Prepared by Francis Davey - 1 December 2009
This is an explanation and analysis of the "copyright infringement provisions" the Digital Economy Bill -- strictly speaking this means clauses 4 to 15 which amend the Communications Act 2003 to add new sections 124A to 124L, but I am also considering clauses 16 (definitions) and 17 (amendments to copyright law) as well.
These provisions are being popularly referred to as "three strikes" law directed against peer to peer file sharing. This is an extremely serious misconception. The bill gives enormous powers - exercisable with no Parliamentary oversight - to the Secretary of State to require the disconnection of individuals' internet access for any reason. Not only is there no requirement for such disconnections to relate to a number of "strikes" there is no need for disconnection to be linked to infringement of copyright.
The Bill's proposal goes far beyond what we have seen attempted in other countries such as France and New Zealand.
Furthermore, while these clauses are almost certainly intended to work against peer-to-peer file sharing in the first instance, the way in which the bill is worded is completely general. Those parts which do refer to copyright infringement at all do not limit it to any technology so that an "innocent" browser of a web page containing, unknown to them, an infringing image or text would be caught.
Stephen Timms is reported as saying:
"so that it, in future, new communications technologies allow creative content to be unlawfully copied in new ways, remedies can be developed and implemented more quickly and flexibly than might otherwise be possible, so that emerging threats can be addressed in a targeted way".
This is clearly mistaken and there is no need for a power to change copyright law to do that job. The power (in clause 17) is self-evidently far too wide. It would allow future governments to restrict or extend the reach of copyright on the internet as they saw fit. Copyright law is much to complex and sensitive a law to be amended wholesale by secondary legislation. I will say no more about it.
The main thrust of the copyright infringement provisions comes in two parts:
notification -- a power to force ISPs to warn subscribers about apparent infringements
technical measures -- a raft of sanctions that may be used against an individual including disconnecting them from the internet.
The Bill makes no connection between the two parts which could operate quite independently. The exact details of their operation is partly constrained by the Bill, but a huge amount of the detail is left to be made by order or by codes of practice made or approved by OFCOM.
the key question of who will be disconnected from the internet and for what reason is subject to no democratic control and requires no consultation to be made
although the codes must be objectively justifiable, non-discriminatory, proportionate and transparent this most important question will be decided by order of the Secretary of State who is not required to be adhere to any principles of proportionality etc.
some decisions (such as whether there has been a copyright infringement) that affect individuals will not be subject to appeal; those that are may not have an adequate route of appeal
many of the important details are left to codes of practice which will not be subject to sufficient parliamentary scrutiny - in some cases there need be no scrutiny at all
the Bill has an inflexible and stereotyped view of the way in which access to the internet is provided which ignores many useful and important business models: many business from Weatherspoons and Macondalds to the British Library and local community access projects will be affected and may have to cease to provide internet access.
Three players appear on the stage (of whom, more later):
copyright owners (includes those authorised to act on their behalf, which is likely to include collecting societies)
internet service providers (ISP's)
subscribers - anyone else, including large corporations as well as individuals
The notification stage proceeds as follows:
copyright owners will be able to send a copyright infringement report to ISP's which will contain an IP address, evidence of an apparent copyright infringement and the time it took place
there is no provision to penalise copyright owners for inaccurate or careless reporting - the threshold requirement in the bill is that it "appears" to them that there has been an infringement of copyright, though the IOC could sharpen that, it is not required to do so
the ISP must then forward a notification to the subscriber identified by the IP address
it is immaterial whether the subscriber themselves is alleged to have infringed copyright or whether someone they allowed to access the internet via their connection was the alleged infringer
there is no requirement that a subscriber be able, at this stage, to object to the report or dispute its accuracy (as there is in the Digital Millennium Copyright Acts' take-down notice procedures for instance)
at a later stage a copyright owner may demand from the ISP a copyright infringement list that will group copyright infringement reports by subscriber, which can be used by the copyright owner to detect repeat infringement, particularly where a subscriber receives dynamic IP address allocation; the copyright owner may then use that information to seek a Norwich Pharmacal order to identify the subscriber.
The notification stage will be governed by a code called the initial obligations code (IOC). The Bill provides a most peculiar way for the/an IOC to be made. The/a code could be made in two ways:
A an "approved code" -- that is a code which has been approved by OFCOM but been made by someone else. Such a code may be approved any time after the act receives Royal Assent, but there may only be one approved code at a time. Such a code will not need to be laid before parliament or made by Statutory Instrument.
by OFCOM who may make a code if there is no approved code from 2 months after the bill receives Royal Assent and must do 6 months thereafter. Such a code may be annulled by Parliament and must be made by SI.
There is no good reason why any code should not be made as a Statutory Instrument and require some form of Parliamentary oversight.
Technical note: Nothing in the Bill appears to prevent a code being approved after OFCOM has made its own (so that there would be two codes running in parallel). There is no provision for withdrawing an OFCOM code (though it may be amended). The language in some places suggests that there may be two at once (for instance by using "an") in other places "the" code is referred to as if there could be only one.
The Bill appears to make unreasonable assumptions about the kinds of business model that is or may be used to supply internet access. There is a particular difficulty with the definition of the terms "ISP" and "subscriber".
Almost anyone who provides access to the internet by allocating IP addresses to individuals will be an ISP. The only restriction on this is that a "subscriber" must be:
supplied the service under an agreement - where "agreement" may be a broader term than "contract"
not receive the service as a communications provider
All sorts of organisations supply open "free" wifi. While they may restrict access to customers or those who have been given an access token, there is an increasing use of unrestricted wifi networks. The operator of such a network may or may not receive it as a communications provider (whether or not they could be said to be a communications provider).
For example Weatherspoons pubs provide wifi to those visiting the pub. Depending on how they buy in their internet access they may or may not be a subscriber of their ISP. If they are they risk being listed as a subscriber on copyright infringement reports.
Weatherspoons does not use access tokens and wifi is used by visitors who may not be customers (eg they may be guests of customers). It is quite possible that those visitors are not subscribers and therefore Weatherspoons would not be an ISP (for the purposes of the Bill) and be required to notify them of copyright infringement reports. But anyone who does allow internet access "under an agreement" would appear to be an ISP.
The definition of "subscriber" and ISP thus creates considerable uncertainty as to who falls into each category.
For example if I agree to let you use wifi in my flat to access the internet via my broadband, I appear to be an ISP and you my subscriber. Because I do not receive my internet access as a communications provider I am also a subscriber. I may be in a situation of double jeopardy: having to notify you of copyright infringement reports (which may be impossibly difficult for me) and turning up on them myself.
Notifications are required to give "advice about the protection of electronic communications networks that use wireless telegraphy" in which there is an implicit assumption that running an open wifi network is in some way reprehensible - an idea that is backed up by various political statements. Again it seems that the Bill may be trying to preclude certain forms of ISP operation.
The scope of these definitions has clearly not been properly thought out and risks making difficult or impossible many alternative business models that will increase digital inclusion (such as social enterprise projects) and business flexibility.
a copyright infringement list will only apply to that owner's notifications so that they are unlikely to be of practical use except to large collection societies and other rights organisations
the requirement to notify specifies that an ISP must send to a subscriber to their email or postal address this assumes that an ISP knows those things (or is able to identify its subscribers in that way) - again an unreasonable assumption that may restrict the kinds of feasible business models for ISP's in the future
a notification must contain information about the "purpose" of copyright. There is considerable political and academic debate as to the answer to this question. It seems entirely wrong that a code of practice should be able to determine so fundamental a question as this
the IOC may set a lower threshold number of infringement reports below which an ISP need not carrying out the notification procedures, but there is no requirement for the code to do this: such a de minimis limit is essential to protect small ISP's (which may be small companies or individuals as I have explained) from an onerous regulatory burden.
"Technical measures" include disconnection from the internet, as well as milder sanctions such as the choking of bandwidth. How, when and for what reason technical measures may be imposed will be decided by order of the secretary of state under s.124H. They need have nothing to do with copyright infringement. All that is required is that the Secretary of State "considers it appropriate". There will be no Parliamentary oversight of such an order which need not even be made by statutory instrument.
Thus technical measures could be imposed on individuals who can prove beyond any reasonable doubt that they are not guilty of copyright infringement of any kind and took all reasonable steps to prevent it. For example, the Bill's tone suggests strongly that technical measures will be taken against those who run wifi networks without properly securing them.
The way in which the technical measures are imposed will be governed by another code "technical obligations code" which OFCOM must issue if/when the secretary of state makes their order under 124H.
The initial obligations code requires that there is an individual (independent of OFCOM, copyright owners and ISP's) to whom appeals can be made. The scope of such appeals is not specified and there is no requirement for any right to an onward appeal. In the technical obligations code there will be two people who must be independent of copyright owners and ISP's:
an "enforcer" (under s.124J(2)(a) which could be OFCOM that will resolve copyright infringement disputes: there are no provisions for appealing any decision of the enforcer although any decision they make may be the subject of judicial review.
another person, which cannot be OFCOM, who resolves subscriber appeals (appeals about the imposition of technical measures): their decisions may be subject to an appeal to a tribunal.
appeals to the tribunal will be on grounds specified in the code including "on grounds that it was based on an error of fact, wrong in law or unreasonable"
The term "copyright infringement dispute" is misleading. It means a dispute between copyright owners, ISP's and/or subscribers involving any "act or omission relating to a technical obligation or the technical obligations code". That does not appear to cover (for example) whether copyright was infringed (or whether copyright subsists at all). There does not appear to be anywhere in the scheme of the Bill for the question of whether copyright has been infringed to be raised.
The wording of the subscriber appeals provision is suspiciously limited:
it does not permit an appeal against the exercise of discretion (eg whether it would be appropriate to impose a technical measure in these circumstances) except on the grounds that the exercise was unreasonable.
it falls short of giving the subscriber a right to have their case heard in full by the tribunal. As written it implies that (for example) the onus would be on the subscriber to prove that the person who made the decision had made an error of fact, rather than the matter being directly before the tribunal.
Many tribunals that oversee significant decisions affecting individuals are given the power to completely determine the matter before them, rather than being restricted to a review of the decision made below them.
The "telecoms package" - a series of amendments to existing EU directives - has, as a result of considerable argument and compromise in the European Parliament, an amendment to be inserted into Framework directive on Electronic Communications, that appears to be intended to protect end-users from arbitrary disconnection from the internet.
Note that an "end-user" is a user not providing a public communications network or publicly available available electronic communications services. A definition which might not cover individuals with open wifi and many corporations who use wifi to attract custom.
It is extremely difficulty to assess what impact the amendment will have on the implementation of the Bill, in particular there are aspects of the law which are developing as I write, but in my view the telecoms package amendment may have very limited impact on the Bill if any.
It appears to try to protect end-users in two ways: (i) by appeal to principles of human rights in the European Convention on Human Rights and general principles of community law; and (ii) by specifically requiring a "prior, fair and impartial procedure shall be guaranteed".
orders setting the criteria and steps to be taken by which technical measures may be imposed
Laying before Parliament (but no possibility of opposition)
"approved" initial obligations code
directions by Secretary of State to OFCOM concerning technical obligations (eg a direction to prepare a technical obligations code)
Laying before Parliament (with possibility of opposition)
initial obligations code (annulment)
order amending the maximum penalty for failure by ISP's to comply with obligations imposed by the copyright infringement provisions (approval)
order amending the Copyright Designs and Patents Act 1988 (approval)