Tuesday, 24 September 2013

Everyman learns about internet jurisdiction

Everyman has just read the questions referred to the EU Court of Justice in C-441/13 Pez Hejduk. [And has now added some Pinckney updates, following the CJEU decision on 3 October 2013.].

Everyman: I see the ECJ has been sent another internet jurisdiction case.

Scholarly Lawyer: Keep ’em coming.

E: Well on my count they’ve had 9 internet jurisdiction referrals in 6 years: Pinckney; Martinez/eDate Advertising; Wintersteiger; L’Oreal v eBay; Sportradar; Pammer/Hotel Alpenhof, Blomqvist, and now this one.  What’s going on?

SL: Lots of tricky stuff, in actual fact.  But let's get straight that they’re not all jurisdiction cases.  You have to understand four different things: territoriality, jurisdiction, applicable law and the Electronic Commerce Directive.

E: They are all about cross-border internet liability, yes?

SL: Yes.

E: So why four different labels?

SL: So first we have territoriality.  Between you and me, no-one understands this apart from IP lawyers.  But it’s important.  Take copyright. Each country’s copyright law applies only within its borders.   To infringe UK copyright, you have to do an act within the UK.  If you do the same thing in France, that would infringe French copyright.  Or maybe not:  UK and French copyright are not the same.  

E: But what’s the problem?  Surely it’s obvious where a copy is located.

SL: Yes, although copyright can apply to transient copies and on the internet those spring up everywhere.  But anyway copyright isn’t just about copying.  You can infringe copyright in a load of different ways. 

E: Can we keep this simple?

SL: So if you put an infringing copy on your UK website, that’s not just copying but also making available to the public – a separate type of copyright infringement. But your website can be read anywhere in the world.  Does that mean you are infringing by making available to the public only under UK copyright, or under the copyright laws of every country in the world, or maybe just some of them? They’ve been having fun at the ECJ with that question.

E: So, what’s the answer? 

SL: Basically, targeting.  For database right…

E: Weren’t we discussing copyright?

SL: Have patience.  For database right the ECJ said in Sportradar that, country of the server apart, making available to the public occurs in the countries to which you target your website.  They said much the same for use of a trade mark in L’Oreal v eBay. 

E: Dare I ask about copyright?

SL: For copyright, they said in Titus Donner that targeting applies to the distribution right (that’s a third way of infringing copyright).  Actually no one has asked them about making available and copyright yet, though your Mr Justice Arnold has held that targeting applies.    

E: So targeting applies to everything then?

SL: Not so fast.  You might think so, but that would be too simple.  Clearly it doesn’t apply to copyright infringement by copying, since that is down to where the copy is made.  Also, the ECJ can only opine on rights that are harmonised across Europe.  That cuts out a chunk of criminal law, not to mention personality rights such as privacy and defamation.

E: So those are down to national laws?

SL: Correct.  Your national courts decide whether the right is territorial under your national law; and if so they apply their own test for the location of the act.  For example your English defamation courts have gone off in a completely different direction from targeting. According to them (and the Australian and New Zealand courts), a defamatory statement on a website is published wherever in the world it can be read and comprehended.  That's a mere accessibility rule, and bad news for the internet.

E: OK, we’ve done substantive law.  Let’s move on to jurisdiction.

SL: Yes, let’s. I’m sure you know the basic rule under the Brussels I Regulation.  You have to sue an EU defendant in the Member State of its domicile.  But there are many exceptions, including the particularly slippery Article 5(3).  That says that for a tort claim you have the option of suing a defendant in the location of the harmful event.  In an early pollution case the ECJ said that that includes the place where the damage is suffered. 

E: That makes sense if you’ve got toxic chemicals flowing down the Rhine – it only brings a handful of extra countries into the frame.  But if you apply that doctrine to the internet, doesn’t the whole world come into play? And within the EU wouldn’t that completely undermine the basic rule?

SL: Article 5(3) causes a lot of trouble.  Because it’s an exception Article 5(3) can’t be allowed to undermine the basic rule.  But you’re right, it’s very easy to argue that on the internet the damage is suffered wherever the effects of the website are felt.  The ECJ is also supposed to provide a high level of protection to IP rights; which could mean allowing rightsholders to sue in any country in which the IP right is infringed.

E: That makes sense, doesn’t it?  Otherwise every court will be clogged up applying the IP laws of foreign countries.

SL: Up to a point, but at the jurisdiction stage it’s only an allegation of infringement.  If a plaintiff only has to make an unsupported allegation to get jurisdiction in the country in which it wants to bring proceedings, then the basic defendant's domicile jurisdiction rule disappears.

E: So should the national court consider the strength of the allegation before taking jurisdiction?  

SL: Good question.  But that’s for each national court’s procedure.  Some countries maintain a clear distinction between jurisdiction and the substantive right; and others, such as England, will look at whether there is a good arguable case of substantive infringement when they consider jurisdiction.  And that brings into play the territoriality of the substantive right.  It’s all very difficult.  [Pinckney update: The CJEU seems to be coming perilously close to saying that jurisdiction and the substantive right must be kept completely separate (para 41 and 42) - even though in Shevill the CJEU said that the standard by which to test jurisdiction is for the national court.  We may start to wonder if the English approach is consistent with EU law.  The UK government made no submissions in Pinckney.]

E: But if, say, a targeting test were part of Article 5(3), then territoriality wouldn’t feature so much.  And all the national courts could apply a uniform jurisdiction rule.

SL: Well spotted.

E: But the ECJ hasn’t said that yet, has it?  In fact its Article 5(3) decisions seem to be all over the place.  Not only do they set different tests for off line defamation (Shevill), online defamation and privacy (eDate/Martinez) and online trade marks (Wintersteiger), but none of them has adopted targeting. 

SL: Wait for Pinckney. [Pinckney update: Well, the CJEU seems very happy with the idea that the meaning of Article 5(3) can vary according to the substantive right (para 32)].

E: That’s the one where the Advocate General has said the ECJ should declare the reference inadmissible? [Pinckney update: The CJEU declared the reference admissible.]

SL: That aside, it’s a copyright case.  The AG has suggested that if the ECJ declares it admissible then Article 5(3) should be aligned more closely with territoriality.  So the AG says that for communication to the public in copyright, the place of damage should be subject to a targeting test. [Pinckney update: Oh dear.  The CJEU has gone in the opposite direction and said in terms (para 42) that Article 5(3) does not require targeting.  Mere accessibility appears to be sufficient (paras 44, 47, operative part).] 

E: That’s all very well, but what on earth does it mean to target a country?  Isn’t that a very uncertain test?

SL: Shazam!  I produce a decision they made earlier: Pammer/Hotel Alpenhof.  It was nothing to do with IP rights or even tort, but the ECJ explained exactly what it means to direct activities at a Member State.  And they have referred to it each time they introduce a new targeting test.  So every time they apply the targeting test in a new area you can look up Pammer/Hotel Alpenhof to find out what it means.

E: That’s quite enough of jurisdiction.  Where does applicable law fit into all this?  Surely if a territorial right is engaged, then it must follow that that territory’s law applies?

SL: Well you’re right – in fact you might think there is no room for a choice of law rule at all.  But not all claims are about territorial rights.  And anyway we have the Rome II Regulation (plus the Rome I Regulation for contractual claims), which lays down choice of law rules for all sorts of non-contractual claims, including some that are territorial. 

E: Don’t tell me that Rome II gives a different answer.

SL: Fortunately, no.  For infringement of IP rights the applicable law is that of the country for which protection is claimed.  When you think about it, that’s really territoriality in different words.

E: So it seems simple enough.  A court has to apply the Rome I or II rules and then, assuming it has jurisdiction, decide the case on the basis of the applicable substantive law.

SL: Not exactly.  Now we have to factor in the ElectronicCommerce Directive.

E:  We’ve done substantive law, we’ve done applicable law and we’ve done jurisdiction.  How can there be room for anything else?

SL:  There’s always room for the internal market rules of the European Union.  These embody the principle of free movement of goods and services which underpins the EU. 

E: Go on.

SL: The Electronic Commerce Directive applied the internal market rules to online services.  The Directive says that one Member State cannot restrict online services incoming from another Member State. 

E: Which it would do by applying its own national law?

SL: Yes, or any other law that the receiving Member State’s court has decided is applicable.  In eDate/Martinez the ECJ said that if the applicable law is stricter than that of the foreign Member State from which the online service is being provided, the court must disapply it.

E: My head’s spinning. You’re telling me that having gone through the whole procedure of establishing jurisdiction and determining that its country’s law is applicable, the court then has to disapply that law again if it is stricter than the law of the defendant’s own country?

SL: If the defendant’s country is in the EU or EEA, exactly so. Except, that is, for IP as it's one of the fields excluded in the Annex.  Fun, isn’t it?

 [Pinckney update added 3 October 2013. Blomqvist added, 6 October 2013.]

Friday, 23 August 2013

Anonymous posters and the new Defamation Act – the draft regulations

Section 5 of the Defamation Act 2013 provides (or will do when the Act comes into force) a complete defence from a defamation claim for a website operator who can show that it did not post the statement on the website.  This is a significant new protection for website operators.

However the defence is significantly watered down for anonymous posts.  It is defeated if the claimant can show:
1. That it was not possible for the claimant to identify the person who posted the statement
2. The claimant gave the website operator a notice of complaint containing various specified information; and
3. The website operator failed to respond to the notice of complaint in accordance with regulations to be made under secondary legislation.
A recurrent complaint during the passage of the Bill through Parliament was that Parliamentarians were unable to assess properly the Section 5 defence because the regulations were not available in draft for Parliament to consider.

In June 2012 the government circulated a note to the Commons Bill Committee indicating its then thinking about the regulations.  Since then two rounds of consultation on draft regulations and guidance documents have taken place with a limited group of stakeholders.  (Hat-tip to INFORRM and Ashley Hurst, who have documented both phases of the consultation.) 
Since the government will at some point lay draft regulations before Parliament, this is a good point at which to review the currently circulating draft regulations (which may yet change) and take a stab at predicting their practical consequences. 

Preliminary

The effect of Section 5 for an anonymous post is that the website operator may still have a complete defence under Section 5, but only if it successfully negotiates the procedural hoops set out in the regulations.  The end point in some scenarios will require the website operator to remove the posting if it is to be able to rely on the defence. 

Although the regulations are littered with references to what a website operator ‘must’ do, they do not in fact oblige a website operator to do anything.  They only set out the conditions that a website operator has to satisfy in order to be able to make use of the Section 5 defence for an anonymous post.    

The Section 5 defence is additional to existing defences under S1 Defamation Act 1996 and the ECommerce Directive.  They are unaffected by the new Act and regulations.

Defamatory or unlawful?

The draft regulations are a mixed bag.  On the good side, the government has kept to its promise in Parliamentary debates on the Bill that complainants would have to do more in their notice of complaint than merely assert that the posted statement was defamatory.  The complainant will have to set out the meaning which the complainant attributes to the statement and also set out the aspects of the statement which the complainant believes are factually inaccurate or opinions not supported by fact.

This goes some way to meeting the recommendation of the Parliamentary Joint Committee on Human Rights that the threshold for a complaint under Section 5 should, as under the ECommerce Directive hosting defence, be unlawfulness. 

This issue reflects the fact that a statement may be defamatory without being unlawful.  A statement is defamatory if it is damaging to someone’s reputation.  However if any one of numerous defences, such as truth, honest opinion, publication on matters of public interest and many others, is established, the statement is lawful. 

So a complaint that something is defamatory only addresses half the story and may encourage the taking down of lawful statements, with consequent chilling effects.  Requiring a complainant to consider possible defences of truth and honest opinion goes some way to ameliorating this.

Action by the poster – a black hole in the regulations
On the debit side the regulations are, perhaps inevitably, a veritable maze of different scenarios requiring different responses from the website operator.  The draft guidance note identifies no less than five different situations that can arise depending on the anonymous poster’s response (or lack of response) to a complaint forwarded by the website operator. 
However other scenarios are possible, which the regulations do not address.  Like a poorly designed IT system, the regulations tend to assume conforming behaviour by all the participants and make insufficient provision for exception handling, especially non-conformant behaviour by the poster whose statement is complained about.  In particular the regulations assume that any removal of the offending statement will be done by the website operator, not by the anonymous poster. 
One illustration is in the draft FAQ for website operators: “What should I do if I receive a Notice of Complaint and the posting has already been removed?”  The given answer is “It is unlikely that a complainant will send a Notice of Complaint in a situation where the posting has already been removed.  If such a situation does arise it will be necessary to follow the process in order to benefit from the section 5 defence.” 

Yet the first step in the prescribed process involves the operator notifying the poster that the statement complained of may be removed from the locations on the website specified in the notice of complaint.  Since in this scenario the statement has already been removed, the notification is meaningless.  Later steps in the process may require the operator to remove the statement from those locations – in this scenario, impossible to comply with. 
In a similar vein, there is a gap in the scenarios contemplated by the regulations for the response by the poster to the complaint notice forwarded by the website operator.  The five possibilities listed in the guidance notes are:

-         Poster fails to reply to website operator within the time limit

-         Poster replies within the time limit indicating that he or she wishes the statement complained of to be removed

-         Poster replies within the time limit but fails to provide the required information

-         Poster replies within the time limit indicating that he or she does not wish the statement complained of to be removed, and consenting to the operator sending his or her contact details to the complainant

-         Poster replies within the time limit indicating that he or she does not wish the statement complained of to be removed, provides contact details to the operator but refuses to consent to the operator sending them to the complainant
A sixth, and perhaps most realistic, response from a poster concerned about the complaint is for the poster to take the initiative on receiving notification from the website operator and remove the offending post (as happened in Tamiz v Google) or edit it.   Again the regulations make no provision for this.  As with the FAQ example above, for scenarios that culminate with an obligation on the operator to remove the statement, where the poster has already taken action that requirement would be impossible to comply with and the operator would apparently forfeit the Section 5 defence.  That is surely an absurd result.

Time limits and time zones
Some critical steps depend on the website operator having received a response from a poster ‘by midnight at the end of the date specified in the notification [from the website operator to the poster]’.  Since neither the website operator nor the poster, nor indeed the complainant, are necessarily based in the UK and may well be in other time zones, there is significant potential for confusion over time limits. 

The draft regulations make some concession to the rigidity of time limits in that the court is permitted in its discretion to treat action taken by the website operator as having been taken before expiry of the time limit.  However there appears to be no flexibility in relation to the 5 day time limit for the poster’s response.  The FAQ for posters makes this point starkly:

“Q. What happens if I’m on holiday and don’t realise the Notice of Complaint has been sent to me?

A.     The time period given for a response will still apply, and if you do not respond within that period the operator may remove the posting which has been complained about.”

Withholding complainant identity
The complainant is given the option not to consent to the website operator passing on the complainant’s name and contact details to the anonymous poster. 

While one can understand the rationale for allowing contact details to be withheld, to permit the complainant’s name to be withheld is very odd.  These regulations are about defamation, which concerns damage to someone’s reputation.  If the statement does not refer to an identifiable person, it is not defamatory.  So either it will be obvious from the statement complained of who has been putatively defamed (in which case it would be pointless for the complainant’s name to be withheld) or, if it is not obvious, then the poster will need to know who is complaining in order to assess whether the statement is defamatory. 

For litigation the Defamation Pre-Action Protocol requires a letter of claim to include (a) the name of the claimant and (b) where relevant, any facts or matters which make the claimant identifiable from the words complained of.

Predictions
Predictions about the practical effect of the anonymous posting aspects of Section 5 are not easy to make. 

Because of the enormous difference between protection for website operators (and only for website operators) in respect of anonymous and non-anonymous posts, there will be intense focus in future litigation on (a) what is and is not a website operator and (b) whether the post was anonymous – i.e. whether it was possible for the claimant to identify the person who posted the statement (defined in Section 5 as “only if the claimant has sufficient information to bring proceedings against the person”). 
The procedure under the draft regulations is so bureaucratic – not easily recognisable as the “quick, clear and practical” process promised in Commons Committee in June 2012 - that it is possible that website operators will ignore it and rely on other available defences.  Even then, however, Section 5 may have a side effect.  A valid complainant’s notice is much more likely than an informal defamation complaint to fix a hosting intermediary with knowledge of unlawfulness for the purpose of the ECommerce Directive defence.  So even if the Section 5 procedure is ignored, a website operator may have more incentive than previously to take a down an anonymous post on receipt of a valid Section 5 notice.

The new intermediary defence under Section 10 will also be significant, whereby a court does not have jurisdiction to hear and determine an action for defamation brought against a person who was not the author, editor or publisher of the statement complained of unless the court is satisfied that it is not reasonably practicable for an action to be brought against the author, editor or publisher.

Many intermediaries will not be an author, editor or publisher (under the special definitions in section 1 of the Defamation Act 1996).  For a website operator in relation to an anonymous post, there may be a question whether the claimant should have to attempt a Norwich Pharmacal application to determine identity in order to escape the prohibition in this section.  It is interesting to speculate on whether a website operator’s decision not to respond to a notice under Clause 5 would be held against it in the court’s evaluation of reasonable practicability.


Tuesday, 20 August 2013

Everyman encounters Government

A dialogue for our times.

Government: We know what’s best for you.
Everyman: I think I’m the best judge of that.

G: Ah, but we know things that you don’t.

E: What things?

G: Can’t tell you, they are secret.

E: So how can I tell whether you are right?

G: You need to trust us on that.

E: Why should I trust you?

G: Because we are fighting your enemies.

E: Who are my enemies?

G: Can’t tell you, you might warn them.

E:  You don’t trust me?

G: No-one is above suspicion.

E: Am I a suspect?

G: We never comment on operational matters. But if you have nothing to hide, you have nothing to fear.

E: What do you know about me?

G: We never comment on intelligence matters.

E: Can you be trusted?

G: We always act proportionately and in accordance with the law.

E: Show me.

G: Don’t be silly, that’s secret.

E: How do I know you don’t think I’m your enemy?

G: You don’t.  But if you carry on asking questions we might put you on a list.

E: On what grounds?

G: That would be telling. 

E: When would you do it?

G: If it was necessary in the interests of national security.

E: Is that legal?

G: We always act proportionately and in accordance with the law.

E: How can I be sure of that?

G: Trust us.  We know best.

Tuesday, 16 July 2013

Shifting formats - the IPO’s draft private copying exception

[Originally published 16 July 2013, based on the draft circulated for technical review.  Updated 14 April 2014 to take account of the amendments contained in the draft Personal Copies for Private Use Regulations laid before Parliament on 27 March 2014.]

The draft private copying exception (PDF) released for consultation on 7 June 2013 is one of the UK Intellectual Property Office’s flagship copyright reforms following the Hargreaves Review.  In his final report (PDF) in May 2011 Professor Ian Hargreaves focused on the lack of a format-shifting exception as particularly threatening to the legitimacy of copyright.  He identified:

“a growing mismatch between what is allowed under copyright exceptions, and the reasonable expectations and behaviour of most people. Digital technology has enabled use and reuse of material by private individuals in ways that they do not feel are wrong – such as sharing music tracks with immediate family members, or transferring a track from a CD to play in the car. It is difficult for anyone to understand why it is legal to lend a friend a book, but not a digital music file. The picture is confused by the way some online content is now sold with permissions to format shift (iTunes tracks) or to “lend” files (Amazon ebooks) at no extra cost.  This puts the law into confusion and disrepute. It is not a tenable state of affairs.”
If respect for copyright is to be restored, the proposed new private copying exception has to shoulder much of the work. 

It has to succeed on several fronts.  The audience for many aspects of copyright is copyright professionals.  However, since the private copying exception will determine what everyday users of PCs, laptops, tablets and mobile devices can and cannot do with music and movies that they purchase, its audience is the general public.

As such the exception needs to be clear, certain and sensible.  For clarity, it should not require special expertise in copyright law to understand the exception and its practical implications.  For certainty, there should be as few as possible areas of doubt about what is and is not permitted.  As to being sensible, there should be a minimum of arbitrary distinctions.  Not only should the user be able readily to understand which particular activities fall on one or other side of the line, but the reasons why the line is drawn where it is should be coherent and readily apparent.  In general terms the boundaries should accord with the reasonable expectations of users, albeit it must be conceded that there are legitimate areas of disagreement as to where the boundaries should lie.

If the exception does not pass these tests, not only will an opportunity to set copyright back on the road to legitimacy have been lost, but further damage to copyright will be done as another specimen of obscurity, arbitrariness and remoteness from reality is added to the list.  In an age when policymakers demand that users should be exhorted to respect copyright, it behoves our legislators to write laws that those users can readily understand and which, when they have understood them, make sense.

This article evaluates the published draft of the exception [now the draft Statutory Instrument laid before Parliament] with those criteria in mind.  We invoke a hypothetical user, Bruce, and try to decide which of his everyday format-shifting activities would or would not be permitted by the proposed new S28B of the 1988 Copyright Designs and Patents Act. 
For the most part the article avoids hotly contested issues about how broad or narrow the exception should be, whether its implementation without a corresponding copyright levy is or is not compliant with the EU Copyright Directive, and whether the whole thing is undermined anyway by the prohibition on circumvention of technical measures. 
The reader can make up his or her own mind whether the draft exception passes the tests of clarity, certainty and sensible boundaries.  To the extent that it may not, we should spare a modicum of sympathy for the Intellectual Property Office since some uncertainty is the inevitable result of lack of certainty in the EU Copyright Directive, which constrains the UK government's freedom of action. 
What follows is the tentative result of wrestling with the short but not entirely simple text of 28B.  Others may well have different views on how 28B is meant to apply.  It would certainly be welcome to discover that I have overcomplicated the thing and that it really doesn’t take the 4,000 words of this piece to analyse it.  But I am not optimistic.
In any event at present 28B is draft legislation, open to consultation until 17 July 2013.  The draft will quite likely be amended before anything is put before Parliament.  [Indeed the SI laid before Parliament is quite significantly amended.]

Preliminary
28B divides logically into two steps.  The first step is to identify whether Bruce has suitable source material at hand.  28B defines this as a copy of a copyright work lawfully acquired by Bruce and which he holds on a permanent basis (for example it is not a copy that is rented to the individual for a specified period or borrowed from a library).  [Eligible source material is now to be called an "individual's own copy". That is a copy which Bruce has lawfully acquired on a permanent basis, is not an infringing copy and has not itself been made under a copyright exception. Lawfully acquired on a permanent basis specifically includes a purchase, a gift, or a download resulting from a purchase or a gift (other than a download enabling no more than temporary access to the copy); but does not include a borrowed, rented, broadcast or streamed copy. None of this will now apply to computer programs, which are excluded entirely from 28B.]

The second step is to consider what use Bruce can make of that source material.  In general terms he can use the source material to make a further cop[ies]y of the work provided that the further cop[ies]y [are]is made for Bruce’s private use for ends that are neither directly nor indirectly commercial. Bruce cannot transfer the further cop[ies]y to another person[, other than on a private and temporary basis]; and if he transfers the source material to another person [(other than on a private and temporary basis)] without destroying the further cop[ies]y, that is an infringement. [A further copy made under 28B is now to be called a "personal copy"]
That may sound fairly simple.  However subtle complications arise when we try to apply it to the multiplicity of real world scenarios, including some specifically mentioned by the Hargreaves Report.

For the sake of relative simplicity we have not addressed the effect (if any) of contractual prohibitions, and have ignored the effect of any TPM restriction. [28B will render a contract term unenforceable to the extent that it purports to prevent or restrict the making of a copy which would under 28B would not infringe copyright. TPMs will remain effective.] 
Source material
First, consider the source material that Bruce must have in order to be able to use 28B.  Would source material that Bruce acquired in any of the following ways qualify?

[Remember that none of this applies to computer programs and the source material cannot itself have been made under an exception from copyright.]

(a)  Bruce purchased a genuine CD
Definitely OK.  28B can be used where the individual has ‘acquired’ a copy lawfully on a permanent basis.  Purchasing a genuine CD is the paradigm case.  28B could also be used if Bruce had received the genuine CD as a gift, either new or second-hand, or had bought it second hand. But Bruce could not use 28B if he had rented the CD or borrowed it from a library, from his sister or from a friend. [But not computer programs. Computer programs have their own regime of copyright exceptions under the EU Software Directive. See sections 50A to 50C of the 1988 Copyright Act.]  

(b)  Bruce purchased an infringing CD
Copyright is infringed by the person who made the infringing CD; and also by the person who sold it if he knew or has reason to believe it was infringing.  Bruce did not infringe copyright by merely purchasing it.  So from Bruce’s perspective as a matter of copyright law he may have acquired it lawfully, even though it was an infringing copy.  This might suggest that he can use it as source material for making a 28B copy.

Contrary to that, in its December 2012 response to consultation the government said that the exception would be limited to use by people who already own a lawful copy of a work; and that the exception would permit copying only by a lawful owner of an original copy.
But differently again, in its recommendation in the same document the government said the exception would allow a lawful owner or buyer of a copy of a work to reproduce that copy for their personal use. 

Lawfully acquiring a copy and lawfully acquiring a lawful copy differ significantly from each other.  It is not obvious from the consultation history which the government intends. [Now clarified.  28B now makes clear that the source material cannot be an infringing copy.] 
As to the merits of each approach, on the one hand why should someone be able to make use of 28B to make another copy of something which already infringes?  On the other hand, why should the consumer be at risk of infringement simply because the original copy turns out to be infringing?  The consumer is poorly placed to know with any certainty whether what s/he has purchased is genuine or infringing.  That is especially the case with secondhand CDs, but can also apply to apparently genuine original CDs.  (It can happen that a well known label sold through reputable retailers turns out to be unlicensed.)  Would it be fair to the consumer that his or her ability to use the exception depends on something that will often be out of her knowledge and control? Should the exception be inapplicable only where it was obvious to the consumer that s/he was acquiring an infringing item? [It will make no difference if Bruce has no means of knowing that the source material is an infringing copy.]

It is also unclear whether private copying from an infringing source copy is permitted under the EU Copyright Directive, with which this exception must comply.  Whether the private copy exception under the Directive can apply to unlawful source copies is the subject of a currently pending reference to the EU Court of Justice, in ACI Adam and Others Case C-435/12.  [Decided 10 April 2014.]
(c)  Bruce borrowed a copied CD from a friend
No.  A borrowed CD, whether copied or genuine, is not held permanently.  The exception could be used to make a private use copy only from a copy held on a permanent basis.  [No change.]

(d)  Bruce received a copied CD as a gift
If the copy for some reason does not infringe, then OK.  Bruce holds it on a permanent basis.  If it does infringe, then the position is the same as scenario (b): unclear. [Now clarified. As in (b), an infringing copy cannot be used as source material for 28B.]

(e)  Bruce purchased a permanent legitimate copy of a song by download over the internet. 
OK, or at least so the government appears to intend.   It mentioned eBooks in the December 2012 impact assessment.  In the Dec 2012 consultation paper it said “This would include downloaded digital content that has been purchased to keep (or licensed in an analogous way) such as eBooks” (Consultation note 41).

However the actual wording of the exception may not be quite so clear.  Unlike acquiring a CD, downloading involves making a new copy.  Does ‘acquiring’ include making a new copy? Since the government apparently intends that it should, it would be as well to put this beyond doubt.
In any event the exception does not apply to rented or streamed materials. [Now clarified.  Bruce will be able to use a copy acquired by means of a non-infringing download resulting from a purchase or a gift (other than a download enabling no more than temporary access to the copy). Bruce will not be able to use borrowed, rented, broadcast or streamed source materials.]

Use scenarios
Let us assume that Bruce is equipped with a permanent copy that he can use as source material under S28B.  We will assume that it is a genuine purchased CD (not unlawfully copied, not an unlawful parallel import from outside the EEA).  Would any of the following acts be permitted under S28B?

(a)  Bruce copies the CD to the hard drive of his PC. 
OK, so long as he makes the copy for his private use for ends that are neither directly nor indirectly commercial.  However, whether he has made the copy for his private use turns out to be quite a tricky question.  Some uses involve further copies being generated.  Others do not (or at least only transient copies).  How does 28B apply to each situation? 

28B legitimises only a copy made for Bruce’s own private use.  So the key question appears to be what was Bruce’s purpose when he made the copy?  That appears to depend at least in part on what was in his head at the time he made the copy (there may be room for arguments about whether the test is subjective, objective or hybrid – we will assume that Bruce’s intention has some relevance).  However surrounding circumstances would offer some pretty big clues to the purpose.  [28B now fleshes out the concept of private use with some examples. It includes private use facilitated by:

- making a copy as a back-up copy
- making a copy for the purposes of format-shifting
- making a copy for the purposes of storage (including in an electronic storage area accessed by means of the internet or similar means which is accessible only by the individual (and the person responsible for the storage area).]

Here are some sub-scenarios:
(i)   Bruce copied the CD into a folder accessible only to himself.

OK. That would be consistent with Bruce’s professed private use purpose.
(ii)  Bruce copied the CD into a public P2P sharing folder on his hard drive.

Probably not OK.  Since it is accessible by members of the public Bruce would have an uphill task convincing anyone that the copy was made for his private use. 

(iii)  Bruce copied the CD into a folder accessible to a small circle of others (such as family members) on his home network. 

If Bruce did this with so as to enable others on his home network to make their own permanent copies, that is beyond Bruce’s own private use and would not be legitimised by 28B.  [No change. Although Bruce will be able to 'daisy-chain' (see below) only he will be able to make further personal copies.]

If Bruce did it so as to enable others on his home network independently to play and listen to the tracks in the folder, that is probably not legitimised by 28B, since their playing and listening to the tracks would be private use by them, but not by Bruce.

If Bruce did it with the intention only of listening to the tracks himself, that might be OK since that is Bruce's own private use.  However Bruce could be challenged as to why, if that was his intention, he put the tracks in a folder accessible to others.

Establishing Bruce’s true intention could be very difficult.  It might depend at least partly on his technical sophistication, such as whether he knew that others could access the folder to which he copied the CD.  That might be especially the case if some other member of the family set up the network and configured his computer. 

(iv)  Bruce copied the CD into a folder accessible only to himself, but with the intention of playing the tracks from the folder through his home loudspeakers via a streaming device.

Unclear.  If Bruce intended to listen through personal headphones that would clearly be his private use.  Playing the tracks through his home loudspeakers means that other domestic and family members can listen to the music that Bruce is playing.  Is this also Bruce’s private use? 

The concept of private use as understood in EU law is wide enough to cover domestic and family use.  Is that what 28B means?  If so does the fact that the playing is under Bruce’s control mean that it counts as Bruce’s private use, as required by 28B?  28B itself offers no illumination, other than that using the word 'private' rather than 'personal' use may suggest that this is OK. (Confusingly however, the IPO uses the term 'personal use' in its commentary on the draft exception).

If it is not OK, then the reasonable user could well regard the results as arbitrary.  It would be permissible to buy a CD and play it to friends and family on a music system at home; but not permissible to copy the CD to a computer or an MP3 player and play that copy to the same audience through the same music system.  [No change. None of the supporting documents or the Impact Assessment shed definitive light on this scenario, although the tenor of the rejected Impact Assessment Option 2 may suggest that the answer is 'Not OK'.]

(b)  Bruce copies the copy that he made in scenario (a) from his hard drive to his portable device (e.g. MP3 player, mobile phone or USB stick)
This 'daisy-chaining' is a very common scenario.  The Gowers Report back in 2006 recognised the importance of daisy-chaining for format shifting: "The exception would only allow one copy per ‘format’, but it would also have to recognise that transfer between formats may require intermediate steps (or formats) to be taken." (para 4.76)

If the copy made from the CD to the hard drive in scenario (a) was legitimised by 28B, this further copy made from it is probably also legitimate if made for Bruce’s private use.  But 28B does not spell this out beyond question. 
Since we are assuming that Bruce legitimately made the copy on his hard drive under 28B, he has lawfully acquired that copy (if we are right that lawfully acquiring includes lawfully making a new copy).  Under 28B he is entitled to keep the hard drive copy permanently unless and until he transfers the original CD to another person.
On that basis Bruce can probably ‘daisy chain’ 28B to make successive copies from the CD to his hard drive and then from his hard drive to his portable device, so long as both copies are for his own private use.  He could presumably keep both copies and continue to sync between them.

Assuming this to be the government's intention, it would be better if 28B made completely clear that daisy chaining is permitted.  [Clarified.  Bruce can make a personal copy under 28B from an existing personal copy that Bruce (but no-one else) has already made under 28B.] 

If Bruce intends to use the portable device to play the tracks in the presence of others in his private sphere, such as in his car (the example given by Hargreaves), then the same uncertainties about private use arise as with the hard drive copy. [No change.]

(c)   Bruce copies the copy that he made in scenario (a) from his hard drive to his private cloud storage area
OK, if daisy-chaining is permissible.  28B places no restriction on the place in which the 28B copy is stored – only that it be made for his private use for ends that are neither directly nor indirectly commercial.  On the face of it that would include a private cloud account.  Since storing the copy in that account involves making a new copy, the ability to daisy-chain is important in order to bring the cloud copy within 28B.  [Daisy-chaining will be OK. See above.]

Cloud storage is specifically addressed in 28B(3).  The drafters appear to have been concerned that storing in the cloud could amount to a transfer of a copy to another person, and thus trigger the infringement provisions of 28B(2).  They have therefore provided that nothing in 28B(2) prevents an individual from storing a further copy made under 28B in an electronic storage facility accessed by means of the internet or similar means, where that facility is provided for his sole private use. 
While specific provision for cloud storage is probably necessary from the point of view of clarity, this sub-section is problematic.   First ‘storing a further copy made pursuant to [28B]’ is an odd phrase in his context, since the act of storing a copy in the cloud necessarily entails the making of an additional copy. Is the section referring to that further copy, to a pre-existing further copy (e.g. made by copying from CD to computer hard drive) or to both? 

The uncertainty is compounded by the reference to 28B(2), since that deals with transferring “the copy”.  That most obviously means the transfer of a pre-existing copy – such as when Bruce gives a USB stick containing a copy to his sister.  On that understanding storage in the cloud would not be a transfer of ‘the copy’ at all, since it involves the making of a new copy in the cloud.  Yet 28B(3) seems to suggest that this process could be understood as a transfer of "the copy". 
If “transfers the copy” is indeed broad enough to include a transfer process that creates an additional copy, that introduces further complications into the operation of 28B(2), since more copies will come into existence than 28B(2) appears to contemplate. [Re-drafted and clarified.  Bruce's copy on his hard drive made from his CD is a personal copy under 28B.  He can make a further personal copy from that and store it in his private cloud storage.  However this only applies if the storage area is accessible only by Bruce and the person responsible for the storage area. Shared storage areas will not count.]

(d)  Bruce copies the copy that he made in scenario (a) from his hard drive to his sister’s portable device for her.
No.  The second act of copying (from hard drive to his sister’s device) would not be for his own private use.  [No change.]

(e)  Bruce copies to his own MP3 player with the intention of lending the MP3 player to his sister.
No, at least if Bruce’s purpose in doing this was that his sister should be able to listen to the tracks.  The copy was not made for Bruce’s private use, but that of his sister.  The same would apply if Bruce copied to a USB stick with the intention of lending it to her.  [No change.]

(f)    Bruce, having copied to his own MP3 player for his own private use, later decides to lend the MP3 player to his sister.
Probably OK?  Since the later decision to lend the MP3 player was not Bruce’s original purpose, that does not prevent the copy being originally legitimate under 28B.  There is nothing in 28B to suggest that it becomes illegitimate if Bruce's intention changes later.  As Bruce is only loaning the MP3 player, it is not caught by the prohibition on transferring (otherwise than on a private and temporary basis) the 28B copy to another person.  The same would apply to a USB stick. [No change.] 

It would be a separate question whether, when the sister listens to the tracks stored on the borrowed device, she infringes copyright.  Probably not (so long as she does so in private circles), but that may be affected by the outcome of a currently pending reference to the CJEU in the Meltwater litigation. 

(g)  Bruce, having copied a CD to a USB stick for his private use, then gives the USB stick to his sister.
No.  Although the USB stick copy was made legitimately under 28B, under 28B2(a) Bruce infringes copyright if he transfers that copy to another person otherwise than on a private and temporary basis.  That previously legitimate 28B copy becomes an infringing copy.

(h)  Bruce, without making any copy of it, gives a genuine purchased CD to his sister.
OK.  Under general copyright law Bruce is entitled to transfer to someone else a physical copy that was previously put into circulation in the EEA by or with the consent of the rightsholder (the principle of ‘exhaustion of rights’). [No change.]

(i)    Bruce, having copied a genuine purchased CD onto a USB stick for his brother, then gives the CD to his sister.
Copying the CD is outside 28B as it is for Bruce’s brother.  That copy therefore infringes.  Bruce can give the genuine CD to his sister since exhaustion of rights still applies to the CD. [No change.]

(j)    Bruce, having copied a genuine purchased CD onto a USB stick for his private use, then gives the CD to his sister.
OK, but only if Bruce first destroys the copy on the USB stick.  If not, he infringes copyright by transferring the CD to another person.  However it is the copy on the USB stick, not the CD, which is then regarded as an infringing copy.  Thus the same result is achieved as if a copy was made outside 28B. [No change.]

(k)  Bruce purchases a copy by download to his MP3 player, then lends the MP3 player to his sister.
OK.  28B does not come into play since no 'further copy' is made.  Private loan is unlikely to be an act restricted by copyright and, since the device itself is lent, no new copy is made.  See (f) above as to whether Bruce's sister would infringe when listening to the tracks.  [No change.]

The same would apply to a copy downloaded to any other device, including a storage device such as a USB stick.

(l)    Bruce purchases a copy by download to a USB stick, then sells the USB stick containing the original copy by online auction.
No, at least for the moment.  28B does not come into play since no 'further copy' is made.  Selling the USB stick infringes the copyright owner’s exclusive distribution right.  At present exhaustion of the distribution right applies only to physical copies (such as CDs) put into circulation by or with the consent of the rightsowner, not to a download made by a customer.  However it is possible that this may change in the future, should the CJEU expand its finding in UsedSoft so as to apply to non-computer programs.  This is a highly controversial issue. [No change.]

(m)    Bruce purchases a copy by download to a USB stick, makes a further copy from the download onto his hard drive for his private use, then sells the USB stick containing the original copy by online auction.
By making a further copy for his private use Bruce brings 28B into play.  Does that make the situation any different from where he has made no further copy at all? 

If Bruce does not destroy the further copy, then selling the USB stick by public sale is an infringement and, as in (j) above, the further copy will be treated as an infringing copy.  That is clear. 

What if Bruce does destroy the further copy?  Here things gets quite obscure, even controversial.   First, as explained above it may not be clear whether a download is a ‘lawfully acquired’ copy. [Now clarified to include a download.] If it is, then 28B(2)(b) states that copyright is infringed where an individual who has made a further copy within 28B permanently transfers the copy from which it is made, without destroying the further copy. 
The casual reader might think that it follows that if Bruce destroys the further copy, then transferring the copy from which it is made does not infringe copyright.  If 28B(2(b) does mean that, that would seem in effect to extend UsedSoft to non-software.  [No. See below.]]

Another view is that 28B provides a limited exception from infringement for certain further copies; that 28B(2)(b) describes a particular circumstance in which the exception is disapplied, and how in that circumstance the otherwise exempt further copy is to be treated as infringing (which it would have been if it had not fallen within 28B in the first place).  On that basis 28B(2)(b) says nothing about the underlying issue of whether transferring a downloaded copy of a non-computer program benefits from exhaustion of rights (as in UsedSoft) or not.  That may at some point come before the CJEU.  The section appears to accommodate either possibility. [The Government in its Response to the Technical Review states that 28B creates an exception only to the reproduction right and does not create any exception to the distribution right or the right of communication of works to the public. Nothing in those provisions creates a new right to re-sell copies, where that right does not already exist.]