Showing posts with label Database right. Show all posts
Showing posts with label Database right. Show all posts

Monday, 28 December 2020

Internet legal developments to look out for in 2021

Seven years ago I started to take an annual look at what the coming year might hold for internet law in the UK. This exercise has always, perforce, included EU law. With Brexit now fully upon us future developments in EU law will no longer form part of UK law. Nevertheless, they remain potentially influential: not least, because the 2018 EU Withdrawal Act provides that UK courts may have regard to anything relevant done by the CJEU, another EU entity or the EU after 31 December. In any case I am partial to a bit of comparative law. So this survey will continue to keep significant EU law developments on its radar.

What can we expect in 2021?

Copyright

Digital Single Market
EU Member States are due to implement the Digital Copyright Directive by 7 June 2021. This includes the so-called snippet tax (the press publishers’ right) and the Article 17 rules for online sharing service providers (OSSPs). The UK is not obliged to implement the Directive and has said that it has no plans to do so. Any future changes to the UK copyright framework will be “considered as part of the usual domestic policy process”.

The Polish government’s challenge to Article 17 (Poland v Parliament and Council, Case C-401/19) is pending. Poland argues that Article 17 makes it necessary for OSSPs, in order to avoid liability, to carry out prior automatic filtering of content uploaded online by users, and therefore to introduce preventive control mechanisms. It contends that such mechanisms undermine the essence of the right to freedom of expression and information and do not comply with the requirement that limitations imposed on that right be proportionate and necessary.

Linking and communication to the public The UK case of Warner Music/Sony Music v TuneIn is due to come before the Court of Appeal early in 2021.

Pending CJEU copyright cases Several copyright references are pending before the EU Court of Justice.

The YouTube and Uploaded cases (C-682/18 Peterson v YouTube and C-683/18 Elsevier v Cyando) referred from the German Federal Supreme Court include questions around the communication to the public right, as do C-392/19 VG Bild-Kunst v Preussischer Kulturbesitz (Germany, BGH), C-442/19 Brein v News Service Europe (Netherlands, Supreme Court) and C-597/19 Mircom v Telenet (Belgium). Advocate General Opinions have been delivered in YouTube/Cyando, VG Bildt-Kunst and Mircom.

YouTube/Cyando and Brein v News Service Europe also raise questions about copyright injunctions against intermediaries, as does C-500/19 Puls 4 TV.

Linking, search metadata and database right

C-762/19 CV-Online Latvia is a CJEU referral from Riga Regional Court concerning database right. The defendant search engine finds websites that publish job advertisements and uses hyperlinks to redirect users to the source websites, including that of the applicant. The defendant’s search results also include information - hyperlink, job, employer, geographical location of the job, and date – obtained from metatags on the applicant’s website published as Schema.org microdata. The questions for the CJEU are whether (a) the use of a hyperlink constitutes re-utilisation and (b) the use of the metatag data constitutes extraction, for the purposes of database right infringement.

Online intermediary liability

The UK government published its Full Consultation Response to the Online Harms White Paper on 15 December 2020, paving the way for a draft Online Safety Bill in 2021. The government has indicated that the draft Bill will be subject to pre-legislative scrutiny.

The German Federal Supreme Court has referred two cases (YouTube and Cyando – see above) to the CJEU asking questions about (among other things) the applicability of the ECommerce Directive hosting protections to UGC sharing sites. The Advocate General’s Opinion in these cases has been published.

Brein v News Service Europe and Puls 4 TV (see above for both) also ask questions around the Article 14 hosting protection, including whether it is precluded if communication to the public is found.

The European Commission published its proposals for a Digital Services Act and a Digital Markets Act on 15 December 2020. The proposed Digital Services Act includes replacements for Articles 12 to 15 of the ECommerce Directive.  The proposals will now proceed through the EU legislative process.

The European Commission’s Proposal for a Regulation on preventing the dissemination of terrorist content online is nearing the final stages of its legislative process, the Council and Parliament having reached political agreement on 10 December 2020. The proposed Regulation is notable for requiring one hour takedown response times and also for proactive monitoring obligations - potentially derogating from the ECommerce Directive Article 15 prohibition on imposing general monitoring obligations on conduits, caches and hosts.

The prospect of a post-Brexit UK-US trade agreement has prompted speculation that such an agreement might require the UK to adopt a provision equivalent to the US S.230 Communications Decency Act. However, if the US-Mexico-Canada Agreement precedent were adopted in such an agreement, that would appear not to follow (as explained here).

Cross-border 

The US and the UK signed a Data Access Agreement on 3 October 2019, providing domestic law comfort zones for service providers to respond to data access demands from authorities located in the other country. No announcement has yet been made that Agreement has entered into operation. The Agreement has potential relevance in the context of a post-Brexit UK data protection adequacy decision by the European Commission.

Discussions continue on a Second Protocol to the Cybercrime Convention, on evidence in the cloud.

State surveillance of communications


The kaleidoscopic mosaic of cases capable of affecting the UK’s 
Investigatory Powers Act 2016 (IP Act) continues to reshape itself. In this field CJEU judgments remain particularly relevant, since they form the backdrop to any data protection adequacy decision that the European Commission might adopt in respect of the UK post-Brexit. The recently agreed UK-EU Trade and Co-operation Agreement provides a period of up to 6 months for the Commission to propose and adopt an adequacy decision.

Relevant CJEU judgments now include, most recently, Privacy International (Case C-623/17), La Quadrature du Net (C-511/18 and C-512/18), and Ordre des barreaux francophones et germanophone (C-520/18) (see discussion here and here).

Domestically, Liberty has a pending judicial review of the IP Act bulk powers and data retention powers. Some EU law aspects (including bulk powers) were stayed pending the Privacy International reference to the CJEU. The Divisional Court rejected the claim that the IP Act data retention powers provide for the general and indiscriminate retention of traffic and location data, contrary to EU law. That point may in due course come before the Court of Appeal.

In the European Court of Human Rights, Big Brother Watch and various other NGOs challenged the pre-IP Act bulk interception regime under the Regulation of Investigatory Powers Act (RIPA). The ECtHR gave a Chamber judgment on 13 September 2018. That and the Swedish Rattvisa case were subsequently referred to the ECtHR Grand Chamber and await judgment. If the BBW Chamber judgment had become final it could have affected the IP Act in as many as three separate ways.

In response to one of the BBW findings the government has said that it will introduce ‘thematic’ certification by the Secretary of State of requests to examine bulk secondary data of individuals believed to be within the British Islands.

Software - goods or services?

Judgment is pending in the CJEU on a referral from the UK Supreme Court asking whether software supplied electronically as a download and not on any tangible medium constitutes goods and/or a sale for the purposes of the Commercial Agents Regulations (C-410/19 Computer Associates (UK) Ltd v The Software Incubator Ltd). The Advocate General’s Opinion was delivered on 17 December 2020.

Law Commission projects

The Law Commission has in train several projects that have the potential to affect online activity.

It is expected to make recommendations on reform of the criminal law relating to Harmful Online Communications in early 2021. The government has said that it will consider, where appropriate, implementing the Law Commission’s final recommendations through the forthcoming Online Safety Bill. The Law Commission issued a consultation paper in September 2020 (consultation closed 18 December 2020).

The Law Commission has also issued a Consultation Paper on Hate Crime Laws, which while not specifically focused on online behaviour inevitably includes it (consultation closed 24 December 2020).

It has recently launched a Call for Evidence on Smart Contracts (closing 31 March 2021) and is also in the early stages of a project on Digital Assets.

Electronic transactions

The pandemic has focused attention on legal obstacles to transacting electronically and remotely. Whilst uncommon in commercial transactions, some impediments do exist and, in a few cases, have been temporarily relaxed. That may pave the way for permanent changes in due course.

Although the question typically asked is whether electronic signatures can be used, the most significant obstacles tend to be presented by surrounding formalities rather than signature requirements themselves. A case in point is the physical presence requirement for witnessing deeds, which stands in the way of remote witnessing by video or screen-sharing. The Law Commission Report on Electronic Execution of Documents recommended that the government should set up an Industry Working Group to look at that and other issues.

Data Protection 

Traditionally this survey does not cover data protection (too big, and a dense specialism in its own right). On this occasion, however, the Lloyd v Google appeal pending in the UK Supreme Court should not pass without notice.

ePrivacy

EU Member States had to implement the Directive establishing the European Electronic Communications Code (EECD) by 21 December 2020. The Code brings ‘over the top’ messaging applications into the scope of ‘electronic communications services’ for the purpose of the EU telecommunications regulatory framework. As a result, the communications confidentiality provisions of the ePrivacy Directive also came into scope, affecting practices such as scanning to detect child abuse images. In order to enable such practices to continue, the European Commission proposed temporary legislation derogating from the ePrivacy Directive prohibitions. The proposed Regulation missed the 21 December deadline and continues through the EU legislative process.

Meanwhile there is as yet no conclusion to the long drawn out attempt to reach consensus on a proposed replacement for the ePrivacy Directive itself. 

[Updated 29 December 2020 to add sections on Data Protection and ePrivacy.] 




Wednesday, 8 January 2014

The CJEU's Innoweb dedicated meta search judgment in 15 tweets

Full CJEU judgment here



And the operative part of the CJEU judgment:

"Article 7(1) of Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases must be interpreted as meaning that an operator who makes available on the Internet a dedicated meta search engine such as that at issue in the main proceedings re-utilises the whole or a substantial part of the contents of a database protected under Article 7, where that dedicated meta engine:
 
–        provides the end user with a search form which essentially offers the same range of functionality as the search form on the database site;
 
–        ‘translates’ queries from end users into the search engine for the database site ‘in real time’, so that all the information on that database is searched through; and
 
–        presents the results to the end user using the format of its website, grouping duplications together into a single block item but in an order that reflects criteria comparable to those used by the search engine of the database site concerned for presenting results."

Sunday, 29 December 2013

Internet legal developments to look out for in 2014 (Updated)

[Updated with progress as at 20 December 2014 and further updated 7 October 2015]

And see: Cyberlaw Memes and Themes for 2014

2013 has been a busy year for cyberlaw. But what does 2014 hold? Here are some developments in the UK and EU pipeline.

1.  Defamation Act 2013. This legislation comes into force in a few days’ time, on Wednesday 1 January 2014.   

  • It provides website operators with complete defamation immunity for identifiable third party posts and qualified protection for anonymous posts.
  • As a result of the 2009 European Court of Human Rights judgment in the Times Newspapers internet archive case we will now have a single publication rule which puts an end to rolling limitation periods for online defamation. 
  • The new ‘booksellers defence’ bars defamation actions against secondary publishers unless it is not reasonably practicable to proceed against the author, editor (if any) or commercial publisher (if any). This will include online intermediaries.  
  • There will now be a bar on proceedings against non-European defendants, unless of all places in which the statement has been published, England and Wales is clearly the most appropriate place in which to bring an action. While this is framed as a general restriction on forum-shopping, it will be especially relevant to actions founded on the mere accessibility in England and Wales of a foreign internet publication. 
The Act does not apply to Northern Ireland, nor do the provisions discussed apply to Scotland.

2. New copyright exceptions. Following the Hargreaves Report new and amended copyright exceptions are slated to come into force by 6 April 2014. These will cover archive & preservation, quotations, educational use, disabled access, private study, text and data analytics, parody and private copying (format shifting). Draft statutory instruments for all these were published for technical review during 2013. Separately, new provisions for orphan works, extended collective licensing schemes and regulation of collecting societies are in the pipeline. And don’t forget the European Commission’s Public Consultation on its review of EU copyright rules, which closes on 5 February 2014. [The copyright exceptions were intended (per the Minister in the IP Bill 2nd Reading Debate) to be laid before Parliament in February 2014 for debate under affirmative resolution procedure. Draft regulations were in fact laid before Parliament and published, together with a response to the technical review, explanatory notes, guidance and other supporting documents, on 27 March 2014 with a view to coming into force on 1 June 2014. All except the parody and private copying exceptions did so. These two exceptions were deferred following questions from the Joint Committee on Statutory Instruments. The drafts were then reissued for debate in Parliament, passed and come into force on 1 October 2014. Following a challenge by judicial review the private copying exception regulation has since been quashed.] [The European Commission Consultation response date was extended until 5 March 2014 and is now closed. 11,117 submissions were received.]


3. Blocking ordersConstantin Films v UPC is pending in the CJEU. This is a case on copyright blocking orders. The Advocate General issued his Opinion on 26 November 2013. In the continuing absence of an English version, here are the Court’s Press Release and my summary of the Opinion. A judgment during 2014 is likely. [The CJEU issued its judgment on 27 March 2014. Comments here.]

4. Copyright and linking. Three cases pending before the CJEU are about whether various types of linking can infringe the copyright communication to the public right. These are Svensson, C More Entertainment and BestWater. BestWater has been stayed pending Svensson, which appears to be heading towards judgment, probably during 2014, without the benefit of an Advocate General’s Opinion. Svensson has provoked two bodies, the European Copyright Society and the International Literary and Artistic Association (ALAI), to issue conflicting opinions on how linking issues should be decided. Also look out for Football Dataco v Stan James in the UK Supreme Court, a database right case under appeal on the question of joint liability. [Svensson judgment issued on 13 February 2014. Discussion here.]

5. Online copyright jurisdiction. Pez Hejduk is a pending reference to the CJEU concerning cross-border jurisdiction over online copyright infringement.  Most likely it will regard Pinckney as having already answered the Pez Hejduk questions. Also look out for Blomqvist, a CJEU case which has online aspects concerning the territoriality of the copyright distribution right and of trade marks. [Blomqvist judgment issued on 6 February 2014. Summary here. AG Opinion in Pez Hejduk issued on 11 September 2014 (not yet in English). CJEU judgment in Pez Hejduk issued on 22 January 2015. Opted for mere accessibility as the threshold for jurisdiction over online copyright infringement.]

6. Intermediary liability. Papasavvas, another pending CJEU reference, asks questions about the scope of the Electronic Commerce Directive provisions on internal market and intermediary liability. The internal market questions look very similar to those already answered in eDate/Martinez. Some aspects of the intermediary liability questions may provide the CJEU with an opportunity to comment on the Delfi decision of the European Court of Human Rights. [17 Feb 2014 ECHR Grand Chamber decides to refer Delfi case (i.e. hear an appeal). Hearing on 9 July according to AdVox. Papasavvas judgment issued 11 September 2014. No surprises. Confirms previous CJEU caselaw, including application of eDate/Martinez to defamation. No mention of Delfi.]

7. Copyright and temporary copies The pending NLA v PRCA reference to the CJEU should determine whether a user’s web browsing is an activity that requires the permission of the copyright owner. The UK Supreme Court thought not, but decided that the question required an EU-wide answer from the CJEU. [CJEU judgment issued 5 June 2014. Browsing permission not required.]

8. PRISM, TEMPORA, Snowden. Watch out for the legal challenges launched by various public interest groups following the Snowden revelations. These include two applications (by Liberty and Privacy International) to the Investigatory Powers Tribunal and a case taken (by Big Brother Watch, the Open Rights Group, English PEN and Dr Constanze Kurz) direct to the European Court of Human Rights. [In the latter the ECtHR requested the UK Government to provide written observations on admissibility and merits by 2 May 2014. The complaint has been stayed pending the outcome of the IPT cases (hearings July 2014). The IPT found that the challenged activities (PRISM intelligence sharing and the hypothetical use of RIPA S.8(4) warrants for TEMPORA were,
 in the light of disclosures of practices and policies made by the government during the proceedings, 'in accordance with the law' going forwards. The position prior to the disclosures would require further consideration. In a further judgment the IPT found that PRISM intelligence receipt prior to the disclosures made in the proceedings contravened Articles 8 and 10 ECHR. In the meantime the CJEU on 8 April 2014 invalidated the Data Retention Directive. As a result the UK government substantially relegislated the Data Retention Regulations 2009 in the Data Retention and Regulatory Powers Act (DRIPA). On 8 December 2014 MPs David Davis and Tom Watson (represented by Liberty) were granted permission to proceed with a judicial review of S.1 DRIPA, with the Open Rights Group and Privacy International intervening. The High Court disapplied S.1 on 17 July 2015, suspended until 31 March 2016. My mindmap of the UK interception legal landscape as at 7 October 2015:]





9. The saga of the Digital Economy Act 2010. The May 2013 Online Infringement of Copyright Roundtable minutes state that letters are not contemplated to start going out until ‘the latter half of 2015’. None of the necessary cost sharing statutory instruments has yet been laid before Parliament, a Treasury approval mechanism seems to be in play, and there is a General Election between now and then.  It could cost participating rightsowners collectively up to £10 million (to March 2015) in OFCOM cost sharing charges to take it forward. [Voluntary letters scheme 'Creative Content UK' announced 19 July 2014.]

See also: Cyberlaw Memes and Themes for 2014


Tuesday, 24 September 2013

Everyman learns about internet jurisdiction

Everyman has just read the questions referred to the EU Court of Justice in C-441/13 Pez Hejduk. [And has now added some Pinckney updates, following the CJEU decision on 3 October 2013.].

Everyman: I see the ECJ has been sent another internet jurisdiction case.

Scholarly Lawyer: Keep ’em coming.

E: Well on my count they’ve had 9 internet jurisdiction referrals in 6 years: Pinckney; Martinez/eDate Advertising; Wintersteiger; L’Oreal v eBay; Sportradar; Pammer/Hotel Alpenhof, Blomqvist, and now this one.  What’s going on?

SL: Lots of tricky stuff, in actual fact.  But let's get straight that they’re not all jurisdiction cases.  You have to understand four different things: territoriality, jurisdiction, applicable law and the Electronic Commerce Directive.

E: They are all about cross-border internet liability, yes?

SL: Yes.

E: So why four different labels?

SL: So first we have territoriality.  Between you and me, no-one understands this apart from IP lawyers.  But it’s important.  Take copyright. Each country’s copyright law applies only within its borders.   To infringe UK copyright, you have to do an act within the UK.  If you do the same thing in France, that would infringe French copyright.  Or maybe not:  UK and French copyright are not the same.  

E: But what’s the problem?  Surely it’s obvious where a copy is located.

SL: Yes, although copyright can apply to transient copies and on the internet those spring up everywhere.  But anyway copyright isn’t just about copying.  You can infringe copyright in a load of different ways. 

E: Can we keep this simple?

SL: So if you put an infringing copy on your UK website, that’s not just copying but also making available to the public – a separate type of copyright infringement. But your website can be read anywhere in the world.  Does that mean you are infringing by making available to the public only under UK copyright, or under the copyright laws of every country in the world, or maybe just some of them? They’ve been having fun at the ECJ with that question.

E: So, what’s the answer? 

SL: Basically, targeting.  For database right…

E: Weren’t we discussing copyright?

SL: Have patience.  For database right the ECJ said in Sportradar that, country of the server apart, making available to the public occurs in the countries to which you target your website.  They said much the same for use of a trade mark in L’Oreal v eBay. 

E: Dare I ask about copyright?

SL: For copyright, they said in Titus Donner that targeting applies to the distribution right (that’s a third way of infringing copyright).  Actually no one has asked them about making available and copyright yet, though your Mr Justice Arnold has held that targeting applies.    

E: So targeting applies to everything then?

SL: Not so fast.  You might think so, but that would be too simple.  Clearly it doesn’t apply to copyright infringement by copying, since that is down to where the copy is made.  Also, the ECJ can only opine on rights that are harmonised across Europe.  That cuts out a chunk of criminal law, not to mention personality rights such as privacy and defamation.

E: So those are down to national laws?

SL: Correct.  Your national courts decide whether the right is territorial under your national law; and if so they apply their own test for the location of the act.  For example your English defamation courts have gone off in a completely different direction from targeting. According to them (and the Australian and New Zealand courts), a defamatory statement on a website is published wherever in the world it can be read and comprehended.  That's a mere accessibility rule, and bad news for the internet.

E: OK, we’ve done substantive law.  Let’s move on to jurisdiction.

SL: Yes, let’s. I’m sure you know the basic rule under the Brussels I Regulation.  You have to sue an EU defendant in the Member State of its domicile.  But there are many exceptions, including the particularly slippery Article 5(3).  That says that for a tort claim you have the option of suing a defendant in the location of the harmful event.  In an early pollution case the ECJ said that that includes the place where the damage is suffered. 

E: That makes sense if you’ve got toxic chemicals flowing down the Rhine – it only brings a handful of extra countries into the frame.  But if you apply that doctrine to the internet, doesn’t the whole world come into play? And within the EU wouldn’t that completely undermine the basic rule?

SL: Article 5(3) causes a lot of trouble.  Because it’s an exception Article 5(3) can’t be allowed to undermine the basic rule.  But you’re right, it’s very easy to argue that on the internet the damage is suffered wherever the effects of the website are felt.  The ECJ is also supposed to provide a high level of protection to IP rights; which could mean allowing rightsholders to sue in any country in which the IP right is infringed.

E: That makes sense, doesn’t it?  Otherwise every court will be clogged up applying the IP laws of foreign countries.

SL: Up to a point, but at the jurisdiction stage it’s only an allegation of infringement.  If a plaintiff only has to make an unsupported allegation to get jurisdiction in the country in which it wants to bring proceedings, then the basic defendant's domicile jurisdiction rule disappears.

E: So should the national court consider the strength of the allegation before taking jurisdiction?  

SL: Good question.  But that’s for each national court’s procedure.  Some countries maintain a clear distinction between jurisdiction and the substantive right; and others, such as England, will look at whether there is a good arguable case of substantive infringement when they consider jurisdiction.  And that brings into play the territoriality of the substantive right.  It’s all very difficult.  [Pinckney update: The CJEU seems to be coming perilously close to saying that jurisdiction and the substantive right must be kept completely separate (para 41 and 42) - even though in Shevill the CJEU said that the standard by which to test jurisdiction is for the national court.  We may start to wonder if the English approach is consistent with EU law.  The UK government made no submissions in Pinckney.]

E: But if, say, a targeting test were part of Article 5(3), then territoriality wouldn’t feature so much.  And all the national courts could apply a uniform jurisdiction rule.

SL: Well spotted.

E: But the ECJ hasn’t said that yet, has it?  In fact its Article 5(3) decisions seem to be all over the place.  Not only do they set different tests for off line defamation (Shevill), online defamation and privacy (eDate/Martinez) and online trade marks (Wintersteiger), but none of them has adopted targeting. 

SL: Wait for Pinckney. [Pinckney update: Well, the CJEU seems very happy with the idea that the meaning of Article 5(3) can vary according to the substantive right (para 32)].

E: That’s the one where the Advocate General has said the ECJ should declare the reference inadmissible? [Pinckney update: The CJEU declared the reference admissible.]

SL: That aside, it’s a copyright case.  The AG has suggested that if the ECJ declares it admissible then Article 5(3) should be aligned more closely with territoriality.  So the AG says that for communication to the public in copyright, the place of damage should be subject to a targeting test. [Pinckney update: Oh dear.  The CJEU has gone in the opposite direction and said in terms (para 42) that Article 5(3) does not require targeting.  Mere accessibility appears to be sufficient (paras 44, 47, operative part).] 

E: That’s all very well, but what on earth does it mean to target a country?  Isn’t that a very uncertain test?

SL: Shazam!  I produce a decision they made earlier: Pammer/Hotel Alpenhof.  It was nothing to do with IP rights or even tort, but the ECJ explained exactly what it means to direct activities at a Member State.  And they have referred to it each time they introduce a new targeting test.  So every time they apply the targeting test in a new area you can look up Pammer/Hotel Alpenhof to find out what it means.

E: That’s quite enough of jurisdiction.  Where does applicable law fit into all this?  Surely if a territorial right is engaged, then it must follow that that territory’s law applies?

SL: Well you’re right – in fact you might think there is no room for a choice of law rule at all.  But not all claims are about territorial rights.  And anyway we have the Rome II Regulation (plus the Rome I Regulation for contractual claims), which lays down choice of law rules for all sorts of non-contractual claims, including some that are territorial. 

E: Don’t tell me that Rome II gives a different answer.

SL: Fortunately, no.  For infringement of IP rights the applicable law is that of the country for which protection is claimed.  When you think about it, that’s really territoriality in different words.

E: So it seems simple enough.  A court has to apply the Rome I or II rules and then, assuming it has jurisdiction, decide the case on the basis of the applicable substantive law.

SL: Not exactly.  Now we have to factor in the ElectronicCommerce Directive.

E:  We’ve done substantive law, we’ve done applicable law and we’ve done jurisdiction.  How can there be room for anything else?

SL:  There’s always room for the internal market rules of the European Union.  These embody the principle of free movement of goods and services which underpins the EU. 

E: Go on.

SL: The Electronic Commerce Directive applied the internal market rules to online services.  The Directive says that one Member State cannot restrict online services incoming from another Member State. 

E: Which it would do by applying its own national law?

SL: Yes, or any other law that the receiving Member State’s court has decided is applicable.  In eDate/Martinez the ECJ said that if the applicable law is stricter than that of the foreign Member State from which the online service is being provided, the court must disapply it.

E: My head’s spinning. You’re telling me that having gone through the whole procedure of establishing jurisdiction and determining that its country’s law is applicable, the court then has to disapply that law again if it is stricter than the law of the defendant’s own country?

SL: If the defendant’s country is in the EU or EEA, exactly so. Except, that is, for IP as it's one of the fields excluded in the Annex.  Fun, isn’t it?

 [Pinckney update added 3 October 2013. Blomqvist added, 6 October 2013.]