Canada Introduces Anti-Spam and Computer Crime Legislation

Canadians may enjoy their poutine, but spam is another matter. Canada has finally passed national anti-spam legislation (Bill C-28) that, in addition to prohibiting the sending of unsolicited electronic messages, prohibits the unauthorized alteration of a message’s transmission data and the unauthorized installation of computer programs. It also introduces monetary penalties and a private right of action against spammers, as well as extended liability which will allow plaintiffs to “follow the money” to the responsible party. And the law amends Canada’s Personal Information Protection and Electronic Documents Act to crack down on the collection or compiling of unlawfully obtained personal information. The new legislation will be enforced by the Canadian Radio-television and Telecommunications Commission, the Competition Bureau, and the Office of the Privacy Commissioner.

© Copyright 2011 Steptoe & Johnson LLP

Supreme Court rules that IP addresses are personal data in file-sharing case

The Supreme Court of Switzerland ruled that IP addresses constitute as personal data in an 8 September 2010 case involving a company, Logistep AG, which had collected, without consent, the IP addresses of internet users who were illegally downloading copyrighted materials using peer-to-peer software. The company – which then passed on the details of those users to copyright holders for a fee - was held to have violated the Swiss Data Protection Act.

Logistep AG had developed software in 2008 to research which works were being offered online on peer-to-peer networks without the author's consent. Whenever one of these works was downloaded illegally, the software would record and store the data relating to the download. This data was then sold to members of music and film industries interested in protecting their intellectual property, who could identify the owners of the internet connection used for the download and claim compensation for copyright violation.

The Court ruled that, while the interest of Logistep AG to reduce copyright infringement was valid, it did not override or justify the infringement into personal privacy. The method was deemed to have ‘significant interference in the private sphere of each user’, which the state is obliged to protect. Logistep AG must now discontinue all of its activities.

The Swiss Data Protection Authority filed the case at the Supreme Court, after the Federal Administrative Tribunal found in Logistep AG’s favour, ruled that the goal to hunt down those guilty of internet piracy did not require the consent of users.

Copyright (C) 2010 Data Guidance

CAP Code to apply to organisations' own website content and social networking sites

The Advertising Standards Authority (ASA) and the Committee of Advertising Practice (CAP) have extended the scope of the British Code of Advertising, Sales Promotion and Direct Marketing (CAP Code) to cover, from 1 March 2011, marketing communications on an organisation's own website and in other non-paid-for online space under a company's control, such as social networking sites. Currently, the Code applies to sales promotions wherever they appear but only to other marketing communications in paid-for online space. However, the Code's remit is to be extended in response to a formal recommendation from a wide cross-section of UK industry. As CAP accepts that it may be difficult to decide what marketing communications are covered by the new rules, it has set out a new three-step test to assist. The change represents a major extension to the remit of the ASA and CAP. Organisations have six months to ensure that their websites and other online space under their control comply with the code. The extended remit follows the introduction of a new CAP Code and Broadcast Committee of Advertising Practice (BCAP) Advertising Standards Code on 1 September 2010.

©Practical Law Publishing Limited; Practical Law Company Limited 2010

Update to Google Keyword Policy in Europe

Google has announced on 4 August 2010 a change to its keyword policy in Europe meaning that as of 14 September 2010 they will introduce a notice and take down procedure. Complaints can then be made directly to Google and if Google agrees that they are valid, Google will remove the offending ads. This follows the recent ruling of the Court of Justice in the recent Google France joined Cases.

See new policy - Adwords Trademark Policy

EU Takes Search Engines to Task on Data Retention

The European Union’s Article 29 Working Party has sent letters to Google, Yahoo!, and Microsoft telling them that they must cease retaining personal data of search engine users for more than six months and must improve their anonymization procedures. It also asked the companies to appoint outside auditors to review their procedures for anonymizing data to ensure that they truly prevent identification of the users behind the data. In addition, the Party sent copies of the letters to the U.S. Federal Trade Commission and asked it to investigate whether the companies’ data retention practices were “unfair” or “deceptive” within the meaning of the FTC Act.

Canada Moves A Step Closer to Mandatory Data Breach Notification

Canada’s Ministry of Industry has proposed amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) that would require private sector entities to notify the Office of the Privacy Commissioner of breaches of personal data, and to notify affected individuals directly if the breach creates a “real risk of significant harm.” The proposal will now be considered by Parliament. The Privacy Office in the past has opposed mandatory notification, but this time around has said it welcomes the proposal. Chances thus seem fairly good that Canada will join the breach notification club.

EU Revises Model Contract Clauses for Data Transfers

The EU Data Protection Directive restricts transfers of personal data of EU residents to non-EU countries. A common approach for complying with this obligation is for the EU data transferor and the transferee abroad to adopt model contract clauses approved by the European Commission. The European Commission earlier this month adopted a decision approving a new set of model contract clauses for the transfer of personal data from a data controller to a foreign processor (controller-to-controller clauses were previously approved). The new clauses permit the foreign processor to re-transfer data to a sub-processor (the previous version did not permit this), and delete an arbitration provision from the previous version that had never been applied in practice.

© Copyright 2010 Steptoe & Johnson LLP

European Commission urges social-networking service providers to improve child safety policies

The European Commission is urging social-networking service providers to improve their child safety policies. In February 2009, 17 social-networking service providers such as Bebo, Facebook, Google and Microsoft signed an agreement on "Safer Social Networking Principles for the EU" (see Legal update, Social-networking service providers sign agreement on child online safety). The Commission has published a report, in which it says that most of these companies had empowered minors to tackle online risks by making it easier to change privacy settings, block users or delete unwanted comments and content. However, Viviane Reding, Commissioner for Information Society and Media, said more needed to be done. Less than half of social-networking providers made profiles of under-18 users visible only to their friends by default and only one third replied to user reports asking for help. Source: European Commission press release, 9 February 2010.

©Practical Law Publishing Limited

Court Muddies the Water on Electronic Signatures in New York

In Prudential Ins. Co. v. Dukoff, et al., a federal district court in New York has left unclear whether state regulators can add requirements for electronic signatures that go beyond those defined in the state’s electronic signatures law. While the court suggested that the state insurance department’s requirements were inconsistent with the statute, it nonetheless deferred to the department’s opinion that an electronic signature on an insurance application is valid only if the insurer can verify the identity of the person signing the application.

© Copyright 2010 Steptoe & Johnson LLP

Is the UK Moving Toward A De Facto Data Breach Notification Requirement?

The UK's Information Commissioner's Office recently warned companies that they could face tougher sanctions if they don't report data security breaches to the ICO. Although notification is not strictly required by the ICO, a recent statement by the ICO suggests that the agency may be seeking to establish a de facto notification requirement for serious data breaches. This warning is yet another sign that more countries, particularly in Europe, are moving toward expressly requiring notification of government agencies and/or affected individuals in the event of a data breach.

© Copyright 2010 Steptoe & Johnson LLP

Court Refuses to Enforce Take-Down Injunction Against Website

USA: A federal district court in Illinois has ruled in David Blockowicz, et al., v. Joseph David Williams, et al., that a website is not required to remove defamatory remarks despite an injunction against the persons who posted the remarks on the site. Wishing to avoid the immunity provision of the CDA, the plaintiffs sued the actual authors of the defamatory remarks rather than the websites that posted the remarks. The court issued an injunction requiring the plaintiffs to remove the remarks, but the plaintiffs were unable to contact the defendants. The plaintiffs therefore moved for third-party enforcement of the injunction against the website, ripoff.com. But the court was unpersuaded that the website – despite Terms of Service that included a copyright claim to all posted comments, a statement that comments would never be removed, and an indemnification clause – should be considered an aider and abettor of the defamatory remarks, and therefore refused to enforce the injunction against it.

© Copyright 2010 Steptoe & Johnson LLP

UK: Court reject copyright infringement and breach of confidence

The High Court has rejected a claim by a computer games designer, Mr Burrows, that a director of a company called Circle Studio Limited (Circle) which had previously employed him, had infringed copyright in a game called "Traktrix" which Mr Burrows had proposed to them, or breached confidence, by trying to exploit a substantially revised version of the game. Norris J found that there was no breach of confidence because the proposal for "Traxtrix" was not disclosed in circumstances importing an obligation of confidence; in disclosing the idea to Circle, Mr Burrows was doing what he was paid to do as a games designer, and there was no evidence that he told Circle that it was an idea that he had thought up before joining Circle. Norris J rejected the copyright claim because, among other things, Mr Burrows argued that Circle had copied significant parts of his original document recording the concept for the game in a later design document relating to it. However, since nobody at Circle knew of the original document, if the design document incorporated parts of it, it was because Mr Burrows himself incorporated them. This was not a grant of an implied licence by Mr Burrows, but a unilateral act requiring no agreement on Circle's part.

©Legal & Commercial Publishing Limited; Practical Law Company Limited 2009

ISPs Ordered to Pay $32 Million to Louis Vuitton for Contributory Trademark and Copyright Infringement

A federal jury in California has found two Internet service providers, Akanoc Solutions, Inc., and Managed Solutions Group, Inc. ("MSGI"), and their owner, Steven Chen, guilty of contributing to trademark and copyright infringement for hosting websites selling counterfeit Louis Vuitton goods, and has awarded Louis Vuitton $32 million in damages. As we previously reported, Louis Vuitton sued Akanoc, MSGI and Chen for "knowingly allow[ing] and encourag[ing] certain websites to use" their Internet hosting services to infringe Louis Vuitton's "valid trademarks and copyrights." Louis Vuitton successfully demonstrated that both ISPs knew of the infringing websites but failed to take "simple measures" to shut them down.

© Copyright 2009 Steptoe & Johnson LLP

Keyword advertising vs. trade mark infringement

Advocate General (AG) Poiares Madura has provided a detailed opinion concerning Google's keyword advertising system, following references to the ECJ from France in three sets of proceedings brought by trade mark owners against Google. The AG considered (among other things) that Google, by displaying advertisements in response to keywords corresponding to trade marks, established a link between those keywords and the sites advertised, which sold goods or services. However, such a link did not constitute trade mark infringement as the mere display of relevant sites in response to key words was not enough to lead to confusion. The AG's opinion provides some much-needed clarification of trade mark law in relation to keyword advertising, although it remains to be seen whether it will be followed by the ECJ when it gives its decision. Brand owners will doubtless be disappointed with the opinion, but the references only concerned the use of keywords which corresponded to trade marks, not the use of the trade marks in advertisements, or in the products sold via the sites advertised. The AG also considered that the liability exemption for hosts in Article 14 of the E-Commerce Directive (2000/31/EC) should not apply to the content featured in Google's AdWords. Case: Google France and Google Inc. v Louis Vuitton Malletier, Google France v Viaticum Luteciel, and Google France v CNRRH and others, Joined Cases C???236/08, C???237/08 and C???238/08, 22 September 2009.

©Legal & Commercial Publishing Limited

Facebook Capitulates in Privacy Law Face-Off

Facebook, Inc. has reached agreement with the Office of the Privacy Commissioner of Canada regarding privacy controls on the social networking website. As we previously reported, the Office found that several of Facebook's practices violated Canada's Personal Information Protection and Electronic Documents Act. The Office gave Facebook 30 days to address the concerns or face court action. Facebook has now consented to several significant changes, including a more forthcoming description of its Privacy Policy; more granular privacy settings; a permissions-based model for third-party applications (e.g., games and quizzes) that allows users to select the information they share with third parties; and the clear option to either "deactivate" or entirely "delete" an account.

© Copyright 2009 Steptoe & Johnson LLP.

Information Commissior Office (UK) publishes guidance on changes to notification fee

The Information Commissioner's Office (ICO) has published a guidance note, which will come into effect on 1 October 2009, on changes to the notification fee system for data controllers under the Data Protection Act 1998. Under the two-tier notification fee system for data controllers due to be introduced under the Data Protection (Notification and Notification Fees) (Amendment) Regulations 2009 (SI 2009/1677), a data controller with an annual turnover of £25.9 million and 250 or more members of staff, and public authorities with 250 or more members of staff, will have to pay initial and annual renewal notification fees of £500, while other data controllers will continue to pay a £35 fee (see Legal update, New data protection regulations introduce two-tier notification fee structure). Among other things, the ICO's guidance explains the criteria used to determine which tier a data controller is in; provides details of certain organisations, such as charities, which will always be deemed fall into the lower tier, regardless of their size or turnover; and explains the rationale for the fee changes.

Source: ICO guidance, Notification fee changes.

IPO rejects opposition to YOU CAN'T BE A VIRGIN ALL YOUR LIFE ITS TIME mark for telecoms

A hearing officer of the Intellectual Property Office has dismissed Virgin Enterprises Limited's opposition to an application to register YOU CAN'T BE A VIRGIN ALL YOUR LIFE ITS TIME for, among other things, telecommunications in class 38. Virgin Enterprises relied on its earlier registrations of VIRGIN for identical services in class 38 to oppose the mark under section 5(2)(b) of the Trade Marks Act 1994 (TMA). The hearing officer held that there was very little similarity between the marks, and that the average consumer would not assume that there was an economic association between the parties so as to give rise to a likelihood of confusion. The hearing officer also dismissed Virgin Enterprises' opposition under section 5(3) of the TMA, which was based on its earlier mark VIRGIN MOBILE in classes 9 and 38. He held that, although the name VIRGIN MOBILE had acquired a reputation as a trade mark in relation to mobile phones and telecoms, the relevant public would not make a link between the respective marks on account of their lack of similarity. The hearing officer did not consider that the applicant's ordinary English-language use of the word "virgin" amounted to taking advantage of the VIRGIN mark. Case: Application no. 2466095 to register the trade mark YOU CAN'T BE A VIRGIN ALL YOUR LIFE ITS TIME and opposition no. 96472, BL 0-216-09, 23 July 2009.

©Legal & Commercial Publishing Limited; Practical Law Company Limited 2009

High Court upholds claim for misuse of confidential information, breach of database right and passing off against ex-employee

The High Court has held that an ex-employee who copied and retained various documents and information belonging to his ex-employer, including thousands of contact details and sales figures, had acted in breach of confidence. Peter Smith J said that the claimant's database was an important tool as it provided an immediate base which the ex-employee could use to start up his rival business of organising conferences. He held that the ex-employee's activities amounted to a classic springboard operation. The judge also held that the ex-employee's acts in extracting a large amount of information from the claimant's database was a breach of article 16(1) of the Copyright and Rights in Database Regulations 1997, as it was clear that the database had been created with substantial investment in obtaining, verifying and presenting its contents. The judge also upheld a claim in passing off as the ex-employee had suggested that the conference his company was organising was a follow-up to the conference the claimants had held the previous year. Case: First Conferences Services Limited & another v Richard Bracchi & another [2009] EWHC 2176 (Ch), 26 August 2009.

Argentine Court Holds Yahoo!, Google Liable for Defamatory Third-Party Content

They say a picture is worth a thousand words, but an Argentine court recently ruled that a picture can also be worth thousands of dollars in damages. Virginia Da Cunha sued Yahoo! and Google for damages after photos of her that were posted on sex-trade websites, without her consent, appeared in the results of Internet searches for her name. A civil court in Buenos Aires ruled for Da Cunha and awarded her $26,248 in damages, finding that the search engines actively amplified the harm of the defamatory third-party postings by making the sex-trade websites more accessible than they would otherwise be. The court also held that neither company was doing enough to guard against such harm to individuals.

© Copyright 2009 Steptoe & Johnson LLP

District Court “Backs Up” from Ninth Circuit’s Ruling on Access to Stored Email

A district court in Illinois recently determined that opened, web-based emails held by an Internet Service Provider are not in “electronic storage” within the meaning of the Stored Communications Act (SCA). Accordingly, the government could obtain such emails with a mere subpoena rather than a search warrant. The district court came to this conclusion despite the Ninth Circuit’s contrary ruling in Theofel v. Farey-Jones which, as we previously reported, reached a broader interpretation of “electronic storage” and thus affords greater privacy protection for emails.

© Copyright 2009 Steptoe & Johnson LLP