Whither ‘mere conduit’?

‘Mere conduit’ is a defence - laid down within the European e-Commerce Directive and transposed to UK law within the Electronic Commerce (EC Directive) Regulations 2000 - that allows an intermediary, typically an Internet Service Provider, to limit liability for illegal activity. This follows on from the accepted position that a mail carrier (Royal Mail etc.) is not liable for the contents of mail that it carries - provided that it does not know what is in the package.

Article 12 of the European Directive sets out the position:

‘Mere conduit’

1. Where an information society service is provided that consists of the transmission in a communication network of information provided by a recipient of the service, or the provision of access to a communication network, Member States shall ensure that the service provider is not liable for the information transmitted, on condition that the provider:

(a) does not initiate the transmission;
(b) does not select the receiver of the transmission; and
(c) does not select or modify the information contained in the transmission.

2. The acts of transmission and of provision of access referred to in paragraph 1 include the automatic, intermediate and transient storage of the information transmitted in so far as this takes place for the sole purpose of carrying out the transmission in the communication network, and provided that the information is not stored for any period longer than is reasonably necessary for the transmission.

So, that seems reasonably clear. An Internet Service Provider (ISP) is an intermediary - they carry traffic across their network, they do not initiate the traffic, they do not select the recipient and they carry it without selection or modification. Provided they adhere to the conditions then they may claim a defence of mere conduit and cannot be held liable for, say, the transmission of illegal criminal content (child abuse content) or unlawful content (Peer 2 Peer file sharing). The problem for the ISP comes when they are told about the traffic or otherwise become aware. Once an ISP is ‘put on notice’ then they must take action.

OK, so why is there a question mark over ‘mere conduit’, what appears to be a well established point of law. The problem, as so many affecting ISPs today, has derived from the peer 2 peer discussion. We know that pressure from the industry has resulted in the ‘3-strikes and you’re out’ process - shortly to be incorporated within the UK Digital Economy Bill. Now it seems that the rights industry has been able to exert pressure in other areas and the outcome of this could be important for the intermediary.

The problem area is ACTA. AC what you say - ACTA stands for the Anti-Counterfeiting Trade Agreement. OK, what has that got to do with ISPs. Governments have been engaged in a series of discussions, the most recent of which have taken place in Seoul, South Korea, to look at the updating of laws to protect intellectual property. Most readers will be familiar with actions brought against online auction houses (e-Bay) alleging collusion in the sale of counterfeit goods diluting the trademark interests of well known luxury brand names. Other actions have been taken by Customs and Trading Standards officers to confiscate counterfeit goods - sunglasses, handbags, rip-off DVDs etc. That all seems fairly straight forward and expected.

The problem comes with the extension of the counterfeiting argument to copyright infringement in the electronic environment. Hints of the nature of the Seoul discussions appeared in leaked preparatory papers. An European Commission (DG Trade) document in September indicated that the EU and US had engaged in discussion in Washington as part of the Intellectual Property Rights Work Group. Within those discussions, a side meeting had been held to discuss the US preparation of the future Internet Chapter of the ACTA. At that time the US delegation indicated that they had been working for some while on the chapter and had engaged in discussion with other Govt. agencies and with interested private stakeholders (not defined or named as these were bound by NDAs). The US delegation gave an oral presentation to the EU Trade group. It is now clear that discussions in Seoul have followed the inital oral advice and that the US drafted chapter appears to follow the provisions of the US Digital Millennium Copyright Act (DMCA)

ACTA requires that ACTA members (Government/member state signatories) have to provde for third-party liability; Safe-harbours for liability regarding ISPs to be based on Section 512 of the Digital Millennium Copyright Act and to benefit from safe-harbours, ISPs will need to put in place policies to deter unauthorised storage and transmission of IP infringing content (these might include making changes to customer contracts to allow a graduated response - ie, ‘3-strikes and you’re out’).

The European Parliament has now voted against the ‘3-strikes’ approach - there is development within the new Telecoms Package to be agreed between the European Council and the European Parliament. That is likely to reach consensus with provisions to allow a ‘3-strikes’ approach but perhaps subject to appeal or judicial oversight.

There is more amongst the discussion from Seoul. It would appear that rights owners will be able to initiate proceedings against intermediaries alleging that they have allowed their networks to be used for unlawful activities. European ISPs have long known that US based rights owners would like to see the European protection removed and brought into line with the US DMCA practice. In order to claim safe-harbour protection the European intermediaries would need to ensure that they, ‘put in place policies to deter unauthorized storage and transmission of IP infringing content.’ That is a wholly different approach to the current status, transferring the onus to the ISP. The EDRI newsletter notes, “European citizens should be concerned and indignant. As reported, the ACTA Internet provisions would also appear to be inconsistent with the EU eCommerce Directive and existing national law, as Joe McNamee, the European Affairs Coordinator of EDRi notes: “The Commission appears to be opening up ISPs to third party liability, even though the European Parliament has expressly said this mustn’t happen, ACTA looks likely to erode European citizens’ civil liberties.”

There has been real concern about the nature of the discussions - and the secrecy within which they have been conducted. The EU leaked paper noted, ‘As agreed among ACTA participants, the negotiating papers are not public documents’. The Washington Post noted that civil rights organisations had written to President Obama to complain about the lack of transparency.

The Washington Post article noted. ‘The groups, which include Public Knowledge and the Sunlight Foundation, wrote in a letter that the secrecy of the process – and on an issue that could have broad implications for Web users – could unfairly the benefit content providers that are most actively involved in the process.

“We applaud your promise of a more transparent, collaborative and participatory government,” the groups wrote. “However, multiple aspects of ACTA fail to meet these standards.”

The Swedish Presidency has published a note about the 6th round of negotiations. The Swedish note notes, ‘discussions at the meeting were productive and focused on enforcement of rights in the digital environment and criminal enforcement.’ The note continues, ‘Participants also discussed the importance of transparency including the availability of opportunities for stakeholders and the public in general to provide meaningful input into the negotiating process.’

The opportunity for the public to ‘provide meaningful input’ is important. The next stage of the ACTA negotiations will take place in Mexico in January 2010. With the Lisbon Treaty in full force from 1st December, the EU will represent all member states and any decisions accepted will be implemented for all. The current (Swedish) presidency of the European Union notes that ACTA hopes to reach agreement and implementation early in 2010 - there is not much time left before we might see major changes that will affect ISPs and other third parties. Where will be the opportunity for public consultation and input in this timescale?

Data retention - still some unhappy states

The Data Retention Directive was introduced into European law back in 2006 - with a requirement that member states transpose the first phase by September 2007 and the second phase by March 2009 (where the State took advantage of a derogation in rellation to IP based traffic).

Interestingly, both Belgium and The Netherlands advised the European Commission of their intention to take advantage of the derogation in relation to IP. That still meant that they were expected to transpose in relation to fixed line and mobile telephone traffic by September 2007 but that had opted, like the UK, to leave IP based retention until the later date.

A group of Belgian organisations have now raised a petition to protest the local transposition of the Directive. In August, the Belgian Minister of Justice proposed a retention period of 2 years (the maximum within the range of the Directive - 6 months to 2 years) . The UK settled on 12 months - interestingly the Belgian Data Protection Supervisor felt that the 2 year period was too long and disproportionate and should be reduced to 12 months. The Belgian petitioners felt that there was not sufficient evidence to justify the retention of traffic data which they felt was not a solution to security issues.

Just to the north, the Netherlands government is also engaged in discussion. A few wees ago, government agencies held meetings with ISPs to provide some clarification of terms within the new Data Retention Act - EDRI-News reports that after the meeting there was still confusion as to what was required and for how long. As currently implemented, both telcos and ISPs are required to retain data for 12 months but discussion in the upper house of the Netherlands parliament (Senate) has suggested that the Minister may be prepared to reduce the ISP requirement to just 6 months (as was suggested in the UK, bearing in mind the low level of requests of user data in relation to IP based traffic).

A full description of the Netherlands law (2008) can be found at the site for Agentschap Telecom, the Dutch telecoms regulator.

There has also been discussion in the Netherlands about the possibility of centralised retention of traffic data. ‘Bits of Freedom’ in the Netherlands reports that some 3 Million requests for traffic data were served by the Netherlands police in 2008 - on a population of some 16 Million. That is a very high figure when compared against the reported request rate in the UK - Surveillance Commissioner reported 0.5 Million requests in 2007 against a population of some 60 Million. If the UK rate were the same as the Dutch then that figure would be in the order of some 11 Million requests!

Clearly there remains considerable concern and disquiet across Europe.

The Directive provides for review of the retention policies in 2010. Clearly there is likely to be a lot to be discussed.

Article 138 amendment

The Crusher understands that agreement has now been reached in the Conciliation phase of discussions relating to the Telecoms Package Agreement between the European Council and the European Parliament.

The agreed text should now read:

“Communications networks shall respect the fundamental rights and freedoms of natural persons, as guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms and general principles of Community law.

Accordingly, these measures may only be taken with due respect for the principle of presumption of innocence and the right to privacy. A prior, fair and impartial procedure shall be guaranteed, including the right to be heard of the person or persons concerned, subject to the need for appropriate conditions and procedural arrangements in duly substantiated cases of urgency in conformity with European Convention for the Protection of Human Rights and Fundamental Freedoms. The right to an effective and timely judicial review shall be guaranteed.”

The amended amendment changes the original - that provided a much clearer requirement for judicial review and oversight before a user account could be suspended. The new version (as above) provides for the right to be heard (in the UK that would seem to be to bring a complaint before a new Ofcom body) and then to seek judicial review at a later stage. The fact that the amendment does not require prior judicial review now leaves the way open for the 3-strikes approach.

If the amended amendment is now approved by vote in both the European Parliament and the European Council (of Ministers) then the Telecom Package will be able to proceed.