In short, Internet subscribers whose connection is repeatedly used to share copyrighted material may be disconnected from the Internet and may have to continue paying for the service (so-called ‘double pain’), or pay a fine.

Active since mid-2010, Hadopi is authorized to initiate proceedings when rightsholders (represented by professional organizations) file a complaint. These organizations (such as Trident Media Guard) surveil public filesharing networks and collect ‘evidence’ of alleged infringements. Hadopi then has two months to contact the relevant Internet Access Provider (IAP) and issue a (first) warning to the suspected infringer. This initial warning is only sent to the email address known by the IAP (usually the default IAP address). When Hadopi is notified of another alleged infringement within 6 months after the first warning or within 1 year after a second warning, another warning can be issued (art. L331-25). The third warning clearly states the possibility of criminal liability which can result in a €1,500 fine and/or disconnecting the individual for up to one month (art. L335-7-1). Originally, Hadopi was issuing orders for disconnection itself, but the Constitutional Court struck down this measure.  Now these sanctions can only be issued by a judge after Hadopi has notified the public prosecutor.

Besides the many questions a potential disconnection raises, several major issues have caused a lot of critique. First of all, under this new legal framework, it is the Internet access subscriber, and only him/her, that is held liable (even when he or she doesn’t know about the allegedly illegal activity) (Article L336-3). This has resulted in a new obligation to secure one’s Internet connection.Hadopi is supposed to provide security tools for individual subscribers in the initial infringement notice, but they have yet to do so.Secondly, the basic presumption of innocence is reversed. In other words, the Internet access subscriber is presumed guilty and has the burden to prove otherwise.Another concern is that the whole Hadopi process is based on evidence (IP addresses) collected by private actors acting as copyright police, who have a financial interest in the process.

So far, Hadopi hasn’t notified the public prosecutor after a third warning was issued and no one has appeared before a judge. As a result, no disconnection has been ordered.

Together with the provisions establishing Hadopi, another article was introduced in the French IP law (article L336-2).

Although the Senate removed the word ‘filtering’ in the final version, the provision still allows courts to order ‘any person capable of contributing … to take any measure appropriate to prevent or stop online copyright infringement’. A recent amendment to the law even allowed Hadopi to grant subsidies to private surveillance and filtering companies. Not much later, though, the Constitutional Court ruled the amendment unconstitutional.

Case law has yet to bring much clarity. According to article 15 of the European eCommerce Directive, member states cannot impose a ‘general obligation to monitor’ (read: filter out potentially infringing content a priori). Nevertheless, some judges in France have expanded the traditional ‘notice and take-down’ principle to a ‘notice and stay-down’ principle. This means that when a rightsholder has requested a takedown of his content, the intermediary should prevent anyone from ever uploading that same content again. This trend, however, seems to have been reversed in a February 2011  Supreme Court decision (DailyMotion Case). In short, content can only be taken down (‘filtered out’) after explicit and clear notification for each individual case. In May 2011 the notice and takedown principle was reaffirmed by a lower court (Google Images case).

Nevertheless, the exclusive focus on the notice and takedown debate and the growing collaboration between intermediaries and third parties (e.g. rightsholders) raise some important concerns as well. In order to avoid liability, intermediaries are increasingly taking down (‘filtering’) content at the slightest concern raised. Additionally, rightsholders are also implementing preventive measures to match online content to copyrighted materials (such as ‘video identification’ or ‘acoustic fingerprinting’ technologies). All these trends have only increased the amount of ‘preventive’ filtering by intermediaries.

Hadopi does not collect personal data a priori, as a preventive measure. When a company hired by a rightsholder (Trident Media Guard is the only known company acting as such a private copyright police) believes he has found content that infringes on his copyright, he communicates the relevant information to Hadopi. These referrals include the date and time, the IP address, information on the relevant copyrighted material, and the name of the Internet Access Provider.

When Hadopi decides to initiate the graduated response procedure, the access provider has to communicate the necessary subscriber information (name, phone number, address, etc.) within eight days after having received the required technical information by Hadopi. Only direct administrative agents of Hadopi (sworn in by its president) have access to the personal data. Data is supposed to be erased 2 months after it is provided to Hadopi, 14 months after the first warning, and 21 months after a second warning (except, of course, when a new warning is issued). When the infringement has been sent to the public prosecutor, data has to be removed from Hadopi’s databases after one year or whenever a court decides not to issue a disconnection order (article 3, Décret n°2010-236).

Ireland’s largest ISP, Eircom, has been following a Three Strikes policy since May 2010 under which it suspends Internet users’ Internet access after receiving three rightsholder allegations of copyright infringement. Since December 2010 Eircom has been disconnecting Internet users for up to 12 months on a 4th allegation of copyright infringement.

This policy arises from an agreement between the Irish Recorded Music Association (IRMA) and Eircom, which settled a 2009 lawsuit brought by IRMA. In the lawsuit, IRMA demanded Eircom filter for potential copyright-infringing material over Eircom’s entire network. Eircom challenged this request. Before the court ruled on IRMA’s demand, however, Eircom and the IP rightsholders reached an out of court settlement in February of 2009 with different terms. Although this agreement only applies to Eircom, IRMA has sued [8] other Irish ISPs, seeking to obtain a similar agreement

As part of the settlement agreement Eircom agreed to adopt and follow a three strikes Internet disconnection policy. In May 2010, Eircom launched a pilot Graduated Response program, under which it agreed to identify and forward successive copyright infringement notices to relevant subscribers. These notices would be sent out after IRMA supplied Eircom with the IP addresses that IRMA or its agents identified as having uploaded copyrighted works.

In December 2010 Eircom formally launched a Graduated Response regime as part of its new MusicHub service. In the current version, Eircom issues notices to subscribers which it matches to the relevant IP addresses, advising them that they have been identified as having uploaded or downloaded copyrighted material on a P2P network. If Eircom receives a third copyright infringement allegation, it suspends the relevant non-business subscribers’ Internet accounts for seven days. Eircom disconnects access for 12 months on receipt of a fourth copyright infringement allegation for the same IP address.

The Eircom Graduated Response process is described in a set of FAQs on Eircom’s website:

“How will the graduated response work?

IRMA will provide eircom with notifications containing the IP addresses of the people they detect illegally uploading or downloading music content. Once eircom identifies the eircom account holder through their IP address eircom will:

• Contact the customer in writing to inform them that their IP address has been detected by IRMA, as infringing copyright. eircom will clearly advise the customer that such acts are illegal and will provide information on how the customer can avoid repeating the infringement.
• If the customer continues to engage in the illegal uploading or downloading of music content, eircom will issue a second warning letter to the customer indicating that unless the infringement ceases the customer will have their service withdrawn.
• Write to the customer for a third time to advise them that their service will be withdrawn for a seven day period as they continue to engage in the illegal uploading or downloading of music content. If the customer infringes a fourth time then the broadband service will be disconnected for a 12 month period.

As well as contacting customers via letter, eircom will also attempt to contact customers via telephone and a browser based pop up to advise them of the infringement and to assist them in ensuring their computers are not a source of copyright infringement.

eircom has set up a dedicated team to support customers through this process.”

Subscribers who feel that they have been incorrectly identified or who are not responsible for the alleged illegal downloading can advise Eircom’s technical team at the time of notification.

In its original lawsuit against Eircom, IRMA sought an injunction requiring Eircom to filter its subscribers’ communications for potential copyright-infringing material. At around the same time, in 2007, a Belgian music collecting organization had obtained an injunction against Belgian ISP Tiscali (now Scarlet), requiring it to filter all communications on its network for potential copyright-infringing material.

At around the same time, in 2007, a Belgian music collecting organization had obtained an injunction against Belgian ISP Tiscali (now Scarlet), requiring it to filter all communications on its network for potential copyright-infringing material.  The European Court of Justice has since ruled that such a broad pre-emptive injunction violates EU law.  The Irish court did not rule on whether this was legal under EU and Irish law because the lawsuit was settled by the out of court agreement on different terms.

Whether ISPs are required to disclose customers’ identity and contact information to rightsholders on an allegation of copyright infringement has been a hotly contested issue in Irish law, and the subject of a 2005 lawsuit against Eircom (more details below). As a member of the EU, Ireland has obligations to protect citizens’ privacy and personal data under a set of EU directives that have been transposed into Irish law.

At the same time, Article 8 of the EU IPR Enforcement Directive (2004/48/EC), establishes a right of information for copyright holders to obtain information from intermediaries (including ISPs) about those in the chain of distribution of infringing material. How the obligations under these various EU directives fit together was the subject of the 2008 European Court of Justice decision in Telefonica v Promusicae and is the focus of another case currently pending before the European Court of Justice.

Eircom’s data collection and IP matching obligations under its agreement with IRMA are particularly interesting because the Irish Data Protection Commissioner had previously expressed concerns about whether data processing for three strikes regimes complies with Irish data protection law, which were effectively sidestepped by judicial approval of the agreement (see below). Then, in June 2011 the Irish Data Protection Commissioner announced that it had opened a further inquiry into whether the agreement’s data processing and identification requirements violates Irish data protection law. This was triggered by a complaint filed by an aggrieved customer who had received a first strike notice after Eircom misidentified and mistakenly sent first strike notices to 300 of its customers when a server failed to update correctly after daylight savings time change in October 2010.

As Law Lecturer TJ McIntyre notes if the Irish Data Protection Commissioner finds, as it did previously, that using IP addresses to terminate subscribers’ Internet access is disproportionate and is not fair use of personal information, the Commissioner could issue an enforcement notice preventing Eircom from using customers’ personal data for this purpose. This could require Irish courts to reconsider the legality of the agreement under EU and Irish law. The inquiry is taking place at a particularly interesting time. Whether data collection and processing for Three Strikes systems is permissible under EU law is one of the questions raised in the pending appeal of the judicial review of the UK Digital Economy Act [LINK TO UK page].

Under its agreement with IRMA, Eircom is required to match its customers’ account names with the IP addresses provided to it by IRMA to send notices and to suspend or terminate the relevant accounts after three copyright infringement allegations. Eircom has said that it will not share customer information with IRMA or any other party. Eircom’s FAQ states that IRMA is using a third party (Dtecnet) to obtain IP addresses that are allegedly engaged in illegal downloading and sharing of music.

In light of the concerns raised by the Irish Data Protection Commissioner, the FAQ also states that "Eircom has sought and received assurance from IRMA that the process is fully legal and approved by the High Court. The Court has confirmed that the process is in their view in accordance with Data Protection Legislation." However, given the June 2011 inquiry, the matter is not as settled at the FAQ suggests.

Identifying users by IP address matching gives rise to several public policy concerns. As a thoughtful editorial by TJ McIntyre and Dr. Richard Tynan explains, IP addresses can’t necessarily be reliably linked to individuals. Recorded music companies made this mistake when they accused wireless printers of file sharing. Second, the Eircom-IRMA agreement effectively creates liability for operating a non-secured open wireless network. This is particularly problematic because Eircom has apparently supplied up to 250,000 of its subscribers with modems that cannot be easily secured.

Third, it may have disproportionate results. The Eircom-IRMA agreement means that the actions of one member of a household or premises can result in termination of Internet access to the entire family or set of individuals using the connection. In Ireland a parent is not legally liable for the actions of their child in most cases; nor is a husband legally liable for the actions of his wife. Imposing legal sanctions on the inhabitants of an entire household, even if those parties did not engage in copyright infringement, completely changes the way in which the law currently assigns liability.

Background: Data Protection and Copyright Enforcement in Ireland

In 2005, IRMA sued Eircom and a few other ISP’s for refusing to turn over the IP addresses of 16 individuals suspected of copyright infringement on the basis that it would violate Ireland’s data protection laws. The court ordered Eircom to turn over "the name, postal address and telephone number" of the users registered to those IP address. The court reasoned that although privity of contract would normally dictate a duty of privacy between ISP and subscriber, privity could not be used to protect a subscriber who committed illegal acts.

One of the stipulations of the agreement between IRMA and Eircom was that Eircom would only comply with the settlement if it complied with EU data protection legislation. In February of 2010, the office of the Data Protection Commissioner claimed that using IP addresses of consumers to cut them off the Internet is not "fair use" of personal information, and therefore the settlement was unenforceable.

Eircom and IRMA found themselves in court once again to see if the settlement agreement complied with Ireland’s data protection laws. At the crux of the case was whether IP addresses were personally identifiable information, and if so, whether complying with the settlement would be unlawful ""under Irish data protection law. Unfortunately, the Office of the Irish Data Protection Commissioner did not make an appearance at the Eircom hearing due to cost concerns. Because the Commissioner was not present, the only evidence was presented by rightsholder EMI, leaving no one to raise the fundamental concerns about protection of Irish citizens’ personal data.

In April of 2010, Justice Charleton ruled that the settlement agreement did comply with Irish data protection laws. Justice Charleton answered three questions posed by the Data Protection Commissioner. First, does the collection of IP addresses by Eircom to provide to EMI constitute personal data under the1988 Irish Data Protection Act? Second if an IP address constitutes "personal data," is using that data "necessary for the purposes of the legitimate interests pursued by [Eircom]" or does it instead result in a violation of fundamental rights? Third, is the personal data "sensitive" because it is involved in the prosecution of a criminal offense?

In answer to the first question, Justice Charleton determined that an IP address was not "personal data" under the Irish Data Protection Act of 1988 because it does not identify a living individual. Moreover, even if it did, at no time would Eircom disclose that information to IRMA in violation of the Act. Interestingly, the European Court of Justice found that an IP address is personal data in its subsequent SABAM v. Scarlet decision.

Second, even though an IP address is not considered personal data, Justice Charlton determined that Eircom’s use of IP addresses to identify which users’ Internet connection to disconnect is lawful. He reasoned that infringement of copyright is a violation of Ericom’s terms of service, and using an IP address to terminate the service of infringing users is necessary for the legitimate purpose of enforcing Eircom’s contract.

Third, Justice Charleton found that although violating copyright law can result in criminal penalties, neither Eircom nor IRMA were pursuing criminal charges against copyright infringers. Just because personal information is related to something that could result in criminal charges, it is insufficient to invoke the extra protections granted by the Data Protection Act of 1988 to "sensitive personal data." Since the data would only be used for civil law purposes, its use for this process did not violate Irish data protection law.

The agreement between IRMA and Eircom went beyond merely imposing a three strikes policy. Under the agreement, "Eircom has agreed that it will not oppose any application our client may make seeking the blocking of access from their network to the Pirate Bay or similar websites." As technology journalist Adrian Weckler notes, this is particularly problematic:

“Irma is drawing up a list of websites it doesn't like and Eircom will block them to all of its customers. And Irma is demanding that other ISPs do likewise, on pain of being sued.

Eircom says that it will only block a website if a court order requests it to. But it has undertaken not to oppose any application to a court, meaning the order is automatically granted. It's a technical way of getting out of taking responsibility for it.”

IRMA has already used this clause of the settlement agreement to have Eircom block the Pirate Bay on its network. Although the blocking of a site that openly flouts copyright law might not inherently seem problematic, blogger Damien Mulley points out just how far reaching this settlement could be:

“So first they’ll start with the Pirate Bay. Then comes Mininova, IsoHunt, then comes YouTube (they have dodgy stuff, right?), how long before we haveBoards.ie because someone quoted a newspaper article or a section of a book? And don’t think they’ll stop there too, any site that links to The Pirate Bay and the others on the hate list will probably be added to the list too[…]

I’m sure the business case for Eircom was they didn’t want any more costly High Court actions […] but this is going to open up a can of worms with IRMA demanding more and more attacks on how people surf the net, this is what it is in my view an attack on our freedom to read, our freedom to write, our freedom to move around the web. […]

And of course the costs of communications with IRMA and of the filtering is going to be passed on to the consumer. The cost of blocking a single site will be almost nothing I suppose but as more sites get added and as the arms race between the pirates and the ISPs escalates, then it’ll become complicated and complicated costs more. So again the majority get to pay[…]”

The Irish government has also become involved in filtering web traffic. The Irish police force has recently been sending out letters to ISP’s asking them to block certain web pages that contain child porn. As Digital Rights Ireland points out in a blog post there are major problems with this policy because it "require[s] ISPs to take additional steps to monitor users, resulting in real risks to privacy. These risks are amplified in the case of the Garda proposals which – incredibly – would require ISPs to report details of web browsing without any legislative basis whatsoever."

Impact of the Settlement on Other ISPs

IRMA has sued [eight] another Irish ISPs to try to impose similar agreements to filter and adopt Three Strikes regimes.

UPC, an Irish cable network, refused to enter into an agreement with IRMA. In July of 2009, IRMA sued UPC claiming that UPC was liable for infringement because their network facilitated illegal file sharing.

In October of 2010, Justice Charleton denied IRMA’s request for an injunction against UPC. Although the court was sympathetic towards the music industry’s concerns, the judge ultimately concluded that the remedies sought for termination, filtering and blocking, could not be granted because Ireland had not fully implemented its obligations under the 2000 EU e-Commerce and EU Directive 2002/21/EC into Irish law. In short, Irish law did not include provisions for "the blocking, diverting or interrupting of internet communications" for violations of copyright law. 

Following that decision, the Irish government has indicated that it intends to legislate to allow injunctions to be granted against ISPs requiring them to engage in filtering. A consultation process was carried out concluding in July 2011, but no proposals have yet been published.

Infringement Notices



Upon receiving information from a rights owner about alleged copyright infringement at a particular IP address, "Internet Protocol Address Providers" (IPAPs) are required to match that address to the name of an account holder and send them an infringement notice. Three notices - “strikes” - for infringement are issued over a certain time period. The notices are called detection, warning and enforcement notices. After the account holder receives the enforcement notice, he or she faces legal action by the rights owner as explained below.

The notices must contain certain information  (e.g. identifying when the alleged infringement occurred or explaining how the account holder can challenge the notice) or else they are invalid. Warning Notices and Enforcement Notices must reference the preceding notice and explain the consequences if further alleged infringement occurs. Notices expire after 9 months, except for the Enforcement Notice, which expires 35 days after it was issued. If that happens, all other notices expire with it.



At the moment, the law does not require IPAPs to send notices to cellular mobile network service customers. This exemption automatically expires on 30 September 2013, unless Parliament decides to delay, repeal or modify the relevant provision.

Like the similar ISP notice-forwarding obligations under the UK Digital Economy Act, the costs of implementing New Zealand’s three strikes law are shared by ISPs and rights owners through a "notice fee" regime. Set by the regulations, ISPs can charge rights owners a $25 notice fee (at most) for identifying subscribers and sending them notices.

Disconnection Orders and Financial Penalties


As mentioned previously, disconnection orders are not currently available, but the three strikes law provides that they can be brought into force with relatively little procedural effort. In this case, the rights owner can seek a court order requiring an IPAP to suspend the account of the account holder for any period up to 6 months. To do so, the court must be satisfied that copyright infringement occurred at the account holder’s IP address, and that suspension is "justified and appropriate in the circumstances, given the seriousness of the infringing." (section 122P, should it come into force). The court is required to consider the following:

• the degree of the account holder’s reliance on access to the Internet;
• whether it would be manifestly unjust to suspend the account holder’s account; and
• any other matters specified in regulations (section 122P(4)).

Rights owners can at current apply to the Copyright Tribunal for a financial penalty of up to $15,000. When applying for a Tribunal order, rights owners have to pay a $200 application fee. To date there have been three Copyright Tribunal decisions, as explained below.

The three strikes law requires both the Tribunal and the District Court to order IPAPs to disclose account holder information.

If a rights owner applies to the Tribunal for financial penalties then the Tribunal can order the IPAP to disclose the account holder’s information — to the Tribunal, not to the rights owner. The Tribunal need only be satisfied that the IPAP sent a valid Enforcement Notice (i.e. it contains the correct information, is not expired, etc).

If section 122P of the law comes into force, a rights owner can obtain the account holder's identity by applying to the District Court for an order terminating Internet access for up to 6 months. The Court will force the IPAP to disclose account holder information if, like the Tribunal, it is satisfied that the IPAP sent a valid Enforcement Notice and the rights owner promises it won’t use the account holder’s information for anything else except to have their Internet cut off.

IPAPs must retain data on the allocation of IP addresses to each of its account holders for a minimum of 40 days (no expiration date is specified).

IPAPs must also retain the following data for a minimum of 1 year (again, no expiration date is specified):

• infringement information received by copyright owners,
• infringement notices sent,
• challenges to infringement notices receieved from the account holder, and
• Internet disconnection orders.

Internet users can be disconnected in several ways under South Korea’s three strike law:

• The Korean Minister of Culture, Sport and Tourism can order online service providers to suspend Internet users’ accounts for up to 6 months, after giving three warnings to remove or block allegedly infringing content.
• The Minister can issue orders to online service providers to suspend part or all of an online bulletin board or service (such as a webhard/ cyberlocker) which has received three orders directing it to delete or suspend transmission of particular content;
• The Korean Copyright Commission can make recommendations to online service providers to suspend particular users’ accounts for a non-defined period.

Suspension of Internet Users’ Accounts

Article 133-2 (1) of the Korean law empowers the Korean Minister of Culture, Sports and Tourism (the MCST) to order online service providers to:

(a)   issue warnings to “reproducers and interactive transmitters” of infringing copies of copyrighted works and information about circumvention of technological protection measures that is sent through  “information and telecommunication networks”: and

(b)  delete or suspend interactive transmission of that material

If an alleged copier or transmitter that has received three of these warnings transmits a further allegedly infringing copy or TPM circumvention information, the MCST can order the online service provider to suspend the account for a period of up to 6 months (Article 133-2(2)). The law exempts email exclusive accounts from suspension.  The Minister issued such warnings to 749 users’ accounts in 2010 and 220 users’ accounts during the first half of 2011.

In addition, the MCST can order online service providers to suspend part or all of a bulletin board established on an information and telecommunications network which has received three or more orders to delete or block particular online transmissions within a 6 month period, if it is considered to “seriously damage sound use of works, etc. in light of the format of the corresponding bulletin board, and the amount or nature of reproductions posted on it” (Article 133-2(4).

Before issuing a suspension order, the MCST must ask the Korea Copyright Commission to deliberate on various factors set out in Presidential Decree No. 21676 including the Internet user’s recidivism, the quantities of works allegedly reproduced or transmitted, the kinds of infringement, the possibility of market substitution, and the influence of infringing reproductions on the distribution order of works.

On receiving a MCST order to suspend an individual’s Internet access, online service providers must give the Internet user at least seven days’ notice of the impending suspension of their Internet account. On receiving a MCST order to suspend a bulletin board service, the OSP must give at least 10 days’ notices of the impending shutdown or part or all of the bulletin board notice by posting a notice on the bulletin board’s website.

The Presidential Decree prescribes the periods of suspension for Ministerial orders:

• Less than one month for a first suspension;
• Not less than one month and less than three months for a second suspension; and
• Not less than three months and less than six months for a third or subsequent suspension.

Suspension on Recommendation of Korea Copyright Commission

Perhaps more worryingly, individuals’ Internet and online services accounts can also be suspended for an indeterminate time period on the recommendation of the Korea Copyright Commission. Article 133-3 of the Korean law authorizes the Korea Copyright Commission to recommend to online service providers that they take corrective measures, in accordance with Presidential Decree No. 21676, including:

• Issuing a warning to an alleged reproducer/ transmitter;
• Deleting or blocking the transmission of allegedly copyright infringing material; and
• Suspending the account of an Internet user that has repeatedly reproduced or transmitted an allegedly infringing copy or TPM circumvention information.

The text of this Article leaves open the possibility of a KCC recommendation for suspension of users’ Internet access or online services account even where the account holder has not received a previous “strike” or warning. However, at the moment, the KCC follows a bylaw issued by the KCC that requires suspension recommendations only for accounts that have received three prior warnings or ”strikes”. (See clarification provided by Heesob Nam.)

According to the Korea Copyright Commission (http://www.copy112.or.kr), the Commission issued 42,794 warnings in 2010 and 54,268 warnings during the first half of 2011. Further, the Commission has recommended the suspension of 91 users’ accounts in 2010 and 54 accounts in 2011 (first half).

Blocking

Created by: law

Article 104 of the Korea law provides that online service providers whose main purpose is to transmit information to one another using computers ("special online service providers", or what might be understood as ‘mere conduit ISPs’) shall, upon a rights-holder's request, implement technical measures blocking illegal transmission of the materials and other necessary measures. Details of what measures can be taken and requirements for valid rightsholder requests are set out in the Presidential Decree.

Spain

Partners

Spain was historically home to sensible copyright enforcement – balancing the needs of creators against users’ innovative approaches to sharing through new technology. But pressure from the U.S. government to enact intellectual property enforcement has jeopardized Spain's pragmatic approach.

The Spanish Congress enacted copyright enforcement provisions in 2011 as part of a larger economic modernization act. The proposals create a fast-track method for removing would-be infringing content from the Internet. ISPs are incentivized to block access to infringing content as soon as it is reported, thereby avoiding further hassle related to the quick procedures. 

The good news is that the legislation does not require ISPs to adopt Three Strikes Internet disconnection of individuals. However, the bad news is that it follows the recent trend of imposing obligations on Internet intermediaries to block content and raises concerns for user privacy.

Even as the copyright laws in Spain threaten digital rights, Spanish courts are taking affirmative steps to narrow copyright enforcement. In particular, a recent ruling by a top Spanish court indicates that the judicial branch is not inclined to hold websites that host links to copyright-infringing materials liable for violating copyright law. This contradicts efforts of the executive branch and the U.S. government to enforce intermediary liability through overbroad copyright legislation. It is not yet clear which branch of government will prevail.

Ley Sinde – Online Service Providers Liability Act

The Sustainable Economy Act ("SEA" -- Statute 2/2011, March 4th) had its origins in a legal initiative approved by the Spanish Cabinet on November 27, 2009. Its main objective was to modernize the Spanish economy in financial, corporate, and environmental matters in order to respond to an economic crisis. The original version of SEA included the so-called Sinde Act ("Ley Sinde"), named after Spain's Ministry of Culture, Angeles Gonzales-Sinde. Ley Sinde was intended to shut down websites that host links to copyright-infringing material. From the beginning, Ley Sinde raised serious concerns for Spanish citizens' rights of due process, privacy, and freedom of expression

According to cables released by WikiLeaks and reported on by El Pais, the U.S. government played a key role in architecting Spain's copyright enforcement initiatives. El Pais reported that in 2008 the U.S. government threatened to put Spain on the annual Special 301 Watch List issued by the Office of the U.S. Trade Representative unless the new Spanish government announced new measures to address Internet piracy. The U.S. made good on its threat to add Spain to the Watch List in 2008 and 2009. The Spanish government responded by proposing Ley Sinde as part of the SEA in 2009.

Perhaps due to the revelations in the WikiLeaks cables, Ley Sinde was highly controversial and was defeated in 2010. However, the bill was reinstated within months, and the SEA -- including Ley Sinde  -- was approved by the Spanish Congress on February 15, 2011. The Spanish executive office deferred to fully enact the copyright law due to its wide unpopularity. In reaction, the U.S. raised the stakes and stated that they would elevate Spain in the USTR's annual Section 301 report that year by listing it in the “Priority Watch List”.  This threat was the final trick. On December 30 2011, the newly elected executive government passed Ley Sinde by approving the regulation that dictated the application of the law. In the 2012 Special 301 Report, the USTR no longer listed Spain.

Blocking

Stage One: ISP Notice Forwarding

The DEA has several phases. In the first phase, ISPs are required to send copyright notifications to subscribers at identified IP addresses on receiving “Copyright Infringement Reports” (CIRs) from copyright holders. The details of how this will work and what ISPs must include in these notifications are set out in a draft Initial Obligations Code produced by the UK telecoms regulator, OfCom.

When a “Qualifying Copyright Owner” sends a valid Copyright Infringement Report to an ISP to whom the Code applies, the ISP must match the IP address in the report with the name of the relevant account holder, and send a first notification to that subscriber. CIRs must include the date, time and duration of the alleged infringement, the IP address used for the alleged infringement, the name of the copyrighted material involved, indicate what part of it was made available, and provide a hash of the copyrighted material.

The draft Code  provides for three escalating notifications to Internet users. ISPs are required to send successive notices to identified subscribers when they receive a valid CIR at least one month after the previous one. If an ISP receives three notices within a 12-month period, it is required to put that account on a blacklist – the “Copyright Infringement List.” At present, ISPs are not required to take the next step and disconnect users’ accounts. This policy decision reflects empirical surveys conducted by the UK government indicating that around 70% of Internet users would refrain from further copyright-infringing filesharing after receiving a first notice alleging copyright infringement. It also reflects British ISPs’ long-standing resistance to Internet disconnection obligations.

The DEA puts the burden on copyright holders to bring lawsuits to enforce their rights. On request from a rightsholder, ISPs are required to provide an anonymized version of the Copyright Infringement List. Copyright owners can then apply to a court for a “Norwich Pharmacal” order directing the ISP to unmask the subscribers that used the identified IP addresses. Rightsholders can then file copyright infringement lawsuits directly against them.

ISPs are only required to take action on valid CIRs that include all specified information, and only for copyright owners that have paid their notification fees to ISPs (see Facts and Figures below) and certified to Ofcom that their system complies with relevant data protection laws (Qualifying Copyright Owners). Finally, the Code provides an appeals process before an independent appeals body for subscribers who wish to challenge copyright infringement notifications.

In its initial phase, the Initial Obligations Code will only apply to fixed line broadband Internet service providers with more than 400,000 subscribers. This captures the seven largest ISPs (BT, O2, Orange, Post Office, the Talk Talk Group, Sky, and Virgin Media) , which account for about 96% of the UK broadband market. It excludes smaller ISPs, in recognition of the burden that costs of compliance would impose on them. The Code also excludes mobile network providers, which allocate IP addresses differently from fixed broadband providers, making subscriber identification from IP address more costly.

Both libraries and citizens who provide open wifi to downstream Internet users seem to fall within the ambit of the DEA. While they are not currently required to send notifications under the Code, they could receive CIRs for actions taken by their downstream users. The DEA essentially creates a new duty to secure open wifi connections against possible misuse for copyright infringement. CIRs will contain information on how to do so. This puts the onus on providers to explain why they should not be held responsible for infringements of downstream users using their Internet connection, and creates unfortunate incentives to restrict or eliminate downstream open wifi use.

The Initial Obligations Code has not yet taken effect. OfCom released a draft in May 2010. The UK Department of Culture, Media and Sports has announced its intention to move forward with implementation of the DEA. A final version of the Code was expected in Autumn 2011. However, in October 2011 the UK Court of Appeal granted an appeal of the judicial review of the DEA sought by UK ISPs British Telecom and Talk Talk. As a result, the timeframe for full operation is now unclear. Ofcom recently estimated that the first letters to alleged infringers will not be sent until the summer of 2013.

Stage Two: Technical Measures

In its second phase, the DEA empowers the UK Secretary of State to make an order requiring ISPs to adopt “technical measures” – including disconnection of subscribers’ accounts – if he or she determines after 12 months that the current notice forwarding regime has not been successful at curbing online copyright infringement. If the order is approved by Parliament, it would result in a Three Strikes Internet disconnection regime.

Technical measures that ISPs can use against infringers include (section 124G):

(a)   limiting the speed or other capacity of the service provided to a subscriber;

(b)  preventing a subscriber from using the service to gain access to particular material, or limiting such use;

(c)   suspending (i.e. disconnecting) the service provided to a subscriber; or

(d)  limiting the service provided to a subscriber in another way.

While there has been much recent discussion about the proposed US website blocking legislation, the Protect IP Bill and the Stop Online Piracy Act, this policy debate has been fought longest in the UK.

Section 17 of the DEA

UK rightsholders, led by the British Phonographic Industry, pressed for the inclusion of expansive new website blocking provisions in section 17 of the DEA.

Section 17 empowers the Secretary of State to create regulations (through secondary legislation) for courts to issue “blocking injunctions” to ISPs on request of rightsholders. These regulations would require ISPs to block websites and online locations that are “being or [are] likely to be used for or in connection with an activity that infringes copyright.”

Before the Secretary of State can use the blocking regulation power, he must be satisfied that:

(a) use of the Internet for copyright infringing activities is having a serious adverse effect on businesses or consumers;

(b) making the regulations is a proportionate way to address this; and

(c) the regulations won’t prejudice national security, or the prevention or detection of crimes.

The DEA also sets out conditions on the court’s ability to grant such broad injunctions. It must be satisfied that the website is:

 (i)       a location from which a substantial amount of material has been, is being or is likely to be obtained in infringement of copyright,

 (ii)      a location at which a substantial amount of material has been, is being or is likely to be made available in infringement of copyright, or

(ii)       a location which has been, is being or is likely to be used to facilitate access to a location within paragraph (a) or (b).

In addition, courts must take account of various factors, including the importance of freedom of expression and whether the injunction would be likely to have a disproportionate effect on any person's legitimate interests.

In February 2011, the UK Minister of Culture Ofocm to review the workability of the DEA’s website blocking provisions. In August 2011, the Department of Culture, Media and Sports announced that it would not go ahead with the DEA website blocking mechanism, at least for the time being. It based its decision on the  Ofcom’s May 2011 report.  It found that the website blocking provisions were not workable in their current format, but did not reject use of website-blocking altogether. Instead, it concluded that website blocking could form ”part of a broader package of measures to tackle infringement.”

Ofcom’s report considered the technical feasibility of four techniques that Internet intermediaries could use to block sites:  Internet Protocol blocking, Domain Name System alteration, URL blocking, and Packet Inspection of network traffic. Ofcom weighed these measures against seven criteria: speed of implementation; cost, blocking effectiveness; difficulty of circumvention by users and counter measures ISPs could take; ease of administrative or judicial process; the integrity of network performance; and the level of granularity of blocking that is possible and its corresponding impact on legitimate services.

Ofcom concluded that while it is feasible to “constrain access to prohibited locations on the Internet” using these techniques alone or in combination, “none of the techniques is 100% effective; each carries different costs and has a different impact on network performance and the risk of over-blocking” and that “[f]or all blocking methods circumvention by site operators and Internet users is technically possible and would be relatively straightforward by determined users.” However, it found that:

Although imperfect and technically challenging, site blocking could nevertheless raise the costs and undermine the viability of at least some infringing sites, while also introducing barriers for users wishing to infringe. Site blocking is likely to deter casual and unintentional infringers and by requiring some degree of active circumvention raise the threshold even for determined infringers.

Ofcom concluded that if blocking is to be implemented, DNS blocking is the preferable approach because it would cause the least delay and cost – two of the key concerns voiced by copyright holders. It also recommended supplementing that with a requirement for search engines to delist websites. Ofcom acknowledged that DNS blocking is at best a short-term solution because implementation of DNS Security Extensions (DNSSEC) will shortly make DNS blocking more transparent and less effective. It recommended Packet Inspection as a longer-term solution, but emphasized that it is technically complicated and raises a number of complex legal questions – such as whether DPI is compatible with UK privacy and data protection law.

Ofcom concluded in their assessment of the Digital Economy Act blocking provisions that the approach set out in the DEA is unlikely to be effective. The Government, in response, said they would not bring forward the blocking measures 'at this time'. The powers remain written in the law.

Section 97A of the Copyright, Designs and Patents Act

Apart from the expansive potential new enforcement powers in the DEA, rightsholders can get broad blocking injunctions against ISPs and online payment intermediaries under existing section 97A of the 1988 UK Copyright, Designs and Patents Act. As a result, UK IP rightsholders can require ISPs to block vast parts of the global Internet, even if the DEA website blocking provisions never come into operation.

Section 97A implements the UK’s obligations under Article 8(3) of the EU e-Commerce directive (2001/31/EC), which requires EU member states to “ensure that rightsholders are in a position to apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right.” Section 97A permits rightsholders to seek injunctions where a service provider has actual knowledge of another person using its service to infringe copyright.

In a key test case brought by the six major Hollywood Studios in July 2011, the UK High Court ordered British Telecom to block its UK subscribers from accessing the Newzbin2 website. Under the terms of the injunction issued in October 2011, BT was required within 14 days to block or attempt to block access to www.newzbin.com, its domains and sub-domains. This includes payments.newzbin.com and “any other IP address or URL whose sole or predominant purpose is to enable or facilitate access to the Newzbin2 website.”

The court required BT to utilize:
(i) IP address re-routing in respect of each and every IP address from which the website operates and which is notified in writing to the Respondent by the Applicants or their agents; and

(ii) DPI-based URL blocking utilizing at least summary analysis in respect of every URL available at the Newzbin2 website and its domains and sub-domains.

The Newzbin2 case is widely seen as setting a precedent that will result in a flood of IP rightsholder requests for blocking of a broad range of websites. Indeed, shortly afterwards, in November 2011, the British Phonographic Industry asked BT to voluntarily block access to The Pirate Bay under threat of a lawsuit for a section 97A injunction.

Rightsholders’ Proposed Voluntary Blocking Code

In addition to legislation and recent litigation, rightsholders have sought a Voluntary Code in closed-door meetings held by the Minister for Culture, Communications and the Creative Industries, Ed Vaizey, in June 2011. The aim of this Code would be to speed up the process of getting sites blocked. Under this, ISPs would be required to “inhibit.. access to websites that are substantially focused on infringement of copyright.” This would be overseen by a “neutral expert body” which would make recommendations to ISPs on measures that they can implement and “technical enhancements” that ISPs may need to keep pace with online copyright infringement. This body would also review evidence, and after notification to the identified site, certify rightsholder applications for injunctions to streamline the judicial process for obtaining blocking injunctions at the Applications Court of the High Court. The Proposed Voluntary Code would apply to websites “mainly hosted overseas, which make available, facilitate the making available of, or otherwise authorize the infringement of copyright content in the UK.” This would require changes to how the legal process works. The body would review the evidence, and after notification to the identified site, it would certify rightsholder applications for injunctions to streamline the judicial process for obtaining blocking injunctions at the Applications Court of the High Court.

The DEA requires ISPs to build systems that gather and retain logs and data necessary for identification via IP address matching, and to keep track of valid CIRs sent by rightsholders.

This raises significant concerns for Internet users’ privacy, and the obligations of ISPs under UK data protection law. This is one of the grounds of the legal challenge to the DEA brought by UK ISPs British Telecom and Talk Talk, in which the digital rights, consumer and human rights groups, Open Rights Group, Consumer Focus and Article 19 have intervened. At first instance, Justice Kenneth Parker in the High Court of Justice, Queen’s Bench Division (Administrative Court) found that the proposed data processing was permissible under EU law. However, in October 2011, the UK Court of Appeal granted BT and Talk Talk the right to appeal on this ground.  The appeal hearing will take place on January 16^th 2012.

As the UK data protection law implements the UK’s obligations under the EU Data Protection Directive (95/46/EC) and the EU Privacy and Electronic Communications Directive (2002/58/EC), observers across Europe are closely watching the UK challenge. Interest in the UK challenge is also particularly high in light of the European Court of Justice’s 2008 ruling in Promusicae v. Telefonica,  the recent ECJ decision in the SABAM v. Scarlet case , and the 2011 European Commission consultation on the EU IPR Enforcement Directive (2004/48/EC).

Following the previous experience in Ireland, the DEA and the draft Ofcom Code include various features intended to provide Internet intermediaries with protection against liability for disclosure of Internet users’ personal data. ISPs are required to disclose the identity of subscribers who have received three CIRs to rightsholders only upon receipt of a Norwich Pharmacal order from a court directing it to do so.

In addition, the DEA framework includes several procedural protections for Internet users. First, Qualifying Copyright Owners are required to submit a Quality Assurance Report to Ofcom before sending its first CIR to an ISP. Copyright owner reports must describe the processes and systems used by copyright owners and the agents acting on its behalf (such as Dtec) to gather evidence about alleged infringements. Ofcom are required under section 7 of the Digital Economy Act to set out the standard of evidence required of copyright owners, although the draft Initial Obligations Code only outlined a 'quality assurance process'. Qualifying Copyright Owners must also certify to Ofcom that their processes comply with relevant data protection laws. Second, participating ISPs are also required to submit their own Quality Assurance Report to Ofcom, certifying that their systems comply with relevant data protection and privacy laws.

Third, ISP notifications to subscribers must include a statement that subscribers have the right, under data protection legislation, to any information held about them, including CIRs sent by copyright owners to ISPs. Fourth, ISPs are only required to retain information about subscribers generated under the DEA for limited time. ISP notifications must inform subscribers that ISPs are required to destroy CIRs and other information held about the subscribers after 12 months, as far as is reasonably practicable.

The U.S. does not have a formal disconnection policy for ISPs, although under Section 512 of the DMCA, individual websites must cancel the accounts of "repeat infringers." There is no strict definition of “repeat infringers” and is usually determined by individual company policy.

However, in July of 2011, major telecom companies and ISPs struck a deal with big content providers to help them police online infringement, "educate" allegedly infringing subscribers and, if subscribers resist such education, take various steps including restricting their Internet access. A lengthy “Memorandum of Understanding" (MOU) was released laying out the details of the agreement.

The MOU calls for the creation of a new organization, called the Center for Copyright Information (CCI), to administrate the six-strikes system. CCI will be governed by a six-person executive committee comprised of representatives from content owners and Internet access providers. A three-person advisory board will include members "from relevant subject matter and consumer interest communities," who will be given the chance to speak up whenever the executive committee asks.

Internet access providers can punish accused subscribers by interfering with the subscribers’ connectivity, including by slowing transmission speeds, temporarily restricting web access for "some reasonable period of time," and conditioning web access on completing a "meaningful copyright education program." These mitigation measures can be imposed solely on the basis of the content owners’ assertions, without a judge ever determining that the subscriber did anything wrong.

The MOU does create a process designed to protect subscribers from unfounded accusations and punishment, but it’s hardly due process, and can be read about in more detail here

Currently, there are no U.S. laws mandating large-scale filtering or blocking of websites. Federal laws requiring ISPs to filter material to the general public have been ruled unconstitutional, though none have dealt directly with copyright.

However, the Department of Homeland Security has asserted authority to seize specific domain names.

Under the proposed Stop Online Piracy Act, the U.S government would be given more power to force DNS providers to block domain names and blacklist websites. In essence, the Attorney General can force the domain name provider, servers, search engines, payment processors, and advertisers to stop doing business with alleged infringing websites—essentially “disappearing” the site off the web.

SOPA would also allow rightsholders to directly force payment processors and advertising networks to cut ties with a site simply by sending a notice alleging the site (or a portion of it) is enabling, facilitating, or taking steps to “avoid confirming” infringement. Rightsholders can also enforce these notices through court orders.  In addition, payment processors and advertisers would be given immunity if they voluntarily stop doing business with a website as long as they had a “reasonable belief” that the website was engaging in infringing activity.

This type of action acts as indirect censorship; without a revenue source, the alleged infringing site will starve to death.

Section 512 of the DMCA lays out the takedown and notice procedure copyright holders must comply with to compel websites to take down alleged infringing material.

When issuing a takedown notice to a website, rightsholders can also get a subpoena to unmask the alleged infringer. To comply with the statute, the rightsholder must go to court and provide a copy of the takedown notice, identify the alleged infringing material, and where the ISP can find the material on its site. If the website is properly served with the subpoena when it receives the takedown notice, it must hand over the identifying information to rightsholder.

When unmasking users of peer-to-peer services, rightsholders have generally followed the model of those filed by the RIAA starting in 2003. Rightsholders begin by suing unnamed “John Does” then seek to subpoena the ISPs of users in order to obtain their identities. They can then sue the individuals themselves.