Drm And The Law :: Laurence Kaye

DRM AND THE LAW UK Legal Framework for Digital Rights Management 1. INTRODUCTION 1.1. This Note contains a summmary of the UK legal framework for DRM through a series of questions and answers. 1.2. It uses terminology which is consistent with copyright law. That is: 1.2.1. “Technological Measures” (or “TPMs” for short) – to mean hardware and/or software which control access and use of works e.g. embedded in Windows Media Audio. 1.2.2. “Rights Management information” – to mean information which expresses permissions attaching to content which machines can read. This may be used with or without TPMs. 1.2.3. “DRM” – to mean both. 2. QUESTION 1: WHICH LAWS APPLY? 2.1. This is really three questions: 2.1.1. Which individual laws apply? 2.1.2. Whose laws apply, bearing in mind the global nature of the medium, at least as far as online distribution is concerned.1 2.1.3. Which country‟s courts have jurisdiction to hear a dispute about illegal content? 2.2. This Note will focus on the first of those three questions i.e. “which laws” and will assume that UK law is the applicable law and that the UK Courts have jurisdiction. 2.3. Before looking at the individual laws, it is important to make some remarks about „hard law‟ and „soft law‟. „Hard law‟ is statute law and common law developed by the Courts. But in the area of digital media and internet law, „soft law‟ is of growing importance. This includes standards and voluntary codes of conduct e.g. Mobile Content Code of Conduct. And there is a relationship between the two. For example, the E-Commerce Regulations and IFRED both encourage their use. 2.4. „Hard law’: 2.4.1. This is primarily, but not exclusively, Copyright law. To set the scene properly, it is important to point out other relevant legal areas which make up the overall framework. 2.4.2. Privacy law, particularly Data Protection law e.g. where a DRM involves user identification or authentication.2 2.4.3. “E-Commerce Law”.3 1

For example, a file containing illegal content is uploaded from a house in France to a server in US and downloaded by a user in UK. Is it French law, US law, UK law or all three? 2 Working Party set up under Article 29 of Directive 97/66/EC raises important questions about the impact of data protection law on TPMs. 3

i.e. UK Regulations stemming directly from the E-Commerce Directive which contain various exemptions from liability for ISPs and hosts of 3rd party content and established the „country of origin‟ principle for establishing „Information Society Services‟ in the EU e.g. a web-based service from which physical goods or services (e.g. a music download service) can be

Page 2 March 2006 2.4.4. Consumer protection law4. 2.4.5. Content regulation in the broad sense beyond copyright.5 2.5. In almost all cases, the laws in these areas stem from EU Directives. In the case of copyright, UK copyright law fits within a supra national legal framework including the Berne Convention on Copyright, administered by the World Intellectual Property Organisation (“WIPO”). 2.6. UK statutory Copyright law is found in the Copyright, Designs & Patents Act 1988, as [relatively] recently amended by The Copyright and Related Rights Regulations 2003 (SI 2003 No. 2498). This is collectively referred to this as the „Copyright Act‟. 2.7. These Regulations implemented the EU Copyright Directive6 which, in turn, was required to enable Member States to comply with their obligations under the WIPO Copyright Treaty of 1996. 2.8. In a nutshell, these changes were designed to streamline copyright for the digital age. Whether this has been achieved largely depends on one‟s perspective. 2.9. But one thing remains constant: copyright has always been a balance of rights and exceptions and limitations. So every new legal instrument in the copyright field involves a re-negotiation of that balance between all the stakeholders. It is therefore no surprise that the resulting legal instruments are full of compromises. 3. QUESTION 2: HOW COPYRIGHT WORKS – WHAT RIGHTS COPYRIGHT OWNERS GET 3.1. In essence, copyright confers certain exclusive rights on the owners of copyright works. Exceptions are not rights per se, but they are the focus of the public interest in the copyright field. 3.2. We will look first at rights, then at exceptions, then summarise the DRM-related provisions and finally look at the relationship between those DRM provisions and exceptions.

Rights 3.3. First, three preliminary points: 3.3.1. There must be a „copyright work‟ i.e. as defined e.g. song, artistic work, book, audio recording, film, database, software etc). 3.3.2. It must qualify for protection e.g. by virtue of country of publication or residence of the author. 3.3.3. It must be within the term of copyright – public domain works fall outside copyright protection. 3.4. The owner of a copyright work has the right to do, or to authorise someone else to do, certain things in relation to that copyright work. (The Act uses the somewhat archaic term of „restricted act‟).

bought. 4

e.g. Distance Selling Regulations which give consumers rights to receive certain information about products or services bought „at a distance‟ and certain rights of cancellation. 5

See, for example, the current proposals to extend regulation of certain aspects of content to „non-linear „services‟ via an update of the Television Without Frontiers Directive. 6

Directive 2001/29/EC on the harmonisation of certain aspects of copyright and related rights in the information society.

Page 3 March 2006 3.5. The copyright owner is the author, the author‟s employer if the work is produced in the course of employment or a successor in title by transfer or licence. 3.6. In addition to economic rights (e.g. to control copying), an author has certain non-economic rights – moral rights – too. These are outside the scope of this short presentation but they can be relevant in the field of DRM. For example, the author has the rights of paternity, to assert his or her right as author. So tampering with Rights Management Information could infringe that right as well. 3.7. In the context of DRM, there are two key rights conferred by copyright law, both of which were harmonised by the Copyright Directive in a „technologically neutral‟ way: 3.7.1. “Copying” 3.7.2. “Communication to the Public”. 3.8. “Copying” covers all forms of copying - analogue to analogue, digital to digital, analogue to digital and digital to analogue. So copying a copyright work from one digital device to another is “copying” (e.g. PC to MP3 player); so is copying from a digital device such as an optical CD to an analogue tape or from a mobile phone to a PC or to an MP3 player. 3.9. “Communication to the public”: 3.9.1. “Broadcast” means „one to many‟/or push‟ where a copyright work is broadcast for

“simultaneous reception or where the “broadcaster” determines the time of transmission”. This includes „Free to Air broadcast‟, Webcast, and Podcast.

3.9.2. “Making available” is „one to one‟ or ‟pull. That is, the “making available to the public of the

work by electronic transmission in such a way that members of the public may access it from a place and at a time individually chosen by them”. This covers the typical on-demand service.

3.10. Copyright infringement therefore occurs where any of these acts are done without authority and no exception applies. 4. QUESTION 3: HOW COPYRIGHT WORKS – EXCEPTIONS 4.1. The EU Copyright Directive fudged the issue of harmonising Member States‟ exceptions – it was just too difficult. 4.2. As a result, it provided only one mandatory exception – in Article 5 (1) for machine-generated „temporary copies‟ as copyright material is carried through electronic communications networks. 4.3. The Directive then provided for 20 optional exceptions, which allowed Member States to retain their traditional exceptions. 4.4. That is what we did in the UK. Apart from incorporating the „Article 5.1 exception‟ as a new section 28A of the Copyright Act, we retained our existing exceptions. 4.5. The Regulations did make certain changes to those exceptions to bring them into line with the EU Directive. For example, our „fair dealing‟ exception for research and private study continues to apply as long as it is for a non-commercial purpose. A similar amendment was made to exception that applies to things done for the purpose of instruction or examination. 4.6. Exceptions in the Copyright Act occupy sections 28 – 76 inclusive. In addition to the „fair dealing‟ exceptions for research and private study and for criticism, review and news reporting, there are a range of other exceptions permitting particular acts for specific purposes, including those in the fields of

Page 4 March 2006 education, libraries and archives, public administration and others.7 4.7. The Copyright Act does not contain, and has never contained an exception for private copying corresponding to that contained in many Continental European countries, along with accompanying levies.8 By „private copying‟,we mean, for example, where a consumer copies a sound recording for private use from PC to CD – „ripping and burning‟ – or to analogue tape in order to play in the car or from PC to MP3 player. 4.8. The Act does contain a „time shifting‟ exception which applies to “..making in domestic premises for

private and domestic use of a recording of a broadcast solely for the purpose of enabling it to be viewed or listened to at a more convenient time.‟ Although, as noted earlier, „broadcast‟ now has an extended, technology neutral definition to include, for example webcasts and podcasts, it does not apply to copying from one fixed device to another.

5. QUESTION 4: IN WHAT CIRCUMSTANCES CAN CONSUMERS BE PROSECUTED FOR COPYING DISKS IN THEIR CARS? 5.1. We have already observed that there is no „private copying‟ exception in the Copyright Act in the sense defined in Article 5. 2 (b) of the Copyright Directive. So if you as a consumer buy a copyright work recorded on a physical digital product – or analogue for that matter – you do not acquire any „inbuilt‟ rights to copy. You can, of course, lend, give away or sell the object on e-bay. 5.2. That means that, technically, private copying, if done without authority, is an infringement of copyright. This is a tort on which a civil action can be brought. It is not a criminal offence. 5.3. As far as I am aware, no legal proceedings have ever been taken in the UK for unauthorised private copying by a consumer. 5.4. It is very important to draw a clear distinction between „private copying‟ and illegal file sharing. The legal actions taken in the UK in respect of illegal file sharing have focused on the unauthorised uploading of copyright material for illegal file sharing purposes, in breach of the „making available‟ right described earlier. 6. QUESTION 5: HOW DOES DRM FIT IN? 6.1. The provisions in the UK Copyright Act have been inserted in compliance with the corresponding provisions in the WIPO Copyright Treaty and the EU Copyright Directive. 6.2. In fact, the 1988 Copyright Act had anti-circumvention provisions, but they applied only to computer software. 6.3. Before going into the detail, it is important to look at the definitions9: 6.3.1. “Technological measures” are broadly defined to cover hardware and software – “any 7

There are many other exceptions, including in relation to computer software, databases, film and others. There are also exceptions in the Copyright (Visually Impaired Persons) Act 2002. 8

Article 5 2 (b) of the Copyright Directive provides an optional exception “in respect of reproductions on any

medium made by a natural person for private use an for ends that are neither directly or indirectly commercial, on condition that the rightsholders receive fair compensation which takes account of the application or nonapplication of technological measures referred to in Article 6 to the work or subject matter concerned.” 9

In Section 296ZF

Page 5 March 2006

technology, device or component which is designed, in the normal course of its operation, to protect a copyright work other than a computer program.” 6.3.2. Such measures are only “effective” “…if the use of the work is controlled by the copyright owner

through – (a) an access control or protection process such as encryption, scrambling or other transformation of the work; or (b) a copy control mechanism which achieves the intended protection.

6.4. So, for the anti-circumvention provision to apply, the TPM has to work, although it is not clear how secure the TPM has to be in order to be „effective‟. A Court will have to decide whether, as a matter of fact, the TPM functions as an access control or protection process. If it does not, it seems unlikely to be an “effective technological measure‟. 10 6.5. A related issue is the effect, if any, of a TPM used without any notice or warning of its existence e.g. rootkit software. Time does not allow a detailed analysis but it raises privacy and consumer protection law concerns. 6.6. Section 296ZA prohibits the circumvention of effective technological measures by a person „knowing, or having reasonable grounds to know, that he is pursuing that objective. So, for example, if a consumer runs a software program or uses a hardware device in order to access and copy an encrypted work, that consumer is treated as a copyright infringer which could give rise to a civil action for copyright infringement. The consumer is not criminalised. 6.7. Section 296ZD also gives the copyright owner the right to bring an action for copyright infringement against anyone who manufactures or supplies any device, product or component:6.7.1. is promoted etc. for the purpose of circumvention of effective technological measures11; 6.7.2. has only limited commercially significant purpose or use other than to circumvent effective technological measures; or 6.7.3. is primarily designed, produced or adapted or performed for the purpose of enabling or facilitating the circumvention of effective technological measures. 6.8. Section 296ZB makes it a criminal offence , carrying a maximum prison term of 3 months on summary conviction or 2 years on indictment and/or a fine, to manufacture etc. any device, product or component, or provide services, which is primarily designed, produced, or adapted for the purpose of enabling or facilitating the circumvention of effective technological measures. 6.9. These anti-circumvention provisions are designed only to apply to acts (e.g. copying) which are done without the owner‟s authority and would be a copyright infringement. Also, they do not apply to the use of the work which is outside the scope of the acts restricted by copyright.12 6.10. As regards Rights Management Information, Section 296ZG provides remedies where electronic rights management information is removed by someone who knows or has reason to believe that by doing so he is enabling, facilitating or concealing an infringement of copyright. 6.11. There have been two cases relating to the legality of mod chips, both decided under the old S. 296. These are, in effect, anti-circumvention devices in the form of a computer chip which can be used to 10 11 12

This was the approach taken by an Australian Court in October 2005 in respect of the Sony „Playstation.‟ Section 296ZD Section Section 296ZF

Page 6 March 2006 modify a games console so that it is instructed to accept any CD-ROM, irrespective of the access code, thereby overriding the console‟s programming.13 6.12. There has been one case in the UK dealing with these provisions, in July 2004, again involving Sony.14 7. QUESTION 5: WHAT IS THE LEGAL RELATIONSHIP BETWEEN DRM AND EXCEPTIONS? 7.1. The Copyright Act, following the EC Directive, provides a mechanism to ensure that a TPM is „lifted‟ so that a person cannot be prevented from carrying out a permitted act i.e. any of the copyright exceptions listed in Schedule 5A of the Act, such as research and private study. 7.2. Section 296ZE deals with the situation where a copyright work is protected by a TPM, and the rightsholder does not provide a voluntary measure to „lift‟ the TPM (e.g. by allowing access to an unencrypted copy via a trusted third party), to permit a person to access and use the work for the permitted exception. 7.3. In that event, the person (or a class of persons) can implement the procedure in Section 296ZE which is triggered by issuing a notice of complaint to the Secretary of State. This can lead to a compulsory „lifting‟ of the TPM. 7.4. For example, a library or group of libraries might seek to implement this procedure if rights holders failed to take voluntary steps to enable them to exercise library exceptions in respect of a TPMprotected work. 7.5. These provisions do not apply to copyright works which are made available on agreed contractual terms (Section 296ZE 9). 7.6. These provisions are not relevant to private copying because there is no private copying exception provision in the Copyright Act. 7.7. A final word about the US DMCA and fair use15. We are not experts in US law. Our understanding is that there is no clear view as to whether the fair use doctrine is available as a defence to charges arising under the anti-circumvention provisions of the DMCA on the grounds that circumvention of a TPM may be necessary to accomplish a fair use. 8. QUESTION 6: IPRED/IPRED2 – HOW DO THEY IMPACT?16 8.1. IPRED 1 and 2 originate from Part III of the 1993 Trade Related Aspects of Intellectual Property Rights (“TRIPS Agreement”) which requires that there are effective, preventative and deterrent remedies against the infringement of IP rights. 13 14

Sony Computer Entertainment v. Owen and Sony Computer Entertainment v. Edmunds.

Kabushiki Kaisha Sony Computer Entertainment Inc. v Ball. This was an unsuccessful attempt for summary

judgment by Sony. 15

The„Fair Use‟ doctrine in the US has some similarity to the „fair dealing‟ exceptions in UK copyright law in that both have tests developed about what is „fair‟, but the US „fair dealing‟ exception is of general application. In deciding whether an apparent infringement is „protected‟ by fair use, there is a four-factor test: (i) the purpose and character of the use; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used and (4) the effect that the secondary use will have on the market for the copyrighted work. 16

This section was authored by Gillian Cordall of Lewis Silkin [email protected]

Page 7 March 2006

8.2. The Directive on the enforcement of intellectual property rights (IPRED 1) was adopted on 26 April 2004 and member states are required to implement it by 29 April 2006. Draft regulations implementing IPRED 1 have been issued. The Commission originally intended to include criminal sanctions within IPRED 1 but these were rejected. A proposal for a Directive dealing with criminal measures (known as IPRED 2) has been published and is currently being considered. 8.3. The intention of IPRED 1 and IPRED 2 is to combat infringement of IP rights by harmonising enforcement and remedies thoughout the EU. The impact of IPRED 1 should not be over exaggerated. Much of IPRED 1 is already dealt with by English law and therefore its additional effect here will be limited to specific changes to the rights and remedies of representative organisations and some minor changes including to the Civil Procedure Rules (eg publication and dissemination of judgements). 8.4. IPRED 2 consists of the original Article 20 from IPRED 1 (which was removed prior to its adoption) and aims to criminalise infringements of those IP rights covered by IPRED 1. Under Article 3, for an infringement to be a criminal offence, the infringer has to have the “requisite intention”. In addition, it will only be a criminal offence where the act of infringement has been carried out on a “commercial scale”. Whether or not infringement is carried out on a “commercial scale” may be difficult to determine. Finally it will be an offence to attempt, aid or abet and incite acts of infringement. 8.5. The Copyright Act already includes criminal sanctions for making or dealing with infringing articles, infringement by communication to the public, making or dealing with illicit recordings and devices and services designed to circumvent effective technological measures. In addition it is also an offence to provide, promote, advertise or market a service to enable or facilitate the circumvention of effective TMs. These offences largely require the iinfringement to be in the course of a business although certain on the offences can be commited otherwise than in the course of a business to such an extent as to affect prejudicially the copyright owner. Certain offences are punishable with up to 6 months imprisonment and/or a maximum £5000 fine on summary conviction and a maximum of 10 years imprisonment and/or an unlimited fine on indictment. IPRED 2 goes further than this, criminalising all IP infringement under IPRED 1 and widening the scope to attempting, aiding, abetting and inciting. Laurence Kaye Laurence Kaye Solicitors © Laurence Kaye 2006 T: 01923 352 117 E: [email protected] www.laurencekaye.com http://laurencekaye.typepad.com/ This article is not intended to be exhaustive and it does not constitute or substitute legal advice, which should be sought on a case by case basis. Please feel free to copy or make available this article without modification in print or electronic form for noncommercial purposes. If you do so, please include this disclaimer and copyright wording with attribution. If you want to re-publish or make the whole or part of this article available in a commercial service or publication, please contact the author at [email protected].