EDRi-gram - Number 8, 7 May 2003


New EU legislation on copyright infringements

The European Commission has launched a proposal for a new Directive that aims at no less than harmonising penalties for infringements against copyright laws. The proposal, adopted by the Commission at the end of January, is currently under discussion in the Legal Affairs Committee of the European Parliament. A first draft of a 'Working Document' was presented to that Committee by its rapporteur on 28 April.

The proposition, which was drafted under the auspices of Internal Market Commissioner Frits Bolkestein, is largely modelled after existing provisions in England and Wales (the Anton Pillar and the Mareva injunction) and in France (saisie-contrefaçon).

The document contains references to the TRIPS agreement, the Bern Convention and in particular to the EU Copyright Directive 2001/29/EC. It calls on Member States to 'ensure that any infringement of an intellectual property right is punishable by penalties. These penalties must be effective, proportionate and deterrent.' The proposal explicitly covers technical copy protection, and it gives semi-authoritative powers to 'rights management or professional defence bodies', who shall be 'entitled to seek application of the measures and procedures referred to in this Chapter'. In order to safeguard evidence, the proposal foresees 'the physical seizure of the infringing goods, if necessary without the other party having been heard'.

Damages are set as 'double the royalties or fees which would have been due if the infringer had requested authorisation to use the intellectual property right in question'. On top of that fine, the infringing good may be destroyed.

With regards to criminal law, Member states are called upon to 'ensure that all serious infringements of an intellectual property right, as well as attempts at, participation in and instigation of such infringements, are treated as a criminal offence.' Where natural persons are concerned, Member States shall provide for criminal sanctions, including imprisonment.'

The draftswoman for the EP Committee is Janelly Fourtou, a French Conservative (UDF) with ties to the publishing industry, who has a history of dealing with sanctions against infringements. She made her parliamentary debut four years ago with a report on the EU Green Paper on Combating Piracy and Counterfeiting in the EU that broadly reflected the interests of the entertainment industry.

In her Working Document, she criticizes that the Commission Proposal 'focuses on infringements committed for commercial purposes or causing significant harm to right holders', a view which, according to her, 'has been severely criticised by some industries'. She gives extensive room to the repetition of the copyright industry's arguments, namely that the Commission Proposal was too soft on 'certain forms of piracy'. She plans, however, to co-operate closely with the commission and other Groups in the EP in order to pass the proposition in First Reading.

Besides Legal Affairs the only Committee involved is Industry; the vote in Legal Affairs is foreseen for September 11 (indeed), the one in Plenary for the week following 20 October.

Proposal for a Directive of the European Parliament and of the Council on measures and procedures to ensure the enforcement of intellectual property rights
http://europa.eu.int/eur-lex/en/com/pdf/2003/com2003_0046en01.pdf

Working Document presented by Fourtou to the European Parliament's Legal Affairs Committee
http://www.europarl.eu.int/meetdocs/committees/juri/20030428/495099EN....

(Contribution by Andreas Dietl, consultant on EU privacy issues)

EDRI launches campaign on air passenger data

This week, European Digital Rights (EDRI) launched a campaign against the transfer of European air travellers' data to the United States. The campaign coincides with renewed talks between the European Commission and the United States.

Since 5 March 2003, an agreement between the European Commission and United States Customs provides US authorities online access to European travellers' Passenger Name Record (PNR) data for flights to the US. The PNR data consist of all relevant information related to a passenger's flight: departure and return flights, connecting flights, special services required on board the flight (meals such as Kosher or Halal) and flight payment information such as credit card numbers.

Under EU privacy regulations the transfer of such personal data to third countries is bound to strict guidelines. However, due to political and economic pressures by the US government, the European Commission has allowed the transfer of passenger data to go through.

On 6 May the parliamentary Committee on Citizens' Freedoms and Rights (LIBE) held a hearing on transfer of European air travellers' data. Representatives of the US Department of Homeland Security came to Brussels to convince the Committee members of their intention to protect the privacy of European air travellers. They had little to offer and presented no new limitations on the existing practice of data transfer.

It became clear during the hearing in the European parliament that the PNR data will be fed into the Computer Assisted Passenger Pre-screening System. In a current test of the second generation of the system, CAPPS II, the goal is to identify terrorists, according to Douglas Browning, a senior official if US Customs. But the agreement between the US and the EU on the PNR data mentions that US Customs may share the data with other US agencies for "legitimate law enforcement purposes". This is a very broad definition and can be read like an assurance that all European passengers' data could be stored in FBI and other US agencies' databases for many years to come, to be used for all kinds of law enforcement purposes. Those purposes are very different from the limited anti-terrorism objectives that, the US government claimed, originally justified their request for more EU passenger data from European airline companies.

In the campaign against the transfer of PNR data European Digital Rights offers models of complaints that air travellers can send to the airline carriers and their national data protection commissioners. With the first letter, air travellers can request their personal data from the airlines and get information about which of their personal data were transferred to the US. The second letter is addressed to national data protection commissioners to urge them to investigate the transfer of personal data. The letters are available through the website of European Digital Rights.

Although the US Department of Homeland Security now has a Privacy Officer and the CAPPS II program will get a Passenger Advocate (to process complaints from passengers) it remains to be seen what influence and powers they will have or if these officials are merely installed to keep EU privacy officials and advocacy groups at a distance.

Campaign against the illegal transfer of European travellers' data to the USA
http://www.edri.org/cgi-bin/index?funktion=campaigns

EPIC resource: EU-US Airline Passenger Data Disclosure
http://www.epic.org/privacy/intl/passenger_data.html

Complaints of US air passengers about the "no-fly" list (an outlook for European travellers!)
http://www.epic.org/privacy/airtravel/foia/watchlist_foia_analysis.htm...

Evaluation of Directive on Electronic Pay Services

In their formal evaluation of the European Directive on Electronic Pay-Services (98/84/EC), the European Commission strongly promotes legal measures against copyright infringements. The report, published 2 weeks ago, evaluates the implementation and enforcement of the directive by member states and candidate countries, from its adaptation in November 1998 through to December 2002. Part of the report is dedicated to the problems with satellite TV. According to the authors, a significant amount of piracy is caused by the fact that many EU-citizens are unable to access protected satellite TV channels originating from other member states, even if they are willing to pay for it. The industry is called upon to actively seek contractual solutions.

If that could be seen as criticism of the entertainment market, the rest of the report is devoted to the need for 'a coherent pan-European legal framework against the piracy of electronic pay services', in which any form of piracy is to be considered a cybercrime. "(There is a) need for a balanced and coherent enforcement framework applicable to all kinds of piracy and counterfeiting and agreed at Community level and the distribution of keys and illicit devices via the Internet."

On the legal protection of electronic pay services - COM (2003)198 (24.04.2003)
http://europa.eu.int/comm/internal_market/en/media/condac/functioning/...

Danish company convicted for spamming

The Danish company Fonndanmark was convicted for spamming last week. The company, specialised in human resource software, has to pay a fine of EUR 2.000 for sending out 156 unsolicited commercial e-mails to 50 different addresses. In Denmark, spamming is forbidden since June 2000, under section 6a(1) of the Danish Marketing Practices Act (Markedsforingsloven). The act creates a very broad privacy-protection, for both natural and legal persons and authorities. The company was sued by the Consumer Council, the supervisory authority of the anti-spam legislation.

Implementing Art. 13 of the new EU Privacy Directive will mean a deterioration of Denmark's privacy-protection. According to the Directive, people that have already given their address to companies, can still be spammed with advertisements for 'similar services'. This policy is called 'soft opt-in'. The Danish act did not allow for that kind of implicit prior consent. The amendment is expected to enter into force 25 July 2003.

Danish Consumer Council
http://www.forbrugerstyrelsen.dk

Press release about the case in Danish:
http://www.forbrugerstyrelsen.dk/presse/03/pm010503.htm

(Contribution by Rikke Frank Jørgensen, Digital Rights Denmark)

European Court of Justice rules on copyright fees

A recent verdict from the European Court of Justice implies that all EU countries should choose the same legislative translation of 'equitable remuneration', a crucial formula in the European Copyright Directive. Weighing the case of the Dutch copyright collecting society SENA versus the national broadcasting organisation NOS, the Court explains how the 1992 EU directive on rental and lending rights should be interpreted. Equitable remuneration "must be interpreted uniformly in all the Member States and applied by each Member State; it is for each Member State to determine, in its own territory, the most appropriate criteria for assuring, within the limits imposed by Community law and Directive 92/100 in particular, adherence to that Community concept."

From 1984 to 1994 the yearly amount the NOS paid the collecting society varied between EUR 272.000 and EUR 317.000. After the entry into force of the 1992 Directive, the new collecting society SENA demanded a yearly amount that was 10 times as high, EUR 3.4 million. Though it is up to the Dutch High Court to decide what the amount will be, and what specific criteria should be used to determine it, the European Court clearly sides with the arguments of the collecting society.

The verdict might cause a lot of head ache for legal officials, since equitable remuneration has been interpreted very freely in the different EU member states. The governments of the Netherlands, Germany, Portugal, Finland and the United Kingdom as well as the European Commission had pleaded with the Court to ignore the reasoning of SENA's lawyers, contending that the 1992 Directive deliberately omitted to lay down a detailed and universally applicable method for calculating the level of such remuneration.

Verdict (in all EU languages)
http://europa.eu.int/smartapi/cgi/sga_doc?smartapi!celexplus!prod!CELE...

Legal opinion on the verdict (in French)
http://www.droit-technologie.org/1_2.asp?actu_id=749

Shareholders give Big Brother Award to Bayer AG

Critical shareholders of the German medicine-company Bayer AG have presented the Big Brother Award to the board during the annual shareholders meeting in Cologne on 25 April 2003. The Award was given to the company in October 2002 for demanding a drug test from every employee applying for in-company training. Bayer did not bother to come to the award ceremony, but members of FoeBuD, the organisers of the German Big Brother Award, happily welcomed the opportunity to come to the board.

According to the jury report, the practice of demanding a urine sample from every employee applying for in-company training is disproportional, the result prone to mistakes, degrading and a very heavy invasion of the privacy of all male and female employees. Though officially participation to the drug test is voluntary, without consent the chances of getting an education are minimal.

Full jury-report in German (25.10.2002)
http://www.big-brother-award.de/2002/.work/

Update on Cybercrime Treaty

Last month, Denmark signed the Council of Europe Cybercrime Convention. Now all 15 EU States have signed it, but only two two countries (Albania and Croatia) have ratified it. The Convention needs five ratifications before it comes into force.

On 7 November 2002, an additional protocol on racism was adopted by the Council of Europe's Committee of Ministers on 7 November 2002. Whilst a number of countries have signed this 'Additional Protocol to the Convention on Cybercrime, concerning the criminalisation of acts of a racist and xenophobic nature, committed through the use of computer systems', none has yet ratified it.

The treaty was severely criticised by civil rights groups from Europe and the United States for giving invasive new surveillance powers to law enforcement, lacking protections for privacy or other civil liberties, and having a much wider impact than just the internet.

Full text of the Convention (in English and French -23.11.2001)
http://conventions.coe.int/Treaty/EN/WhatYouWant.asp?NT=185

Additional protocol on Racism and Xenophobia (07.11.2002)
http://www.coe.int/T/E/Legal_affairs/Legal_co-operation/Combating_econ...(2002)24E.pdf

ACLU: 8 Reasons the International Cybercrime Treaty Should be Rejected
http://www.treatywatch.org/TreatyProblems.html

Recommended Reading

Report by Jan Wouters & Frederik Naert from the Institute for International Law, Leuven University (Belgium).

Extensive analysis of EU measures after 11 September, with excellent references to sources,focussed on the development of the framework decisions on terrorism andthe European arrest warrant (both adopted June 13, 2002).They conclude: "The EU has reacted to the September 11 events by fairly quickly adopting an impressive number of measures, in many policy areas. It has achieved the most progress in the field of cooperation in criminal matters, although the jury is still out on whether the measures adopted will all be effectively implemented and vigilance will be required to ensure overall consistency and continuing respect for human rights, democratic oversight and the rule of law."

The European Union and 'September 11' (January 2003)
http://www.law.kuleuven.ac.be/iir/WP/WP40e.pdf