Martin Keegan, Deputy Leader,
Campaign for Digital Rights
(mk@ukcdr.org)
The UK Patent Office has recently requested1comments from the public concerning its proposals for the incorporation of the European Copyright Directive2 (EUCD) into the law of the United Kingdom. This document comprises the response of the Campaign for Digital Rights (CDR) to this consultation exercise.
This response first sets out the assumptions CDR has made with regard to the extent of the UK's legal obligations to implement the Directive, and the limits to the discretion enjoyed to the Government as a result of the particular mechanism chosen for fulfilling these obligations. On what it is hoped is a balanced view of the Government's freedom of action, the response then identifies areas of concern where the proposed implementation may permissibly be modified. The response's proposed alternative statutory language is located in the Recommendations section.
Broadly speaking, the response concentrates on Articles 6, 7 and 9 of the Directive, which concern, inter alia, the legal protection of technological systems which restrict or monitor the use of copyrighted works. The Government has expressed its view that it wishes to pursue a minimalist implementation of the Directive, and not revisit the balance established with the passage of the Copyright Designs and Patents Act 1988 (``the CDPA''). CDR, whilst accepting that it may be necessary for intellectual property regulation to become more restrictive in response to changing costs of infringement, enforcement and detection, also seeks a minimalist and balanced implementation, contending that the proposals in this response will better preserve the balance of the law in practice.
It is hardly a secret that CDR would prefer an entirely different Directive altogether--the response however aims to identify how the Government may work within the flexibility afforded by the existing Directive, and does not recommend against implementing the Directive itself3.
The areas of concern are as follows:
This response makes the following legal assumptions:
The response places some reliance on the savings clause in Article 9 of the Directive, and on interpretation of the recitals in the Directive's Preamble.
Economically, copyright resembles a monopoly--a single entity controls the availability of a good. Some monopolists have an incentive to ``price discriminate''7, to maximise revenues; this practice may also be more socially efficient, but involves invasions of the privacy of consumers. Technological measures allow rightsholders the ability to increase the extent to which they can price discriminate.
With existing law and technology, this practice could only be undertaken in a rudimentary manner. For example, a book is indirectly available from the publisher in many ways: hardback, softback, second-hand, public libraries, borrowing from acquaintances, etc. Traditionally with software, licensing may be used to restrict aftermarket activities of consumers, in addition to discounts for particular low-income groups. In both cases, the publishers are not ordinarily able to collect information about the identity of readers and users, or how much they use the products, or, say, how long they spent on each page. This information however is of economic value for the same sorts of reasons as supermarkets record purchases with voluntary ``loyalty'' cards.
Technological measures may by their operation render it impossible for a user to opt out of such a ``loyalty'' scheme. The rightsholder may contrive to ensure that a prohibited8 circumvention is the only way for a user to protect his privacy. Whereas some rightsholders may be subject to European data protection law, this will not be the case where the rightsholder is based overseas9, or has ceased to exist, or never existed. Those holding or receiving the data need not be connected with the rightsholder. Nor might some technological devices cease recording and disseminating personal data when a rightsholder ceases to exist.
Compact disks have been available in the UK which have the ``phone home'' property10. Windows Media Player is gradually acquiring these sorts of properties; it is already outside the control of the user, and phones home to a Microsoft website.
Given that incentives exist to invade user privacy via the vigilanteism (or ``self-help'') of technological measures, and the inability of data protection and privacy law to prevent such intrusion effectively and efficiently, there is no reason to privilege technological measures against user vigilanteism. Circumvention undertaken solely for the purpose of protecting privacy should not be prohibited. This does not conflict with the Directive: Article 9 indicates that the protection in the Directive shall be without prejudice to provisions on privacy, which is a right treated as fundamental in the European legal order. The scope of the right to privacy in European law is such that any restrictions thereon must be prescribed by law, and necessary in a democratic society for the protection of the rights of others11.
In the case of protecting personal privacy, the United States' Digital Millennium Copyright Act permits individual acts of circumvention against certain technological systems12. It would be difficult to argue that Europe, with its stronger privacy protection policies, should nevertheless regard their abridgement as socially necessary when even the United States has legislated otherwise. Ultimately, the non-moral aspects of the privacy question reduce to the consideration of the economics of customer profiling--less privacy will generally equate to less inefficiency and higher social costs. This is a minor economic policy decision of how much rent the producer can accumulate with the State's say-so, hardly a matter of necessity. In their economic analysis of the DMCA's anti-circumvention rules, Samuelson and Scotchmer13 conclude that an anti-circumvention rule narrower than that passed by Congress would still achieve the objective of protecting copyright holders but with lower burdens for other actors. If it was not thought necessary even in the much less privacy-conscious United States, should it be any less unnecessary to allow circumvention rules to override privacy interests in Europe?
Given the incentives to abridge user privacy, and the inability of data protection law alone fully to alleviate the problem, the UK must interpret its obligation to implement ``adequate legal protection''14 against acts of circumvention ``without prejudice to provisions concerning''15privacy, as not overriding the user's right to circumvent if that is necessary to protect his privacy.
``It is impossible to reverse engineer a technical protection measure without circumventing it''16. The consequences of a broad restriction on reverse engineering in the context of digital information markets are far-reaching. The rules in Article 6 of the Directive will allow the designer of a product to render it a crime or at least a tort for a company to develop a complementary product17, thus allowing abusive control over related markets. The Directive intends the opposite result; Recital 50 of the Directive states that legal protection for technological measures ``should neither inhibit nor prevent the development or use of any means of circumventing a technological measure that is necessary to enable acts to be undertaken in accordance with the terms of [certain provisions of the 91 Directive]''. The acts protected are related to the economic process of reverse engineering, which is critical to the functioning of the software industry. The Government must not allow those who would seek to distort competition to hide behind the protection of Article 6, which was not intended for this purpose, as is clear from the recital and from Article 9, the latter of which leaves the Government considerable discretion in this area.
This issue is discussed at length elsewhere, both by legal and economic commentators18 and directly by the judiciary: Jacob J noted that Sony would have had no anti-trust defence to claims that it could completely control the market for Playstation games, as a result of its control over the copy-protection systems employed in Playstation consoles, in the liability hearings in Sony v. Owen19This case turned on the precise construction of the current §296 of the CDPA.
Without specific legislative enactment, the courts will continue to rule as in the Sony case, irrespective of how worthy the defendant is. Where it would be contrary to public policy in competition, actions under A6(2) in particular must be barred. Such a bar must even apply in respect of the residual §296 (which will only regulate computer software after the implementation of the Directive), otherwise UK law will not be in compliance with the intent of the Directive.
The importance of interoperability and reverse-engineering to the computing industry cannot be overstated. The Government must use the discretion afforded by the Directive to protect these activities to the extent justified by public policy.
[This section contributed by Julian T J Midgley20]
Academic cryptographers review algorithms proposed by their peers, examine algorithms and devices used by industry, and in the ordinary course of events, publish the results of their research, to assist in the advancement of knowledge of cryptography, and to enable flaws in algorithms to be corrected. Technical protection measures applied to copyrighted works frequently involve the use of cryptographic algorithms, and often make use of known algorithms that are used for a variety of purposes, many of which may have nothing whatever to do with technical protection measures. As it stands, the proposal hinders research into cryptography in the following ways:
It cannot have been the intention of the legislators to give an empty promise in the Preamble.
In response to Article 6(4) of the Directive, the Government is proposing a scheme whereby beneficiaries of copyright exemptions may apply to the Secretary of State for an order requiring the rightholder (or other responsible person) to make available to them the means necessary so to benefit where this has been restricted by technological measures21.
Whereas some have sought to characterise this as ``apply to the Government to get your freedom of speech back'', such a statement is misleading, since the main exemptions critical to freedom of expression are not even included within the scope of A6(4).
The Directive seems to require that Member States ensure the required availability, whereas the proposed implementation puts this at the discretion of the Secretary of State. This is presumably judicially reviewable, but if the matter can end up in the courts, why force the applicant to go through the administrative procedure in the first place? Judicial determination of civil rights is a requirement of the ECHR22--then again, the copyright exemptions necessary for the preservation of expressive freedom of the individual and the press aren't preserved against rightsholder appropriation in A6(4) in the first place.
A better means to ensure the required availability would be to retain the scheme of an action in breach of statutory duty, but remove the requirement for the intervention of the Secretary of State. The normative effect of this would be dissuasive of abuse by righsholders of technological measures. Additionally, the costs dumped onto users, and the disincentives for beneficial transformative uses of copyrighted material, would be greatly reduced.
The proposed legislation encompasses criminal provisions, though this is not required by the Directive. The offence to be created by §296ZB would be one of strict liability--the prosecution would not have to prove intention, knowledge, or recklessness23 on the part of the defendant.
At the very least, some form of knowledge on the part of the defendant ought to be required, otherwise unknowingly doing some of the prohibited acts will be punishable by the criminal sanction. As drafted, the only defence of ignorance available is to be that the defendant must prove that he did not know the technological properties of the devices in question.24
The wording of the criminal provisions suggests they are analogous to the criminal provisions elsewhere in copyright law. The basic infringement is civilly actionable, and aggregated forms (the ``in the course of a business'' or ``to such an extent as to prejudicially affect ...'' language) are criminalised. The provisions of A6(2) should not be regarded as analogous to copyright regulations. A6(1) is unconnected with infringement--intent to circumvent, not to infringe, is all it is necessary to prove; what is enjoined is an activity generally preparatory to infringement, but which may be undertaken for legitimate purposes (though such legitimacy is not recognised by the Directive). A6(2) then enjoins preparatory activities (the tools needed to perpetrated acts prohibited by A6(1)) at an additional step removed from the infringement the Directive purports to be intending to prevent. Possessory and other inchoate versions of the offence are even further removed from the undesirable act of infringement, and the legitimate reasons one might undertake the conduct to be prohibited broader still.
In light of the indirect nature of the protective objective, the breadth of the criminal sanctions being proposed, the absence of any requirement for criminality, the CDR submits that the proposed §296ZB goes too far. It should be amended at the very least to include some intent test on the part of the accused.
Additionally, the drafting of the legislation should make it clearer that there is no intent to criminalise recording studios which employ devices designed to add and remove copy-protection from media such as digital audio tapes.
Freedom of speech is implicated when copyright or similar regulations impinge on one's ability to express an idea. This is not normally a problem--a speaker should just employ a different means of expression which isn't copyrighted! However, such substitutability does not always obtain; one might need to incorporate the copyrighted expression of another to convey one's own idea.
Copyright law is said to accommodate legitimate freedom of expression interests internally, that is to say, the statute incorporates them. Such an assertion is supported by the courts and other commentators25 through the invocation of some combination of the doctrine of the ``idea/expression dichotomy'' and the observations that copyright is limited in term and subject-matter26, and subject to exemptions27 and other limitations28. The leading cases in the UK and United States both involve newspaper scoops of unpublished memoirs of former political leaders29, and in both jurisdictions it has been held by the courts that the copyright statute accommodates freedom of expression sufficiently. The reasoning has rested primarily on the idea/expression dichotomy as combined with the statutory copyright exemptions - the former limits copyright only to the particular form of expression chosen by the author, and the latter permits even this to be used in certain cases, which is important as idea and expression are not always separable in practice30.
In Ashdown, the Court court held that ``the provisions of the Act alone can and do satisfy the [requirements of ECHR Article 1031]''. These provisions are identified as the fair dealing exemptions in Chapter III of the CDPA and the public interest rule in §171(3) of the same legislation, and it suggested that no other legislative provisions outside the Act need be considered32. Logically, then, if these sections were amended, the CDPA might subsequently fail to comport with the requirements of ECHR. It is clear from the judgment that ECHR interests would not permit the wholesale repeal of these sections. What is less certain is the degree to which the reduction of fair-dealing provisions in the statute may permissibly broaden copyright protection; at some point the protection afforded to rightsholders must become so burdensome of speech as to transgress ECHR Article 10's requirement of necessity within a democratic society.
The Court offers no analysis of which particular exemptions in CDPA protect freedom of speech, merely noting that Laddie J has counted forty-two circumstances in which unlicensed reproduction is non-infringing. The ruling seems to suggest that the mere existence of a substantial number of such exemptions insulates the CDPA from Article 10, or that these should be weighed collectively when balancing the freedom of expression requirements of the Article against the protection of the ``rights of others''. The exemptions are not analysed for the extent to which they constrain copyright protection to that which is socially necessary33. That having been said, the context in which these remarks were made was a case concerning a five-star freedom of expression claimant - a mainstream national newspaper. It is difficult to envisage how CDPA could avoid conflict with ECHR, absent protection for news reporting, criticism and review.
The Directive will of course cause the CDPA to be amended34, and thus raises precisely the possibility that the currently conformant balance found by the Ashdown court will be upset. The Directive's anti-circumvention35 and anti-device provisions36, read in isolation, violate ECHR Article 10, as they restrict freedom of expression to an extent not ``necessary in a democratic society'', nor are they mitigated by the parallel benefits guarantee of A6(4) to an extent sufficient to withstand ECHR scrutiny.
It is not clear how A6(2) could be interpreted so as not to conflict with ECHR's requirements for freedom of expression. A defence could be afforded however to those who breached laws established under A6(1) for the purposes of securing their rights under ECHR Article 10.
§296ZD may go beyond what the Government may permissibly provide for by way of a statutory instrument, in that it redefines the Directive's objective definition of what constitutes a technological measure. The words ``is intended, in the normal course of its operation'' allow the rightsholder to substitute his intentions for the technological facts.
Technological measures which due to misdesign do not achieve the protective objective should not be legally protected to the same degree as those which actually work. The contrary intentions of those applying the measures should not have any saving effect. Not all such malfunctioning systems would be laughed out of the Courts on the application of some sort of de minimis principle.
The statutory language proposed by CDR is as follows:
It may also be beneficial to include language clarifying that the mere provision of information, as opposed to devices or services, does not bring one within the scope of §§296ZB & 296ZC.
The author wishes to thank the following for their assistance in the production of this response: Julian T J Midgley, Gerry Magennis, David Harris, James Boyle, Carl May Smith, Joe Myers, Sebastiaan Kokelaar, Matthew Lavy, Alison Perrett, Peter Clay, Chris Lightfoot, Matthew Johnson, the Randolph Hotel in Oxford and the staff of almost every coffee shop in Cambridge.
This document was generated using the LaTeX2HTML translator Version 2K.1beta (1.48)
Copyright © 1993, 1994, 1995, 1996,
Nikos Drakos,
Computer Based Learning Unit, University of Leeds.
Copyright © 1997, 1998, 1999,
Ross Moore,
Mathematics Department, Macquarie University, Sydney.
The command line arguments were:
latex2html -split 0 cdrporesp.tex
The translation was initiated by Martin Keegan on 2002-11-03