IP addresses as personal data under the CJEU, French Supreme Court, and the GDPR approach: towards an expanding protection of data

Are IP addresses personal data? The answer has been debated in recent times.

An IP (internet protocol) address is a series of digits assigned to a networked device to facilitate its communication over the internet. IP addresses do not directly reveal the identity of users: additional information is necessary to identify them. However they can show some patterns of user behaviour. Static IP addresses are invariable and allow continuous identification. Dynamic IP addresses are provisional and change each time there is a new connection.

A study commissioned by the EU Commission (available here) revealed how EU members’ traditions with regard to the IP address “personal” nature have substantially diverged.

Recently, in the Breyer case (full text here), the CJEU held that under Directive EC/95/46 (“Privacy Directive”) IP addresses can be personal data. The action was brought by Mr Patrick Breyer, a member of the German Pirate Party. He objected that websites of Federal German institutions store visitors’ IP addresses with the aim of preventing cyber-attacks and allowing criminal proceedings. Eventually, the Bundesgerichtshof asked the CJEU whether in that context (where only internet service providers – ISP – hold data to identify users) ‘dynamic’ IP addresses constitute personal data.

A personal data is any information relating to an identified or identifiable individual, including in by reference to an identification number. Recital 26 of Privacy Directive says that to determine whether a person is identifiable, account should be taken of all the means “likely reasonably” to be used either by the controller (or by any other person) to identify him/her. It is not required that all the information necessary to identify the data subject is in the hands of one person. The possibility to reach the data with reasonable efforts is enough. Thus, the CJEU held that, since the website owner is able to contact the competent authority, so that the latter orders the ISP to disclose additional data on the individual, the website owner has the means which may likely reasonably be used to identify the data subject on the basis of the IP address. In light of this, a dynamic IP address can constitute personal data.

The Court thus embraced an extensive interpretation, previously suggested by the Article 29 Working Party (see opinion 4/2007 on the concept of personal data, p. 16).

Personal nature of IP addresses has been recently confirmed by the French Cour de Cassation (French text here), which held – although briefly – that “les adresses IP, qui permettent d’identifier indirectement une personne physique, sont des données à caractère personnel”.

In this context, the General Data Protection Regulation (“GDPR”) has strengthened this approach. It has specifically recognized that online identifiers, including IP addresses, may potentially identify users and create profiles, especially when combined with unique identifiers (e.g., usernames, see Recital 30). Therefore, the GDPR now explicitly includes online identifiers in the definition of personal data (Article 4). Thus, apparently the rule set by the GDPR could be as follows: IP addresses (likewise online identifiers) are presumed to be personal data unless under the circumstances a data controller can demonstrate that it does not have means “likely reasonably” to identify individuals. However, based on Breyer such proof will not be easily reached.

Finally, as a confirmation of the tendency to expand the definition of data deserving protection, the e-Privacy Regulation proposal (available here, which should repeal Directive 2002/58/EC) seems in line with the GDPR’s approach. The draft includes metadata (e.g. time of a call and location, numbers called, the websites visited, etc.), which are highly intrusive in the privacy sphere, within the scope of the protected data. Thus, except their use for billing purposes, metadata will require users’ consent to be used.

In sum, the concept of protected data is in the process of being updated and expanded, probably having the IoT and big data in mind, to embrace all aspects of virtual identities. And shall be shortly re-defined also vis-à-vis new tracking techniques.

Francesco Banterle

CJEU, decision of 19 October 2016, C-582/14, Patrick Breyer v. Bundesrepublik

French Supreme Court, decision of 3 November 2016

Patent or Utility Model: which distinction?

Four months ago, the Italian Supreme Court ruled again on the distinction between Patents and Utility Models (full Italian text here).

Vecam S.p.A. brought action before Milan IP Court asking for the declaration of invalidity of the Italian portion of European Patent No. 1024331, owned by Tecnosystemi S.p.A. The patent dealt with a “Flush-mount enclosure, particularly for making provisions for air-conditioning systems”. While resisting against Vecam, Tecnosystemy in alternative asked to establish whether the requirements for conversion of the Patent into a Utility Model were met.

Article 76.3 of the Italian Intellectual Property Code reads “A null patent may produce the effects of a different patent of which it possesses the requirements of validity and that would have been desired by the requesting party, if he had known of the nullity”.

On 13 May 2010, the IP Court upheld the claim of Vecam declaring the Italian portion of European patent no. 1024331 invalid. At the same time, the Court asserted that the legal requirements for conversion of the patent into a utility model were met.

Against the first instance decision, which downgraded the Patent into a Utility Model, Tecnosystemi filed an Appeal before Milan’s Court asking for the Italian European Patent no.1024331 to be recognized valid.

The Court of Appeal confirmed the decision of the first instance stating that the technological solution constituted an utility model. In particular, the Court explained that Tecnosystemi improved the usefulness of something already existing whilst it did not invent anything new.

More precisely, the air conditioning unit was built with a new device allowing a 180 degrees rotation of the flush-mount enclosure’s base aiming to facilitate the condensate’s drain.

Tecnosystemi then filed an appeal before the Italian Supreme Court assuming that the Court of Appeal, as the Judge of first instance had done, had not been able to identify how to correctly distinguish between Patent and Utility Model.

The Supreme Court declared the appeal inadmissible and, quoting two precedents (Italian Supreme Court – Judgments 8510/2008 – and 19688/2009), it clarified that Utility Models: require an inventive step capable of increasing the usefulness of something already existing rather than inventing a completely new product or process.

By this decision the Italian Supreme Court followed the so-called “Qualitative Doctrine”, whereby, while Patents relate to a new product or a new process Utility Models concern an existing object.

However, several scholars share the so-called “Quantitative Doctrine” whereby Patents require an higher inventive step.

Other proposals have emerged in Italy in the last few years, which aim at across-the board abolishing the category itself of utility models. This, on the basis of the intrinsic inconsistency of separating two different levels of ‘inventive character’ vis-à-vis the fact that, even for patents, nothing more than ‘non obviousness’ is required. Thus, once the ‘inventive step’ is a unitary requirement, there is no reason why to retain two different types /level of protection.

Giovanna Sverzellati

 Italian Supreme Court – Judgment No. 16949 of 10 August 2016

HOW MUCH A TRADEMARK SHALL BE USED BY A NON-PROFIT ASSOCIATION TO AVOID BEING DECLARED REVOKED FOR NON-USE? THE SEVERE OPINION OF THE COURT OF BOLOGNA

According to article 24 of the Italian Intellectual Property Code, an Italian trade mark shall be revoked (i) if, within a continuous period of five years, it has not been put to genuine use in connection with the goods or services in respect of which it is registered, and there are no proper reasons for non-use or (ii) if the use is suspended for the same amount of time.

Not many Italian decisions addressed the question of which uses are considered “genuine” and which is the sufficient amount of use that would put the right-owner safe from any contestation.

The Court of Bologna had the chance to investigate this question in a case (available here) involving a non-profit sailing club that sued a company when it discovered that it had started the production and commercialization of sailing cloths and accessories using the exact same trade mark already registered by the club and had registered a number of identical and similar trademarks for identical products (i.e. sailing accessories and garments).

immagine-iplens-moro

According to the defendants, however, the plaintiff could not enforce its earlier trademark because it had been used on the market in a manner that was not effective. Thus, they counter-claimed to declare it revoked for non-use.

The plaintiff resisted claiming that the use made of the “IL MORO” trademark in the years was genuine and continuous, in line with the purposes of the sailing club and the activities organized by its members. In particular, the plaintiff showed, by filing a number of pictures and invoices, that the trademark was used for clothes, shoes and accessories that were distributed for free during sailing races and similar events.

Bearing in mind that the rationale behind the provision on revocation for non-use is to “clean” the register from those trademark registration preventing third parties from registering and using a name or a logo as trademark in absence in the right owner of any interest in being secured such monopoly – which is indeed a goal consistent with the pro-competitive rationale of the requirement of availability (i.e. the need to keep free) – the case law actually adopts different approaches on the notion of use that is sufficient to evidence the subsistence of said interest.

According to a first theory, any type of use is sufficient, as long as it shows an actual interest of the right holder in continuing to distinguish its products/services on the market. Consequently, only the complete and total cessation, in any mode, of the trademark’s use would cause its revocation. Even a local, restrained in time or intermittent use could be thus considered sufficient (see Court of Milan decision of 10 October 1996, Court of Milan decision of 30 September 2002, Court of Turin decision of 21 December 2004 and Court of Rome decision of 22 May 2003 and, among the leading scholars, A. Vanzetti – V. Di Cataldo, Manuale di diritto industriale, Milan, 2012, page 283).

According to a second theory, to which the decision in comment adheres, only a sufficiently intense, stable and continuous use of the trademark on products or services offered for sale on the market can prevent revocation. This use shall be not symbolic: consumers shall be aware of the sign so that it is capable of distinguishing the products or services from the competitors’ (see Supreme Court case no. 16664 decision of 1 October 2012, Court of Naples decision of 2 February and Court of Milan 20 September 2002).

By upholding this second theory the Court of Bologna non only affirmed that the use made by the plaintiff was too limited for the small amount of sailing clothes and accessories produced by the club, but also claimed that said use was not genuine. This because the garments and accessories on which the trademark was fixed were promotional gadgets intended to be distributed for free to club members and in occasion of sailing events. In other words, they were not for sale. Thus, the “IL MORO” figurative trademark was, according to the Court of Bologna, not used to distinguish the sailing club’s products from the ones offered by other companies on the relevant market.

Even if the ‘requirement of availability’ would support the result of the decision, due to the limited use made of the trademark on the market, it is also true that trademark law does not require that only companies with a profitable business (and the consequent capability of demonstrating wide sales made on the Italian market) are entitled to register a trademark.

In particular, the provision requires the existence of a use and not that such use has generated incomes to the right owner. The EU Court of First Instance seems to have confirmed this point, having assessed – with respect to EU trademarks, but the provision is equivalent – that “the purpose of the provision is not to assess commercial success or to review the economic strategy of an undertaking, nor is it intended to restrict trade-mark protection to the case where large-scale commercial use has been made of the marks” (Case T-191/07 Anheuser‑Busch v OHIM, Inc. see also case T‑169/06, Charlott v OHIM and case T‑203/02 Sunrider v OHIM).

It thus seems that the evaluation of the existence of a use should be carried on taking into account also the type of business of the right-owner, on the basis of a case-to-case analysis. Otherwise, the trademarks registered by non-profit organizations would be seriously compromised.

Court of Bologna, case No. 9754/2013, 9 September 2015, Europa Yacht Club, Moro S.r.l. and Giovanni Benito Ballestrazzi v. Punta della Maestra S.r.l., Overseas Property LLC, ASD Il Moro di Venezia Yacht Club and Rama S.n.c..

Industrial Design works: exhibition in museums as proof of special artistic merit?

A recent decision issued by the Tribunal of Milan (full-text in Italian available here), Specialized IP Section, has acknowledged special artistic merit, hence copyright protection (under Art. 2.10  of Italian Copyright Act implementing Art 17 of EU Directive 71/98) to after-sky boots, branded Moon Boots (as designed after the US astronauts’ boots ), a popular model marketed (also) in Italy since more than 40 years.

nasa
Aldrin’s boot and footprint in lunar soil – credit: Nasa

(As known, in some countries like Germany and Italy, copyright protection of industrial design products requires a plus of artistic merit than the mere ‘individual character’ requested by the general copyright paradigm).

 

The trump card for this recognition was the Louvre Museum’s choice of Moon Boots as one of the 100 most representative industrial design works of the XX century. The readers will think, and with reason, that this position is not novel, either in Italy or in other countries (Germany,i.a.). And with reason: as a matter of fact, Milan’s Tribunal just follows the blueprint of Flos.

So, it is not for its peculiarities that we are recalling the Moon Boots decision. Rather, it is an occasion for some critical comments on the general position – general:  aside from the specific case – espoused by the Milan Court.

First: is the selection/exposition by even prestigious museums a per se decisive argument for assessing special artistic value? More precisely: is it so without inquiring whether the exhibition was the Museum’s choice an autonomous initiative, or was it sponsored by the producers of the industrial design products? We all know how quite often, nowadays, public and private museums and art galleries, as well as the press, generalist and specialized, specialized struggle for balancing their budgets. And how a skillfully set up ‘environment’ can frame prestige and ‘cultural’ aura for the presentation of even everyday household appliances. And we know, of course, how  intense is the ‘race’ by industrial design producers to obtain that prestigious upgrading, which translates in a potentially over 100 years rent-seeking position.

So, at least Courts should adopt the testsponsored or autonomous’?

One might add that an even more significant test could be adopted. By checking whether this or that industrial product, of which the producer/plaintiff claims special artistic value, has ever been auctioned at art sales by famed houses as Christie’s, Sotheby’s and the like. Or, just by checking with same houses if they are prepared to auction such products as after-sky boots… (I am personally interested to this, I must confess: in my garage I have a couple of forgotten old used boots that I was going to throw away…).

Let’s now give a broader glance at the issue. First of all, its ‘competitive cost’. Is it reasonable, and consistent with the principle of freedom of competition, that utilitarian products sold since many years, even after the expiry of the 25 years design registration, and whose basic model has been currently adopted, after such expiry, by many competitors (usually SMEs ) — is it reasonable, then, that a sudden ‘copyright baptism’ makes them again object of exclusive rights? — possibly, repeat, for  more than a century ahead! I do not think so: however, the question of an ‘easy’ building of such rent/seeking positions is not worth neglecting. Also for an additional reason. Under Berne Conventions’ rule on derivative works (Art.2.3) the rightholders on the original design retain the faculty to inhibit the production and marketing of competing products bearing variants.

At least — at the very least— a more balanced regime should establish a suitable term for competitors, who entered the market after the expiry of the registration, to continue production and sales as not to waste the investments poured therefor. On the determination of such ‘transition’ period, it is well known, lobbies of big international furniture producers are actively at work, e.g. now in UK after the disgraceful repeal (itself lobby-driven), of Sec. 52 of Design Act by the Enterprise Act of 2013 .

Finally: let alone SMEs, do Courts worry about the cost for consumers, i.e. effect on price, of such… baptism? Not that I know.

Gustavo Ghidini

 

Court of Milan, IP Section, decision of 7 July 2016, No. 8628/2016

FRANDly negotiations: national Courts apply the Huawei v. ZTE framework

The Bucharest Court of Appeal and the Regional Court of Düsseldorf have recently issued two decisions concerning the enforcement of standard essential patents (SEPs) in the telecommunication industry. The decisions (which have been made available by Comparative Patent Remedies: see here and here, also for their English translation) are particularly interesting in that they apply the framework depicted by the CJEU in the Huawei v. ZTE case (C-170/13, full text here) with regard to the availability of injunctive relief for SEPs encumbered by FRAND (Fair, Reasonable and Non-Discriminatory) commitments. As is well known, according to the Huawei v. ZTE decision, a SEP holder, before asking an injunction against an alleged infringer, must present him a specific and detailed FRAND license offer (Huawei v. ZTE, par. 63). In the absence of such a FRAND license offer, seeking an injunction may amount to an abuse of dominant position under Art 102 TFEU (Huawei v. ZTE, par. 77). But what if the infringer does not respond to the SEP holder’s offer? Is the FRAND-compliance of the SEP holder’s offer still to be verified, in order for the injunction to be granted?

***.***.***

The Romanian case

In 2014, Vringo, Inc., an Israeli non-practicing entity (NPE), obtained from the Tribunal of Bucharest a preliminary injunction against ZTE Romania on the basis of a patent essential to the 4G/LTE standard. The decision was upheld by the Bucharest Court of Appeal. In particular, in the case at stake, Vringo had offered a license to ZTE Romania and ZTE Romania did not respond to the offer.

Later on, ZTE Romania filed a motion to have the above preliminary injunction lifted on the grounds of its alleged inconsistency with the Huawei v. ZTE framework. However, both the Tribunal and the Court of Appeal of Bucharest dismissed the petition. In particular, by decision of 28 October 2015, the Court of Appeal stated that, precisely in the light of Huawei v. ZTE, when the alleged infringer does not respond to the SEP holder’s offer (but the same applies to the case of a non-FRAND counter-offer), the SEP holder cannot be deemed to be abusing its dominant position. It seems from the line of reasoning of the decision that the Bucharest Court did not verify the FRAND-compliance of Vringo’s offer, and deemed it sufficient that ZTE Romania failed to present a FRAND counter-offer for an injunction to be granted.

The German case

The approach of German Courts is different. In an order of 13 January 2016, the Higher Regional Court of Düsseldorf held that the alleged infringer is not required to propose a FRAND counter-offer if the one it received is not FRAND-compliant. In other words, the Court has, first of all, to verify whether the patent owner’s offer is FRAND. Only if this condition is met, it will check if the counter-offer is FRAND-compliant too. Therefore, the alleged infringer who receives a non-FRAND offer and does not respond cannot be subject to an injunction under the Huawei framework and, if sued before a Court, he can simply object that its counterparty did not respect the FRAND “etiquette” provided by the CJEU. Obviously, the patent holder would still have the chance to prove before the Court that its offer was actually compliant to FRAND terms and conditions, and to obtain an injunction.

The same approach was recently adopted by the Regional Court of Düsseldorf too, in its decision of 31 March 2016 (English  translation  of  the  relevant  excerpts made available by Comparative Patent Remedies blog here). In this case, concerning a patent essential to the AMR-WB standard for 3G communications, the Court specifically assessed the FRAND nature of the patent holder’s offer, although it was undisputed that the alleged infringer had not proposed a counter-offer.

***.***.***

The German approach seems to be preferable. Since, under the Huawei v. ZTE framework, a FRAND-compliant offer by the patent holder is mandatory, Court should not issue injunctions without a prior assessment of the FRAND nature of the patent holders’ offers. Should this assessment be omitted, the burden of estimating a fair offer would shift from the patent holder – the only one who has the very instruments to calculate a fair royalty rate according to “comparable licensing agreements” – to the alleged infringer. So that, in order to avoid an injunction, the alleged infringer will most likely present a very high counter-offer. This seems to stifle the pro-competitive effects of the Huawei v. ZTE framework.

Stefano Vignati

(IPlens’ guest)

The pictures of notorious people may be used on commercial websites without their consent (or, at least, this is what the court of Bologna said)

In 1992, for the first time in more than 141 years of America’s Cup, an Italian boat was able to dispute the famous sailing race, so becoming famous all over the world as the first boat from a non-English speaking team to fight for the victory. Not only the most passionate sailors know that the boat was “Il Moro di Venezia”, Paul Cayard its skipper and that the sailing team was leaded by Raul Gardini.

This story was re-evoked in a proceeding for violation of image and personality rights started by Paul Cayard and the heirs of Raul Gardini before the Court of Bologna (full text here) to stop the unauthorized use of pictures, names and logos of Il Moro di Venezia and its protagonists on a commercial website (and related promotional Facebook pages) managed by a brand called “Il Moro di Venezia” that was unrelated to the sailing team of the famous boat.

According to the Court, however, the personality rights of an individual, that include the ways in which such individual is presented to the public, shall reflect the social perception that common people have of his/her personality and is not violated insofar as there is no misinterpretation of his/her intellectual ideological, ethic and professional heritage, as it emerges from his/her personal story as known.

Moreover, with particular reference to the names and images of Il Moro di Venezia and its team that were used on the website, the Court affirmed that the plaintiff had no right to stop their use on the basis that the contested elements were not used as trademarks and the link created with them on the resistants’ web pages was not abusive or detrimental of other rights.

The Court seems to recall the case law affirming that, besides misrepresentation, there is a further case when there could be violation of personality rights. Reference is made to the cases where the image and name of an individual are used in advertising in association with a brand, in so far as their use suggests a patronage to the brand which, instead, is lacking. A parallelism with trademark law could be found in the provisions inhibiting to deceive the public about the qualities of a sign and to create in the consumers’ mind an association between a notorious trademark and a product, thus taking an unfair advantage of said trademark.

This further case was, however, excluded by the Court of Bologna. It thus seems, by reading this decision, that anyone can make use of the names and images of third parties, also on a website aimed at promoting their commercial activity, when such person is depicted as the society expects him/her to be, suggesting a support of the related brand. This, even if a link between such person and the activity is created in the public in absence of any will from the depicted one or, as it was in the present case, with his/her express disapproval.

Many decision, on the contrary, affirmed that any individual has the right to control the uses of his/her name, image and any other aspect of his identity, even if the same were made available to the public with their previous consent, because the interested party could not approve their further use and, in particular, a commercial connection suggesting that he/she is connected to a brand (see Supreme Court decision of 6 December 2013, no. 27381; Court of Milan, decision of 21 May 2002 and Court of Rome, decision of 15 September 2007).

It’s a bit scary thinking about the consequence of the decision of the Court of Bologna that seems to be very permissive as to the possible uses of names and pictures of a person. It would be reasonable, we believe, extending the concept of distortive use as including the use on a commercial website that has not been approved by the person in question or, even worst, is expressively discouraged.

Court of Bologna, decision No. 2637/2015, 9 September 2015, Ivan Gardini, Eleonora Gardini, Maria Speranza Gardini and Paul Pierre Cayard v. Punta della Maestra S.r.l., Overseas Property LLC, Yacht Club Il Moro di Venezia and Rama S.n.c.

Personal data processing for marketing purpose under the new GDPR: consent v legitimate interest and Recital 47 – first thoughts

Under EU privacy law, we are used to think about “opt-in consent” as the ground normally used to legitimise the processing of personal data for marketing purposes (i.e. you can market individuals only with their explicit consent to do so). “Opt-out mechanisms” (i.e. you can market individuals if you have previously given the option not to receive communications) are instead an exception allowed only (i) for using email addresses already obtained by the data controller in the context of the sale of a product/service and (ii) for direct marketing of its own similar products or services, i.e. excluding direct marketing of third party’s products (see Article 13 of Directive 2002/58/EC – “E-Privacy Directive”).

The General Data Protection Regulation (“GDPR”) apparently has strengthened this approach (although it does not formally repeal the E-Privacy Directive, the latter will be soon amended to conform with it – otherwise a dual regime would make little sense). Personal data shall be processed on the basis of the consent of the data subject or some other legitimate basis including “legitimate interest” (Recital 40).

Consent (as the rule)

The GDPR requires consent to be a clear affirmative act, freely given, specific, informed and unambiguous, whereas “silence, pre-ticked boxes or inactivity” cannot instead constitute consent (Recital 32). Moreover, Article 7 states that data subjects have the right to withdraw consent at any time and such withdrawal shall be easy as to give consent. Thus, at a first reading, it seems that the GDPR lives no more rooms for opt-out mechanisms.

New exceptions are set out although limited. Recital 32 states that affirmative acts include (i) choosing technical settings for information society services (cookie settings on a browser?); or (ii) another conduct which clearly indicates in this context the acceptance of the processing (a form of implied consent?). Additionally, Article 6 states that consent is not necessary for subsequent “compatible” processing operations. Recital 50 says that compatibility should be assessed in light of the link between the processing purposes, the reasonable expectations of the data subjects, the nature and the consequences of further processing and the existence of appropriate safeguards for the data. Further example of lawful compatible operations are processing for archiving purposes, scientific or historical research purposes, or statistical purposes (we assume mainly scientific statistics without commercial nature, i.e. no big data analysis in most cases).

Legitimate Interest

On the other hand, among the other legitimate basis legitimising the processing Article 6 counts the “legitimate interest”. Interest is the stake or benefit that the controller (or a third party) has in the processing of data. Similarly to Directive 95/46/EC (see Article 7, letter f), the GDPR excludes the legitimacy of controller’s interest when it is overridden by the interests or fundamental rights of the data subject. In sum, the legitimate interest requires a true balancing test between the interest of the controller and the data subjects rights. This test shall also take into account reasonable expectations of data subjects and their particular relation with the data controller

What is new in the GDPR is Recital 47 stating that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. Does this mean that data subject’s consent is no more required for processing personal data for marketing purposes?

Some helpful indications are provided by the Working Party’s opinion on the notion legitimate interest (WP 6/2014 – the Working Party – “WP” – is the EU Privacy Advisory Body). Actually the WP already acknowledged that direct marketing and marketing research can constitute a valid legitimate interest under Directive 95/46/EC, and provided suggestions on how to conduct the balancing test. In marketing activities the object of the balancing test is about companies’ interest in knowing their customers and promoting their products against individuals’ interest not to be unduly monitored and spammed.

In general, the outcome of the test depends mainly on:

  • the intrusion/impact the processing entails (e.g. in case of profiling operations and combined analysis on vast amounts of data the intrusion is significant, and thus the test probably negative); and
  • the safeguards put in place by the data controller, and particularly the mechanisms to object to the processing and opt-out solutions.

The WP considered the outcome of the test in the following examples:

y general marketing by post to users of a food-delivery mobile app, when: (i) data are gathered when the user used the app to place a food-order; (ii) the app included an easy-to-use tool to opt-out from marketing ; (iii) limited information collected and used for marketing, i.e. contact details only (name, postal address); (iv) the marketing is operated by post and concerns similar products to those purchased (thus meeting users’ expectations) – the data and the context are of relatively innocent nature.

x targeted marketing (both online/offline) to users of a food-delivery mobile app combined with other data: same situation above, but: (i) the app uses users’ recent order history (a 3-year period), additionally combined with location data and browsing history via the mobile phone, and the data from a supermarket operated by the same company running the app; (ii) marketing is targeted based on the order history and operated both online and offline; (iii) the app lacks a user-friendly information and an easy-to-use opt-out tool – the data and the context are intrusive and there is a strong impact on users.

In conclusion

The WP’s opinion provides further examples that however confirm the above reasoning. In sum, it appears that in fact “soft” marketing can rely on the legitimate interest rule (substantially aligned to the opt-out exception of Article 13 of E-Privacy Directive), whereas advanced marketing (targeted emails, location based advertising, automated calling systems, etc.) always require consent.

The line between the two categories is not always clear. In those cases, relying on legitimate interest to justify marketing requires demonstration that the outcome of the test is positive (see Recital 69), due to low intrusion of that particular marketing and/or safeguards that are in place (e.g. mechanisms to access or modify personal data; or in case of free services which are in fact “paid” by allowing the use of personal data, alternative basic versions which do not require processing of data for marketing). In addition, Article 13 of the GDPR requires a clear mention of the legitimate interest pursued by the controller within the privacy notice.

Francesco Banterle

Oracle v Google: fair use defense saved web developers!

On 26 May 2016 a jury in the District Court for the Northern District of California unanimously upheld that Google’s use of Oracle’s APIs constitutes a “fair use” under the U.S. Copyright Act (full text here). The battle between Oracle and Google begun in 2010 when Oracle sued Google for using JAVA APIs, owned by Oracle, without permission. API stands for Application Programming Interface and is a set of instructions which allows different types of software to communicate to each other. When Google started the implementation of its Android Operating System (OS), despite writing its own version of JAVA, it copied some features of Oracle’s APIs in order to facilitate app developers, already familiar with them, in writing programs for Android. Therefore Oracle claimed a copyright on JAVA APIs  and the infringement of the copyright by Google.

On 31 May 2012 Judge Alsup (Northern District of California) ruled that APIs cannot be subject to copyright under the U.S. Copyright Act (full text here) which does not protect purely functional things, i.e. “process, system or methods of operation” (17 U.S. Code § 102). He motivated that in the situation at issue the taxonomy “is composed entirely of a system of commands to carry out specified computer functions”, therefore, “to accept Oracle’s claim would be to allow anyone to copyright one version of code to carry out a system of commands and thereby bar all others from writing their own different versions to carry out all or part of the same commands”. Oracle appealed and on 9 May 2014 the U.S. Court of Appeals for the Federal Circuit reversed the ruling (full text here), establishing that JAVA APIs are copyrightable, while leaving open the possibility of a “fair use” defense in Google’s favor. In reaching its conclusion, the Federal Circuit underlined that “a set of commands to instruct a computer to carry out desired operations may contain expression that is eligible for copyright protection”. Therefore, even if a computer program is functional by definition, according to the Court, can be protected by copyright as long as it is original and its underlying idea could have been expressed in multiple ways by the author. On October 2014, Google filed a petition to the U.S. Supreme Court requesting the review of the Federal Circuit’s decision. The U.S. Supreme Court denied Google’s petition on June 2015. Therefore, the case returned to the District Court and a jury agreed that Google’s re-implementation of JAVA APIs is protected by fair use.

This decision constitutes a big relief for all developers out there which are used to re-implement each other’s APIs in performing their everyday work. A different finding by the jury could have caused a chaos in the “programmer’s world” as it could have been the begin of numerous copyright claims with a consequent slowdown of the IT progress, at least in the long run. Nevertheless, the most founded decision was Judge Alsup’s ruling in 2012, when he ruled that computer programs cannot be protected by copyright law. In fact, all programs are functional for their own nature, therefore the consideration that the same functional scope can be performed by a variety of software is without relevance in order to establish the copyrightability of computer programs. What matters from a juridical standpoint is that in computer programs there is not an actual (but only a fictious) dichotomy between idea and expression (which is the core requirement for copyrightability), instead the two merge with the consequence that APIs should not be protected by copyright, as Judge Alsup’s ruled in 2012. Nevertheless, Oracle plans to appeal, let’s see what’s next!

Elisabetta Coronel Vera

(IPlens’ guest)

District Court for the Northern District of California, 26 May 2016, Oracle America, Inc. v. Google, Inc.

The Court of Rome reintroduces the notion of “active hosting provider”: new uncertainties on the ISP liability rules

By a decision published on 27 April 2016, the Court of Rome held TMFT Enterprises LLC- Break Media (“Break Media“) liable for copyright infringement for the unauthorized streaming of audiovisual content owned by Reti Televisive Italiane S.p.A. (“RTI“).

Break Media argued that it was a passive hosting provider because it merely stored information at the request of a recipient of its service. Pursuant to Article 14 of the E-Commerce Directive 2000/31/CE, as implemented in Italy by Legislative Decree 70/2003, hosting providers are not liable for stored information if they are unaware of its illegal nature. Moreover they are not required to remove illegal content unless ordered to do so by the competent public authorities.

Further, the provider outlined that the notice sent by RTI was generic, failing to report the location (URL) where the infringing content were placed. Therefore, it imposed no legal obligation to inform the competent authorities under Article 17 of the Directive and no liability for contributory copyright infringement could be found.

In addressing the hosting provider’s arguments, the Court of Rome found the website owner to be liable.

In line with the previous Italian case law (cf. Court of Rome, October 20 2011, VVBcom.Limited and Choopa LLC; Court of Milan May 19 2011, RTI v Yahoo! Italia and Court of Milano, January 20 2011, RTI v ItaliaOnline Srl) the Court of Rome applied the distinction between active and passive hosting providers, based on the analysis of the activities performed by the entity in question.

The decision held that if a hosting provider is directly involved in the website’s operations by allowing users to upload videos and other content, it is deemed to manage the information and content that its users provide. In this case, the ISP would be regarded as an active hosting provider, subject to a duty to remove illicit content if so requested by the rights’ holder.

On the contrary, if a hosting provider merely provides storage and connectivity to specific websites, and plays no active role in managing information online, it should be regarded as a passive hosting provider, which is not jointly liable with website owner for copyright infringement unless it fails to comply with a removal order issued by the competent administrative or judicial authorities or is aware of the illicit nature of the content on the hosted website and fail to alert the competent authorities.

According to the Court, Break Media was an “active hosting” of media content. Indeed, the activity of Break Media was not limited to the activation of technical procedures for enabling the content to be loaded to the platform (“passive hosting”), but provided a complex service of advertising exploitation of the content.

As a result, the liability exemptions established by Article 14 of the E-Commerce Directive were not applicable.

Although RTI’s notice demanding the removal of the infringing materials from the platform did not identify the specific location of the content to be removed, the defendant was effectively aware of the infringing nature of the content. This knolwedge was deemed enough in order to affirm the provider’s liability.

Based on the above, the Court condemned the provider to pay damages for € 115,000, approximately corresponding to € 1.300 for each minute of unauthorized publication.

Reintroducing principles affirmed by the aforementioned case law, the current decision distanced from the decision of the European Court of Justice on the SABAM case (24 November 2011 in Case C‑70/10, Scarlet Extended SA v. SABAM et al.) according to which national authorities are prohibited from adopting measures which would require an ISP to carry out general monitoring of the information that it transmits on its network.

Based on the SABAM jurisprudence, the Court of Appeal of Milan, January 7 2015, overturning the Court of Milan first instance decision in the case RTI v. Yahoo! Italia, took the view that the distinction between ‘active’ and ‘passive’ hosting providers should be regarded as misleading, being envisaged in neither the E-Commerce Directive nor in the Italian implementing Legislative Decree 70/2003. Consequently the fact that an ISP provides for services to organize contents published by its users should not change its role.

The issue provides matter of clarification for the Supreme Court.

For further comments look at the interesting analysis carried out by Maria Letizia Bixio on dimt.it

Jacopo Ciani

Court of Rome, 27 April 2016, Reti Televisive Italiane S.p.A. v. TMFT Enterprises LLC- Break Media

MISLEADING FOOD (WINE) INDICATIONS STIGMATIZED BY THE ITALIAN COMPETITION AUTHORITY

In a recent decision (full text in Italian here), the Italian Competition Authority (“AGCM”), which is competent also for misleading advertising under the Italian Consumer Code, sanctioned the famous Italian high-quality food retailer Eataly, the wine distributor Fontanafredda, and the association Vino Libero for having marketed a series of wine bottles bearing the sign Vino Libero (“Free Wine”).

Vino Libero is an association promoted by Eataly which counts a series of wine producers, with an alleged “ethic” project of sustainable agriculture and oenology. Actually Vino Libero wines are not sulphites-free, however the maximum dosage thereof is lower by at least 40% than the limit set by EU Regulation 606/2009 (in fact, sulphites limits set by Vino Libero disciplinary are quite similar – a little lower – to those of the organic wine set out by EU Regulation 203/2012).

During a preliminary phase the AGCM considered the expression Vino Libero misleading and invited the parties to adopt an additional claim that must follow each mark Vino Libero: “free from synthetic fertilizers, free from herbicides and free from at least 40% of sulphites than the limit set by law. After having found that Eataly and Fontanafredda failed to fully respect the commitments on the additional claim, the AGCM issued a final decision and fined them.

Indeed, the AGCM held that the expression Vino Libero on a wine bottle, without further specifications, can effectively lead consumers to believe the wines bearing that mark are totally absent chemical fertilizers, herbicides and – above all – sulphites. Thus misleading them about the initiative Vino Libero and the actual presence of sulphites. In this regard, the AGCM excluded that the mere mandatory indication on the label about positive presence of sulphites (required by EU Regulation 1169/2011) is able to reduce the deceptive effect of the sign Vino Libero.

The AGCM’s reasoning is well grounded and stands against marketing initiatives playing with organic evocations. However, the optimal solution to put an end to the debate on sulphites would consist in imposing on wine producers stricter obligations to list ingredients and dosage on the labels.

Francesco Banterle

Italian Competition Authority (“AGCM”), decision No. 25980 of 13 April 2016, bulletin n. 15 of 9 may 2016