Anonymous posters and the new Defamation Act – the draft regulations

Section 5 of the Defamation Act 2013 provides (or will do when the Act comes into force) a complete defence from a defamation claim for a website operator who can show that it did not post the statement on the website.  This is a significant new protection for website operators.

However the defence is significantly watered down for anonymous posts.  It is defeated if the claimant can show:

1. That it was not possible for the claimant to identify the person who posted the statement

2. The claimant gave the website operator a notice of complaint containing various specified information; and

3. The website operator failed to respond to the notice of complaint in accordance with regulations to be made under secondary legislation.

A recurrent complaint during the passage of the Bill through Parliament was that Parliamentarians were unable to assess properly the Section 5 defence because the regulations were not available in draft for Parliament to consider.

In June 2012 the government circulated a note to the Commons Bill Committee indicating its then thinking about the regulations.  Since then two rounds of consultation on draft regulations and guidance documents have taken place with a limited group of stakeholders.  (Hat-tip to INFORRM and Ashley Hurst, who have documented both phases of the consultation.) 

Since the government will at some point lay draft regulations before Parliament, this is a good point at which to review the currently circulating draft regulations (which may yet change) and take a stab at predicting their practical consequences. 

Preliminary

The effect of Section 5 for an anonymous post is that the website operator may still have a complete defence under Section 5, but only if it successfully negotiates the procedural hoops set out in the regulations.  The end point in some scenarios will require the website operator to remove the posting if it is to be able to rely on the defence. 

Although the regulations are littered with references to what a website operator ‘must’ do, they do not in fact oblige a website operator to do anything.  They only set out the conditions that a website operator has to satisfy in order to be able to make use of the Section 5 defence for an anonymous post.    

The Section 5 defence is additional to existing defences under S1 Defamation Act 1996 and the ECommerce Directive.  They are unaffected by the new Act and regulations.

Defamatory or unlawful?

The draft regulations are a mixed bag.  On the good side, the government has kept to its promise in Parliamentary debates on the Bill that complainants would have to do more in their notice of complaint than merely assert that the posted statement was defamatory.  The complainant will have to set out the meaning which the complainant attributes to the statement and also set out the aspects of the statement which the complainant believes are factually inaccurate or opinions not supported by fact.

This goes some way to meeting the recommendation of the Parliamentary Joint Committee on Human Rights that the threshold for a complaint under Section 5 should, as under the ECommerce Directive hosting defence, be unlawfulness. 

This issue reflects the fact that a statement may be defamatory without being unlawful.  A statement is defamatory if it is damaging to someone’s reputation.  However if any one of numerous defences, such as truth, honest opinion, publication on matters of public interest and many others, is established, the statement is lawful. 

So a complaint that something is defamatory only addresses half the story and may encourage the taking down of lawful statements, with consequent chilling effects.  Requiring a complainant to consider possible defences of truth and honest opinion goes some way to ameliorating this.

Action by the poster – a black hole in the regulations

On the debit side the regulations are, perhaps inevitably, a veritable maze of different scenarios requiring different responses from the website operator.  The draft guidance note identifies no less than five different situations that can arise depending on the anonymous poster’s response (or lack of response) to a complaint forwarded by the website operator. 

However other scenarios are possible, which the regulations do not address.  Like a poorly designed IT system, the regulations tend to assume conforming behaviour by all the participants and make insufficient provision for exception handling, especially non-conformant behaviour by the poster whose statement is complained about.  In particular the regulations assume that any removal of the offending statement will be done by the website operator, not by the anonymous poster. 
One illustration is in the draft FAQ for website operators: “What should I do if I receive a Notice of Complaint and the posting has already been removed?”  The given answer is “It is unlikely that a complainant will send a Notice of Complaint in a situation where the posting has already been removed.  If such a situation does arise it will be necessary to follow the process in order to benefit from the section 5 defence.” 

Yet the first step in the prescribed process involves the operator notifying the poster that the statement complained of may be removed from the locations on the website specified in the notice of complaint.  Since in this scenario the statement has already been removed, the notification is meaningless.  Later steps in the process may require the operator to remove the statement from those locations – in this scenario, impossible to comply with. 

In a similar vein, there is a gap in the scenarios contemplated by the regulations for the response by the poster to the complaint notice forwarded by the website operator.  The five possibilities listed in the guidance notes are:

-         Poster fails to reply to website operator within the time limit

-         Poster replies within the time limit indicating that he or she wishes the statement complained of to be removed

-         Poster replies within the time limit but fails to provide the required information

-         Poster replies within the time limit indicating that he or she does not wish the statement complained of to be removed, and consenting to the operator sending his or her contact details to the complainant

-         Poster replies within the time limit indicating that he or she does not wish the statement complained of to be removed, provides contact details to the operator but refuses to consent to the operator sending them to the complainant

A sixth, and perhaps most realistic, response from a poster concerned about the complaint is for the poster to take the initiative on receiving notification from the website operator and remove the offending post (as happened in Tamiz v Google) or edit it.   Again the regulations make no provision for this.  As with the FAQ example above, for scenarios that culminate with an obligation on the operator to remove the statement, where the poster has already taken action that requirement would be impossible to comply with and the operator would apparently forfeit the Section 5 defence.  That is surely an absurd result.

Time limits and time zones

Some critical steps depend on the website operator having received a response from a poster ‘by midnight at the end of the date specified in the notification [from the website operator to the poster]’.  Since neither the website operator nor the poster, nor indeed the complainant, are necessarily based in the UK and may well be in other time zones, there is significant potential for confusion over time limits. 

The draft regulations make some concession to the rigidity of time limits in that the court is permitted in its discretion to treat action taken by the website operator as having been taken before expiry of the time limit.  However there appears to be no flexibility in relation to the 5 day time limit for the poster’s response.  The FAQ for posters makes this point starkly:

“Q. What happens if I’m on holiday and don’t realise the Notice of Complaint has been sent to me?

A.     The time period given for a response will still apply, and if you do not respond within that period the operator may remove the posting which has been complained about.”

Withholding complainant identity

The complainant is given the option not to consent to the website operator passing on the complainant’s name and contact details to the anonymous poster. 

While one can understand the rationale for allowing contact details to be withheld, to permit the complainant’s name to be withheld is very odd.  These regulations are about defamation, which concerns damage to someone’s reputation.  If the statement does not refer to an identifiable person, it is not defamatory.  So either it will be obvious from the statement complained of who has been putatively defamed (in which case it would be pointless for the complainant’s name to be withheld) or, if it is not obvious, then the poster will need to know who is complaining in order to assess whether the statement is defamatory. 

For litigation the Defamation Pre-Action Protocol requires a letter of claim to include (a) the name of the claimant and (b) where relevant, any facts or matters which make the claimant identifiable from the words complained of.

Predictions

Predictions about the practical effect of the anonymous posting aspects of Section 5 are not easy to make. 

Because of the enormous difference between protection for website operators (and only for website operators) in respect of anonymous and non-anonymous posts, there will be intense focus in future litigation on (a) what is and is not a website operator and (b) whether the post was anonymous – i.e. whether it was possible for the claimant to identify the person who posted the statement (defined in Section 5 as “only if the claimant has sufficient information to bring proceedings against the person”). 

The procedure under the draft regulations is so bureaucratic – not easily recognisable as the “quick, clear and practical” process promised in Commons Committee in June 2012 - that it is possible that website operators will ignore it and rely on other available defences.  Even then, however, Section 5 may have a side effect.  A valid complainant’s notice is much more likely than an informal defamation complaint to fix a hosting intermediary with knowledge of unlawfulness for the purpose of the ECommerce Directive defence.  So even if the Section 5 procedure is ignored, a website operator may have more incentive than previously to take a down an anonymous post on receipt of a valid Section 5 notice.

The new intermediary defence under Section 10 will also be significant, whereby a court does not have jurisdiction to hear and determine an action for defamation brought against a person who was not the author, editor or publisher of the statement complained of unless the court is satisfied that it is not reasonably practicable for an action to be brought against the author, editor or publisher.

Many intermediaries will not be an author, editor or publisher (under the special definitions in section 1 of the Defamation Act 1996).  For a website operator in relation to an anonymous post, there may be a question whether the claimant should have to attempt a Norwich Pharmacal application to determine identity in order to escape the prohibition in this section.  It is interesting to speculate on whether a website operator’s decision not to respond to a notice under Clause 5 would be held against it in the court’s evaluation of reasonable practicability.

Everyman encounters Government

A dialogue for our times.

Government: We know what’s best for you.

Everyman: I think I’m the best judge of that.

G: Ah, but we know things that you don’t.

E: What things?

G: Can’t tell you, they are secret.

E: So how can I tell whether you are right?

G: You need to trust us on that.

E: Why should I trust you?

G: Because we are fighting your enemies.

E: Who are my enemies?

G: Can’t tell you, you might warn them.

E:  You don’t trust me?

G: No-one is above suspicion.

E: Am I a suspect?

G: We never comment on operational matters. But if you have nothing to hide, you have nothing to fear.

E: What do you know about me?

G: We never comment on intelligence matters.

E: Can you be trusted?

G: We always act proportionately and in accordance with the law.

E: Show me.

G: Don’t be silly, that’s secret.

E: How do I know you don’t think I’m your enemy?

G: You don’t.  But if you carry on asking questions we might put you on a list.

E: On what grounds?

G: That would be telling. 

E: When would you do it?

G: If it was necessary in the interests of national security.

E: Is that legal?

G: We always act proportionately and in accordance with the law.

E: How can I be sure of that?

G: Trust us.  We know best.

Shifting formats - the IPO’s draft private copying exception

[Originally published 16 July 2013, based on the draft circulated for technical review.  Updated 14 April 2014 to take account of the amendments contained in the draft Personal Copies for Private Use Regulations laid before Parliament on 27 March 2014.]

The draft private copying exception (PDF) released for consultation on 7 June 2013 is one of the UK Intellectual Property Office’s flagship copyright reforms following the Hargreaves Review.  In his final report (PDF) in May 2011 Professor Ian Hargreaves focused on the lack of a format-shifting exception as particularly threatening to the legitimacy of copyright.  He identified:

“a growing mismatch between what is allowed under copyright exceptions, and the reasonable expectations and behaviour of most people. Digital technology has enabled use and reuse of material by private individuals in ways that they do not feel are wrong – such as sharing music tracks with immediate family members, or transferring a track from a CD to play in the car. It is difficult for anyone to understand why it is legal to lend a friend a book, but not a digital music file. The picture is confused by the way some online content is now sold with permissions to format shift (iTunes tracks) or to “lend” files (Amazon ebooks) at no extra cost.  This puts the law into confusion and disrepute. It is not a tenable state of affairs.”

If respect for copyright is to be restored, the proposed new private copying exception has to shoulder much of the work. 

It has to succeed on several fronts.  The audience for many aspects of copyright is copyright professionals.  However, since the private copying exception will determine what everyday users of PCs, laptops, tablets and mobile devices can and cannot do with music and movies that they purchase, its audience is the general public.

As such the exception needs to be clear, certain and sensible.  For clarity, it should not require special expertise in copyright law to understand the exception and its practical implications.  For certainty, there should be as few as possible areas of doubt about what is and is not permitted.  As to being sensible, there should be a minimum of arbitrary distinctions.  Not only should the user be able readily to understand which particular activities fall on one or other side of the line, but the reasons why the line is drawn where it is should be coherent and readily apparent.  In general terms the boundaries should accord with the reasonable expectations of users, albeit it must be conceded that there are legitimate areas of disagreement as to where the boundaries should lie.

If the exception does not pass these tests, not only will an opportunity to set copyright back on the road to legitimacy have been lost, but further damage to copyright will be done as another specimen of obscurity, arbitrariness and remoteness from reality is added to the list.  In an age when policymakers demand that users should be exhorted to respect copyright, it behoves our legislators to write laws that those users can readily understand and which, when they have understood them, make sense.

This article evaluates the published draft of the exception [now the draft Statutory Instrument laid before Parliament] with those criteria in mind.  We invoke a hypothetical user, Bruce, and try to decide which of his everyday format-shifting activities would or would not be permitted by the proposed new S28B of the 1988 Copyright Designs and Patents Act. 

For the most part the article avoids hotly contested issues about how broad or narrow the exception should be, whether its implementation without a corresponding copyright levy is or is not compliant with the EU Copyright Directive, and whether the whole thing is undermined anyway by the prohibition on circumvention of technical measures. 

The reader can make up his or her own mind whether the draft exception passes the tests of clarity, certainty and sensible boundaries.  To the extent that it may not, we should spare a modicum of sympathy for the Intellectual Property Office since some uncertainty is the inevitable result of lack of certainty in the EU Copyright Directive, which constrains the UK government's freedom of action. 

What follows is the tentative result of wrestling with the short but not entirely simple text of 28B.  Others may well have different views on how 28B is meant to apply.  It would certainly be welcome to discover that I have overcomplicated the thing and that it really doesn’t take the 4,000 words of this piece to analyse it.  But I am not optimistic.

In any event at present 28B is draft legislation, open to consultation until 17 July 2013.  The draft will quite likely be amended before anything is put before Parliament.  [Indeed the SI laid before Parliament is quite significantly amended.]

Preliminary

28B divides logically into two steps.  The first step is to identify whether Bruce has suitable source material at hand.  28B defines this as a copy of a copyright work lawfully acquired by Bruce and which he holds on a permanent basis (for example it is not a copy that is rented to the individual for a specified period or borrowed from a library).  [Eligible source material is now to be called an "individual's own copy". That is a copy which Bruce has lawfully acquired on a permanent basis, is not an infringing copy and has not itself been made under a copyright exception. Lawfully acquired on a permanent basis specifically includes a purchase, a gift, or a download resulting from a purchase or a gift (other than a download enabling no more than temporary access to the copy); but does not include a borrowed, rented, broadcast or streamed copy. None of this will now apply to computer programs, which are excluded entirely from 28B.]

The second step is to consider what use Bruce can make of that source material.  In general terms he can use the source material to make a further cop[ies]y of the work provided that the further cop[ies]y [are]is made for Bruce’s private use for ends that are neither directly nor indirectly commercial. Bruce cannot transfer the further cop[ies]y to another person[, other than on a private and temporary basis]; and if he transfers the source material to another person [(other than on a private and temporary basis)] without destroying the further cop[ies]y, that is an infringement. [A further copy made under 28B is now to be called a "personal copy"]

That may sound fairly simple.  However subtle complications arise when we try to apply it to the multiplicity of real world scenarios, including some specifically mentioned by the Hargreaves Report.

For the sake of relative simplicity we have not addressed the effect (if any) of contractual prohibitions, and have ignored the effect of any TPM restriction. [28B will render a contract term unenforceable to the extent that it purports to prevent or restrict the making of a copy which would under 28B would not infringe copyright. TPMs will remain effective.] 

Source material

First, consider the source material that Bruce must have in order to be able to use 28B.  Would source material that Bruce acquired in any of the following ways qualify?

[Remember that none of this applies to computer programs and the source material cannot itself have been made under an exception from copyright.]

(a)  Bruce purchased a genuine CD

Definitely OK.  28B can be used where the individual has ‘acquired’ a copy lawfully on a permanent basis.  Purchasing a genuine CD is the paradigm case.  28B could also be used if Bruce had received the genuine CD as a gift, either new or second-hand, or had bought it second hand. But Bruce could not use 28B if he had rented the CD or borrowed it from a library, from his sister or from a friend. [But not computer programs. Computer programs have their own regime of copyright exceptions under the EU Software Directive. See sections 50A to 50C of the 1988 Copyright Act.]  

(b)  Bruce purchased an infringing CD

Copyright is infringed by the person who made the infringing CD; and also by the person who sold it if he knew or has reason to believe it was infringing.  Bruce did not infringe copyright by merely purchasing it.  So from Bruce’s perspective as a matter of copyright law he may have acquired it lawfully, even though it was an infringing copy.  This might suggest that he can use it as source material for making a 28B copy.

Contrary to that, in its December 2012 response to consultation the government said that the exception would be limited to use by people who already own a lawful copy of a work; and that the exception would permit copying only by a lawful owner of an original copy.

But differently again, in its recommendation in the same document the government said the exception would allow a lawful owner or buyer of a copy of a work to reproduce that copy for their personal use. 

Lawfully acquiring a copy and lawfully acquiring a lawful copy differ significantly from each other.  It is not obvious from the consultation history which the government intends. [Now clarified.  28B now makes clear that the source material cannot be an infringing copy.] 

As to the merits of each approach, on the one hand why should someone be able to make use of 28B to make another copy of something which already infringes?  On the other hand, why should the consumer be at risk of infringement simply because the original copy turns out to be infringing?  The consumer is poorly placed to know with any certainty whether what s/he has purchased is genuine or infringing.  That is especially the case with secondhand CDs, but can also apply to apparently genuine original CDs.  (It can happen that a well known label sold through reputable retailers turns out to be unlicensed.)  Would it be fair to the consumer that his or her ability to use the exception depends on something that will often be out of her knowledge and control? Should the exception be inapplicable only where it was obvious to the consumer that s/he was acquiring an infringing item? [It will make no difference if Bruce has no means of knowing that the source material is an infringing copy.]

It is also unclear whether private copying from an infringing source copy is permitted under the EU Copyright Directive, with which this exception must comply.  Whether the private copy exception under the Directive can apply to unlawful source copies is the subject of a currently pending reference to the EU Court of Justice, in ACI Adam and Others Case C-435/12.  [Decided 10 April 2014.]

(c)  Bruce borrowed a copied CD from a friend

No.  A borrowed CD, whether copied or genuine, is not held permanently.  The exception could be used to make a private use copy only from a copy held on a permanent basis.  [No change.]

(d)  Bruce received a copied CD as a gift

If the copy for some reason does not infringe, then OK.  Bruce holds it on a permanent basis.  If it does infringe, then the position is the same as scenario (b): unclear. [Now clarified. As in (b), an infringing copy cannot be used as source material for 28B.]

(e)  Bruce purchased a permanent legitimate copy of a song by download over the internet. 

OK, or at least so the government appears to intend.   It mentioned eBooks in the December 2012 impact assessment.  In the Dec 2012 consultation paper it said “This would include downloaded digital content that has been purchased to keep (or licensed in an analogous way) such as eBooks” (Consultation note 41).

However the actual wording of the exception may not be quite so clear.  Unlike acquiring a CD, downloading involves making a new copy.  Does ‘acquiring’ include making a new copy? Since the government apparently intends that it should, it would be as well to put this beyond doubt.

In any event the exception does not apply to rented or streamed materials. [Now clarified.  Bruce will be able to use a copy acquired by means of a non-infringing download resulting from a purchase or a gift (other than a download enabling no more than temporary access to the copy). Bruce will not be able to use borrowed, rented, broadcast or streamed source materials.]

Use scenarios

Let us assume that Bruce is equipped with a permanent copy that he can use as source material under S28B.  We will assume that it is a genuine purchased CD (not unlawfully copied, not an unlawful parallel import from outside the EEA).  Would any of the following acts be permitted under S28B?

(a)  Bruce copies the CD to the hard drive of his PC. 

OK, so long as he makes the copy for his private use for ends that are neither directly nor indirectly commercial.  However, whether he has made the copy for his private use turns out to be quite a tricky question.  Some uses involve further copies being generated.  Others do not (or at least only transient copies).  How does 28B apply to each situation? 

28B legitimises only a copy made for Bruce’s own private use.  So the key question appears to be what was Bruce’s purpose when he made the copy?  That appears to depend at least in part on what was in his head at the time he made the copy (there may be room for arguments about whether the test is subjective, objective or hybrid – we will assume that Bruce’s intention has some relevance).  However surrounding circumstances would offer some pretty big clues to the purpose.  [28B now fleshes out the concept of private use with some examples. It includes private use facilitated by:

- making a copy as a back-up copy
- making a copy for the purposes of format-shifting
- making a copy for the purposes of storage (including in an electronic storage area accessed by means of the internet or similar means which is accessible only by the individual (and the person responsible for the storage area).]

Here are some sub-scenarios:

(i)   Bruce copied the CD into a folder accessible only to himself.

OK. That would be consistent with Bruce’s professed private use purpose.

(ii)  Bruce copied the CD into a public P2P sharing folder on his hard drive.

Probably not OK.  Since it is accessible by members of the public Bruce would have an uphill task convincing anyone that the copy was made for his private use. 

(iii)  Bruce copied the CD into a folder accessible to a small circle of others (such as family members) on his home network. 

If Bruce did this with so as to enable others on his home network to make their own permanent copies, that is beyond Bruce’s own private use and would not be legitimised by 28B.  [No change. Although Bruce will be able to 'daisy-chain' (see below) only he will be able to make further personal copies.]

If Bruce did it so as to enable others on his home network independently to play and listen to the tracks in the folder, that is probably not legitimised by 28B, since their playing and listening to the tracks would be private use by them, but not by Bruce.

If Bruce did it with the intention only of listening to the tracks himself, that might be OK since that is Bruce's own private use.  However Bruce could be challenged as to why, if that was his intention, he put the tracks in a folder accessible to others.

Establishing Bruce’s true intention could be very difficult.  It might depend at least partly on his technical sophistication, such as whether he knew that others could access the folder to which he copied the CD.  That might be especially the case if some other member of the family set up the network and configured his computer. 

(iv)  Bruce copied the CD into a folder accessible only to himself, but with the intention of playing the tracks from the folder through his home loudspeakers via a streaming device.

Unclear.  If Bruce intended to listen through personal headphones that would clearly be his private use.  Playing the tracks through his home loudspeakers means that other domestic and family members can listen to the music that Bruce is playing.  Is this also Bruce’s private use? 

The concept of private use as understood in EU law is wide enough to cover domestic and family use.  Is that what 28B means?  If so does the fact that the playing is under Bruce’s control mean that it counts as Bruce’s private use, as required by 28B?  28B itself offers no illumination, other than that using the word 'private' rather than 'personal' use may suggest that this is OK. (Confusingly however, the IPO uses the term 'personal use' in its commentary on the draft exception).

If it is not OK, then the reasonable user could well regard the results as arbitrary.  It would be permissible to buy a CD and play it to friends and family on a music system at home; but not permissible to copy the CD to a computer or an MP3 player and play that copy to the same audience through the same music system.  [No change. None of the supporting documents or the Impact Assessment shed definitive light on this scenario, although the tenor of the rejected Impact Assessment Option 2 may suggest that the answer is 'Not OK'.]

(b)  Bruce copies the copy that he made in scenario (a) from his hard drive to his portable device (e.g. MP3 player, mobile phone or USB stick)

This 'daisy-chaining' is a very common scenario.  The Gowers Report back in 2006 recognised the importance of daisy-chaining for format shifting: "The exception would only allow one copy per ‘format’, but it would also have to recognise that transfer between formats may require intermediate steps (or formats) to be taken." (para 4.76)

If the copy made from the CD to the hard drive in scenario (a) was legitimised by 28B, this further copy made from it is probably also legitimate if made for Bruce’s private use.  But 28B does not spell this out beyond question. 

Since we are assuming that Bruce legitimately made the copy on his hard drive under 28B, he has lawfully acquired that copy (if we are right that lawfully acquiring includes lawfully making a new copy).  Under 28B he is entitled to keep the hard drive copy permanently unless and until he transfers the original CD to another person.

On that basis Bruce can probably ‘daisy chain’ 28B to make successive copies from the CD to his hard drive and then from his hard drive to his portable device, so long as both copies are for his own private use.  He could presumably keep both copies and continue to sync between them.

Assuming this to be the government's intention, it would be better if 28B made completely clear that daisy chaining is permitted.  [Clarified.  Bruce can make a personal copy under 28B from an existing personal copy that Bruce (but no-one else) has already made under 28B.] 

If Bruce intends to use the portable device to play the tracks in the presence of others in his private sphere, such as in his car (the example given by Hargreaves), then the same uncertainties about private use arise as with the hard drive copy. [No change.]

(c)   Bruce copies the copy that he made in scenario (a) from his hard drive to his private cloud storage area

OK, if daisy-chaining is permissible.  28B places no restriction on the place in which the 28B copy is stored – only that it be made for his private use for ends that are neither directly nor indirectly commercial.  On the face of it that would include a private cloud account.  Since storing the copy in that account involves making a new copy, the ability to daisy-chain is important in order to bring the cloud copy within 28B.  [Daisy-chaining will be OK. See above.]

Cloud storage is specifically addressed in 28B(3).  The drafters appear to have been concerned that storing in the cloud could amount to a transfer of a copy to another person, and thus trigger the infringement provisions of 28B(2).  They have therefore provided that nothing in 28B(2) prevents an individual from storing a further copy made under 28B in an electronic storage facility accessed by means of the internet or similar means, where that facility is provided for his sole private use. 

While specific provision for cloud storage is probably necessary from the point of view of clarity, this sub-section is problematic.   First ‘storing a further copy made pursuant to [28B]’ is an odd phrase in his context, since the act of storing a copy in the cloud necessarily entails the making of an additional copy. Is the section referring to that further copy, to a pre-existing further copy (e.g. made by copying from CD to computer hard drive) or to both? 

The uncertainty is compounded by the reference to 28B(2), since that deals with transferring “the copy”.  That most obviously means the transfer of a pre-existing copy – such as when Bruce gives a USB stick containing a copy to his sister.  On that understanding storage in the cloud would not be a transfer of ‘the copy’ at all, since it involves the making of a new copy in the cloud.  Yet 28B(3) seems to suggest that this process could be understood as a transfer of "the copy". 

If “transfers the copy” is indeed broad enough to include a transfer process that creates an additional copy, that introduces further complications into the operation of 28B(2), since more copies will come into existence than 28B(2) appears to contemplate. [Re-drafted and clarified.  Bruce's copy on his hard drive made from his CD is a personal copy under 28B.  He can make a further personal copy from that and store it in his private cloud storage.  However this only applies if the storage area is accessible only by Bruce and the person responsible for the storage area. Shared storage areas will not count.]

(d)  Bruce copies the copy that he made in scenario (a) from his hard drive to his sister’s portable device for her.

No.  The second act of copying (from hard drive to his sister’s device) would not be for his own private use.  [No change.]

(e)  Bruce copies to his own MP3 player with the intention of lending the MP3 player to his sister.

No, at least if Bruce’s purpose in doing this was that his sister should be able to listen to the tracks.  The copy was not made for Bruce’s private use, but that of his sister.  The same would apply if Bruce copied to a USB stick with the intention of lending it to her.  [No change.]

(f)    Bruce, having copied to his own MP3 player for his own private use, later decides to lend the MP3 player to his sister.

Probably OK?  Since the later decision to lend the MP3 player was not Bruce’s original purpose, that does not prevent the copy being originally legitimate under 28B.  There is nothing in 28B to suggest that it becomes illegitimate if Bruce's intention changes later.  As Bruce is only loaning the MP3 player, it is not caught by the prohibition on transferring (otherwise than on a private and temporary basis) the 28B copy to another person.  The same would apply to a USB stick. [No change.] 

It would be a separate question whether, when the sister listens to the tracks stored on the borrowed device, she infringes copyright.  Probably not (so long as she does so in private circles), but that may be affected by the outcome of a currently pending reference to the CJEU in the Meltwater litigation. 

(g)  Bruce, having copied a CD to a USB stick for his private use, then gives the USB stick to his sister.

No.  Although the USB stick copy was made legitimately under 28B, under 28B2(a) Bruce infringes copyright if he transfers that copy to another person otherwise than on a private and temporary basis.  That previously legitimate 28B copy becomes an infringing copy.

(h)  Bruce, without making any copy of it, gives a genuine purchased CD to his sister.

OK.  Under general copyright law Bruce is entitled to transfer to someone else a physical copy that was previously put into circulation in the EEA by or with the consent of the rightsholder (the principle of ‘exhaustion of rights’). [No change.]

(i)    Bruce, having copied a genuine purchased CD onto a USB stick for his brother, then gives the CD to his sister.

Copying the CD is outside 28B as it is for Bruce’s brother.  That copy therefore infringes.  Bruce can give the genuine CD to his sister since exhaustion of rights still applies to the CD. [No change.]

(j)    Bruce, having copied a genuine purchased CD onto a USB stick for his private use, then gives the CD to his sister.

OK, but only if Bruce first destroys the copy on the USB stick.  If not, he infringes copyright by transferring the CD to another person.  However it is the copy on the USB stick, not the CD, which is then regarded as an infringing copy.  Thus the same result is achieved as if a copy was made outside 28B. [No change.]

(k)  Bruce purchases a copy by download to his MP3 player, then lends the MP3 player to his sister.

OK.  28B does not come into play since no 'further copy' is made.  Private loan is unlikely to be an act restricted by copyright and, since the device itself is lent, no new copy is made.  See (f) above as to whether Bruce's sister would infringe when listening to the tracks.  [No change.]

The same would apply to a copy downloaded to any other device, including a storage device such as a USB stick.

(l)    Bruce purchases a copy by download to a USB stick, then sells the USB stick containing the original copy by online auction.

No, at least for the moment.  28B does not come into play since no 'further copy' is made.  Selling the USB stick infringes the copyright owner’s exclusive distribution right.  At present exhaustion of the distribution right applies only to physical copies (such as CDs) put into circulation by or with the consent of the rightsowner, not to a download made by a customer.  However it is possible that this may change in the future, should the CJEU expand its finding in UsedSoft so as to apply to non-computer programs.  This is a highly controversial issue. [No change.]

(m)    Bruce purchases a copy by download to a USB stick, makes a further copy from the download onto his hard drive for his private use, then sells the USB stick containing the original copy by online auction.

By making a further copy for his private use Bruce brings 28B into play.  Does that make the situation any different from where he has made no further copy at all? 

If Bruce does not destroy the further copy, then selling the USB stick by public sale is an infringement and, as in (j) above, the further copy will be treated as an infringing copy.  That is clear. 

What if Bruce does destroy the further copy?  Here things gets quite obscure, even controversial.   First, as explained above it may not be clear whether a download is a ‘lawfully acquired’ copy. [Now clarified to include a download.] If it is, then 28B(2)(b) states that copyright is infringed where an individual who has made a further copy within 28B permanently transfers the copy from which it is made, without destroying the further copy. 

The casual reader might think that it follows that if Bruce destroys the further copy, then transferring the copy from which it is made does not infringe copyright.  If 28B(2(b) does mean that, that would seem in effect to extend UsedSoft to non-software.  [No. See below.]]

Another view is that 28B provides a limited exception from infringement for certain further copies; that 28B(2)(b) describes a particular circumstance in which the exception is disapplied, and how in that circumstance the otherwise exempt further copy is to be treated as infringing (which it would have been if it had not fallen within 28B in the first place).  On that basis 28B(2)(b) says nothing about the underlying issue of whether transferring a downloaded copy of a non-computer program benefits from exhaustion of rights (as in UsedSoft) or not.  That may at some point come before the CJEU.  The section appears to accommodate either possibility. [The Government in its Response to the Technical Review states that 28B creates an exception only to the reproduction right and does not create any exception to the distribution right or the right of communication of works to the public. Nothing in those provisions creates a new right to re-sell copies, where that right does not already exist.]

The Good Fairy of the Internet and her Magic Wand

Last week I attended the Index on Censorship ‘Caught in the Web’ event.  I asked a question from the floor and was put on the spot by chair David Aaronovitch about David Cameron's call for the big players to do more about child porn on the internet.  Answered along the lines of not really understanding what more Cameron thought they could do, given that the Internet Watch Foundation runs a list already; and needing to examine any proposals to see if they carry too high a price in terms of interference with freedom of expression. 

OK as far as it went, but this is what I should have said.  When politicians demand that the most visible targets (ISPs, search engines, social media platforms) should do more to stop whatever abomination is hitting today’s headlines, really they just want a good fairy of the internet to wave a magic wand and make the nastiness go away.  The trouble is that the good fairy is a myth, the magic wand rubs out good stuff and the bigger the magic wand the more of the good stuff it rubs out.  And the nastiness still doesn’t go away.

Worst of all, when each has had its turn at waving the magic wand - the child protectionists, the responsible speakers, the cultural preservationists, the extreme speech purgers, the adcensors, the promoters of the public interest, the filth filterers, the religious reverents, the porn exterminators, the benevolent regulators, the upholders of community standards, the real namers, the guardians of the general good, the copyright cops, the internet safety inspectors, the privacy protectors, the departments of public harmony, the joke jailers, the moral champions, the speech cleaners and scrubbers and all the clamouring crew of prohibitionists – what then is left?

If the fundamental human right of free speech means anything, it is that we can build search engines without fear that the State will make us convert them into suppression engines.

I am not an IP address

[Update 3 December 2014. 18 months on, this has now come alive. The 'IP address resolution' proposals flagged up in the Queen's Speech are included in the Counter-Terrorism and Security Bill introduced in Parliament on 26 November. Initial analysis here. 

The Draft Communications Data Bill Joint Committee Report in December 2012 reached some consensus around this issue: "Not all United Kingdom providers currently obtain all the data necessary to trace which subscriber is using which IP address. During the course of our inquiry we heard of various circumstances in which the lack of this data has impeded investigations. We accept that if CSPs could be required to generate and retain information that would allow IP addresses to be matched to subscribers this would be of significant value to law enforcement. We do not think that IP address resolution raises particular privacy concerns."] 

The truism that an IP address denotes a device, not a human being, is ingrained in anyone with a technical understanding of the internet.  Nothing gets a geek going like the suggestion that an IP address identifies a person.  

So when the briefing document (PDF) on last week’s Queen’s Speech said: “When communicating over the Internet, people are allocated an Internet Protocol (IP) address”, sharp intakes of IT literate breath could be heard up and down the land.  The somewhat contradictory statement a few lines later that law enforcement had a problem with being unable to match individuals to IP addresses did little to improve matters, accompanied as it was by the suggestion that addressing this issue may involve legislation.

Cybergeeks are right to be exercised about this, a technical issue but no mere technicality.

Legislating around IP addresses is a dubious idea at the best of times.  A legislative approach that embeds specific technical implementations falls foul of an important principle of lawmaking in the tech field, technological neutrality.  Professor Chris Reed explains in his book Making Laws for Cyberspace how legislating at too detailed a technical level is likely to create legal uncertainty.  Legislation that assumes or mandates specific technology is at risk of impeding new technological developments.  Technology-specific law is bad law.

Legislating at a detailed technical level also requires a sound understanding of the technology.  The Digital Economy Act was the first UK statute to mention IP addresses.  One has to wonder whether that was done with a full appreciation of IP addressing's manyfold variations.

The particular problem on which the Queen's Speech focuses is that public IP addresses are often shared, so an IP address does not necessarily identify a single end user device.  The public IP address can denote the gateway of a domestic household or of a large organisation, a point within a public network or even the gateway of an entire public network (often mobile).  So thousands of household or organisation routers and potentially millions of end user devices may sit behind a single public IP address.  This is why, when the first draft Initial Obligations Code for the Digital Economy Act was published in May 2010, port numbers (not mentioned in the Act) were included as well as IP address information.    

Ironically, one thing that DEAct did appreciate was that an IP address does not identify a copyright infringer.  Much of the opposition to DEAct was aimed at its mechanism for overcoming this by creating a presumption, which the subscriber had to rebut, that a subscriber identified from the public IP address allocated by the subscriber's ISP was responsible for repeated infringement; even though anyone with access to the subscriber’s system could have used the device identified by the IP address. 

The courts know that this is an important issue.  The speculative invoicing business depended on asserting that a harvested public IP address provided grounds on which to assert a copyright claim against a subscriber identified from the IP address and the ISP's records.  In the UK this was discussed by H.H.J. Birss in the Media Cat case:

“IP addresses  are numerical references used to identify entities on the internet.

…

“Media CAT's monitoring exercise cannot and does not purport to identify the individual who actually did anything. All the IP address identifies is an internet connection, which is likely today to be a wireless home broadband router.  All Media CAT's monitoring can identify is the person who has the contract with their ISP to have internet access. Assuming a case in Media CAT's favour that the IP address is indeed linked to wholesale infringements of the copyright in question …, Media CAT do not know who did it and know that they do not know who did it.”

Numerous US courts have made the same point, summarised in May 2012 by magistrate judge Gary Brown in K-Beech:

“In sum, although the complaints state that IP addresses are assigned to “devices” and thus by discovering the individual associated with that IP address will reveal “defendants’ true identity,” this is unlikely to be the case. Most, if not all, of the IP addresses will actually reflect a wireless router or other networking device, meaning that while the ISPs will provide the name of its subscriber, the alleged infringer could be the subscriber, a member of his or her family, an employee, invitee, neighbor or interloper.”

Port numbers (if retained) can reach beyond the public IP endpoint to an end user device.  In combination with other contextual information it may then be possible to identify a person who was using the device.  For this reason law enforcement authorities want access to information associated with IP addresses and seek ways of matching an IP address to a unique end user device.  For exactly the same reason such schemes, even if embarked upon for the worthiest and most serious of motives, have civil liberties implications. 

These were articulated most starkly in the 1960s TV series The Prisoner.  When No. 6 said “I am not a number, I am a free man”, he did more than reject a numeric tag.  He pitted his personal autonomy against an all-controlling bureaucratic embrace: “I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.”  Today Patrick McGoohan could as easily have written “I am not an IP address”.