IMPACT®

A tale of 5 sausage rings

You can tell it's a quiet news week, up pops another example of an English eccentric falling foul of the law. In this day and age it is surprising that people still think they can use well known trade marks to promote their own businesses, and the media insists on portraying these individuals as victims. The Olympic symbol is a protected device and the body that looks after that device is positively rabid in its policing of unauthorised use.

When the UK won the competition to host the 2012 Olympics national legislation was passed to protect just about every emanation of London 2012 you can think of, presumably with an eye to re-couping some of the vast expense of hosting the game. This legislation has the dubious honour of being the most draconian legislation relating to Olympic symbols passed to date!

Mid-summer madness

For those of you heading off to the golf course this weekend, there's something other than lightning for you to worry about. It seems that a small number of golf gurus have gone so far as to patent their strokes. My advice for avoiding any possible chance of patent infringement is to head for the pub instead and use your golf clubs as tinder for the BBQ.

FSF takes the fight to Microsoft

The Free Software Foundation, the US organisation that promotes and supports free software, has issued a dramatic press release saying, of the Microsoft & Novell deal:

"If Microsoft distributes our works licensed under GPLv3, or pays others to distribute them on its behalf, it is bound to do so under the terms of that license.  It may not do so under any other terms; it cannot declare itself exempt from the requirements of GPLv3."

The FSF goes on to declare that it will "ensure... that Microsoft respects our copyrights and complies with our licences".

The GPL3 provision in question is one that I discussed in a post at the end of July. In that post, I reviewed the provision from the perspective of its enforceability by the unfortunate user who is at the receiving end of a legal claim by Microsoft. Here, the FSF is seeking to enforce the provision against Microsoft itself.

The crucial issue appears to be whether Novell is distributing GPL3 software on Microsoft's behalf or as Microsoft's agent. If this were the case, Microsoft would effectively be the distributor and therefore, for the software in question, subject to GPL3. If it is not, I am struggling to see on what grounds FSF can sue Microsoft.

Even if FSF can satisfy a court that Microsoft is subject to a GPL3 licence, the next question is how FSF can enforce the particular provision of GPL3 against Microsoft. If the court is a US one and follows the logic we've recently seen applied in the US case Jacobsen v Katzer (which was about a different open source licence, not GPL3), it might find that:

• Microsoft has permission to distribute the GPL3 software under the GPL3 licence, and therefore cannot be found to have infringed copyright; and
• Therefore the only way that Microsoft can be liable is if it is in breach of contract. In Jacobsen v Katzer, the court appears to have avoided ruling on the issue of whether a FOSS licence is a contract or not; it didn't have to because the plaintiff didn't raise the issue as part of his claim.

It would be interesting to what decision a US court would make on the "GPL3 as a contract" issue. From a UK perspective, such a decision would not set a precedent for our courts, although it might be persuasive.

As an aside, a friend has suggested to me that if Microsoft v FSF legal proceedings did begin, Microsoft might be obliged to finally disclose to the world exactly which of its patents it believes are infringed by Linux code (and are therefore the reason for the Novell vouchers), if this information could be shown to be relevant to the dispute. For us bystanders, that in itself would make the legal action worth it!

What is "personal data"? ICO issues technical guidance

The Information Commissioner's Office has issued a lengthy technical guidance document to help people understand what is and isn't regarded as personal data under the Data Protection Act 1998. Whilst the content itself is nothing new, and merely reflects current law that has already been reported, it is useful to have the content all in one place, with some good examples.

AllofMp3 set to relaunch

The BBC reports that Russian music site allofmp3.com is set to relaunch following its successful defence of criminal proceedings against it. The judge in the proceedings considered that there had been no infringement of Russian copyright laws by the owner of the site. Following this victory a statement on the site says it is to relaunch shortly which has angered opponents in the record industry.

Site users outside of Russia should take note of the health warnings that may be employed on the relaunched site to protect allofMp3. These could include what it currently has on the site it launched shortly after it was shut down - Mp3Sparks.com. This flags clearly that the site should not be used if it conflicts with laws that operate in the users country and that if such use is illegal it is not its responsibility.

As the record industry is not averse to aggressively pursuing those that infringe its rights site users can find themselves personally on the hook for such activity like the unfortunate couple in Arizona that Alex comments on below.

How to review a software licence

The IPKat has featured a series of tips on how to review software licences. The tips are designed for existing lawyers new to the field. The current post is probably the most useful, with 19 points from lawyer Richard Bridge.

"1. Which side is she on--user or licensor?
2. Law and jurisdiction (beware effect on the Unfair Contract Terms Act (UCTA) on use of jurisdiction provisions to sidestep the Act)
3. Dispute resolution/binding arbitration/dispute escalation (beware
much the same)
4. Service levels?
5. "There is no such thing as error-free software" - exclusion, limitation (particularly as to which host environments the program might or might not work with), structuring to maximise effect of the schedules in UCTA about the things to which UCTA does NOT apply
6. Backups (offer backup media at a reasonable price), the things
implied in to software licences and barred from them by the CDPA 1988. Source code escrows?
7. The grievous crime of users trying to get round encryption to
exercise such rights!
8. Ownership of media/loan; if loan, access to retrieve
9. Infringment warranties/indemnities (not). If commissioning,
ownership of copyright and proof of subsistence and title.
10. Costs in litigation if litigation can take place outside UK
11. Service (not in litigation)
12. Service (in litigation)
13. Is it the sort of software users might adapt or package? Or does it
package with it other licensed in items? Whole slew of issues here - not to mention what happens when the licensed-in bit undergoes a version change ...
14. Termination of licence, if applicable. Inspection (including by
back-door keys) to check for breach of licence terms.
15. If there are periodic licence fees, software clamping (of that
program, of other programs, of whole machines, by service engineer, or automatically)
16. Wealth creation - some software is used to create other works or
sources of revenue. Should the Licensor participate?
17. Intra-group use - Contracts (rights of third parties) Act and
barring remedies of non-parties.
18. Bespoke items - not posting details and confidentiality.
19. Computer games raise other issues too"

Subcontract the dead donkey: the extent of outsourcing in the newspaper industry

It has been said, cynically, that journalism is "the ability to meet the challenge of filling space" (Rebecca West). Well now, it seems, a lot of newspapers have outsourced that challenge to other media companies, and some in turn have also outsourced the task.

Back at the start of August, Seamus McCauley's Virtual Economics blog took a look at the extent of outsourcing within the newspaper industry, asking "what don't newspapers do?" The answer seems to be that some newspaper companies don't do much at all because it's all done by others. Of course, technically newspapers have always "outsourced" much of their journalistic function, because a lot of the hacks they use are freelance. However, Seamus McCauley is talking outsourcing to a much greater degree. Well worth a read if you are interested in keeping up with the world of outsourcing.

Also worth reading is a follow-up post by Seamus looking at the economics of online newspapers.

Arizona court finds couple liable for "making available" music on Kazaa

An interesting little report comes from Slashdot on a couple who have been held liable for "making available" music on Kazaa, the peer-to-peer (commonly abbreviated to "P2P") file sharing system.

Whilst this case was decided under Arizon/US law, the legal implications of file sharing are of relevance to all internet users. The sharing of copyrighted music on Kazaa and similar P2P networks has been an issue for years.

The issue of the moment is the sharing of much larger copyrighted content such as movies using Bittorrent, a P2P system more advanced than Kazaa. In particular, the Pirate Bay website is drawing lots of attention. Pirate Bay is a Bittorrent tracker, effectively a search engine for Bittorrent files. The Guardian's Technology section featured a really good article about Pirate Bay at the weekend, including an interview with the bods behind the site.

Number of patent applications continues to grow

The Ipeg blog brings us a report on statistics from the European Patent Office on patents for 2006. Key points are:

• Across the world, the number of patent applications is growing by 4.7% per year
• Germany files the most patents out of any EU country

Transferring personal data outside the EU: IMPACT guide to the essentials

This is a quick guide to transferring personal data from an EU country to outside the EU.

If you are intending on making a transfer, whilst this guide will give you a rough idea of the legal issues, always obtain legal advice to ensure that your transfer is compliant with the law.

The law
The use of personal data in the UK is governed by the Data Protection Act 1998 ("DPA") - see our guide to the DPA.

The Eighth Data Protection Principle of the DPA states that: 

“Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

The European Commission keeps a list of countries that the EU regards as providing an adequate level of protection.

What if the country to which personal data is to be transferred is not on the EC approved list?

• The European Commission Standard Contract Clauses. These are approved by the EC, and therefore you will achieve compliance with the law provided that you do not make any substantive changes to the documents. There are two versions: controller-to-controller and controller-to-processor.
• The International Chamber of Commerce Alternative Standard Contract Clauses. These are approved by the EC as giving an adequate level of protection. They are generally regarded as being an improvement on the Standard Contract Clauses because they are more ‘commercial’. However, the only approved version is for controller-to-controller transfers - the controller-to-processor alternative clauses are not yet approved for use. Therefore the ICC standard clauses are not always an option.
• Self-assessment. A company assesses that its arrangements for transfer are DPA compliant, even without using either of the above standard contracts. This approach is risky; even if the company spends a lot of time on assessment, there is no guarantee that the Information Commissioner’s Office would regard the arrangement as adequate in the event of a complaint.
• Obtaining a declaration of compliance from the Information Commissioner’s Office. Not a practical route. The Information Commissioner’s Office has only ever approved as adequate the 3 types of standard contract detailed above.
• Obtain data subjects consent to the transfer. Not practical or likely to be effective. To gain consent, data subjects would have to be notified of specific details of the transfer, including the fact that India does not have adequate data protection laws. The Information Commissioner’s Office has stated that consent must be specific, informed, and freely given, meaning that the consent wording cannot just be part of a larger text that data subjects read.
• Binding corporate rules ("BCRs"). BCRs are be a bespoke set of policies about data transfers for a group of companies, where the group includes companies within and outside the EU. The policies must be legally enforceable, both within the group and by data subjects and data protection authorities. BCRs must be approved by the data protection authorities, making their implementation a lengthy and expensive process. At the time of writing, two sets of BCRs have been approved by the ICO.