunal decision on equipment interference powers.

The ECtHR gave a Chamber judgment in the BBW case on 13 September 2018. That and the Swedish Rattvisa case were subsequently referred to the ECtHR Grand Chamber and are awaiting judgment. If the BBW Chamber judgment had become final it could have affected the IP Act in as many as three separate ways.

In the Privacy International equipment interference case, the Supreme Court held on 15 May 2019 that the IPT decision was susceptible of judicial review. The litigation will now continue.
Compliance of the UK’s surveillance laws with EU Charter fundamental rights will be a factor in any data protection adequacy decision that is sought once the UK becomes a non-EU third country post-Brexit.

Here is an updated mindmap of challenges to the UK surveillance regime:

Software - goods or services?

Judgment is awaited from the UK Supreme Court as to whether software supplied electronically as a download and not on any tangible medium is goods for the purposes of the Commercial Agents Regulations (Computer Associates (UK) Ltd v The Software Incubator Ltd).

[Updated 20 December 2019 to add Tom Kabinet and AirBnB CJEU judgments; and 22 December 2019 to add C-511/18 and C-512/18); and 20 October 2020 with updated mindmap]

Saturday 14 December 2019

Cyberleagle Christmas Quiz 2019

This year the answers (such as may exist) can be found in the about to be published 5th edition of Internet Law and Regulation.
  1. What is the essence of TV-ness?
  2. For the purposes of interception legislation, is there such a thing as a communication with no intended recipient?
  3. In which country did the first reported extradition for criminal copyright infringement take place?
  4. English defamation law recognises a targeting test for cross-border publication. True or false?
  5. A web site proprietor can be liable in negligence to users who rely on incorrect information on its site. True or false?
  6. Can new sites can be added to a site blocking injunction without the approval of the court?
  7. Is it defamatory to accuse someone of copying?
  8. English law recognises the concept of a dishonest device. True or false?
  9. The Electronic Commerce (EC Directive) Regulations 2002 implement the EU Electronic Commerce Directive in English law. True or false?
  10. In English law, site blocking injunctions are limited to intellectual property infringement. True or false?
  11. Only a qualified electronic signature has legal effect equivalent to a handwritten signature. True or false?
  12. Under the Investigatory Powers Act 2016, is the web address ‘’ treated as content or as communications data?
  13. Can dishonest exploitation of a patent be a criminal offence?
  14. The Defamation Act 1996 superseded the common law subordinate disseminator defence. True or false?
  15. Can copyright subsist in a URL?
  16. Can an online intermediary can be bound by an injunction in proceedings to which it is not a party?
  17. Under the ECommerce Directive intermediary liability provisions, what is the difference between liability ‘because’ of a third party’s infringement and liability ‘in respect of’ it?
  18. How many times in a single judgment did one judge use stealing, theft, or similar epithets to describe internet copyright infringement?
  19. Linking to grossly offensive material can constitute an offence under S.127 Communications Act 2003. True or false?
  20. For a computer to computer communication, what is the meaning of meaning?