News & Publications

News

19 April 2010

EMI & others -v- Eircom: Three strikes leads to loss of internet access

The Irish High Court has decided that Ireland's largest ISP, together with the major record labels, can validly operate a "three strikes" escalated procedure leading to termination of internet access in response to detected instances of copyright infringement. A copy of the judgment can be found here.

Background

The question being decided by Mr Justice Charleton was whether a "three strikes" protocol agreed between the four major record labels (EMI, Sony, Universal and Warner) and the largest of Ireland's ISPs (Eircom) was objectionable on data protection grounds. Briefly the arrangement was that the record labels would operate software to identify file-sharing of files in which they claimed copyright, where one of the parties was operating from an IP address assigned to Eircom. Eircom would be notified of the alleged infringement, and agreed it would implement a "three strikes" procedure ultimately leading to termination of the subscriber's internet access on the third such notification.

The Data Protection Commissioner initially wrote to the solicitors for EMI expressing concern over their intention to collect, share and process IP addresses which might constitute "personal data" and/or "sensitive personal data". If the data fell under these headings then there would have been restrictions on the use of this data by the record labels and/or by Eircom.

The questions for decision, and the judge's ruling

The judge was asked to make a ruling on three questions which can be summarised, simplified and rephrased for context as follows:

1) Do IP addresses, in the hands of EMI, constitute "personal data" for the purposes of the Data Protection Acts, 1988-2003, such that EMI must comply with certain specified provisions of the Data Protection Acts?

• Held: No, since the subscriber cannot be identified from the IP address, and it is not likely that the record labels can combine the IP address with other information, or will even attempt to do so, the IP addresses are not personal data within the meaning of the Act.

2) Assuming that the processing by Eircom of "personal data" when terminating an internet user's subscription is potentially permissible under the Data Protection Acts, is it nevertheless prohibited because the termination of internet access represents "unwarranted [processing] by reasons of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject"?

• Held: No, terminating an internet user's subscription is not unwarranted and therefore not prohibited. Copyright is a personal property right under the Irish Constitution which the Courts have a duty to protect. By imposing on subscribers, as a condition of internet access, a prohibition on copyright infringement, Eircom as an ISP is acting legitimately to support a third party's constitutional right, and the sanction of terminating access is not excessive and is consented to by the subscriber. Enforcing this sanction using the automated system agreed with the record labels is similarly not excessive or unwarranted.

3) Is it open to EMI and/or Eircom under the Data Protection Acts to implement the three strikes process, and in particular, the termination of an internet user's subscription, in circumstances where:-

(a) In doing so they would be engaged in the processing of "personal data" and/or "sensitive personal data", including the provision of such data from one private entity to another private entity; and

(b) The termination of an internet user's subscription by Eircom would be predicated on the user having committed an offence (i.e. the uploading of copyright-protected material to a third party by means of a peer-to-peer application) but without any such offence having been the subject of investigation by an authorised body; and, further, without any determination having been made by a court of competent jurisdiction, following the conduct of a fair and impartial hearing, to the effect that an offence had in fact been committed.

• Held: Yes, it was open to the parties to operate the three strikes process. The judge reasoned that the parties were not really concerned with whether or not any criminal offence had been committed (this would require a showing of knowledge or intent, which was beyond the scope of the detection and notification procedures), and that their only concern, in operating the three strikes process, was in detecting and preventing civil copyright infringement. As such, the issues associated with "sensitive personal data" and the more stringent controls on processing data relating to criminal offences, did not require consideration.

Comment

It is perhaps noteworthy that the Data Protection Commissioner was not represented before the Court, and nor was there any representation for the consumer (the data subject) or for digital advocacy groups opposed to the implementation of the three strikes system. The judgment is particularly striking for the language chosen by the judge to describe the act of copyright infringement ("theft", "stealing", "filching"), and to describe those involved ("copyright thieves"). Such language is a departure from the normally neutral terminology of "infringer" or "alleged infringer" usually found in judgments dealing with patent, trademark and copyright cases.

The overall tenor of the judgment strongly champions the rights of the copyright holder, with the judge indicating that he believed it was not disproportionate to terminate internet access as a result of three acts of copyright infringement. Little weight was given to the "legitimate interests of the data subject" in answering the second question, although the judge was satisfied that there was a mechanism in place for those who depended on internet access for medical needs or their livelihood to appeal against termination of their account.

In setting out the third question, the the Data Protection Commissioner appears to have asked the judge to rule on the legality of the three strikes system in cases where Eircom cuts off a subscriber believed to have committed a criminal offence (as opposed to civil copyright infringement). Interestingly, the Court's answer seems to be that the system will not in fact operate in this way, and that Eircom and the record labels will not be concerned with criminal offences at all. This suggests a divergence of opinion between the Data Protection Commissioner and the Court as to how the system will operate in practice and the basis upon which disconnections will take place.

Unlike the French Constitutional Court rulings last year, which decided that a three strikes law was unconstitutional unless the final disconnection step was taken by a judge, this decision of the Irish High Court deals only with a private arrangement involving a single ISP, and there is no law in Ireland providing for a "three strikes" solution. No other ISP has yet agreed to implement this three strikes rule, and some have publicly indicated that they will fight any attempt to impose a similar solution on them. All of this suggests that this is not the last word on the three strikes system from the Irish courts.