Never mind Brexit, what is coming up on the UK internet legal scene in the coming year? The highlight of 2020 is of course the January publication of the 5th Edition of Internet Law and Regulation :-). That apart, here are some cases and legislation to look out for. (In accordance with long tradition this feature does not cover data protection).
DSM Copyright Directive
Member States’ implementation of the Digital Single Market Copyright Directive is due by 7 June 2021. This includes the so-called snippet tax (the press publishers’ right) and the Article 17 rules for online sharing service providers (OSSPs).
A CJEU challenge to Article 17 by the Polish government (Poland v Parliament and Council, Case C-401/19) is pending. Poland argues that Article 17 makes it necessary for OSSPs, in order to avoid liability, to carry out prior automatic filtering of content uploaded online by users, and therefore to introduce preventive control mechanisms. It contends that such mechanisms undermine the essence of the right to freedom of expression and information and do not comply with the requirement that limitations imposed on that right be proportionate and necessary.
The EU Directive extending the country of origin provisions of the Satellite and Cable Broadcasting Directive to online radio and news broadcasts was adopted in April 2019 and has to be implemented by 7 June 2021.
Linking and communication to the public
Pending CJEU copyright cases
Several copyright references are pending in the EU Court of Justice. Judgment in the Dutch Tom Kabinet case on secondhand e-book trading (Case C-263/18) was delivered on 19 December 2019. The CJEU decided against Tom Kabinet, holding that its service was a communication to the public, not a distribution subject to exhaustion of rights.
The YouTube and Uploaded cases (C-682/18 Petersongs v YouTube and C-683/18 Elsevier v Cyando) pending from the German Federal Supreme Court include questions around the communication to the public right, as do C-392/19 VG Bild-Kunst v Preussischer Kulturbesitz (Germany, BGH), C-442/19 Brein v News Service Europe (Netherlands, Supreme Court) and C-597/19 Mircom v Telenet (Belgium).
The UK government published its Online Harms White Paper on 8 April 2019. The subsequent Conservative manifesto for the December 2019 election promised to legislate for online safety, while at the same time defending freedom of expression and in particular recognising and defending the invaluable role of a free press. The government’s response to its consultation on the White Paper was originally due to be published before the end of 2019. The Queen’s Speech immediately before the election indicated that draft legislation would be subject to the pre-legislative scrutiny process.
The German Federal Supreme Court has referred two cases (YouTube and Uploaded – see above) to the CJEU asking questions about (among other things) the applicability of the ECommerce Directive hosting protections to UGC sharing sites. C-442/19 Brein v News Service Europe (Netherlands, Supreme Court) and C-500/19 Puls 4 TV (Austria, Supreme Court) also ask questions around the Article 14 hosting protection, including whether it is precluded if communication to the public is found.
On 19 December 2019 the CJEU issued its AirBnB (C-390/18) judgment on the scope of the eCommerce Directive, holding that the kind of service provided by AirBnB is an information society service within the scope of the Directive. It also held that in criminal proceedings with an ancillary civil element, it is a defence to measures restricting an information society service incoming from another Member State that the measures had not been notified to the European Commission and the Member State concerned under Article 3(4) of the Directive.
The new European Commission is proposing a Digital Services Act, starting with a public consultation in early 2020. This will include a review of the ECommerce Directive liability shields.
On 12 September 2018 the European Commission published a Proposal for a Regulation on preventing the dissemination of terrorist content online. This followed its September 2017 Communication on Tackling Illegal Content Online and March 2018 Recommendation on Measures to Effectively Tackle Illegal Content Online. It is notable for proposing one hour takedown response times and for the ability for Member States to derogate from the ECommerce Directive Article 15 prohibition on imposing general monitoring obligations on conduits, caches and hosts. Discussions on the proposed Regulation continue.
Cross-border liability and jurisdiction
Discussions continue on a Second Protocol to the Cybercrime Convention, on evidence in the cloud.
State surveillance of communications
The UK’s Investigatory Powers Act 2016 (IP Act), has come into force, including amendments following the Watson/Tele2 decision of the CJEU. The government has said that it will introduce ‘thematic’ certification by the Secretary of State of requests to examine bulk secondary data of individuals believed to be within the British Islands.
A pending reference to the CJEU from the Investigatory Powers Tribunal in litigation brought by Privacy International (Case C-623/17) raises questions as to whether the Watson decision applies to national security, and if so how; whether mandatorily retained data have to be held within the EU; and whether those whose data have been accessed have to be notified.
Liberty has a pending judicial review of the IP Act bulk powers and data retention powers. It has been granted permission to appeal to the Court of Appeal on the question whether the data retention powers constitute illegitimate generalised and indiscriminate retention. Other aspects (including bulk powers) are stayed pending the Privacy International reference to the CJEU or (a challenge based on the Human Rights Act) were refused by the Divisional Court.
The IP Act (in particular the bulk powers provisions) may be indirectly affected by other cases pending in the CJEU: Schrems 2 (C-311/18), challenges by La Quadrature de la Net to the EU-US PrivacyShield (T-738/16) and to the French data communications data retention regime (C-511/18 and C-512/18), and a challenge to the Belgian communications data retention regime (C-520/18); in the European Court of Human Rights (in which Big Brother Watch and various other NGOs challenge the existing RIPA bulk interception regime) and by a pending domestic judicial review by Privacy International of an Investigatory Powers Tribunal decision on equipment interference powers.
The ECtHR gave a Chamber judgment in the BBW case on 13 September 2018. That and the Swedish Rattvisa case were subsequently referred to the ECtHR Grand Chamber and are awaiting judgment. If the BBW Chamber judgment had become final it could have affected the IP Act in as many as three separate ways.
In the Privacy International equipment interference case, the Supreme Court held on 15 May 2019 that the IPT decision was susceptible of judicial review. The litigation will now continue.
Compliance of the UK’s surveillance laws with EU Charter fundamental rights will be a factor in any data protection adequacy decision that is sought once the UK becomes a non-EU third country post-Brexit.
Here is an updated mindmap of challenges to the UK surveillance regime:
Software – goods or services?
Judgment is awaited from the UK Supreme Court as to whether software supplied electronically as a download and not on any tangible medium is goods for the purposes of the Commercial Agents Regulations (Computer Associates (UK) Ltd v The Software Incubator Ltd).
This post originally appeared on the Cyberleagle blog and is reproduced with permission and thanks.