My report for WIPO on filesharing and intermediaries

Briefly, WIPO has just released two studies on copyright, intermediaries, filesharing and implications such as the rise of graduated response, the first of which I prepared:

A. Role and Responsibility of the Internet Intermediaries in the Field of Copyright, by Professor Lilian Edwards

This Study aims to identify the trends and principles governing the changing role of Internet intermediaries, summarizing the evolution of business models and outlining the complex issues to be considered in developing public policy in this field.

B. Comparative Analysis of National Approaches of the Liability of the Internet Intermediaries, by Professor Daniel Seng and Professor Juan Jose Marin

In this second Study, Professors Seng and Marin seek to identify the possible commonalities among different liability doctrines. The Study is divided into two parts, the first consisting of a “Survey of National Legislation and Jurisprudence on the Liability of Internet Intermediaries in the Field of Copyright and Related Rights”, covering 30 jurisdictions¹. The second contains a conclusion resulting from the Survey, which defines trends and commonalities in the treatment of the responsibility of Internet intermediaries.

Both (I would modestly suggest) are worth a read , though the second as so far issued is empirical description, no conclusions yet. They do however dovetail usefully. My report's tentative conclusions are:

• - Global consensus on NTD as sensible balance between rightsholders and intermediaries broken in copyright field

• - No consensus on replacement regime

• - Graduated response (GR) solutions are costly, error prone and sanction may be disproportionate; pose serious risks to fundamental rights and public interest in digital inclusion; and their effectiveness is unproven.

• - Accordingly recommended that any attempt to impose GR by law should be justified by prior, independent ,empirical investigation, taking into account not just economic factors but also (i) impact on fundamental freedoms (ii) public interest in digital inclusion and promotion of innovation and (iii) state of incentives to create a market of legal alternatives to illicit filesharing.

• - If GR regimes are so justified, regimes should be introduced via legislation, subject to constitutional scrutiny , rather than by voluntary or coerced action

• - Solutions imposing fewer costs on user and public interests should be adopted first, eg, “notice and notice” rather than notice and disconnection, and empirically monitored to see if they prove sufficient

• - International treaty should lay down rules on safeguards to be observed in any GR regime imposed by law. In particular, independent and transparent scrutiny of allegations of infringement before sanction, as well as judicial appeal after such, is vital.

• - Website and content blocking and blanket monitoring in particular should both be subject to stringent scrutiny as presumptively in breach of fundamental freedoms.

The - The international community should give pressing attention to what legal steps must be taken to facilitate and incentivise new business models for monetising digital content.

I just spoke to WIPO's Standing Commitee re the report which I may say more about later (currently leaching the free wi fi at Geneva Airport. ) I also had request for the slides I used which summarise the rather long report : WIPO is putting these up itself but I will try to add them here too shortly.

Hargreaves IP Review : first impressions

The Hargreaves review, or as we should call it, Digital Opportunity: A Review of Intellectual Property and Growth, is finally out, and the blogosphere is awash with comment. Like many people, Pangloss has only had a chance to glance at it and note that the key recommendations are described thus [my italics added]:

• an efficient digital copyright licensing system, where nothing is unusable because the rightsowner cannot be found;
• an approach to exceptions in copyright which encourages successful new digital technology businesses both within and beyond the creative industries;
• a patent system capable of preventing heavy demand for patents causing serious barriers to market entry in critical technologies;
• reliable and affordable advice for smaller companies, to enable them to thrive in the IP intensive parts of the UK economy;
• refreshed institutional governance of the UK’s IP system which enables it to adapt organically to change in technology and markets.
  

Most of this seems at first sight to be very good news. The emphasis throughout on an empirical evidence base for IP policy is quite staggeringly refreshing in a field which is known to be the most lobbied by partisan stakeholders of any economic policy area. Much of this, one hopes, comes from the fact that serious academic economists , not paid by any industry or rightsholder sector, have contributed in depth to the Report. There is a formidable list of supporting evidence and documents which will be a great resource for those working in the field. In particular the restraint in paragraphs like this is to be treasured:

"No one doubts that a great deal of copyright piracy is taking place, but reliable data about scale and trends is surprisingly scarce. Estimates of the scale of illegal digital downloads in the UK ranges between 13 per cent and 65 per cent in two studies published last year. A detailed survey of UK and international data finds that very little of it is supported by transparent research criteria. Meanwhile sales and profitability levels in most creative business sectors appear to be holding up reasonably well. We conclude that many creative businesses are experiencing turbulence from digital copyright infringement, but that at the level of the whole economy, measurable impacts are not as stark as is sometimes suggested."

Rightsholders have claimed it as a victory that no US style general exception for "fair use" (or even "transformative use" as Gowers put it) has been proposed: this is rubbish, as all sides know that would require rewriting the EU Infosoc Directive, which would take countless and possibly fruitless years of negotiation. Instead the report suggests the UK uses to the full the exceptions that are available within the EU framework, including parody, archiving, data mining and format shifting exceptions, which would finally allow the long suffering public to legally rip their own CDs to their own iPods. This is all good stuff, as the British Library have already said - but it has to be remembered the Gowers report recommended almost exactly the same things several years back, and precisely nothing happened. Let's hope Hargreaves won't go the same way.

The most unexpected outcome was probably the attention paid to the way that "patent thickets" increasingly commonly stifle innovation and hinder new intrants with new technological ideas. My colleague Technollama, a long time open source and open science advocate has written approvingly of the plans announced , which is good enough for me.

My own interest is most piqued by the recommendation that the Government bring together rights holders and other business interests to create the world’s first Digital Copyright Exchange. The idea behind this proposal is that it will make it easier for users to obtain licences of rights holders' works for digital exploitation, in the hope that this will help drive digital innovation - for example, perhaps finally allowing ISPs like Virgin to offer legal P2P for a flat fee, something which major music rightsholders have stymied for several years by refusing to issue blanket licenses for unlimited sharing. The history of Spotify is also instructive here - though they have had huge success in parts of Europe, their launch in the US has been endessly delayed by the music rightsholders refusing to play ball. Every new online service suffers from barriers to offering comprehensive current and back catalogue. It is extremely heartening to see a UK government review say upfront that the future for the content industries lies not with ever more draconian IP enforcement strategies, but with creating a market where attractive licensed content is available in ways that rival and compete with the illegal market; and where the main aim is not to alienate the potential consumer but to offer him/her a great product.

Not coincidentally , Pangloss has just come to exactly the same conclusion in her own report for WIPO on the Role and Responsibilities of Online Intermediaries in Copyright which will be launched very shortly in Geneva. Some parts of the EU policymaking machine also believes better cross licensing and collecting society arrangements are the longterm answer, not anti consumer measures like restricting services in some markets, and promoting graduated response. Hopefully the UK will now make these points during the upcoming renegotiations of the IPRED Directive.

To quote again:

"Such research as exists indicates that we should be wary of expecting tougher enforcement alone to solve the problem of copyright infringement. Instead, Government should respond in four ways: by modernising copyright law; through education; through enforcement and by doing all it can to encourage open and competitive markets in licensed digital content, which will result in more legitimate digital content at prices which appeal to consumers."

However, as one blogger has already noted ,the proposal is likely to be resisted to the teeth by some large creative industry rightsholders . Taylor Wessing note:

"Issues that arise include:

• Who will police whether rights are being accurately recorded within the Exchange? The opportunity for abuse is immediately apparent, with many disputes over ownership being flushed out at the outset of the Exchange.
• How will limitations on licences (e.g. territorial restrictions or particular restricted uses) be recorded? Some licences will have a string of limitations attached to them, making the Exchange quite complicated to navigate for a lay person.
• Who will fund it? It is unlikely to be the Government given these times of austerity. Therefore, funding is likely to come from within the creative industries. Is this a cost that the industry can stomach or will this be seen as yet another cost to the creative industries, along with those of tackling digital piracy?

Finally as expected the report makes no new recommendations concerning the Digital Economy Act: it was known this would be off limits given the uncertainty around the judicial review. Given that there is still a very interesting Chapter 8 on enforcement (covering counterfeit goods and a possible small patent court claim for patent owners, as well as copyright), which concludes by recommending that

"When the enforcement regime set out in the DEA becomes operational next year its impact should be carefully monitored and compared with experience in other countries, in order to provide the insight needed to adjust enforcement mechanisms as market conditions evolve. This is urgent and Ofcom should not wait until then to establish its benchmarks and begin building data on trends."

Interesting times. In the meantime Hargreaves and his team are to be given every support in the hope these difficulties can be overcome - and that these proposals will not fester like Gowers.

Do You Want To Know A Secret?

Pangloss thought she was really going to write something serious about superinjunctions after the #Twitterstorm got on her nerves this morning, but it seemed by the time she got time that everyone else had written about it already. Including of course, David Allen Green.:)

Then she worried a bit about what the effect of all this might be on Twitter itself, rather than the celebrities, the newspapers, or the courts. Intermediaries worry a lot about being the ones who take the flak for the actions of their users. As a result most have abuse policies which boil down to "complain and we'll find a clause in our T & C which lets us take down the offending comment or possibly even kick the blighter off our site".

What worried me, then, was the suggestion this a.m. (which I now can't find, but believe me, it's out there) that Twitter could automatically redact tweets which threatened to infringe superinjunctions (ah found it!). Because I very much doubt they can . I suspect all they do right now is take down, in whole, on complaint, and that may not satisfy irate celebrity lawyers. Twitter is very very much more likely only to be able to automate removal of every tweet (and all of it) featuring say Jemima Khan's name . Or Gordon Ramsay's. Or um Andrew Marr. Even tweets by these people themselves. And that would er just be silly.

But then I remembered there's a fairly clear set of directions in the injunction Demon Internet got the court to approve way back in 2001, when they worried that one of their subscribers would break the court ban on revealing the new identity of Venables, one of the killers of Jamie Bulger.

An ISP shall not be in breach of the injunction unless it, or any of its employees or agents:

Knew that the material had been placed on its servers or could be accessed via its service, or

Knew that the material was likely to be placed on its servers or was likely to be accessed via its service, and, in either case

Failed to take all reasonable steps to prevent the publication."

Twitter isn't an ISP but the responsibility (and thus risk) seems similar or greater than a mere ISP. But what are "all reasonable steps"? Having a decent abuse policy? Providing the identity of alleged infringing tweeters on request? Providing it on court order? More? Yet more privatised filtering coming our way? Le sigh. (Hard to believe the ECJ would back that last though, the way SABAM seems to be going.)

But what I really ended up wanting to say wasn't a legal point but this quote which I found by an anonymous commenter at the end of one of the Guardian pieces.

The naming of celebrities still feels like a moral victory: as though we've usurped the rich and powerful. Celebrity superinjunctions annoy me not because of potential hypocrisy or controlling what I can and can't know (though those things do annoy me), but because it's wealth privilege on display. If I had an affair, and if for some reason the newspapers saw fit to print information about it, I wouldn't be able to get a superinjunction. I couldn't afford it.

So there you go. Superinjunctions, and their accompanying deconstruction and storm of comment, aren't about privacy vs freedom of expression. Or sex vs sensible journalism, tabloids vs broadsheets, the UK v the ECHR. or even the English High Court and Justice Eadie vs the Rest of the World. They're about power and the proletariat. Now can we go back to talking about stuff that matters, like jobs and health?

And why hasn't Wikileaks published that list of celebrities already anyway??

EDIT: Useful piece in OUT-LAW today about whether Tweeters could be done for contempt of court if accurately infringing outstanding injunctions cf @superinjunction.

One of the big issues is if a Tweeter as opposed to a media organisation would have had sufficient notice of the injunction, without actually having seen it or read it - Kim Walker thinks yes.

Another is anonymity - a Norwich Pharmacal order would work in UK, but will it work against Twitter whose HQ is in US? Walker thinks Twitter UK would request its US parent to seek a US order. Interesting - my own thought was that as with this case of the billionaire and allegedly libellous pseudonymous comments on Wikipedia, it would be up to the aggrieved celebrity to seek the US subpoena themselves. But again, seeking the ID itself, might be another of those "reasonable steps" Twitter as platform would have to take to ensure it was not itself in contempt?

An interesting point several commenters have brought up is that if a Twitter account is deliberately spreading false rumours the appropriate action would be not breach of confidence but libel, and that this would apply not just to the original accountholder but all the RTs. Litigation heaven beckons :) One wonders if the Jameel rules on abuse of process (previously used to restrain libel tourism) might not intervene here to stop the courts being flooded with thousands of Norwich Pharmacal orders...? (Note also that if the allegations were accurate, RTing would involve those who reweteeted as also breaching confidence - and yadda yadda, but more litigation hell..)

Return of the Robots! and Hay on Wye Festival!

Longtime readers of Pangloss may recall that last September I was momentarily rather obsessed with robot law and roboethics, having been kindly invited to an expert meeting on this topic by the EPSRC. In particular I gave you a sneak preview of my own version of the redesigned "Asimovs laws" as "Laws for Roboticists" which we worked on drawing up. The Scotsman also published a two page spread about this.

The full "committee" version of the new laws - expanded to five - have now been oficially published in New Scientist in a piece written by the marvellous Alan Winfield.

Alan writes on his blog:

"Well it's taken awhile, but the draft revised 'laws of robotics' have now been published. New Scientist article Roboethics for Humans, reporting on the EPSRC/AHRC initiative in roboethics, appears in this week's issue (Issue 2811, 7 May 2011). These new draft ethical principles are an outcome of the joint EPSRC/AHRC workshop to discuss ethical, legal and societal issues in robotics, last September.! ..

Asimov’s laws updated: instead of 'laws for robots' our revision is a set of five draft 'ethical principles for robotics', i.e. moral precepts for researchers, designers, manufacturers, suppliers and maintainers of robots. We propose:

1. Robots are multi-use tools. Robots should not be designed solely or primarily to kill or harm humans, except in the interests of national security.
2. Humans, not robots, are responsible agents. Robots should be designed & operated as far as is practicable to comply with existing laws and fundamental rights & freedoms, including privacy.
3. Robots are products. They should be designed using processes which assure their safety and security.
4. Robots are manufactured artefacts. They should not be designed in a deceptive way to exploit vulnerable users; instead their machine nature should be transparent.
5. The person with legal responsibility for a robot should be attributed."

These are of course very top level rules, needing interpretation in particular cases (just as the original laws did). Further commentary on these by the group (which I wrote a fair bit of, so like :) can be found here.

We emphasise that these are working documents, intended to inspire discussion not lay down immutable laws - comments here or elsewhere are very welcome.

This seems a good time to also announce that, slightly bizarrely, Pangloss is speaking on robots at HowTheLightGetsIn, the Hay-on-Wye Philosophy and Music Festival, which is a satellite to the famous literary festival! No, I'm not running the karaoke. I am part of the panel below for which I somehow suspect tickets are still available ( a snip at £6!)..

2.30pm Sat May 29th 2011

Rise of the Machines

Lilian Edwards, Peter Hacker, Hilary Lawson. Henrietta Moore chairs.

From 2001 to The Matrix, intelligent machines have played a central role in our fictions. But for half a century Artificial Intelligence research has been stalled. Now advances in robotics and language translation have put AI back on the agenda. But is AI possible or just a science fiction fantasy? And should we be excited or fearful at the prospect?

Eminent Oxford philosopher Peter Hacker, lawyer and technology guru Lilian Edwards and post-postmodernist Hilary Lawson imagine a future ruled by machines.

See you there! There's also Cory Doctorow, Susan Greenfield and Evgeny Morozow on that weekend and many more -- geek paradise!

Still time for GikII Gothenberg!!

I have neglected to post here that the abstract deadline for GikII 6: This Time It's Gothenberg! has been extended to MAY 15. You have two whole weeks more!!!

So don't waste your time watching the Royal Wedding, pretending to enjoy making the BBQ light, or pointelessly walking up a Munro when you could be doing something much more geeky instead! Instead send an abstract to lilian.edwards@strath.ac.uk or Mathias Klang (klangm@chalmers.se). We will notify successful applicants very shortly thereafter.

Full details and dates are here - note also that a limited number of places are also available to non speakers - with preference given to postgraduates and PhDs working actively in IT law related areas. You can notify us your details using the form here though note this does not confirm acceptance.

So come, come ye all or you risk missing: ppaers on variously the Twitter accounts of Abba, the legal personality of zombies, robot ethics and liability, law and virtual pornography, soft law in World of Warcraft, whistleblowing after Wikileaks, and the legal implications of time (or possibly the chronological implications of law).

Web blocking: the Internet is not for porn

Researching for my last class of the year, on Internet pornography (save the good stuff for the end :-) , Pangloss is amused to discover a survey commissioned by no less an institution than Radio 1's Newsbeat, claiming that a quarter of men between 18 and 24 think they watch too much porn online. Notwithstanding this, 8 out of 10 of the male 18-24 year olds questioned admitted to looking at porn on the net compared to only a third of women. Only 4% admitted to viewing such sites for more than 10 hours per week, the lvel required for a diagnosis of compulsion or addiction.

More seriously, it seems worth reminding oneself of the cogent reasons by which Joe McNamee of EDrI persuaded the European Parliament earlier this month that state-mandated, self-regulatory,non-judicial, non transparent web blocking by ISPs was not the path to go down.



This is all the more important as, behind closed doors, Ed Vaizey, the UK Culture Minister, presses on regardless with plans for "voluntary" blocking by the big ISPs of both sites alleged to be complicit in copyright infringement, and even more worryingly, sites hosting "sexually explicit" material - material that in EU parlance may be harmful to, or just disliked by, some, but which is not in principle illegal for all to view or possess as is universally the case with child pornographic images.

If these matters are so important, one wnders, then why does the government not mandate them by the usual tool of legislation? Could it be that, having narowly escaped humiliation at the hands of the judicial review court in respects the Digital Economy Act (for now at least), they know that for an EU government to demand explicit blanket filtering of non-illegal material (which circulates with relative freedom in several EU member states) would almost certainly fall foul of art 10 and probably art 8 of the ECHR, as well as restraining freedom of services and trade across the EU?

At such moments, it never hurts, perhaps, to consult the old classics: The Internet is for Porn.. but not for long?

Judicial Review of Digital Economy Act fails: interim note

Just a quick note for those seeking basic info, as I haven't had time to read it properly yet - am about to! (or try @copyrightgirl's tweets, or the Guardian . )

The expected, though still bad, news is that most the arguments put forward by BT and TalkTalk were rejected ie on incompatibility with the Technical Standards Directive, the Data Protection laws, the E-Commerce Directive and proportionality generally. The Act therefore stands.

However BT etc were partially successful in relation to sharing the costs of the filesharing system to be established - the cost sharing SI made under the Act proposed a 75:25 split between the copyright holders and the ISPs; it now seems ISPs wil not be required to pay 25% of the cosst of establishing the appeals body but will still have to pay in relation to "internal costs" ie sending letters and identifying filesharers.

A key point will be appeals. BT and Talk Talk are considering their positions on this. I would have strongly expected a reference to the European Court of Justice for clarification, but the judge has indicated he found the issues of law clear and therefore would not support such. My feeling is this point at least might well be appealed successfully - especially following the Advocate General's opinion in Scarlet v SABAM only a few days ago, where the reasoning is strongly against the legality of blanket filtering and monitoring to protect copyright, since invasion of personal data privacy is inevitable. Although this does not necessarily directly affect provisions of the DEA itself other than s 17 on web blocking orders (which may itself be heading for non-implementation hell if Ed Vaizey manages to convince ISPs, IWF-style, to block sites on a voluntary basis, without need for court orders, behind closed doors) the balance struck here between rights of privacy and rights of property will surely cast a doubt that the interpretation of EC law, especially the DPD and PECD , is quite as untroublingly easy as Mr Justice Parker has suggested.

If there are no such appeals, the Guardian suggests the first letters to filesharers could go out in the first half of 2012. Pangloss is not quite sure if this means letters warning alleged filesharers or letters indicating sanctions like suspension, traffic slowing, etc (technical measures) - but probably the former. Certainly it has already been announced that the final version of the Initial Obligations Code has been put back to at least summer 2011 from the original deadline of Xmas 2010. Given that the Initial Obligations stage has to run for at least a year before stage 2, Technical Measures can even be introduced - and that still needs the assent of both Houses of Parliment - we are still a very long way from the first potential disconnections.

In the meantime, streaming has already overtaken downloading, Spotify has managed to educate millions of Europeans, even without much assistance from US record labels, that legal streaming is a great idea, and hardened down and up-loaders have already become far too clever to ever be caught by the DEA's IP address collection methods, while the innocent may find themselves falsely accused (see Richard Clayton's excellent witness statement to the court) .

By that long away time (2013?) when the first disconnections might be justified, the DEA may be too antiquated for even the music industry to press for its continuation. In the meantime however a huge amount of money - £500m estimated - will have been spent to safeguard an industry worth £200m (also an estimate, of course) - and of course also to make it universally hated by its target customers.

The takeaway message on this also is that the judicial review court has only found that the DEA has not technically violated any EC laws. Only these arguments could be made because an Act that is otherwise passed under doctrines of parliamentary sovereignty, however bad it is , in principle, policy or execution, stands till repealed, because that is how we do law in this country. Nothing that happened today proves the DEA makes sense or is right - merely that one judge thinks it does not violate any supranational laws.

ps is there really no English translation of SABAM yet other than a Google translation? Pangloss cannot seem to locate..

The right to forget or the right to spin?

Viviane Reding has been publicising one of the more poetic planks of the upcoming Data Protection Directive reforms, the so-called "right to forget" or from the French (who dreamt it up), the droit a d'oubli.

The right to forget is intriguing and seems to have caught the public attention of more than geeks and DP nerds. In boring Anglo-Saxon, it sounds much less exciting. The right to delete your personal data, wherever it is held - eg on Facebook - is what it's about. Put that way it doesn't sound that new. After all the DPD already gives you the right in art 14 to

" object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;"

In the UK DPA 98, s 10, that gets translated as the right to stop processing where it is "causing or is likely to cause substantial damage or substantial distress to him or to another" and this is "unwarranted". As often the case, there is an argument that this is a rather limited expression lof the DPD, especially when case law is considered. There's also a connected right to demand your personal data is not processed for the purposes of direct marketing.

But this doesn't add up to an unqualified right to have data deleted nor to have this done for no reason at all, except it's your data. This is what the "right to forget"or "delete" movement is about.

Pangloss initially found the right to forget very appealing, but has got more conflicted as time has gone on. The trouble most often cited is that your personal data is very often also someone else's personal data. If I post a picture of both of us at a party on FB, do you have the right to delete it? What about my freedom of expression, my right to tell my own story? With pictures, you can imagine solutions - pixellate out the person objecting or crop it. Perhaps the compromise is that I have the right to post the photo but you have the right to untag yourself from it. (Though this will not suit some.)

But what about where I say "I was at Jack's last night and he was steaming drunk?" Does Jack have the right to delete this data, even if it's on my profile? This is where the Americans start indeed to get steamed up - since their culture and legal system has repeatedly preferred free speech to privacy rights.

Unsurprisingly this is one of the the scenarios Peter Fleischer, chief privacy officer of Google, had in mind when he described the right to forget last week as "foggy thinking ", claimed that "this raises difficult issues of conflict between freedom of expression and privacy" and more or less implied that this could be dealt with perfectly well by traditional laws of libel. In an ideal world this might be so: but we don't live in that world, but one where ordinary citizens as opposed to celebrities, almost never get to use laws like libel because they're simply far too costly and scarey.

Would Jack sue for libel in the above example? No, almost never. But he might ask FB to take it down (if he was aware it existed). This is another of Fleischer's worries - that intermediaries like ISPs and hosts would get inextricably and expensively involved in the "right to forget". Here his real agenda becomes fairly apparent - Google's success is entirely based on their right to remember as much as possible about us. We are back here in another version of the cookie and data retention wars, passim.

I am a fan of the Google chocolate factory, as anyone reading this blog will surely have gathered - but it is a mite disingenous to read Fleisher's (beautifully written) post without bearing in mind what seems to be Google's real worry, as cited at the bottom of his list, that search engines will find themselves called on to implement what people often want far more than a right to delete, namely a "right for their data not to be found" - ie, for it to be expunged from Google's web results.

Fleisher says correctly (and commendably under-statedly) that "This will surely generate legal challenges and counter-challenges before this debate is resolved. ". Imagine the reaction of Trip Advisor for example when 1000s of people who run hotels and restaurants try to have the site removed from Google rankings because it has personal data about them that they're not overly fond of..? More sympathetically, many readers of this blog will know decent people who have tried for years to get results removed from Google - unfair and illegitimate reviews, catty remarks from ex partners, professionals whose working life is blighted by abusive remarks by disgruntled ex clients. There should I think be clear remedies for them not dependent on the ad hoc discretion of the sitein question, depending on what mood it's in that day. On the other other hand, I don't want a world where politicians or demagogues can get their dodgy past involvements with fascism or the BNP or whatever quietly deleted or rendered unfindable on Google (this is a turf war which already goes on day in day out on the edits on Wikipedia).

A big problem (as with all DP issues) is the cross border, applicable law or jurisdiction aspects. Fleisher's column cites a rather sensationalist example - when a German court ordered references to a murder by a German citizen removed from a US based Wikipedia page because those convictions under German law were "spent". In fact rules about rehabilitation of offenders and spent convictions are common - certainly the UK has similar - and all that is unusual about this case is the attempt of the German courts to extend jurisdiction to publications hosted abroad. Indeed as some US states have "rights of publicity" protecting celebrity image and some don;t, one imagines they must already have evolved a degree of expertise in the international private law of privacy/publicity rights. (What if Elvis's image on tee shirts is protected in Tennessee but not in Virginia? can the Tennessee estate sue the Virginia t shirt factory that uses his image without paying?)

But certainly an EU right to forget will almost invariably engage us in the same kind of angst and threats of "data wars" over extraterritoriality that the Eighth DP Principle on export of personal data already has - not something to look forward to. It is noticeable that Reding fires off an early salvo on this when her spokesperson says , not for the first time, that companies "can't think they're exempt just because they have their servers in California or do their data processing in Bangalore. If they're targeting EU citizens, they will have to comply with the rules."

In reality , Pangloss suspects any right to forget that makes it through the next few years of horse trading will look much more limited and less existential than most of the ideas in the blogoverse - more like the right FB has already conceded, to delete rather than simply deactivate your profile, for example. Reding's speech itself seems to be in practice more about how FB sets its defaults than anything else: a default opt out from letting third parties tag your photos, rather than opt in, would seem a pretty limited and sensible demand.

Being more aspirational, Pangloss still has a soft spot for one interpretation of the "right to forget" which Fleischer rather derides as technically impossible - self expiring data. I'd love to hear from any techies who know more about this topic.

But the debate that has caught the public imagination goes wider than just DP law, and it is about whether we want to live in an online spin society.

There has been a certain amount of information coming out lately about how the Internet is not what it once was. Once we thought the Web was a conduit to unmediated news and opinions from real people, that it would enable direct democracy and change the world. But recent evidence has been that when it really matters - in matters of politics and revolutions and celebrities and ideology - a lot of what seems to be the "honest bloggers" or commenters or posters are actually paid spinners, employed and trained in the blogging and astro turfing schools of China and Russia and Iran and now, we hear this week, the US.

The right to forget can in some ways be used as the individual, non corporate, non state version of this. Rewriting history has been described by many people as Orwellian: we are at war with Eastasia, we have always been at war with Eastasia. That is chilling (in all senses of the word, including speech :-). The reality, as I already said, is likely to be consideringly less overwhelming (or effective). But this is still a debate we need to start having.

Online behavioural advertising: threat or menace?

Pangloss has recently been engaged in high level summit talks with her usual sparring partner Cybermatron on this rather current topic (which Pangloss is teaching, and about which Cybermatron is organising a workshop): as usual CyberM takes the privacy moral high ground that it is simply wrong for businesses and marketers to "follow you around the Web" without clear informed consent, while Pangloss is reduced to her usual confused, "er, um, yes it's a bit squicky but does it really need regulation? is it that significant in the nature of things compared to tsunamis, revolution in Africa and control orders? isn't it a matter that could better be dealt with by code and co-regulation, rather than regulation which would be territorially limited and probably merely favour US over EU digital industry?"

The latter approach certainly seems to be taking centre stage. Today I hear on Twitter that Microsoft, still maker of the most popular browser in the world, have agreed to install a Do Not Track opt-out cookie into IE v 9; this follows Firefox doing something roughly similar, leaving only Chrome (Google) and Safari (Apple) of the major desktop browsers as outliers.

Will this self regulatory, "code" solution, which has been heavily advocated by the FTC in the US be successful? It is very relevant to us in Europe right now, where a similar system is being promoted by the ad industry, especially the IAB and EASA . They suggest an "awareness raising icon" or "big red button" ,which would be put on the sites of participating websites, and would then lead users who clicked on it to an opt-out registry by which means they could indicate "do not track me" to the ad networks. These are the networks which collect data via third party cookies and other techniques such as Flash cookies, and then distribute the ads to participant websites. (Slightly worryingly, Pangloss has heard of this development anecdotally via attendee accounts of meetings held with the EC Commission in December and March, but cannot seem to trace an official document on the Web about it. These accounts seem to indicate that the Commission is already heavily behind these initiatives, which is all the more reason for a proper public debate.)

In an ideal universe, such a user-choice driven system could be good. It might allow users (like Cybermatron) who want to to protect themselves from online data collection and profiling, to do that: and let those who are either quite happy about it all (the majority "don't cares"), or feel that web 2.0 businesses need a revenue stream to survive that targeted ads supply, and the genie is already out of the bottle re their personal data (moi, on a bad day); or who actually like targeted ads (these people must exist somewhere, though Pangloss has never met them); or who feel they can protect themselves from ads using filter products like AdAware or Firefox anti-ad plugins (the techy fringe, and distinctly not including my mum), to go on doing their thing.

But as usual it's a little more complicated than that (c Ben Goldacre, 2011). The WSJ note firstly:

It still isn't clear how effective the privacy protection tools in Microsoft's browser will be. The do-not-track feature automatically sends out a message to websites and others requesting that the user's data not be tracked.

But the system will only work if tracking companies agree to respect visitors' requests. So far, no companies have publicly agreed to participate in the system.

The price goes on to quote the IAB moaning that their members have no systems set up to respond to "Do Not Track" requests. This strikes me as getting into protesteth too much territory: if the advertising industry wants to avoid mandatory regulation with, perhaps, stiff fines, they wil get their act together on this pronto or face the worse alternative. One imagines similar fears are driving Microsoft and Forefox. It is interesting that Google who make Chrome and who benefit by far the most from the online advertising market appear to be dragging their feet.

So what are the problems? Pangloss has been trying to get her head around this, with a bit of help from Ms Matron and Alex Hanff's blog on PI.

First, that good old chestnut, consumer ignorance, inertia and techno-inability. Most consumers don't click on buttons to opt out from behavioural tracking, just like they don't go looking for privacy settings on Facebook. They have better things to do: like go looking for the goods and services they went online for in the first place, or on FB, looking to see what friends are having cool parties. There also seems to be some debate about just how big the "big red button" will be but that's really the least of the problem.

(Interestingly, Pangloss has spent some time lately helping her much maligned mother with computing matters and observed that she (my mum that is) just does not have the habit most readers here of younger generations will have acquired without noticing, of searching all around a webpage for cues. She would never even notice the big red button unless it was as big as a Comic Relief red nose. But I digress.)

And in fact US research bears this out already re the behavioural ads opt out button. Hanff states:

"TrustE carried out an experiment to measure the effectiveness of the (US Do-Not_track) icon. Over 20 million people visited an experimental web page of which 0.6% of unique visitors interacted with the icon. TrustE shouted that this was a wonderful success, but I think the sane among us would argue the opposite is true."

If this is true, I'd certainly agree.

A secpnd, connected, problem is what is the effect of an opt out indication even if someone gets around to making one, by Do Not Track button or otherwise? You might well think it means that you have chosen for data collected about you not to be profiled and mined ie not to be tracked: but in fact the US experience so far may be just that the data collection and mining still goes on, but you don't get the targeted ads. This rather misses the point and I'm pretty sure everyone, including the NAI and IAB , knows this :-)

And a third problem is that given inertia, the problem is not really solved by the button, charming as it is, but by the underlying default set up of consumer browsers like IE, Firefox and Chrome. If the default is no tracking without saying "yes, please." (ie opt-in) then those who really want targeted ads can indeed opt-in, argues Cybermatron, and leave the rest of us alone. Less determined people like me say, well if no one ever clicks buttons if they don't have to, then no one will opt in to targeted ads bar a few maniacs, and web 2.0 will go bankrupt. I don't want that. Hmm. (It is also worth noting at this point that browsers are mostly written by companies whose fortunes are fairly heavily dependent on online advertising. Also hmm.)

Matron's solution is that web 2.0 can survive on serving ads, without using ad networks and behavioural tracking and data mining - good old fashioned second party cookie tracking, where one site uses what it learns about you to serve you more relevant ads. The likes of Amazon used to do quite nicely on this alone, using algorithms like "People like you who bought X also liked Y". Users can also fairly successfully block second party cookies themselves using most browsers, without having to rely on believing ad networks will implement do-not-track opt-out registers, not just save the data fot later and hide the ads.

But such evidence as there has been available to the public in recent years seems to point, unfortunately, to second party cookie tracking not being good enough for economic success. Google has massively the giant's share of the online ad delivery market because via its AdWords programmes, its near monopoly of search terms in many countries and its affiliates like YouTube and Android, it can collect far more targeting info about users than any other single site. The empirical evidence seems to be ; more targeted info means more click throughs means more money for the online industries in question.

One of the notable phenomena is that for companies like Amazon, advertising was a second string activity, really mainly marketing their own services. By contrast, the web 2.0 market, like Google, Facebook, last.fm etc etc, charge nothing so have to make money out of selling something, ie ads for other services and companies. This can only be achieved in any realistic way via third party cookies, ad networks and the like, goes a fairly obvious argument. Is it coincidence that third party advertising networks began to take over the market at almost the same time web 2.0 unpaid activity became the great success story of the Web? Seems unlikely but who knows?

In short, we need more data. Economic data on who makes money from which forms of targeted marketing, and who doesn't. Technical data on how effective an opt-out cookie can be anyway (what for example, would its effect be on Flash and zombie cookies? what happens if you delete your opt-out cookie?) Technical and social data on how valid the underlying data profiles are which are used by ad networks to deliver targeted ads: are their predictions reasonable out of context (eg some in-game data collection seems to have reportedly tagged people as "risk taking" or "aggressive" ; are they verifiable and transparent ; can they be misused (eg used to target addicts or the young with inherently risky offerings); can they be de-anonymised.

Since the latter seems increasingly likely (see Paul Ohm's seminal work passim), I have suggested before that such anonymised data profiles should benefit from some if not all of the same protection as "personal data" under some rubric like "potentially personal data". Notably this might make data profiles even where not tagged by name subject to subject access requests, and deletion requests where damage or distress was shown (or even not at all if we get the much ballyhooed right to forget).

Finally, for us lawyers, I think the biggest challenge is to dig ourself out the regulatory hell we are in where the DPD and PECD (and the media, exceptionally unhelpfully) present us with a mish mash of consent, "explicit consent", prior consent, informed consent, opt-in and opt-out consent. To a very large extent these distinctions are now pretty meaningless in their purpose, ie, to provide protection to users in controlling the processing of their personal data without their knowledge and consent. Eg, "sensitive personal data" is supposed to be specially protected by a requirement of "explicit consent" in the DPD scheme, but a common lawyer would argue a site like Facebook gets exactly that - via the registration, login or "I accept the terms and conditions" box - without any real sense of any added protection.

Hanff (above)argues forcefully that the amended PECD, which is due to be implemented across the EU shortly, now requires prior opt-in, and thus an opt-out system of the "big red button" type, will be illegal. But sympathetic as I am to his outrage, this is not what the new law says.

Art 5(3)of the PECD now says that placing cookies is only allowed where "the user has given his or her consent, having been provided with clear and comprehensive information." In some EU countries such as notably the UK, consent can be given by implication. If the article said "explicit" consent then this would not be possible - but, contrary to some very bad BBC reporting, and according to BIS's version of the amended PECD, there is no use in amended art 5(3) of the word "explicit". (Nor by the way, is there in art 14 on locational data which remains unamended by the new changes. This seems exceptionally odd.)

Furthermore, under EU law generally, it seems that the settings of a browser which has not been altered to opt-out, very unfortunately, can probably be seen as giving that consent by implication, as this has what has been expressly put into the recitals of the amended PECD. Most browsers do by default accept second, and sometimes third, party cookies. In some browsers, such as the version Pangloss has of Firefox, this distinction is not made - cookies are accepted and users can choose to go in and delete them individually. In such an analysis, most browsers will be set to "give consent" and the "big red button" is merely providing users with an opportunity to withdraw the consent they have already given, and is perfectly legal.

This is not a good analysis for privacy or consumers. It is not what those who fought for the changes in art 5(3) probably thought they were getting. But it is a plausible interpretation. Of course, existing national laws and national implementations may alter its meaning "on the ground" ; and I suspect we will see substantial cross EU disharmony emerging as a result. None of which will in fact help the digital industries.

What do we need out of regulation rather than this fumbling about opt in and opt out? Nellie Kroes has some ideas:

First and foremost, we need effective transparency. This means that users should be provided with clear notice about any targeting activity that is taking place.

Secondly, we need consent, i.e. an appropriate form of affirmation on the part of the user that he or she accepts to be subject to targeting.

Third, we need a user-friendly solution, possibly based on browser (or another application) settings. Obviously we want to avoid solutions which would have a negative impact on the user experience. On that basis it would be prudent to avoid options such as recurring pop-up windows. On the other hand, it will not be sufficient to bury the necessary information deep in a website’s privacy policies. We need to find a middle way.[italics added]

On a related note, I would expect from you a clear condemnation of illegal practices which are unfortunately still taking place, such as ‘re-spawning’ of standard HTTP cookies against the explicit wishes of users.

Fourth and finally: effective enforcement. It is essential that any self-regulation system includes clear and simple complaint handling, reliable third-party compliance auditing and effective sanctioning mechanisms. If there is no way to detect breaches and enforce sanctions against those who break the rules, then self-regulation will not only be a fiction, it will be a failure. Besides, a system of reliable third party compliance auditing should be in place."

That "middle way" solution, that involves real opt in consent but not endless pop up windows requesting consent, sounds a lot to me like mandating that browsers and manufacturers set browsers by default to reject cookies so users can demnonstarte real consent by changing that setting : the same strategy that I rejected above as impractical as the death of revenue to web 2.0. Maybe there is some more suble version of Reding's "middle way" I don't know about - I sincerely hope so. (Techy answers again very welcome!!)

But if Ed Vaizey, can for example suggest, as he did this week, that all computers sold in the UK should be shipped with software set by default to filter out all "porn", (however he plans to define that, and good luck with that) then why can't a similar command be sent out re the relatively simple privacy settings of browsers? Pangloss suspects that in reality, neither will happen, especially given that computers and handsets alike are mostly assembled outside the EU. It looks like the cookie and OBA wars , both in and outside of Europe, still have a fair way to go..

A few more dates for diaries

The Strathclyde LLM in Internet law and Policy is happy to present a public lecture by Daithi MacSithigh of the University of East Anglia on March 25th 2011 Room 7.42, 7th floor Graham Hills Building, 40 George Street, Glasgow, commencing at 5.00pm. The event is free but please email Linda at linda.nicolson@strath.ac.uk to let us know if you are planning to attend.

The title is ""The medium is still the message:Angry Birds,the Met Opera & broadband bills"

Pangloss is really looking forward to that :)

Also for central-belt Scots - put April 14th 2011 evening in your diary, when Strathclyde Law School and the Franco-Scots Alliance will be co-hosting an event on the current state of anti filesharing legislation in the UK and France - myself and Nicolas Jondet (currently teaching IP law at Strathclyde, and local expert on HADOPI) representing these jurisdictions respectively. Venue TBD but Old College in Edinburgh likely. Given the current events around the Digital Economy Act - judicial review, Hargreaves Review - as well as in France this could be lively :)