The venue Old Bank of England, is mid way between Chancery Lane and Bell’s Yard in Fleet Street. As you walk into the grand pub room bear right towards the bar, and then left past the bar and then turn right. We have the two adjoining downstairs rooms on the left.  They’re right by the bar area.  So, there will be more space to mingle than last time we held the tweet up in that pub as we only had one room then.

Lilia will be sitting at the entrance by the rooms till about 8.30 or 9.00 pm. Please give her £5 per person to cover the cost of food/use of the space. She will have labels so you can write out your name, and she’ll have the list of attendees so please tick off your name. This is so we can mention you in the write up of the tweetup.

In feedback report last time we held the tweet up at that venue one person said they thought £5 should cover food and a drink.  I’m afraid £5 does not go that far these days, especially in a venue like the Old Bank of England!  So, you’ll have to also buy your own drinks.

Earlier in the evening there’ll be some crisps, but otherwise no food until 7.45 pm. I’ll try and keep an eye out and make sure nobody goes without food if they arrive later on.  However, if I don’t notice that there’s no food and you’re there without anything to eat, do let me know. We’ll assess the finances and if there’s a surplus we’ll order more food, and/or a few bottles of wine later on.

Although the time given for the tweet up is 6.30-9pm, I fully expect many of you will stick around much longer than that. The organised part of the evening ends at 9pm, and personally I’ll probably leave around then as I have a busy day on 18th.  So if you’re hungry after 9pm, please understand that if there’s no food it’s because the party has officially ended…

If you haven’t responded yet please let us know whether you will be attending or if your plans have changed and you are unable to make it, please update your status: RSVP.  We are still in the process of arranging the catering for attendees, and so it would be much appreciated if you could help keep our numbers accurate.

I look forward to seeing you all on the 17th!

Many lawyers educate the public about the value of taking legal advice.  So, it is somewhat surprising for a Government funded entity to communicate the message that legal advice may be dispensed with.  For example, on the IPO website it says “some applications may benefit from professional advice” implying not all of them do.

What is really going on here?   IP law is not a straightforward topic, and in my experience all business owners benefit from professional advice.  So why does the IPO put this in doubt?

The IPO offers a wealth of information on its site www.ipo.gov.uk.  As a firm we suggest clients use the resources available for preliminary information, so that their time with us can add maximum value.  But when it comes to drafting, searching, or making informed decisions about trade marks and broader IP issues, we absolutely recommend taking professional advice as does every other IP lawyer I know.

As far as government organisations go, the IPO is fantastically helpful.  They are quick to respond, thorough, and staff are an absolute pleasure to deal with, so it saddens me to find myself levelling criticism in  their direction.  But as a solicitor who advises SMEs on Internet, and IP matters, including trade mark filings, I am absolutely sure that encouraging SMES to file their own trade marks often doesn’t do them any favours.

Some downsides of DIY trade marks

Some people who file their own applications are unsuccessful in securing a registration.  Take a look at the refused marks.  Many either have  fundamental errors which could not be resolved, or if they could be resolved, the business owners didn’t know how to do so or lacked time to deal with it.  Often applications fail because the mark is descriptive and incapable of functioning as a trade mark.

I’m even more worried about those who succeed in securing registration because the scope of the applications is often inadequate to cover the activities of their business.  What is a serious issue is that these entrepreneurs’ success gives them a false sense of security.  Some even go on to file their own Madrid applications via the WIPO website. Filing more widely on the basis of what is often an inadequate UK base application compounds the problem. If their applications are drafted by professionals there may be some recourse if they turn out to be unsuitable, but if they themselves drafted the form as laymen, they have no come back if their business suffers as a result.  Certainly they would not be able to complain that it was the IPO’s fault as the IPO is careful to avoid liability.  It will not review people’s application forms before they file.

Possible clue

The courts don’t suggest parties adopt a DIY approach to advocacy, and the DVLA don’t recommend that you pop the bonnet on your car at home to prepare for your MOT.  Although its heart is in the right place, and there is no disputing that any effort to inform the public about trade marks is worthwhile, the overall approach of the IPO does not seem to be in the best interests of the applicants themselves.  If the IPO’s motivation is really to help start ups then why not give them a discount on official fees instead?

The fact is that it is in the IPO’s interests to encourage SMEs to file trade mark applications.  A couple of years ago the IPO made 100 redundancies due to the reduced number of filings in the recession. So, on the face of it the IPO does have a conflict of interest.  If it  encourages taking advice then people would go to advisers who may not necessarily recommend trade mark registration.

In pushing trade mark registration as it undoubtedly does, the IPO is not helping start ups.  It’s adding to their costs and depriving them of the opportunity to consult lawyers who might suggest that they need not apply for a trade mark at the beginning unless they have a name they want to own (and which is capable of being owned).

Indeed, many start ups choose descriptive names and these are just fine for getting the business off the ground.  The name tells potential customers what the business does, and as it’s descriptive, nobody else will be able to register it.  Later, if the business succeeds, it should brand itself with a good name and have it professionally registered.

You don’t need to register a trade mark

I doubt the IPO is making it clear to start ups that they don’t need to register a trade mark.  Indeed judging from the below case, the IPO is likely helping businesses with descriptive names to find ways to register whatever they can, quite regardless of whether it’s an important brand element for them to register.

When would the IPO suggest taking professional advice then?

One business I know well, chatted to an IPO representative at a business start up fair, and then proceeded to file two trade mark applications for marks they felt would succeed through the registration process.  These were not much used as trade marks within the business, and therefore low priorities for registration.  The names the business did use for its products and services were too descriptive to register as trade marks.  So, these other names were seized on for no better reason than that they might succeed in being registered.

Unbeknown to the business, they have a serious problem on their hands in not having a distinctive brand name they can trade mark.

The business was so successful it had already licensed its format in a couple of countries and was set to expand more widely internationally.  The business simply did not appreciate what it means to not have a name it can own.  Any professional would advise a rebranding in light of the business’ intention to licence globally.  Otherwise, it would be missing out on owning a valuable IP asset.

Independence is key

The fact that this business spoke to an IPO representative and walked away none the wiser about the importance of consulting a professional and instead engaged in wasteful trivial trade mark registrations speaks volumes about the undesirable consequences the IPO’s current policy is having.  Unless the IPO distances itself from helping applicants to file their own marks, it is reducing the quality of its IP awareness raising activities.

This particular business is successful and could easily afford to pay a legal representative for advice.

Cutting costs

So the current IPO policy is not helping entrepreneurs to see there is more value to be obtained from taking advice than just securing a trade mark registration.  For many, registering a trade mark is not essential initially, but, where trade marks are important (for example, for a fashion label applying its brand to clothes) then getting it right is crucial.  Such businesses should be encouraged to get legal help because a professionally drafted trade mark will be better than one they can produce themselves, and it’s an investment they are making in their business.  If they need to cut costs, then let the business itself decide what to cut.  It is not necessarily a smart move to cut out professional legal costs.

And if 80% of businesses fold in year one, then let them decide in consultation with their professional advisers whether a trade mark registration is appropriate for them.  If they don’t even have a suitable name, I’d suggest they cut out expensive branding and websites too until they’re more established.  Starting out cost effectively and thinking carefully about what you spend money on is a sensible approach.  An example of a business that adopted this strategy is Distilled.  It was known by a different name in its first 18 months and rebranded when it knew the business would be viable.

The IPO – A Competitor

Personally I now see the IPO as my competitor.  Sometimes I think: Surely there must be competition rules to protect us against unfair competition from a government funded entity?  An entity that influences businesses not to consult lawyers except in rare cases, and advises them that when they do want to consult someone: “Professionals who belong to the Institute of Trade Mark Attorneys and the Chartered Institute of Patent Attorneys are especially useful in helping you obtain and understand your IP rights”. How does the IPO justify making such a statement.  I would love it if the Law Society took this up with them.

Surely it depends what sort of IP need a business has.  In our knowledge economy where intangible assets are signficant to most businesses, not just to inventors or creatives, it’s likely that many start ups are in need of other types of IP advice.  Those setting up web based businesses (and websites are a bundle of IP rights) have copyright issues and need appropriate contracts and lawyers who understand the internet.  IP Solicitors such as my firm, are probably more able to help them with their typical IP needs than other types of IP professional.  But by directing everyone in need of trade mark or other IP help to ITMA and CIPA the IPO is not necessarily helping people to find the best person for the job.

Solicitors are skilled and experienced professionals.  The IPO does not need to protect the public against them.  The IPO should instead focus its energies on helping the public to distinguish between regulated professionals who are insured and are answerable to professional bodies from others who prey on inventors and creatives with their various IP services.

The UKIPO has a huge responsibility in this area, and should take care when making recommendations that they don’t unintentionally mark out one group of professionals as being more useful than another when they have not offered sufficient explanation to allow readers to choose what is right for them.  So, in my view the IPO needs to make some changes. It should encourage SMEs to take professional advice, and should avoid favouring one profession over another.  This is particularly important in light of the IPO’s impending consultation reported in IPKAT to identify how lower cost IP legal and commercial advice can be provided to SMEs

Arguably unique in the personal computer industry, Apple exercises strict controls over every element of its product line.  This control over both the hardware and software used in its computers, peripherals and devices has enabled the company to ensure a consistent user experience worldwide, and to avoid compatibility issues which have in the past plagued other platforms.

However, this monopoly also means less choice for consumers.  Often, PC users choose to buy their own commodity hardware, put it together and install their operating system of choice.  The motivations for this are varied: some users are searching for bleeding edge performance; others are looking for value; and some simply enjoy the experience of building their own PC.

In the past a number of businesses have established themselves as alternative Mac hardware vendors – typically selling cheaper PCs tailored to be compatible with Apple’s OS X.  A recent example of such a business, fighting Apple in the courts for the right to do so, is Psystar.

Some would argue that Apple are shooting themselves in the foot by preventing other vendors from selling compatible packages that might increase the user base of OS X, sell more copies of the operating system and, possibly, sell more devices developed to integrate with that operating system.  However, Apple differs from companies like Microsoft in that it is arguably a hardware business.  Allowing hardware competitors into the marketplace to increase software sales is not good business sense for the company.  Particularly as the strength of Apple’s brand depends upon its ability to exercise strict controls over the user experience – “It just works”.

So, Apple’s software licence for OS X imposes significant restrictions on licensees.  A recent US ruling highlights the utility of software licences in enabling developers to control how their work is used.  At issue was whether the US first sale doctrine applied such that a purchaser could sell on Apple’s software as they saw fit – think buying a car and selling it on second hand.  The court found, unsurprisingly, that customers are not buying the software itself – they do not own the software after they buy a disc holding a copy of OS X, or download it – they are merely granted a licence to use it subject to a range of restrictions.  The terms of the licence they are granted preclude its use on other hardware.

This is bad news for Psystar but, as Groklaw points out, good news for proponents of Open Source Software.  It affirms the (albeit widely accepted) presumption that a US purchaser of open source software is not entitled by way of the first sale doctrine to resell it on their own terms and thereby circumvent an open source licence.

The pair founded the Pirate Bay back in 2003, and the site quickly became infamous as a place to find and illegally download copyrighted content including music and movies.  The site relied on BitTorrent, a protocol making it possible for thousands of users to share the burden of distributing files, and meaning that the Pirate Bay did not need to host any copyrighted material itself.   Instead it simply offered a search facility allowing users to find out what content was being shared, and where to get it.

In contrast, Bayfiles aims to provide users with faster downloads and increased reliability through the HTTP protocol.   HTTP is used when retrieving webpages and the vast majority of other material found by typical users on the world wide web.  It involves downloading files straight from a server.  So, unlike with the Pirate Bay, BayFiles intends to directly host the files being shared.  An oft cited argument against alleged infringement of services like the Pirate Bay is that they do not store or transmit infringing content; should Bayfiles be used by pirates this will not be the case, and it might seem therefore that there is an increased risk of liability for infringement.  Out of the frying pan and into the fire perhaps?

Co-founder Fredrik Neij explains the choice of HTTP saying ‘BitTorrent is increasingly throttled or even filtered by ISPs, HTTP usually is not’.  On the subject of copyright infringement, BayFiles have said that they will follow potential complaints and take down files that might infringe copyright when identified. They intend to comply with the Digital Millennium Copyright Act (DMCA) and have registered DMCA officers on board to handle complaints.  Their terms of service explicitly provide that content which violates third party copyrights will not be accepted, and that they will terminate without notice and without recourse, accounts of holders who are repeat infringers of copyright.  The site will log the IP addresses of uploaders, and disclose these if legally obliged to do so, but details of downloaders will not be retained.

A variety of similar services exist, such as MegaUpload and RapidShare, and perhaps through diligent compliance with copyright law, and prompt action in response to notices of infringement they continue to operate despite hosting a range of copyright content.   That is not to say that they haven’t come under fire – as illustrated by actions in both the US and Germany.

The founders have described that their ultimate goal as making sharing effortless and efficient while maintaining privacy.  They note:

‘Storage and transfers on Bayfiles also preserve users’ privacy. And another advantage is that users can be sure that content stays up, which is important for personal backups. It also guarantees that other personal files such as your MP3 collection are always accessible; so users are able to stream it live to any device.’

Admirable goals, copyright compliance and easy file sharing for all.  Despite the founder’s aims, some remain skeptical that the site will avoid infringement.  A lawyer with legal firm Cobbetts told the BBC “I suspect what they’re concentrating on is the idea that if it can be shown that they’re infringing or facilitating the infringement of an identifiable copyright work, they will comply with the requirement to notice and take down in time ….  So there will be a lot of infringement – but they are basically saying if you catch us we will cough’.

Nevertheless, the new venture is a far cry from a site which took a somewhat less positive view of the rights of copyright owners, and the work of their lawyers [see here].

Image by Si McMahon, click for Flickr

Further progress was made in the Newzbin saga last week when the High Court ordered BT to prevent its subscribers from accessing the website.  You may recall that the site had hopped abroad to the Seychelles, escaping the reach of the UK courts (or so it thought).  However, despite its emigration, the Motion Picture Association has succeeded in finding another way to attack its user base.

The blocking order, the first of its kind in the UK, requires BT to implement technology similar to that used to block sites featuring child abuse.  The technology works via a mechanism similar to email SPAM blockers you might use yourself, or web browser plugins used by many to hide adverts on web pages.  The ISP will return to the courtroom in October to iron out the details, but in the meantime the case is suggested by commentators to have been partly behind a recent Digital Economy Act (DEA) u-turn.

One of the significant provisions of the DEA, heralded by some as a key weapon for copyright holders, was intended to allow the blocking of infringing websites.  Not implemented in full by the DEA, the details were still to be finalised by secondary legislation.  However, following an announcement by the Business Secretary Vince Cable it seems this may never happen, as Ofcom is to review the policy.  Echoing the not-uncommon opinion that the DEA is outdated before it has even had an impact, Mr. Cable said “We’ve discovered that the drafting of the original laws, which took place a year or so ago, were not tight”.

A real problem with the intersection of copyright law and technology is the phenomenal pace at which technology develops, in stark contrast with the gears of the legislature.  A mixed bag all round, with the film industry cheering the result of the Newzbin case on the one hand, but unhappy with the possible loss of the DEA’s teeth on the other, some believe that blocking measures may not even be feasible with BT’s current technology.

James Blessing, a member of the Internet Service Providers’ Association remarked that “Trying to put Newzbin and other sites into the same blocking technology would be a bit like shutting down the M1. It is not designed to do that.”

Popular concerns include flood-gates and censorship – “What will qualify a site to be worthy of blocking? Who makes the decisions about what people are allowed to see online?” asks Peter Bradwell, a campaigner for the Open Rights Group, who says of the ruling: “if the goal is boosting creators’ ability to make money from their work then we need to abandon these technology naive measures, focus on genuine market reforms, and satisfy unmet consumer demand”.

While Mr. Blessing’s statement may be true as far as CleanFeed goes, the technology will likely be available to implement the blocks in the near future. However, as with most DRM (even DRM applied to an entire country) those with enough determination will find a way through the wall.

In the meantime, it seems that the internet, an invention aimed at breaking down barriers, is slowly becoming cluttered with ‘walls’ – firewalls (not criticising virus protection); pay-walls; the ‘great firewall of China’; and now this.  Where next?

Under ss.51 and 52 of the Copyright Designs and Patents Act 1988: copyright in a design document is not infringed by making articles to that design provided that they are not themselves artistic works (51); and, where a design is exploited through the (licensed) manufacturing of articles derived from it, a period of 25 years from the first exploitation this is no longer an infringement (52).  However, if the helmets themselves were sculptures, artistic works, then any copying of them might be classed as infringement even 30 years after Star Wars’ release.

On this crucial point an analogy was drawn with the use of prop military helmets in film portrayals of historic wars, the difference in the instant case being that the war was entirely fictional.  However, despite the imaginary nature of the Stormtrooper characters, The Court explained that the work of art created by the appellants was the Star Wars film, and the helmets were ‘utilitarian in the sense that [they were elements] in the process of production of the film’ rather than artistic works in their own right.

Some commentators observe that the defences mentioned above set the UK apart from other jurisdictions, and allow for less substantial protection of creative works created in the course of producing a film.  An important distinction here is between the typical duration of copyright protection, lasting for 70 years from the death of the author, and the much shorter period where derivative works are commercially exploited – 25 years following their being marketed.

Aside from the characterisation of Stormtrooper helmets as utilitarian, another interesting finding emerged from the decision – that claims for infringement of foreign copyright are justiciable in UK courts.  Although Ainsworth succeeded in his defence against infringement of UK copyright, the Supreme Court held that the UK are entitled to take jurisdiction over a UK defendant in a claim for infringement of foreign copyright, and the eventual fallout of the case on this point remains to be seen.

Your differentiating proposition effectively says to consumers that buying from you will give them a specific benefit. This benefit must be powerful enough to influence the buyer to choose you.

Where there is insufficient differentiation between businesses customers choose on price.

Many businesses seek help from marketing and branding companies to work out their differentiating strategy. Once determined, these advisers will translate the differentiating strategy into a name, logo, and tagline, which are the elements of a brand that the law protects through design and trademark registrations.

Additionally, certain brand elements are automatically protected by copyright without the need for registration.  The business owner should ensure a proper agreement is in place with the agency in respect of such copyright elements so that if someone infringes the brand later they are able to take necessary steps to protect their brand.

Focus on IP rights

It’s important to involve an IP lawyer in any branding exercise so as to end up with brand elements that also works well from a legal perspective.

The worlds of branding and intellectual property rights tend to be different and separate.

What works from a marketing perspective, does not always work from a legal point of view.

Just as it’s important for your business to stand out from your competitors’, so it’s important that the branding components of your identity are not commonplace and are capable of legal protection. Then you will have a strong brand from a legal perspective, which is going to stand the test of time in the long run if your business succeeds.

Branding designers will be considering your identity from many different perspectives, but the law of intellectual property rights is unlikely to be top of mind. Indeed, they are not lawyers, and not all of them may know which elements of a brand are capable of protection by the law, and what the legal criteria are for protection. Nor will it be obvious to non-lawyers why it’s important that brand elements should be distinctive, and therefore, capable of trademark protection.

Legally Descriptiveness is Not Differentiating Enough

Names, logos or taglines must not purely describe your product or service.

An example of a common place logo may be an image of a bunch of flowers for a florist – although this would depend very much on both the logo and the services being offered by the trademark owner.

Descriptive names may seem attractive to start ups who want their name to immediately convey what it is that they do. However, being simply descriptive renders the name or logo incapable of trademark protection. This means you will have a hard time stopping copy cats later down the line if you should have a successful business.

Take as an example Google or Twitter. They chose highly distinctive names with the result that there is no possibility of mistaking other businesses for them now. Imagine how different it would have been had they chosen a name like ‘Search Engine’ or ‘Micro Blogging Platform’ for a name. It would be impossible with such a descriptive name to stop other search engines or micro blogging platforms from also calling themselves ‘search engine’ or ‘micro blogging platform’ – indeed it’s unlikely their business could have enjoyed the same level of success they have had.

This is a very extreme example, but the point to take on board is that sometimes if a name comes too close to the boundary between descriptive and distinctive, it may be better for your marketing team to go back to the drawing board until they are able to turn their first choice name into something more distinctive. For example, if you identify a strapline for your business which is effective at conveying a key benefit of doing business with you – your brand promise – then that’s a break through. But think how much better it would be if the strapline was also protectable as a trademark.

Had John Lewis developed a strap line saying: ‘We will refund the difference if you buy goods from us which you find at a lower price elsewhere’ that would have conveyed their ethos but it would not have been capable of trademark protection. By going further and converting this concept into ‘Never knowingly undersold’ they ended up both with something catchier and with a unique tagline that is capable of trademark protection.

Recently, we introduced our own strapline – Easy Legal Not Legalese – which we are proceeding to trademark. What this means is that while others will be free to copy the idea – for example, by using a strapline like ‘We use plain English’ – they will not be able to actually copy the wording of our strapline. Right now that may seem unimportant. The strapline is not well known. It’s once a name or strapline becomes well known that others may want to piggy back on its success. That’s when it will pay off to have built and protected your brand elements carefully in the early days.

Aggressive protection of intellectual property is essential to America’s current economic prosperity and future success

Proposals aimed at clamping down on IP offences by the Obama Administration in the White Paper on Intellectual Property Enforcement Legislative Recommendations are varied and far reaching, recommending a raft of changes including:

1. The use of wiretaps in cases of copyright and trademark infringements
2. Clarification that unlawful streaming of copyright material is a felony
3. More serious penalties for repeat IP offenders
4. The creation of a new US right of public performance for works broadcast over-the-air

These are just some of the proposed reforms aimed at tackling what some consider to be an increasingly relaxed public attitude towards piracy and IP infringement.  The problem of how to enforce copyright online is significant to businesses in a wide range of fields, and a proper understanding of the relevant issues can be a considerable advantage when deciding if, and how to distribute content.  This is the motivation behind an upcoming webinar to be delivered by Azrights: Controlling Copyright in the Cloud.

Digital Economy Act Update

Meanwhile, the UK High Court recently rendered its opinion following the application by BT and TalkTalk for judicial review of the DEA and Copyright (Initial Obligations) (Sharing of Costs) Order 2011.  You might recall that our earlier post touched on the compatibility of the Act with European law, now the results are in (the case report is available here).

Of the objections raised by the Telecoms providers, only one was accepted by Justice Kenneth Parker, while four claims were dismissed confirming the courts view that the law is consistent with European legislation. The successful claim concerned an obligation on ISPs to bear a proportion of the costs involved in implementing the new legislation, and a number of parties have expressed dissatisfaction not only at the rejection of the remaining issues but at the degree of success that this claim enjoyed.  While elements of the charges to be borne by ISPs relating to Ofcom’s setting up, monitoring and enforcement of the rules were found to be unlawful, the judge maintained that they would remain liable for a significant proportion of the costs of operating the system and the appeals process – a burden likely to lead to higher prices for consumers, possibly to the extent that tens of thousands of people may be excluded from faster broadband access.

Data Protection

Of particular interest to this writer, is that the Judge makes the case for the classification of IP addresses as personal information.  The reasoning behind this is that, despite the IP address only identifying an internet connection (or an internet subscriber) rather than a particular user, it may still constitute personal data because:

the subscriber, who can be identified through the dynamic IP address, is inevitably linked to the data … as the person who, in a broad sense, has facilitated the infringement.

The suggestion here is that IP addresses, coupled with information about the time particular material was accessed by a subscriber assigned that address, may themselves be protected under Data Protection law.

Image courtesy of opensourceway, click the image for their page on Flickr

This ruling is a significant blow to opponents of the Act, but the AG’s opinion in Scarlet v. SABAM, continuing efforts by the Open Rights Group, and the possibility of appeal by BT and TalkTalk mean that the future of the Act is far from certain.  The Initial Obligations Code, which sets out in more detail the operation of the Act, has yet to be published, and the Costs Order will now need to be reviewed in light of the decision.  So, it is likely to still be some time before we can expect to see the full impact of the law.

Data must be retained so that it can be handed over to the authorities on demand, and must be kept for at least one year, so that it can be used by the authorities if necessary. The data that the law will require the sites to retain includes personal information such as customer names, addresses, telephone numbers and even passwords.

However, Google and over 20 other companies want to reverse the new legislation. The ASIC argues, “It doesn’t make sense to have different requirements in France than what we have in Spain and England. Also we do not feel comfortable turning our customers’ passwords over to the police”

The new law raises a number of concerns over privacy, something for which Google and Facebook have already faced criticism as a result of their collection and retention of personal information. In fact Google has been the target of legal action brought by France itself, and was last month fined $142,000 after collecting data through wireless access points around the world.  On a related note, Facebook has found it necessary to change is privacy settings in light of concerns over access to user information.

With a number of the companies affected by the legislation having suffered damage to their reputation themselves following the efforts of privacy advocates, it is no surprise that they are objecting to a new law which will now require them to retain, and release on demand, their users’ personal data.

The new law could be could prove particularly problematic in cases where security is breached. If companies are bound to retain a broader range of user data, including passwords which might be used with a variety of services, it is more likely that an attacker would be able to gain complete access to millions of Internet users’ accounts across not only social networking sites, but email, intranets and possibly even online banking.

The head of ASIC, Benoit Tabaka, has highlighted a range of problems with the new law. One issue he raises is that ‘there was no consultation with the European Commission.’ He goes on to explain that, ‘Our companies are based in several European countries. Our activities target many national markets, so it is clear that we need a common approach’. And he claims that collecting and retaining passwords is a ‘shocking measure’.

In light of the increasing concern over privacy online it is not surprising that the new law has caused a stir. Especially among those companies which have come under attack as a result of their collecting personal information.  Furthermore, is this yet another burden for new IT business to bear, as touched on previously in our post covering Regulation and Start Up Britain, and could it lead to a less competitive marketplace here if similar measures are adopted in the UK?

Proposed reforms to data protection law in Europe, including the right to be forgotten online, and changes to laws which affect when cookies may be stored and accessed by websites, are aimed at developing a “comprehensive set of existing and new rules to better cope with privacy risks online”.  However, while entrepreneurship is hailed as a means for economic recovery, over regulation would certainly represent a significant obstacle  to start ups.  While the barriers for entry to the online marketplace have traditionally been very low, and while web based businesses have been relatively free to design their systems and user experiences as they wish, these freedoms are increasingly weighed against the privacy of users.

Regular scandals serve to highlight the importance of more effective safeguards on the use of personal information, for example the loss of address, bank, and national insurance details for 25 million people in 2007; a BP laptop going missing with personal data for thousands of oil spill victims on board last month; and the exposure of names and email addresses following a cyber attack aimed at Epsilon, who provide e-mail services to several high profile businesses.  There is good reason for concern over the safety of information we provide online, but notably, in each of the cases mentioned here, the exposure of personal details was not necessarily attributable to a lack of consent or misuse of data, but to a breach of security.

Freedom to do business online must be balanced with controls on the use of data, especially as the growth of social media sees more and more interaction taking place on the web. However, if the scales are tipped too far one way or the other, regulation may have a severe negative impact on businesses, or the privacy of web users.

Following the increase last year in the maximum fine which can be levied by the ICO from £5000 to £500,000 and calls for the law to provide mechanisms for enforcement against global companies, the growing reach and impact of data protection law means a steadily increasing burden on website operators to obtain consent for the collection of visitor data, to control its use, and to control access to it.  While compliant businesses are likely to develop trust, and while stricter rules may give web users greater peace of mind, it might be argued that education could play a more significant part in preventing breaches of privacy online, and reduce the need for regulation.  It will be interesting to see whether the reforms strike the right balance, and allow entrepreneurship to thrive, or whether they eventually raise the bar to entry such that only larger players have access to the market.