EU Internet Law

SABAM

•  Requirements for ISP to install filtering software for copyright enforcement
  • CJEU decided that is not required as it potentially undermines freedom of information/speech

Deckmyn

• Parody as a way of expressing oneself, but must strike a fair balance between interests and rights of persons and freedom of expression
• Two criterias of parody:
  • Evokoe an existing work but noticeably diferent
  • Constitute an expression of humour or mockery

Google Spain

•  Balance of freedom of expression with freedom of privacy (right to be forgotten)
  • Court held that freedom of privacy bears more importance. No criteria though as when and how this limitation of a freedom can be made

1.CJEU

• Concerns Directives, regulations à preliminary rulings
• Two people cannot sue or argue directly at the CJEU, first the national court, and then to the CJEU (horizontal relations)

2.ECHR

• Covers cases between citizens/ legal persons and a state (vertical relations)

Definition:

• refers to various state efforts to eliminate certain content from internet

If the state allows certain conduct, the ISS can still decide to block this content (e.g. State allows the spreading of misinformation (vertical), however FB can block this content (horizontal))

If the state forbids certain conduct, the ISS cannot decide to still allow this content, it must obey and block content.

ISP includes ordinary telecom companies and information society services

Basic rules:

• User generated content (Who post content and who is infringer?) --> why sue the ISP?

  • Person is anonymous

  • ISP is always evident

  • ISP can always do somethig about it

  • ISP have more money

Steps:

1. ISP can be held liable for infringement
2. Unless the ISP falls within scope of article 12-14 of E-Comm Directive
   1. Art. 12: mere conduit = providing the service, but nothing to do with the content (select or modify information) etc. If you are completely passive, then you are usually in the scope of  not being liable. They can however be forced to break the passivity and then might be liable. For passive conduct you cannot sue for damages but for injunction
      1. Did not initiate the transmission
      2. did not select the receiver
      3. does not select or modify the information
   2. Art. 13: cashing = not really important
   3. Art. 14: hosting = online platforms (social media, search engine etc) and hosting providers
      1. not liable if provider does not have actual knowlede of illegal activity or
      2. the provider upon obtaining such knowledge acts expeditiously to remove or disable access to the information (e.g if FB filters all the content, then they might be liable as they would have knowledge)
3. and fulfills all the requirements

Art. 17

Main rule:

• ISP shall be liable for unauthorised acts of communication to the public of copyirght protected works

Exception:

• Unless ISP demonstrates that they have
  • made best efforts to obtain an authorisation and
  • made best efforts to ensure the unavailability of specific works
  • acted expeditiously to diable access to or remove from their websites
• --> here the EU changed its regime and for copyright infringement the ISP cannot remain passive as otherwise they become liable
  • Risk that ISP block everything (encourage cencorship)
  • This clashes with Art. 15 (General monitoring prohibition)

Privacy is a fundamental right (Art. 8 ECHR)

• everyone has the right to the protection of personal data concerning them” and “such data must be processed fairly for specified purposes and on basis of consent of the person concerned or some other legitimate basis laid down by law

Any processing of personal data is a possible interference with that fundamental right

Data is processed more than ever in the Information Societey. Free Services in exchange for data offer valuable insights. But may affect bargaining power between parties

Directive 94/46

GDPR (2016/679)

ePrivacy directive

Art. 2 Material scope

• Processing of --> not household or personal activity
• personal data --> not anonymized
• by automated means or filing systems

Art. 3 Territorial scope

• Establishment in the EU
• No establishment in EU, but Activities in EU
  • Offering of Products or Services
  • Monitoring of behaviour

Art. 5

• Lawfulness, fairness and transparency
• Purpose limitation
  • Reasons for processing, particular purpose most be determined beforehand
  • specific, explicit and 
• data minimisation
  • no more data should be processed than necessary for the purpose
• accuracy
  • data must be correct if data is not, must be adapted or deleted
• storage limitation
  • data should not be stored longer than necessary
• integrity and confidentiality
  • data security must be maintained (also when transferred to another country)
• accountability
  • One must be able to demonstrate that this is actually the fact, just being compliant is not sufficient

Furthermore, principles of data protection by design and by default

• By design: Data protection must be acknowledged already when designing an app, etc.
• By default: settings that are most friendly to GDPR, like opt in not opt out. Default settings that are most protective.

Record of processing activities (Art. 30)

• Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information --> see art.

Data Protection Impact Assessment (Art. 35)

• Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data

Prior consultation (Art. 36)

• The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk

DPO

Art. 6 (general personal data)

• Consent
• Performance of a contract
• Compliance with a legal oblgation
• Public interest
• Legitimate Interest (balancing test with fundamental rights of data subjects)

Art. 9 (sensitive personal data)

• explicit consent
• necessary for carring out obligations of employment or social protection law

• freely given --> must be specifically judged in context of contract performance
• specific --> one or more specific purposes
• informed --> aware of what is consented to)
• unabiguous --> unambiguous indication of data subject
• Right to withdraw at any time
  • data subject must be informed about this prior to giving consent

Should be given by a clear affirmative act such as by written statement, which includes electronic means or an oral statemnt

Request for consent must be clear, concise and not unnecessarily disruptive to the use of the service

Planet 49 case:

• pre clicked checkboxes for consent are invalid
• different purposes should not be bundled

Right of access (Art. 15)

Right of rectification (Art. 16)

Right to erasure / right to be forgotten (Art. 17)

• Google Spain case
  • Google was the controller as they determined the purpose and the mean
  • Balancing the interest of Gonzalez (right to privacy vs. google's interest of gathering data for search)
  • Court found that right to privacy prevails, so google was ordered to remove the link to original webpage. Original page could keep the content tho.

Right to restriction of processing (Art. 18)

Right to data portability (Art. 20)

Right to object (Art. 21)

Art. 24

Controller must implement appropriate technical and organisational security measures 

Art. 25 / 26

Data protection by design / default

• Free movement of goods
• Freedom to establish and provide services
• Free movement of capital
• Free movement of persons

The TEU sets out the objectives and principles of the EU and the TFEU provides the organisational and functional details. 4 Pillars in TFEU.

European commission

-Representatives of the MS, elected by people in these MS

-Propose new legislation

The Council of the EU

-Ministers of the states

-Are also involved in the legislation process

Parliament

-Elected by the citizens of the EU

-Discuss and approve / change the proposal

European council

-Head of states

-Set overall strategy/political agenda of the EU, meet every quarter

-Can’t do anything about legislation

European court of justice

-Judges

Law making process
1. EC, then parliament, then The Council of the EU

Goal: free trade between MS

Customs union

• Free trade area
• uniform rules for third country products

• Within the MS no boarders (taxes) can be imposed. Products need to be treated equally

External vs internal effect

External

• High entry barrier, all work together in regard to the outside of this area

Internal

• in terms of freedom of goods = more competition due to no borders

Art. 30 TFEU: prohibition of customs duties and charge

Art. 34-36 TFEU: prohibition of quantitative restrictions and measures

Art. 110 TFEU: prohibition of internal discriminatory taxation

Cassis de Dijon case (limitations to free movement of goods)

• ruling: "goods that can be lawfully produced or marketed according to standards applying in one MS can also be lawfully produced or marketed in another MS"
• but if goods are illegal in one MS --> Art. 36 TFEU
  • MS have the power to prohibit certain goods if they are justified on grounds of public morality, public policy or pubilc security but it cannot just target products of one member state --> needs to have non-economical considerations.

Art. 63 TFEU: prohibition of all restrictions on the movement of capital

MS can set limitations to this freedom, but they cannot ban everybody from opening a bank account f.e

Provides companies with the possibility to establish (anywhere) in the EU

Possibility to move to another MS or to create daughter companies

• Certain prerequisites can be established, but no total blockage can be imposed

Art. 45 TFEU: allowing EU-citizens to work in another MS

Art. 49 TFEU: allowing EU citziens to work in another MS as a self-employed person

Art. 56-57 TFEU: allowing EU citizens to receive services in another MS

In order to use EU rights, one must be economically active. So if you contribute to the state, you cannot be discriminated (CJEU ruling)

(i) the free movement of persons, services and capital is ensured; and

(ii) where the individuals and businesses can seamlessly access and engage in online activities under conditions of fair competition, and a high level of consumer and personal data protection, irrespective of their nationality or place of residence.

Goals:

• creating a digitally connected EU
• breaking down digital barriers
• investing in the digital future of EU
• technology that works for people
• a fair and competitive economy
• an open, democratic and sustainable society

• Upholding the freedom to trade on the internal market
• to promote competition by keeping prices low
• to incentivise innovation and to increase welfare.
• Protect the end consumer
• Art. 101, 102 TFEU and merger regulation prohibits horizontal and vertical restraints
• Prohibits abuse of market power

How is this done?

• Prohibiting price agreements
• Prohibiting cartels
• Rules against the misuse of dominant position
• Protect consumers from high prices

Two criterias:

(I) Undertakings are involved

• Public ltd or private companies, organisations, that conduct economic activities --> any activity related to offering goods or services
• Exemption: Tasks of public interest (Compass Case)

(II) Trade between MS is affected

• Anything that has a significant influence in a MS. A company that is only active in one MS, cannot infringe EU competition law
• Indirect or potential effects on inter-state trade fulfil this requirement

Art. 101 TFEU:

- Anticompetitive agreements

• “an association of manufacturers or suppliers with the purpose of maintaining prices at a high level and restricting competition”

Art. 102 TFEU:

- Abuse of market dominance

• "Any abuse by one or more undertakings of a dominant position within the internal market or in a substantial part of it"

Art. 101(1) TFEU schema

1. Undertakings
2. Affect trade between MS
3. Enter into an agreement, decision or concerted practise
4. Object to distort competition (prevention, restriction, distortion)
   1. Directly or indirectly fixed prices (purchase or selling) -> hardcore
   2. Limit or control production, markets, technical development or investment
   3. Share markets or sources of supply
   4. Apply dissimilar conditions to equivalent transactions (vertical)
   5. Tying: make the conclusion of contracts subject to acceptance by the other party of supplementary obligations (vertical)
5. Exemptions? Art. 101(3) --> Benefit consumers?
   1. R&D collabs.
   2. Technology transfer agreements (licencing)
   3. Sector specific (insurance etc.)
   4. Block exemptions include provisions regarding the market share ceiling and a list of black clauses.
   5. Parties need to prove that the agreement contributes to the improvement of production or distribution of goods, promote economic progress, allowing consumers a fair share of the resulting benefit
6. Exemptions of exemptions Art. 101(3) (III/IV)

Art. 102 TFEU schema

1. One or more undertakings
2. Market dominance (depends on the market)
   1. Within the internal market or substantial part of it (e.g. 50% or more, significant player)
3. Abuse
   1. Imposing unfair purchase or selling prices
   2. Limitation of production, markets etc.
   3. Applying dissimilar conditions to equivalent transactions
   4. Tying: Supplementary obligation
   5. Predatory pricing (unreasonably low prices, below average var. cost) (AKZO Case)

• They’re pervasive.

• In the information society they are more valuable than ever.

• Even if you don’t have IP, others have, so you need to be aware.

• Policy discussions abound!

Features:

• Territorial
• Exclusive

Property of intangibles

Protects:

• concrete expression of abstract ideas

Consists of subrights:

• right to use, sell, give away, exclude, make public, distribution, rental, etc.
• but also liability rules: call and put options
• creates legal monopolies

•Economies of scale

•Creates an incentive for innovation (is the argument).

•Otherwise: Tragedy of the commons.

In a nutshell, exhaustion means that when a product is lawfully put on the market, that product is exhausted, i.e. the IPR owner has lost its right to exercise the IPR protection in relation to that product

• Exhaustion takes place when the protected product has been marketed in the EU or EEA.
• only applies to the disposal right of that product.

First authorized sale of a product that uses IP exhausts the rightsholders ability to claim infringement by further sales of that product. Rightholders right to sell has exhausted, thus subsequent sales can't be prohibited. Exhaustion doctrine differs however at different territories. (e.g. EU wide exhaustion)

• Premier League Case --> no violation because UK law was in contrast to Art. 56 TFEU (free movement of services)
• Digital exhaustion (see UsedSoft Case)
  • If you receive software on a fixed medium (t.g. CD or downloaded directly on your computer), you have the right to sell said software.

• Copyright
• Trademarks
• Patents
• Business Secrets
• Design rights

Covers

• Paintings, Music, Movies, Literature, Sculpture
• Covers the artistic expression

How to get out of public domain?

• Originality
  • An concrete expression of the creators individual character, distinctive features
• Novelty
  • Subjective standard. The creator must not have seen it anywhere else
• There is no need to register, Copyright exist the moment when it is created. Lasts for 70 years after death of creator

Protected rights

• Exclusive right to copy(reproduce), show, distribute, make it accessible to the public (import etc.). Main rule, any kind of copying is covered by the right (Art. 2)
• Exception (Art. 5(1)):
  • If copying is 1) transient, 2) is an essential part of a technological purpose, which legal, Then not an infringement.

Infringement

• Infringement happens if someone else creates a work that creates the same sense of identity as the original work
• Art. 17 DSM Directive:
•  Online Content Sharing Service Providers
  • Liable for illegal content on services (Art. 17(1))
  • Unless (Art. 17(4))
    • Best effort to contract
    • Best efforts to filter if given information
    • Expeditious action upon notification

• Covers
  • Technical inventions / solutions
  • The mechanics, not designs etc.
    1. Novelty --> not previously published by others
    2. Inventive step --> must be non-obvious to a professional in the field
    3. Utility --> must have real life / industrial use
    4. Patenability -> must be recognized under national law
  • Needs to be registered for protection. Runs for 20 years, non renewable
  • What can´t be patented and why?
    • Scientific theories --> are ideas
    • Laws of nature -->  not created by humans
    • Software --> protected by copyright
    • Genes --> public policy
• Infringement
  • Based on wording of patent claims.
  • Direct infringement
    • All integers of claims are repeated in infringing product.
  • Technically equivalent infringement
    • Solving the same problem mostly in the same way

Designs:

• Covers:
  • Industrial designs
  • Ornamental or aesthetic aspect of an object.
  • Shape, pattern, or combination of these

• How do you get out of public domain?
  • New
    • Not seen before (global standard, not only in one country)
  • Individual character (legal fiction)
    • gives the informed user a different overall impression than other designs.
• Duration:
  • 25 years max, renewed every 5 years

• Practices, processes, commercial methods, compilations of information.
• Kept from public.
• Not normally known or easily learned.
• Give the Rightholder a leg up on competition.
• Protected kind of like copyright.