High Court of Ireland Decisions

Judgment Title: EMI Records & Ors -v- Eircom Ltd


Neutral Citation: [2010] IEHC 108


High Court Record Number: 2008 1601 P

Date of Delivery: 16/04/2010

Court: High Court

BETWEEN

EMI RECORDS (IRELAND) LIMITED

SONY B.G. MUSIC ENTERTAINMENT (IRELAND) LIMITED,

UNIVERSAL MUSIC IRELAND LIMITED, AND

WARNER MUSIC IRELAND LIMITED

JUDGMENT of Mr. Justice Charleton delivered on 16th April, 2010

1. A settlement has been effected in the litigation between the parties. Its purpose is to diminish the theft of copyright material over the internet. The infringers are to have their service cut off. This judgment concerns the compatibility of what the parties have agreed in relation to data protection legislation. The substance of the original case concerned the stealing of copyright-protected sound and video recordings over the internet, mainly by peer-to-peer sharing groups. Eircom Limited, the defendant, is an internet service provider and some of their customers, among others, engage is this activity. Nothing suggests any willing infringement of copyright by Eircom, or that they were in any way a party to copyright theft. That, however, does not mean that an injunction cannot justly and conveniently be granted against a conduit for copyright infringement; a point to which I will return. The plaintiffs are big players in the music and film industry. They represent sound recording and motion picture artists who have assigned their copyright in new original creative work to them in exchange for financial backing, promotion and the protection of a commercial organisation to further their interests. Remuneration for that kind of work is shrinking by reason of copyright theft over the internet. I will describe the process shortly.

2. Since the parties in this case resolved their differences, after eight days of evidence, it was not necessary for the Court to make an order. On 28th January, 2009, terms of settlement were set down in writing and filed in court. The implementation of that settlement raises issues under the Data Protection Acts 1988 and 2003 and, in consequence, the terms agreed must be scrutinised by the Court to analyse its compliance with that legislation. Because a large amount of computerised data was involved, one of the parties communicated with the Data Protection Commissioner to seek his advice. He, in turn, raised three issues as to why the settlement might be doubted to conform with the legislation as to the manner of its implementation. By order of Kelly J. made in the Commercial Court motion list, and dated 18th January 2010, I am asked to rule on these issues. Hence, this judgment is given after argument by the parties to the main case. The Data Protection Commissioner did not appear because of a concern over indemnity as to his costs. I will shortly recite each issue and my conclusion thereon but, firstly, I need to refer to some background.




Background
3. The problem faced by the plaintiffs is extremely serious. Many talented artists have assigned copyright in their musical and cinematic work to them. In common with many other occupations, those working in the music and film industry may be at the very top of the earnings ladder or at the bottom without even a foot on the first rung. Most will be somewhere in between. It is of no interest to me as to whether people hold views that the music and film industry either over-rewards or unfairly-exploits its artists. Copyright is a universal entitlement to be identified with and to sell, and therefore to enjoy, the fruits of creative work. It applies to everyone who manages to produce anything copyrightable from a song, to a telephone directory, to a symphony, to a film. Were copyright not to exist, then the efforts of an artist could be both stolen and passed off as the talent of another. Were the artist not entitled to exploit her or his creation by preventing others from copying it without permission, usually for a fee, then the fruits of moments of inspiration worked out through weeks of endeavour and representing, sometimes, the distillation of some fundamental experience of life, would bring no reward, perhaps not even applause. Even if an artist won acclaim, it alone would not keep body and soul together. Examples of what can occur where copyright protection is absent used to be found as notorious examples of unfairness in history rather than as a contemporary situation that has developed because of the abuse of the internet. When Jan Sibelius, a Finn, penned his Valse Triste, Finland was part of the Russian Empire, not a party to the copyright convention, and the great composer received nothing for what was then his most popular work. The three early ballets of Igor Stravinsky, a Russian, suffered the same fate; though on moving to the West, the composer re-orchestrated them and republished them gaining copyright but only in that form. No reasonable person doubts the injustice of that situation. The law does not doubt it either.

4. When the internet gained wide currency in the 1990s many of its adages began to believe that a new form of reality had been created. Some felt that it should be subject to no rules since, as it was not based in a particular country, but as its name implies is a world-wide web of communication, unlike the previous means of communication through the post, by telephone, through television or through films, it seemed to be impossible to subject to local regulation. That is not so. Nor should it be. In common with other aspects of life, the internet has both a positive and a dark side. On the positive side, its aids free communication; it opens up avenues of knowledge so that it has become a centre of learning in itself; it furthers public debate; and has established the swiftest and most far reaching form of communication that humanity has known. It is, on the other hand, also thickly populated by fraudsters, pornographers of the worst kind and cranks.

5. The internet is only a means of communication. It has not rewritten the legal rules of each nation through which it passes. It is not an amorphous extraterrestrial body with an entitlement to norms that run counter to the fundamental principles of human rights. Since the early days of the internet, and increasingly as time has gone on, copyright material has been placed on the World Wide Web by those with no entitlement to share it. There, it is downloaded by those who would normally have expected to pay for it. Among younger people, so much has the habit grown of downloading copyright material from the internet that a claim of entitlement seems to have arisen to have what is not theirs for free.

6. How is this done? The internet consists of millions of connected computers with linkages established by many thousands of internet service providers operating very large computers. The defendant Eircom is one of these. Normally, an internet service provider could not be expected to control the contents of what flows over the communications channel between its customers, who pay them for internet service, and others on its network, or elsewhere on the World Wide Web. Before this case, Eircom did not monitor its customers. It provides a service and lets the customer proceed with enjoying the benefits of that. This freedom does not exempt the customer from criminal or civil liability. There is nothing in the criminal or civil law which legalises that which is otherwise illegal simply because the transaction takes place over the internet. Child pornography, for instance, remains child pornography whether sent by post or digitally transmitted.

7. Those who wish to obtain, or to share, copyright material which belongs to others, without acknowledgement of their rights and without payment, frequently join a peer-to-peer network. This may consist of a swarm of thousands of computers which are all on line at any one time and connected through internet service providers. To obtain the relevant software for downloading complex material in musical or cinematographic form, an internet user can go to an illegal site. Legal downloading of free material is also becoming increasingly popular on sites hosted by, for instance, national radio and television broadcasters. Many television and radio networks store material for legally downloading for free from their television or radio archives, or for listening or seeing again, using an ‘i-Player’ system, or something similar. This can be accessed on their websites, and links to the relevant software as a free service are often provided. The software for peer-to-peer illegal downloading, on the other hand, is obtained from such sites as Pirate Bay. That is only an example. As I understand the evidence that I heard, internet sites like that one supply two basic things. Firstly, they will allow downloading of the relevant software for peer-to-peer illegal file participation. Secondly, those so inclined can learn from such sites what swarms of active computers contain the material that they want to filch. Then, a person so inclined will open up a new file on their computer with the relevant newly-downloaded software. This enables a peer-to-peer download. It also makes each downloading participant an uploading participant whereby others in an active swarm will load from each other participant. This happens because of the peer-to-peer software and it happens whether a participant wants it to happen or not. Whatever is within the peer-to-peer file that is necessary for illegal downloading on a computer will be copied as a participant downloads and will be sent over the internet, through the internet service provider, and into, and from, the participant’s computer. This is a complex activity and used to be very slow. Using high speed broadband quickens the process. That which used to take hours can sometimes now be completed in minutes. As to a song or a video, it does not all come from, nor is it all taken from, the same participant. Again, reviewing the evidence that I heard in this case, it seems to operate like this: each digital encoding of a musical or cinematographic work is split up into miniature files. These may last a couple of seconds in real time when played. They, as well as being in digital language, have a beginning and an end code in digital format. Since internet technology is partly about the shortest route of communication, the peer-to-peer software enables the illegal downloader to obtain a few seconds here, there and elsewhere from participating swarms. The overall file of the work will be identifiable in the beginning and end codes and within the intermediate codes. These will arrive randomly, a bit like a computer image building up on the screen, and be put together by the computer software docking the beginning and end codes of each of the few seconds into a complete and chronologically correct entity. While a participant is downloading this material, each participant’s own computer engages with the swarm so that every music song or video in the relevant file of each individual computer becomes available to thousands of other users around the world. They will mutually download, and so illegally share material, in the same way.

8. In general, no one will come knocking on the door of any of these people. Up to the terms of settlement agreed between the parties in this case, moreover, no internet service provider had apparently agreed to attempt to tackle this copyright-repugnant situation of their own volition. From the point of view of the participants, everyone seemed to win; except for the creators of original copyright material who were, and are, utterly disregarded. It is only common sense that this attraction of free, but illegal, downloading of the latest songs and videos made the sale of internet access attractive. Those who wished to filch the copyright material of others had to provide others with material to be filched from them. The more the participants, it seems, the easier the internet route. The only downside to participation, mentioned in the course of the hearing, is that the mischievous side of the human personality, containing a repulsive aspect as well as an attractive and humorous one, has also come to the fore over the internet. Using these networks exposes participants in the swarms to severe computer-crippling viruses.




The Settlement
9. Because this process takes place over the internet in generally unencoded form, software has been developed to detect illegal downloaders. One such was referred to in evidence as DtecNet. This is one of the current technology market leaders, but if encoding of illegal sharing of copyright material increases - it is now in its infancy - technology for detection will have to forge ahead also. Companies operating this or similar services are hired by the plaintiffs. Under the terms of the settlement, these companies tell the plaintiffs that a particular computer has been involved in illegal file sharing of its copyright material. This information is passed by one of the plaintiffs to the defendant Eircom, as the internet service provider. It then informs its subscribers that they have been detected infringing copyright. If there is a second occasion of illegal downloading, Eircom is obliged, when so informed, under the settlement to write to the subscriber warning them that unless that sort of infringement ceases, they will be disconnected from general internet service. This disconnection does not apply to any telephone or television service that a subscriber gets over their internet facility. On a third infringement, that discontinuance is implemented by Eircom: the subscriber is taken off service except for phone or television internet access. This is a serious sanction. Some would argue that it is an imposition on human freedom. There is no freedom, however, to break the law. Further, while it is convenient to have internet access at home, most people in Ireland have only to walk down to their local town centre to gain access for around €1.50 an hour. The parties also agreed, under the settlement, to negotiate a protocol setting out the details of the precise procedure for implementing this settlement.

10. Since it was likely to be deeply unfair that only Eircom with about 40% of the market share, as the defendant in these proceedings, should bear the burden of this settlement, thus activating the winds of market forces to drive customers towards Eircom’s competitors, the plaintiffs agreed to initiate similar proceedings against other internet service providers in the State. This, I understand, has been done. That case is in the Commercial Court list for hearing on 10th June, 2010. In addition, Eircom agreed not to oppose an application by the plaintiffs to injunct the Pirate Bay site. I have already given judgment on this ex tempore, closing down access to that site through Eircom; see EMI v. Eircom, [2009] IEHC 411, (Unreported, High Court, Charleton J., 24 July, 2010).




The Protocol
11. The settlement was always going to be difficult to implement precisely. The parties agreed, as part of it, to negotiate a protocol governing their respective sides of the bargain. I wish to refer to the main points. There has to be an education and awareness campaign by Eircom, directed at its internet customers, about the abuse of peer-to-peer software, securing broadband installation in the home and how signs of copyright infringement might be detected by the main householder. A lot of this seems predicated as likely to happen at teenager or slightly older level. The implementation of the settlement was to be phased in by a three month pilot programme; because this was the only way the parties could see how things were working and to analyse how practical their measures might be proved to be. There were to be exceptions to the ultimate sanction. Some people might be depending on their broadband internet access for medical services and others for their livelihood. Where an infringement took place within a business, but contrary to the internet use policy within the organisation, communication by way of admonition might replace the ultimate measure of shutdown. Other categories of exception might grow over time. In terms of privacy, there are two provisions which are relevant to the data protection legislation to which I shall shortly turn. Under para. 2.10 of the protocol, where an exception to shut down after a third infringement occurs in the manner provided for, Eircom will only communicate with the relevant plaintiff to the effect that “this IP address does not fall with the terms of the protocol”. Under para. 2.3, notification by one of the plaintiffs to the defendant that there has been an illegal downloading of their copyright material consists of details of the copyright holder (which could be, for example, a particular songwriter); that a breach of copyright has occurred; details of the relevant album or song or video; the IP address that has been detected in infringing copyright; and other details that show proper investigation, namely, the relevant software used and the digital fingerprint of the copyright material used.

12. Then one moves on to the three infringement levels under the protocol. Nothing in these provisions changes one basic fact. Neither DtecNet, or any similar service of detection, nor any of the plaintiffs whose copyright material is being infringed would ever know through this process that the infringer is a particular person living in a particular place in Ireland. What they do know is that a particular IP address has been involved in the downloading. An IP address is the number given to a computer from an internet service provider when it receives internet access. The IP number electronically identifies the user of the internet. Banks of numbers for IP addresses are produced by an international organisation and these, in turn, are provided to internet service providers. One can find out by looking at the IP number, I understand, who the internet service provider is. What internet service provider is given what bank of thousands or millions of IP numbers is not kept a secret anywhere. Since each internet service provider will have, in turn, many thousands of customers, one is not moving much closer to finding out the identity of an internet abuser by knowing the copyright infringing IP address was assigned to that company. That number will probably give you no more than an indication of the domicile of the computer. Further, I am convinced, on the basis of the affidavit evidence before me, that the plaintiffs have no interest at all in using this process to find out who the copyright infringers are. Rather, what they are interested in is having the protocol work so that the plague of copyright infringement may be undermined.

13. On the first infringement, the bill payer at the IP address will be told with their bill that an infringement was detected at such and such a time in respect of a particular song, or whatever it is, that is subject to copyright. This enables them to reflect on their conduct or to communicate with the rest of their household. On a second infringement, a formal letter is received by the customer from Eircom. This is to the same effect, but it will presumably be couched in stronger terms than the warning with the bill. The customer can only go to level 2 after fourteen days have passed since the first infringement. As I understand it, these communications may also contain information concerning how to keep one’s computer secure from, for instance, the person next door and other continuing education tips. When a third infringement notification is received by Eircom from one of the plaintiffs, after a further fourteen days, Eircom must then review all the evidence. This is done on a human basis; the first two levels operating automatically. A termination notice is then issued to the customer giving fourteen days before cut-off. The customer is then entitled to make representations to Eircom, as the internet service provider, over the telephone or through the internet. The user’s representation is considered by Eircom, not in consultation with the plaintiffs, under para. 2.8 of the protocol. Private matters involving extenuating circumstances, so as to call into play one of the exceptions, or material whereby it is claimed as a matter of fact that the infringement has not taken place at all, must be considered by Eircom. Then, if that does not cause the consequences of the protocol to be diverted or postponed, the customer is cut-off from internet service.




The Eircom Subscriber Contract
14. Eircom provides internet service to its customers based on a written contract. This document is very strong in the pact which a customer makes with Eircom not to use the internet for illegal purposes. Under clause 2.1 of the agreement, the customer agrees to avail of the facility of internet service subject to the terms and conditions set out in the written document. Among the matters which the customer has to agree to is not to use the facility to create, to host, or to transmit obscene or racist material; clause 5.3. The customer must agree not to use the facility of internet access to infringe the propriety rights of any software; clause 5.6. Under clause 5.10, the customer agrees that the internet service can only be used in accordance with the acceptable usage policy posted in clear terms on www.eircom.net. This site displays a clause very similar to clause 5.5 of the contract which, because of its importance to the issues which follow, I should now quote:-


“Customers may not use the facility to create, host or transmit material which infringes the intellectual property rights including, but not limited to, the copyright of another person or organisation”.

15. Clause 7.1 provides that the agreement may be suspended or terminated by Eircom for breach of its terms. It is important to recall that it is one of the basic functions of the courts under the Constitution to give effect to lawful agreements.




The Issues Raised
16. By letter dated 4th December, 2009, the Data Protection Commissioner wrote to the solicitor for the plaintiffs raising a number of concerns as to the lawfulness of the settlement terms. These were later, on the 15th January, 2010, encapsulated by Philip Lee, solicitor, in a precise form for which the Court is grateful. These are the three issues:-


“1. Do data comprising IP addresses, in the hands of EMI or its agent(s), and taking account of the purpose for which they are collected and their intended provision to Eircom, constitute “personal data” for the purposes of the Data Protection Acts, 1988-2003, thereby requiring that the collection of such IP addresses by EMI or its agents must comply with the specific requirements of each of section 2, 2A|, 2B, 2C and 2D of the Data Protection Act, 1988 as amended?

2. Having regard to section 2A(1) of the Data Protection Act 1988 as amended, and assuming for current purposes that the processing by Eircom of “personal data” in the context of the third of three steps envisaged by the graduated response scheme proposed under the terms of this settlement, (i.e. the termination of an internet user’s subscription) is “necessary for the purposes of the legitimate interests pursued by [Eircom]”, does much processing represent “unwarranted [processing] by reasons of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”?

3. Having regard to section 2A(1) and 2B(1) of the Data Protection Act 1988 as amended, is it open to EMI and/or Eircom to implement the graduated response process set out in the terms of the settlement including, in particular, the termination of an internet user’s subscription under step 3 of that process, in circumstances where:-

(a) In doing so they would be engaged in the processing of personal data and/or sensitive personal data (in so far as the data can be considered to relate to the commission of a criminal offence), including the provision of such data from one private entity to another private entity; and

(b) The termination of an internet user’s subscription by Eircom would be predicated on the internet user in question having committed an offence (i.e. the uploading of copyright-protected material to a third party by means of a peer-to-peer application) but without any such offence having been the subject of investigation by an authorised body; and, further, without any determination having been made by a court of competent jurisdiction, following the conduct of a fair and impartial hearing, to the effect that an offence had in fact been committed.”

17. I now propose to address each of these issues in turn and to rule on same.




Issue 1
18. Here, for the sake of clarity, is issue 1 again:


“Do data comprising IP addresses, in the hands of EMI or its agent(s), and taking account of the purpose for which they are collected and their intended provision to Eircom, constitute “personal data” for the purposes of the Data Protection Acts, 1988-2003, thereby requiring that the collection of such IP addresses by EMI or its agents must comply with the specific requirements of each of section 2, 2A|, 2B, 2C and 2D of the Data Protection Act, 1988 as amended?”

19. Personal data is defined by s. 1 of the Data Protection Act 1988, as amended by the Data Protection (Amendment) Act 2003, as:-

“Data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller.”

20. Under the same section of the Act, the data controller is defined as meaning a person who, either alone or with others, controls the contents and use of personal data. What is involved in the first, second and third step of the protocol is the scanning by either the plaintiff personally, or more likely through computer agencies hired in that regard, of the entire internet network to see whether any infringement of copyright material is taking place. Attention is likely to be focused in Ireland for these purposes. Using software such as DtecNet, their efforts will gain two basic pieces of information. Personalising DtecNet, for the moment, it, as a computer programme is only interested in the copyright material of the plaintiffs, or one or other of them. Continually scanning and rescanning internet communications, it finds the material being transmitted in various directions from peer-to-peer, or similar, swarms and, in effect, follows the communication down the line until it ends up in a particular computer and takes note of its IP number. In the course of the case, I heard that some computer firms are also developing automatic systems to cut copyright infringing communications prior to completion; but that is not relevant here. In some way, perhaps because the signal runs two ways, at least after the first illegal download, DtecNet and similar systems are able to find out the IP address and what infringement of copyright material has taken place. This is the material that is then collected in blocks and delivered to one or other of the plaintiffs. As I have previously indicated by reference to the protocol, none of this material gives any clue as to the name of the main householder, or business, or café in which the computer is situated or whether it is in An Gorta Choirce in County Donegal or in Ranelagh in Dublin.

21. I need to refer here to what processing means under the Act, as amended. This is set out thus in s. 1, the definition section:-


“Processing, of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including -
(a) obtaining, recording or keeping the information or data,

(b) collecting, organising, storing, altering or adapting the information or data,

(c) retrieving, consulting or using the information or data,

(d) disclosing the information or data by transmitting, disseminating or otherwise making it available, or

(e) aligning, combining, blocking, erasing or destroying the information or data;”

22. An Act should never be split up into its constituent pieces and then analysed as if each were disconnected from the broader purpose that constitutes the legislation. Insight is often gained as to the meaning of a particular section, or indeed a definition, by showing how it is used in conjunction with other sections, or by analysing how the same concept is dealt with elsewhere. The definition of disclosure in s. 1 of the Act assists in this regard. That definition states:

“Disclosure, in relation to personal data, includes the disclosure of information extracted from such data and the transfer of such data but does not include a disclosure made directly or indirectly by a data controller or a data processor to an employee or agent of his for the purpose of enabling the employee or agent to carry out his duties; and, where the identification of a data subject depends partly on the data and partly on other information in the possession of the data controller, the data shall not be regarded as disclosed unless the other information is also disclosed”.

23. I do not accept fully the dictum of McMullin J. in Transport Ministry v. Simmonds, [1973] 1 NZLR 359 at 363 as to what the word “likely” means when used within a statute. To be personal data, under the Act, the information has to identify a living individual from the data or from data in conjunction with other information in the possession of the data controller, or from other information that is likely to come into the possession of the data controller. McMullin J. says that the word likely can be used in many contexts and that its meaning has to depend upon the particular context of the statute or regulation. That is hard to disagree with. He refers to an event which is likely in terms that it “may be an event which is probable but it may also be an event which, while not probable, could well happen”. In addressing juries, judges in this jurisdiction refer to the civil standard of proof as being that a fact is shown to be more likely than not; in other words, more probable than not. In referring to a sporting fixture, the pundits will say that one team, rather than another, is the likely winner. Where a group of teams is involved, the most likely winner may be identified and, in that context, the word may be used to mean something other than probable. If likely does not mean probable in a particular context, it at least means something akin to probable. I agree with McMullin J. that the word “likely” has no relevance to any concept such as a bare possibility, and I am rather inclined to believe that in most, if not all, statutory contexts that likely means probable; no more or less than that.

24. The previous approach of the plaintiffs to the problem which I have described was to apply for what are now called Norwich Pharmacal orders; named after the House of Lords decision in Norwich Pharmacal v. Customs and Excise [1974] AC 133. That order involves an application against an innocent party, such as Eircom, to disclose information because a civil wrong is being, or was being, perpetrated against the plaintiff and because the defendant, though not a party to the wrong, can identify the tortfeasor. In EMI Records v. Eircom Limited [2005] 4 IR 148 Kelly J. made such an order against the defendants in the context of the activity that I have described earlier in this judgment. The plaintiffs were then exploring obtaining information by court order in civil proceedings as to who was infringing copyright over the internet and then following up on that by further legal action. I do not regard it as relevant whether that further action might be criminal or civil. The purpose of this settlement is different. Kelly J. made an order that Eircom should disclose the names of its infringing customers, the plaintiffs having first supplied a tranche of IP addresses together with evidence of copyright infringement. That order was made on the basis that there had been a demonstration of wrongful activity by unknown persons who were internet subscribers of Eircom whereby copyright assigned to the plaintiff was being infringed. The stated purpose of such an order was to enable the plaintiff to then directly take action against each such illegal downloader. Kelly J. considered in depth the issue as to whether the information required could be obtained elsewhere than from the defendant. The action in question is pointless, in terms of the practical application of litigation tools, and the Norwich Pharmacal order is not allowable as a matter of law, unless the only practical way of obtaining the identifying details is through the suit. Since the High Court has made such an order in the context of this problem, I regard it as beyond doubt that it was both necessary to make the order disclosing the tortfeasors and that the judgment conformed with the requirements of the procedure that is so clearly set out in the judgment of Kelly J. The difference between that order and this settlement, is that the plaintiffs have left behind what they reasonably regard as an expensive and futile pursuit of the identity of copyright tortfeasors in favour of injunctive relief that has been expressed in the settlement of this case as a protocol to choke off the problem in a three stage process that never involves the identification of any wrongdoer.

25. In consequence, I conclude, that none of the plaintiffs have any interest in personally identifying any living person who is infringing their copyright by means of the settlement and protocol. I do not regard it as at all likely that they will attempt in any way to use the IP address as supplied to them by DtecNet of those engaged in illegal downloading in order to find out their names and addresses. Further, since, on the affidavit evidence before me, the plaintiffs had previously engaged in expensive litigation against Eircom in order to find out who they were, there seems no legal avenue open to them to get that information apart from an application for the names and addresses of the copyright thieves to the internet service provider. It is proved to me to be close to impossible that they could have recovered them by any easier or less pricey means. Nor do any of the plaintiffs have any intention of engaging in any illegal activity. Rather, the entire purpose of this litigation is to uphold the law. The first question is therefore answered no.




Issue 2
26. The second issue raised by the Data Protection Commissioner questions whether the settlement furthers any legitimate interest pursued by Eircom and asserts a possible conflict with the fundamental rights and freedoms of the data subject. For the sake of clarity, I reproduce it again:


“Having regard to section 2A(1) of the Data Protection Act, 1988 as amended, and assuming for current purposes that the processing by Eircom of “personal data” in the context of the third of three steps envisaged by the graduated response scheme proposed under the terms of this settlement, (i.e. the termination of an internet user’s subscription) is “necessary for the purposes of the legitimate interests pursued by [Eircom]”, does much processing represent “unwarranted [processing] by reasons of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”?

27. I define this issue as involving, firstly, identifying if there is a necessity from the point of view of Eircom in entering into the settlement. Secondly, it is relevant whether there is any right to steal somebody else’s copyright material. Thirdly, and in the context of the first two questions, it is relevant to ask if the protocol involves any interference with any fundamental right or freedom involving internet service. If so, I must consider any intervention on the basis that the interference should be proportional and justified. This involves, in this context, looking at what is protected; how important that right is; what level of threat is directed at that right; and what level of participation may be legitimately inferred against the data subject. Since this question is responsibly based by the Data Protection Commissioner on s. 2A of the Act as amended I need to quote that in full:

“2A(1) Personal data shall not be processed by a data controller unless section 2 of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met:
(a) the data subject has given his or her consent to the processing or, if the data subject, by reason of his or her physical or mental incapacity or age, is or is likely to be unable to appreciate the nature and effect of such consent, it is given by a parent or guardian or a grandparent, uncle, aunt, brother or sister of the data subject and giving such consent is not prohibited by law,

(b) the processing is necessary –

(i) for the performance of a contract to which the data subject is a party.

(ii) in order to take steps at the request of the data subject prior to entering into a contract.

(iii) for compliance with a legal obligation to which the data controller is subject other than an obligation imposed by contract, or

(iv) to prevent –

(I) injury or other damage to the health of the data subject or

(II) serious loss or damage to property of the data subject,

or otherwise to protect his or her vital interests where the seeking of the consent of the data subject or another person referred to in paragraph (a) of this subsection is likely to result in those interests being damaged.

(c) the processing is necessary –

(i) for the administration of justice,

(ii) for the performance of a function conferred on a person by or under an enactment,

(iii) for the performance of a function of the Government or a Minister of the Government, or

(iv) for the performance of any other function of a public nature performed in the public interest by a person.

(d) the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”.

28. In dealing with this aspect of data protection entitlement, I feel I must return, for a moment, to some basic principles of law. There is fundamental right to copyright in Irish Law. This has existed as part of Irish legal tradition since the time of Saint Colmcille. He is often quoted in connection with the aphorism: le gach bó a buinín agus le gach leabhar a chóip (to each cow its calf and to every book its copy). I regard the right to be identified with and to reasonably exploit one’s own original creative endeavour as a human right. Apart from legal tradition, the rights now enshrined in the Copyright and Related Rights Act, 2000 were, under their previous legislative incarnation, identified in Phonographic Performance Ireland Limited v. Cody, [1998] 4 I.R. 504 by Keane J. at 511 as having a pre-legislative origin and super-legislative effectiveness as part of the unenumerated fundamental rights under the Constitution:-

“The right of the creator of a literary, dramatic, musical or artistic work not to have his or her creation stolen or plagiarised is a right of private property within the meaning of article 40.3.2° and Article 43.1 of the Constitution of Ireland, 1937, as is the similar right of a person who has employed his or her technical skills and/or capital in the sound recording of a musical work. As such, they can hardly be abolished in their entirety, although it was doubtless within the competence of the Oireachtas to regulate their exercise in the interests of the common good. In addition and even in the absence of any statutory machinery, it is the duty of the organs of the State, including the courts, to ensure, as best they may, that these rights are protected from unjust attack and, in the case of injustice done, vindicated.”

29. I regard that authority as both binding and sound. The courts under the Constitution are obliged to supply, even in the absence of legislative intervention, appropriate remedies for the undermining of rights within the scheme of fundamental law that the Constitution represents. As has often been said, the powers of the courts in that regard are as ample as the Constitution requires. I am, therefore, obliged by Constitutional imperative to protect, as best I can, the rights of copyright owners from unjust attack or, where that sort of attack has taken place, to vindicate their rights through an appropriate order. There is ample expression of statutory remedies in the laws passed by the Oireachtas under the Constitution. Section 37 of the Copyright and Related Rights Act 2000 provides that the owner of the copyright in work has the exclusive right to undertake or authorise others to make that work available to the public. This legal entitlement is being flagrantly violated by peer-to-peer illegal downloading. I can see no other way of looking at the problem. More than one of the conditions in s.2A of the Data Protection Act 1988 as amended is met as to both the legitimate interests of Eircom, as a responsible company, and that of the community in general. The most important of these interests is that of abiding by the law. It is completely within the legitimate standing of Eircom to act, and to be seen to act, as a body which upholds the law and the Constitution. That is what the court expects of both individuals and companies. That expectation is derived from the rights protected under the Constitution and the general pact which the people of Ireland mutually made in founding a legal system, as the Preamble to the Constitution clearly declares, that is dedicated to attaining true social order. The insertion of express conditions by Eircom in the user – internet service provider contract, as quoted above, against the use of the internet as a facility for transmitting obscene images and against the infringement of the copyright of others is a step taken in pursuance of a corporate policy that is no less than lawful and proper. It is abundantly clear that the data subject has given his or her consent in return for obtaining internet access. Under contract, if any of these conditions be breached, then their access can be terminated. It may be that internet access is available elsewhere from other internet service providers on lesser conditions. If that is so it is hard to see, however, how conditions of a contract can validly avoid the law. These, however, are the conditions that apply here. A contract for service, involving termination for breach as a consequence on the operation of a condition is present by consent. That is not all. Furthermore, such processing, involving sifting the data from the plaintiffs, warning Eircom customers and, ultimately, cutting them off, is necessary for both the performance of a contract and for compliance with a legal obligation cast upon the courts, among other organs of the State, to defend the Constitution and the laws of our society. No one in the community can escape the law, as to the obligations that it imposes or the rights that it declares. The means of infringement, or the ideology that may grow around a medium of infringement, are not germane. Otherwise, the law lacks legitimacy.

30. Even if only s. 2A(1)(b) of the Data Protection Act, as amended, was operative, it is legitimate for Eircom to have a corporate policy whereby the facilities that it hires out to the people of Ireland are used for lawful purposes only. Having that policy, they are entitled to pursue it by means of conditions in contract that incorporate an enforcement modality. The protocol is merely a more complex means to that end. I find it impossible to imagine that such interference is unwarranted because there is some fundamental right or freedom or legitimate interest in the data subject whereby, in contrast to those who engage in other forms of unlawful copyright theft which may leave them more readily subject to the law, the internet is used for the violation. There cannot be a right to infringe the constitutional rights of others, absent some argument as to a genuine and compelling competing right. In some instances, the purpose for which a right is asserted undermines its character as a right. There could not be, for instance, a constitutional right to privacy that extended to the organisation of a violent crime over the internet or by telephone. There is nothing disproportionate, and it is therefore not unwarranted, about cutting off internet access because of three infringements of copyright. The exceptions in the protocol, to which I have already referred in detail, provide for upholding relevant rights to medical care, to livelihood and to business use in appropriate circumstances. The protocol, at the relevant stage, is not inhumane or arbitrary. Rather, there is a right to make representations and these will, I am assured and I believe, be listened to if sensible and credible.

31. These are adequate procedural safeguards in the protocol and there is conformity, in addition, in my view, with article 1(b) of the European Parliament and Council Directive 2009/140/EC of 25 November 2009 amending Directives 2002/21/EC on a common regulatory framework for electronic communications networks and services, 2002/19/EC on access to, and interconnection of, electronic communications networks and associated facilities, and 2002/20/EC on the authorisation of electronic communications networks and services O.J. L 337/37 18.12.2009, commonly called the framework Directive. At the moment there is no instrument making this effective in Irish law, but I have been referred to it as a matter of caution.

32. Lastly, I note the many Directives in European Law on the harmonisation of aspects of copyright and related rights. The Copyright and Related Rights Act 2000, as amended by the Copyright and Related Rights (Amendment) Act 2007 is a domestic Act, but it must be interpreted in accordance with Ireland’s obligations under European law. In part, some terms are derived from our European Union obligations. The relevant European law Directives were implemented piecemeal over many years and later Directives, at times, repeat the text of earlier ones. Two sections of the European Parliament and Council Directive 2001/29/EC of 22nd May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society O.J. L167/10 22.6.2001 are important. Firstly, recital 59 records:-


“In the digital environment, in particular, the services of intermediaries may increasingly be used by third parties for infringing activities. In many case such intermediaries are best placed to bring such infringing activities to an end. Therefore, without prejudice to any other sanctions and remedies available, rightholders should have the possibility of applying for an injunction against an intermediary who carries a third party’s infringement of a protected work or other subject matter in a network. This possibility should be available even where the acts carried out by the intermediary are exempted under Article 5. The conditions and modalities relating to such injunctions should be left to the national law of the Member States.”

33. And then there is Article 8.3 of the Directive:-

“Member States shall ensure that rightholders are in a position to apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right”.

34. In the Copyright and Related Rights Acts 2000, as amended, references to the right of the copyright holder in section 40 to make available to the public copies of a work are declared to include such acts as broadcasting the work, issuing copies of it or renting out copies; as in DVD libraries. Then, after establishing those legal entitlements in the holder of copyright, subs. 3 and 4 of that section go together and I quote them:-

“3. Subject to subsection 4, the provision of facilities for enabling the making available to the public of copies of a work shall not of itself constitute an act of making available to the public of copies of the work.

4. Without prejudice to subsection 3, where a person who provides facilities referred to in that subsection is notified by the owner of the copyright in the work concerned that those facilities are being used to infringe the copyright in that work and that person fails to remove that infringing material as soon as practicable, thereafter that person shall also be liable for the infringement.”


35. Injunctions are granted by the court where it “just and convenient”. That is the basis for all equitable relief formalised by the Supreme Court of Judicature (Ireland) Act 1875. I interpret the Copyright and Related Rights Act 2000 as extending to the making of an injunction against an innocent third party in order to block, in the appropriate way that is convenient as to the balance between the parties and that is just, as to their standing and conduct, the wholesale illegal destruction of the right to livelihood through creative effort which copyright, as a fundamental concept in law, is designed to defend and to vindicate. I make no comment on the protection of rights through injunctive relief where a primary actionable wrong in damages is not present; see Prince Albert v Strange (1849) 2 De & Sm 293 and, more recently, Douglas v Hello! [2002] 2 A.C. 457. The second question should therefore be answered no.




Issue 3
36. Central to this two-part third issue raised by the Data Protection Commissioner is whether the processing by Eircom, through warning and then on the third infringement, through cutting internet access, involves sensitive personal data. It admits of only one answer. I, again for clarity’s sake, requote the issue:


“Having regard to section 2A(1) and 2B(1) of the Data Protection Act 1988, as amended, is it open to EMI and/or Eircom to implement the graduated response process set out in the terms of the settlement including, in particular, the termination of an internet user’s subscription under step 3 of that process, in circumstances where:-
In doing so they would be engaged in the processing of personal data and/or sensitive personal data (in so far as the data can be considered to relate to the commission of a criminal offence), including the provision of such data from one private entity to another private entity; and

The termination of an internet user’s subscription by Eircom would be predicated on the internet user in question having committed an offence (i.e. the uploading of copyright-protected material to a third party by means of a peer-to-peer application) but without any such offence having been the subject of investigation by an authorised body; and, further, without any determination having been made by a court of competent jurisdiction, following the conduct of a fair and impartial hearing, to the effect that an offence had in fact been committed.”

37. In considering this issue, I recall that since the earliest days of entitlement to copyright as enshrined in legislation, it has been both part of the civil code of law and it has also involved the creation of a number of criminal offences. These criminal offences are now set out in s. 140 of the Copyright and Related Rights Act 2000. I need to quote this in part:-

“140(1) A person who, without the consent of the copyright owner
(a) makes for sale, rental or loan,

(b) sells, rents or lends, or offers or exposes for sale, rental or loan,

(c) imports into the State, otherwise than for his or her private and domestic use,

(d) in the course of a business, trade or profession, has in his or her possession, custody or control, or makes available to the public, or

(e) otherwise than in the course of a business, trade or profession, makes available to the public to such an extent as to prejudice the interests of the owner of the copyright,

a copy of a work which is, and which he or she knows or has reason to believe is, an infringing copy of the work, shall be guilty of an offence…

(7) A person guilty of an offence under subsection (1) … shall be liable-

(a) on summary conviction, to a fine not exceeding £1,500 in respect of each infringing copy, article or device, or to imprisonment for a term not exceeding 12 months, or both, or

(b) on conviction on indictment, to a fine not exceeding £100,000, or to imprisonment for a term not exceeding 5 years, or both”.

38. These are certainly criminal offences but they are not merely regulatory offences, the commission whereof may involve no element of mental culpability beyond doing the action outlawed. They are true criminal offences. They involve an external element of the infringement of copyright, in one of the modes provided for; an absence of any consent of the copyright owner; and a mental element of knowing or having reason to believe that one is dealing with an infringing copy of the work: in other words knowledge or recklessness. I am satisfied that neither the plaintiffs as owners or assignees of valuable copyright, nor Eircom as the internet service provider, are in any way interested in the detection or prosecution of criminal offences. There are now many instances where civil liability and criminal responsibility coincide by reason of statute. The most obvious example occurs under the Taxes Consolidation Act, 1997 whereby every infringement of taxation regulation is made into a crime. Every statutory instrument of which I am aware under the European Communities Act 1972, as amended, involves an apparently fixed policy of transmuting European law Directives into Irish law in a form that makes an infringement of the relevant term a summary offence. The Act forbids the creation by statutory instrument of indictable offences. Even before that modern statutory tendency, matters such as assault and false imprisonment existed in virtually identical form in tort law and in criminal law by virtue of accepted common law definitions carrying remedies, on the one hand, in damages and, on the other, in punishment.

39. There doesn’t seem to be any relevant issue, however, as to any mental element for the proof of any relevant criminal offence in terms of the purpose in processing data that is dependent upon the legal definition of sensitive personal data contained in the definition section of the Data Protection Act 1988, as amended. I quote this:-


“Sensitive personal data means personal data as to
(a) the racial or ethic origin, the political opinions or the religious or philosophical beliefs of the data subject,

(b) whether the data subject is a member of a trade union,

(c) the physical or mental health or condition or sexual life of the data subject,

(d) the commission or alleged commission of any offence by the data subject, or

(e) any proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in any such proceedings.”

40. In consequence, it could be argued that the sensitivity of data in relation to crime is centred on the commission of the offence, or an allegation of the commission of an offence through criminal process. That could be a parking offence or a litter offence as well as arson or murder. But, criminal proofs as regards the definitional elements of the first two offences differ markedly from the last two. This much, however, is obvious. Nothing in the affidavits that I have seen, nor anything in the evidence which I have heard, shows any interest by any of the plaintiffs, much less by the defendant, in alleging the commission by the person illegally downloading copyright material, the data subject, of a criminal offence. Nothing in the protocol to which I have referred will ever involve “the disposal of… proceedings” or “the sentence of any court”. This strikes me as having high relevance to the third issue. Furthermore, since one is dealing here not with a regulatory offence, one which carries no necessary mental element of culpability, but with a true criminal offence, which does, there is nothing in the terms of the settlement, or the resulting protocol, or the attitude of the parties, which is directed at that crucial, and elusive, proof of the relevant mental element in criminal law. Rather, everything that I have seen is based upon civil law principles. In contrast to the criminal process, these establish liability by virtue of the proof of external facts, without any necessity to proceed to look to knowledge or intention, to recklessness or to criminal negligence (an element exclusive to manslaughter not relevant here). Even in the law of negligence, one is concerned with what ought to have been realised or done and not, as in criminal law, with what was perceived. As to the principles of liability, civil and criminal law are entirely different.

41. I do not believe that, in truth, this issue arises at all. Nor do I believe that it is necessary that there should be an investigation by an authorised body, or a determination made by a court of competent jurisdiction, following the conduct of a fair and impartial hearing, in order to determine that an offence has in fact been committed. That is because, in reality, no one is accusing anyone of an offence. There is no issue as to anything beyond civil copyright infringement. To accuse them of the criminal offence it would have to be copyright infringement together with the mental element expressly required by the crime.

42. In the course of the hearing, as I have said, reference was made to the framework directive, Directive 2009/140/EC. Its seems to me that the right to an effective and timely judicial review can be enabled by the State, if following settlements as carefully drafted as the protocol to which I have referred, or injunctions granted by the court in accordance with s. 40(4) of the Copyright and Related Rights Act 2000 as interpreted in accordance with Article 8.3 and recital 59 of the Directive 2001/29/EC, that an overall supervisory review of a settlement can in future be made at the time by the court granting an injunction or other order with all due respect to fundamental rights and freedoms. Any of that is an aspect of the future regulation of a very serious problem. As it is, I believe that I have made that review now and that nothing prevents the Court from enforcing the orders made in the settlement. The answer to the last composite question is therefore yes, the graduated response process is lawful. As to the present, I believe I have answered the questions posed as best I can.




Result
43. The parties can therefore lawfully proceed to implement the settlement.