Legal World Law in Headlines
Resolving tension between copyright infringement and privacy. Nick Graham and Helen Anderson
The US $1bn copyright infringement case of Viacom (the owners of Paramount Studios) against the video-sharing site YouTube and its parent company Google has attracted much public and legal interest. It is a major test of the extent to which a social networking site or similar platform may be liable for infringement. However, there is another aspect of the case which has also attracted significant interest.
Viacom has successfully applied for disclosure of all of YouTube's videos, including the name and ID of every computer user watching a clip. This would involve Google handing over to Viacom and the court huge amounts of customer data, potentially covering its global customer base including those in the UK. This has raised substantial privacy concerns and questions of whether such a disclosure would be permitted under UK law.
Uncertainty
There has been some uncertainty about the scope of information Google will disclose. Viacom originally sought disclosure of the names and IP addresses of customers and which YouTube videos they had viewed. However, it appears that Viacom, recognising the privacy concerns raised about such wide disclosure, has reached an agreement with Google to provide the information in an anonymous form.
The one exception is that Viacom is insisting that it wants the details of YouTube employees viewing material on YouTube. The agreement with Google certainly may reduce the privacy concerns and, provided that Viacom has no other information from which to identify viewers, Viacom should only receive anonymous, statistical data. However, the privacy concerns remain in relation to the employee data.
A matter of definition
Would the data to be disclosed by Google be “personal data” as defined by the Data Protection Act 1998 (DPA 1998). This has been slightly more difficult to answer given the uncertainty as to the meaning of “personal data” following the Durant case (which appeared to narrow the definition). However, the information commissioner's guidance last year brought greater clarity to the process of assessing what is “personal data” and includes a series of tests to assess whether data is personal. Applying these to the YouTube case, it is likely that the login names of users will identify the users. IP addresses are likely to identify the user where held in conjunction with the login names or other information. Even where IP addresses are held independently, they may be personal data which distinguishes one user from another and can be used to influence decisions that impact individual users. The combined effect of the information is to reveal the viewing habits of the relevant user and that would fall within the “personal data” test under the information commissioner's guidelines. In the UK, this information could therefore be viewed as “personal data” and so fall under the remit of the UK.
The general answer is that disclosure of personal information under a court order as part of ongoing litigation would not be in breach of DPA 1998. It may, however, be possible to argue that the extent of the disclosure is excessive and it is not necessary to disclose personal data to comply with the court order.
Could this happen in UK?
DPA 1998 permits disclosure for the purposes of legal proceedings, so are we likely to see the UK courts make a similar order in the future? While it is not impossible, it is unlikely that a court in the UK would make such a court order because courts in the UK have a narrower mandate to order disclosure than the US.
A recent judgement of the European Court of Justice on a Spanish case, Productures de Musica de Espana (Promusicae) v Telefonica, categorically stated that an ISP was not required under the various EU Directives to disclose details of customers of the ISP for a rights holder to sue those individuals for copyright infringement. While the purpose of seeking the customer information is different from the Google case, the European courts, including the UK, may take this as a guide when dealing with disclosure requests in relation to an IPR infringement action.
The US court's position in the Google case highlights a difference of approach in dealing with personal data in court cases. The US court was willing to require disclosure of vast amounts of personal data as background evidence for Viacom to pursue its action against Google.
By contrast, the Telefonica case shows a much greater reluctance of the European courts to order disclosure of personal data. In the Telefonica case, Promusicae needed the personal data to pursue actions against those individuals but was unsuccessful. We wait to see how the courts in the UK would deal with a similar situation.
