Laurence Kaye on Digital Media Law

Data protection and the digital agenda

Dear reader

For as many years as I can remember, my mantra at the beginning of the year has been that "This year, privacy and data protection will be high on the Board agenda." And each year, with a few exceptions, it hasn't.

But perhaps 2015 will be different. For instance, there were quite a few comments at Davos about loss of trust in the US consumer technology giants, drawing parallels with the banking industry.

For other reasons, privacy and data protection is in the news, as the terrorist attacks in France have brought into focus the rights of the State to intercept and monitor communications for security purposes.

So, standing at the meeting point for the conflicting forces of privacy, freedom of  expression, security and 'big data', data protection law is demanding more attention.

In the USA, as  reported in the FT recently, President Obama proposed 3 bills which call for companies to provide speedy information to customers who suffer a data breach  (e.g. theft of credit card data) and to implement protections for information  collected by tablets. computers and other technologies in the classroom. He also  urged the creation of a consumer privacy bill of rights, which would set rules  for the way that personal information is used an stored by tech  companies.

 

One of the criticisms levelled at data protection law is its fragmentation and lack of consistency across different jurisdictions. In Europe, the  Commission is keen to complete its review of the 1996 Data Protection Directive and have it updated by a new Data Protection Regulation and, in that way, to drive consistency as part of its single digital market agenda.

 

In the attached article, Download 1-5516942-8A-5397693-Note_for_publishers_conference_-_pdf

we have summarised the key changes which are contained in the draft of  the new Regulation, and what action you should be taking now to prepare for these changes. Although it's aimed at publishers, most of our  comments are applicable generally. We hope you find it an interesting read and, of course, will be  happy to answer any questions you have.

 

Have a good week,

Laurie Kaye

 

Google News - hasta la vista

Dear reader

I've written on a number of occasions over the years on how the liability position of Google and other intermediaries is shifting from a simple "I'm just a host, so don't look to me" to one of increasing responsibility.

In the Court of Justice of the EU's decision in Google Spain and Google, Inc vs. AEPD (Spanish Data Protection Authority) and Snr. Gonzalez, the Court was clear that Google, Inc was a 'data controller' and so within scope of European data protection law.

Yesterday, Google announced that it is shutting down Google News in Spain, responding to the forthcoming introduction - Happy New Year Google, on 1/1/15 - of the 'canon AEDE' which introduces a new statutory copyright limitation which allows the use of 'press snippets' but carries a price tag for intermediaries in the form of fair compensation. In fact, this follows on the heels of a change in German copyright law whose legal form is different but whose effect is the same.

Not all press publishers welcome the legal changes as they fear Google switching off the service may result in a loss of traffic to their sites. But others warmly welcome the change and say it's about time that Google and other intermediaries started paying for the use of their content.

As it happens, I wrote on article on this subject which was published by Intellectual Property Magazine this week. So if you'd like to drill down into the detail, you can read it here, made available courtesy of the magazine:

Download 034-035-IPM_Dec2014_Jan2015-FO2

As with many digital media relationships, partnership and collaboration is going to be the way forward - 'win, win' vs. 'win, lose'.

As this will be my last post of 2014, I'd like to wish all my readers Season's Greetings and very happy New Year.

Regards

Laurie Kaye

Hi again - have a cookie

Dear reader

If you're a regular reader, you may have noticed a slight gap since my last post - July 31st to be precise. That's not good. But I do have some justification. And it wasn't just due to the lovely weather over the summer, when a cool glass of white wine took precedence too easily over another post. I've also been busy, along with my colleagues Mailin and Sherif, integrating my law practice into its new home at national law  Shoosmiths which, I'm pleased to say, has gone really well. Apart from having found some great colleagues to work with, I've re-discovered my table tennis skills, thanks to my colleague Andy who demonstrates admirable skill in countering my fearsome topspin smash with a mean counter-attacking forehand.

But, no, digital media law is not being overlooked. I'm now getting back on track. And talking about tracking, I was speaking at the EASDP Congress in Amsterdam last week on the upcoming changes to Data Protection law (e.g. the 'right to be forgotten'and possible changes to the definition of 'consent' for lawful processing) and the further impact the Regulation may have on the tracking, profiling and targeting of individuals for online advertising and other purposes.  David Worlock, one of the most experienced and wisest digital strategists, asked whether data protection law, present and future, allowed users to knowingly exchange privacy rights in a granular way with advertisers and with others.

At the moment, the nature of that exchange is blurry and still in the early stages of development. Think about the rather clunky way that you as a user give your consent to cookies. When you visit a website, do you bother to click through to understand the 1st and third party cookies that the website  may serve to your computer before you proceed further or do you just get rid of the pop-up box?

The debate about cookies and consent can be very black or white - track or do not track. Interestingly, Google is exploring replacing 3rd party cookies, installed by companies such as ad networks or other parties, but not by the website you're visiting, with the use of a personal identifier. FT reported on this this weekend, and said that this ID would enable internet users to "...adjust a single setting in their browser to determine how much information about them is given to advertisers. But this is not a new approach. Apple blocks cookies with its Safari browser and gives users control over information contained in a single personal ID.

Returning to David Worlock's point, we need the technology to make it much easier for individuals to manage their online identity - or indeed to manage a number of different identities - so that the nature, extent and types of permissions we give to 3rd parties to use and share information about us can be varied according to particular contexts and particular instances.

My next post will be about the current debate about the re-sale of digital content content copyright material. If you're coming to the Frankfurt Book Fair, I'll be chairing a session on that topic at CONTEC. Please drop in to our session if you can.

Have a good week,

Laurie Kaye

Digital media + big, smart open data

Dear reader

I attended the recent FT Digital Media Conference 2013. As ever, it was full of useful insights and I highly recommend viewing the sessions which are available on demand here. Mostly, it was about incremental change. There were lots of stats and discussion about the year on year growth of digital as a % of media businesses, the proliferation of VOD platforms on TV and mobile, the presssure on advertisers to integrate their ads into content on games and other media to keep viewers' attention, the ongoing challenge for newspapers to monetise their content and generally for traditional publishers and others to transform their existing business models. According to a couple of speakers, digital is now 30% of media businesses and Martin Sorrell of WPP said that 34% of WPP's business is now digital.

But the one theme that, for me at least, really stood out, was data. You name it - big, open, smart, social, CRM and every other kind of data was present in almost every panel. What was really interesting was not just the fact that the gathering, analysis and use of customer and other data gathered online is a core marketing function, it's the way that data management is now at the very heart of business. The language and discourse of media business has changed. One speaker talked about the need for data scientists who can take raw data and push it through their analytic tools and algorithms. Another said "organisations are increasingly data-centric". A representative of The Weather Channel described their business as "a data science and technology company as well as a media company."

Whilst much of the discussion was about customer data gathered via the web and social media, the issue of data is much broader. The availability of open data, the midata initiative and other data sources makes a strategic approach to data management absolutely essential.

My legal eagle readers involved in this area of the law will already have their eyes on the draft EU Regulation which will replace the existing regime set out in Directive 95/46/EC. It contains measures that will harmonise data protection procedures and enforcement across the EU, and aims to achieve consistency with the existing system for ensuring privacy online, which is set out in the Directive 2002/58/EC  (E-Privacy Directive).

I cannot claim any great insight in saying that data protection and privacy is really important to all organisations. Not "just" at the level of legal compliance but at the heart of the brand - just think about Bloomberg's current problems with disclosure of user's data. Sometimes it takes time for the message to sink in. But my tip for anyone looking to build their legal career in the online sector is become a data law expert.

Against this background, the Regulation will  extend the impact of data protection law.  For instance, it's expected to have a significant impact on data controllers and processors who are active within the EU, including many who are located outside it but who monitor the behaviour of EU consumers, or offer them goods or services online. Data processors will now explicitly be included in the scope of the data protection regime. 

In addition, the definition of "data subject" will now make it clear that "personal data" includes all data that can identify an individual, whether that data is held by the data controller himself or by a third party which, in combination with the data held by the controller, could identify the data subject.

So for data scientists and data lawyers, things are getting to get really busy.

Have a good week,

Laurie Kaye

The 10 overriding themes of the 'digital shift'

Dear reader

In my last post, I looked at the ‘digital shift’. In this post, I'm going to list the ten overriding, interlinked themes which characterise this shift and shape digital media’s legal agenda. I'll also describe the first 3 themes. I'll look at the remaining themes in my next two posts. In future, when I blog about a new case or legal/business development, I'll 'tag' the post with the relevant theme(s) so that, hopefully, we can continue to see the digital wood for the trees.

So here are the themes:

T1: Digital disruption in the value chain

T2: Being IP centric, platform agnostic

T3: The rise and rise of social media

T4: The digital citizen/consumer calling the shots

T5: Mind the [digital] platform

T6: Collaboration is the name of the game

T7: Consolidation & Fragmentation

T8: It's a mobile economy

T9: Wer'e all in the technology business

T10: It's a borderless world.

I'll now turn to the first three:

T1: ‘Digital Disruption’ in the value chain

Digital disruption is a fact of digital media life. The disrupters are everywhere.

They’re new players, often ‘born digital’ businesses, which enter an industry and create an entirely new business which didn’t exist before e.g.a new consumer products business which use ‘the crowd’ as their ‘R&D’ division to identify new inventions and product or a new entrant like anobii, a social platform for book recommendations.

 They’re also new players who enter an industry and perform an an existing activity in the value chain better and/or differently to existing incumbents and in the process displace them.‘Kobalt’ is an example, a new online platform which offers a service to streamline royalty payments to artistes.

But ‘digital disrupters’ are also existing players who reinvent themselves and in the process even cannibalise part of their business in order to create a new business and income stream e.g. Getty’s ‘istockphoto’ service.

So what’s on the legal agenda with TI? They include the legal structurees which underpin business models and the contracts and business relationships which implement them; applying existing laws to new models e.g. when is a ‘sale’ of a digital work a licence or vice versa? (See here); & watch out for developments in the US case of Capitol Records v. ReDigi which again examines whether a digital file is a licence or a digital good.

 T2: ‘IP Centric, platform agnostic’

Increasingly, content owners are “getting” the fact that they need to take a ‘360 degree’ approach to their intellectual property (IP) in a multi-platform world, multi-format world. For instance, a number of leading publishers have recently created new roles with responsibility to transition publishers into being multi-platform organisations. Often, the people appointed come from outside the industry - games, television etc. - with cross-platform experience.

At the heart of this '360 degree’ approach is a ‘format/platform neutral’ approach to IP and new products and services. In turn, this demands skill in being innovative with IP creation and exploitation, building new business models etc. It also puts IP rights, especially copyright and trade marks (brands) at the heart of the business.

T2’s legal issues include the role of copyright and the copyright reform agenda (Hargreaves etc.), including proposed changes to copyright law. The bigger picture is how copyright continues to maintain the balance between rights holders, users and intermediaries. This is a dynamic area. Only last week, Germany's Parliament have introduced a new 'neighouring right' which gives print publishers the right to licence their web content. This is a hugely significant development.

More broadly, IP covers a whole range of rights including those in brands, designs and patents. These can be used both offensively - see in the ‘patent wars’ in the digital space and defensively. No creative company can be without an IP strategy

T3: The rise and rise of social media

It's already a truism to say that social platforms such as Facebook, Linked-In, Twitter and Pinterest are playing an increasingly significant role n business. For some, these platforms may simply be relevant from a marketing and PR perspective e.g. a company having a FaceBook page to build engagement with its customers.

For others, especially those in the media and information sectors, these social platforms are becoming increasingly integrated into their business. For instance, digital services provider ‘Soundcloud’ are embedded within FaceBook so that FaceBook users can launch sounds on SoundCloud rom within Facebook. This integration process is two way – Facebook is also embedded into these services.

So what are the ‘T3’ legal issues?  Linked to social media, but not confined to it, is the whole issue of tracking consumers’ behaviour online and using this data in an aggregated way for marketing and
advertising purposes. This brings us to the heart of the debate about privacy and data protection.

Also, the presence of celebrities, public figures and others on social media such as Twitter makes reputation management an increasingly important area, which from a legal perspective brings defamation into the picture along with the laws and regulations governing data protection, consumer protection and marketing and advertising.

I'll continue this theme in my next post.

Finally, if you enjoy my blog post, please share it with colleagues and anyone else you think may encourage them, with a suggestion that they might like to subscribe.

Have a good week

Laurie Kaye

 

Data subject access rights – have your say

Dear reader

In the second of a series of posts on recent developments in the field of data protection law, my colleague Sherif Malak highlights some important aspects concerning the rights of individuals to access their data and the consultation on a new code that is currently underway.  A number of privacy campaigns have sought to raise the public’s awareness of the increasing volumes of personal data used and collected by service providers online, so it is important to have the right processes and procedures in place when dealing with a user request for access to their personal data.

The public consultation period for a draft code of practice on the access right of data subject access published by the ICO (the UK data protection authority) is due to end next month.  The 60 page draft code contains guidance on the requirements of the Data Protection Act (DPA) as well as points of good practice that it recommends organisations adopt in respect of the rights of access data subjects have under sections 7-9A of the DPA.  Generally, within 40 days of request and for a nominal fee (max. £10), individuals are entitled to be told whether personal data are being processed and to be given a description of that data, the reasons for processing and whether data will be shared with other organisations or people.  They are also entitled to be given a copy of the personal data and, if available, details of their source. 

For many organisations and other data controllers, such subject access requests (“SARs”) are commonplace and so the guidance may have a significant impact on how they conduct their request handing procedures.  The draft code emphasises that organisations should embrace the opportunity to take a positive approach to data subject access rights by streamlining request handling through staff training and guidance and by monitoring compliance.  We recommend reading through the paper which is quite detailed and provides a number of useful examples.  In the meantime, a few points made in the draft that will no doubt be of interest include:

• Although a SAR must be made in writing, it does not need to take a prescribed form nor mention the DPA (or that it’s a SAR) and can even appear at first sight to be a Freedom of Information Act request. In fact, a request can be sent, directly or indirectly, by post, email, fax, via an organisation’s website  or even posted on its social media site or a third party website.  So make sure you’re vigilantly checking your organisation’s tweets if it has a Twitter page!

• A child’s rights may be exercised by parents/guardians but it is the child who has the right of access.  If an organisation is confident that a child is mature enough to understand his/her rights then it should respond to the child and not to the parent (regardless whether the parent or the child made the SAR). The draft code helpfully lists a number of factors to consider in borderline cases on page 13.

• The 40 day period to respond to a SAR cannot be extended because an organisation is relying on a data processor to supply the required information.  So organisations using data processors take note – you will need to put in place contractual arrangements to make sure that you can deal with SARs promptly, including when they are send to your processors directly.

• You should not ignore a SAR simply because an individual has not paid the fee, has not provided enough information or if you reasonably require more information to confirm the requester’s identity.  You should contact the individual promptly and inform them of what is needed for their request to be processed.  If you have done so, the 40 day period will not begin until you’ve obtained these things from the requester.

• The draft code clarifies that the ‘disproportionate effort’ exception applies to the supplying of the information by organisations but does not permit you to exclude information from your response just because it is difficult to access or find.  Data controllers are therefore obliged to make extensive efforts to locate data relevant to a SAR but not obliged to “leave no stone unturned”.  You cannot require the requester to narrow the scope of their request if they have asked for “all the personal information held” about them.

• You should have procedures in place to find and retrieve personal data requested that has been electronically archived or backed-up.  However, the ICO has said that it does not expect you to use expensive technical expertise to ‘undelete’ deleted information that can technically be recovered.

• The draft code also covers in detail how you should deal with requests involving 3^rd party data, special cases (such as credit and health records) and the form in which you can respond to a SAR.

The consultation period ends on 21 February 2013 and if you would like to participate and provide your feedback, you can find the submission form for your comments as well as a copy of the draft code on the ICO’s webpage here.

Have a great week,

Laurie Kaye