Opinion and debate on the legal issues affecting IT, by international law firm Pinsent Masons Opinion and debate on the legal issues affecting IT, by international law firm Pinsent Masons Opinion and debate on the legal issues affecting IT, by international law firm Pinsent Masons

Thursday, 01 May 2008

Do you know where your data is?

It is often said that technology is the problem and the solution. This is surely appropriate for data security. After all, more than 95 per cent of corporate data is held electronically.

Perhaps the best approach is to distinguish between data security ­ – preventing unauthorised disclosure – ­ and litigation/regulatory readiness ­ – managing authorised disclosure effectively. The legal rules of data protection and the civil courts require those responsible for the relevant data to consider what technology is available to better avoid unauthorised and manage authorised disclosure. This fact alone dictates that IT and legal experts should communicate and collaborate.

The Data Protection Act imposes a duty to ensure an appropriate level of security. This involves a consideration of the nature of the data, and the likelihood of loss, cost and developments in technology. It is not sufficient for the risks around storing and using high volumes of electronic data to appeal to the legal framework alone.

The potential damage to brand and reputation is too often underestimated.

When 1,500 Standard Life savers’ personal details were lost en route between HM Revenue and Customs (HMRC) offices in Newcastle and Edinburgh, the data was encrypted to the highest degree. But two lost HMRC CDs containing Child Benefit Agency information were protected by only one password.

Subcontracting is another example of risk – ­ one that led to Marks & Spencer (M&S) losing an unencrypted laptop and being found by the Information Commissioner to have violated the law.

What about the litigation/regulatory risk? Few organisations appreciate the burden, time and cost of a request from an opponent in litigation or from a regulator to produce documents. Most are blissfully unaware of what is involved.

What are you going to do when asked to produce substantial volumes of data against a tight deadline? Where is the data? How are you going to search for it? What happens if you do not produce files when requested but they subsequently come to light? The low priority accorded to this risk could prove disastrous.

What should companies be doing?

First, the risks must be appreciated and managed. Make data management an organisational priority. Instigate ongoing communication and collaboration between the IT function and the legal team. For example, is there a policy about the removal of mobile devices from company premises? What about the use of removable media such as memory sticks? Who is controlling that data?

Second, draw up and enforce appropriate policies that should be kept under constant review. Keep audit trails so that a course of action can be justified later if necessary.

The use of encryption is not as widespread as may be thought, as the M&S incident testified. Training is vital, and every contract within the organisation should be reviewed in relation to the data management risk.

Whether your technology is in-house or outsourced, those responsible will need to appreciate the different data protection laws in different countries, the prevention of over-writing backup procedures during the preservation and collection phase, and the challenges presented by differences in local language and culture where data has to be collected across continents.

Volume reduction is essential to confine data within reasonable parameters such as date ranges, file types, and relevance, to eliminate unnecessary duplication.

A documented and defensible methodology to justify decisions is indispensable. And project management skills to review the data for confidentiality, privilege and non-relevance is essential to stop costs spiralling out of control.

Legal teams must understand what technologies are available, and IT managers must understand the rules governing the retention, destruction and disclosure of electronically stored information.

What better way to start taking control than for IT and legal to talk to each other?

Mark Surguy is a senior associate at international law firm Pinsent Masons

Data protection disasters

  • HMRC lost two unencrypted CDs containing the details of 25 million child benefit recipients. It appears that it was a breach of company policy to use the internal post (a courier) rather than recorded mail that led to the loss, and not a breach of any encryption requirement.
  • M&S used a consultancy to prepare pensions statements. The evening before a meeting, the company’s data was downloaded to a laptop in unencrypted format, and the computer was stolen. M&S immediately put into operation an encryption programme for all its laptops.
  • When Arthur Anderson staff shredded documents in connection with the Enron affair, the fatal damage to the company was caused by a failure to comply with a document-destruction policy. Had the shredded documents been destroyed in accordance with the policy, no complaint could have been made and the organisation would still be in existence today.

Wednesday, 30 January 2008

File sharing rows rumble on

Any record industry executive would have been weeping into his cornflakes today as he perused the newspapers. The European Court of Justice (ECJ) was reported everywhere as having handed victory in a battle to privacy activists and file-sharers by ruling that ISPs do not have to hand over subscriber details in file sharing or any other civil cases.

The problem is that these reports have missed the point. What the ECJ actually said was that national governments can, effectively, do what they like on the issue.

Therefore, if Spain wants to rule that file-sharer details can only be revealed in criminal cases, it can. However, if UK courts want to hold, as they do, that file-sharer details can be revealed in all cases, then that's fine too.

It all boils down to the slightly complicated question that the ECJ was asked. Telecoms firm Telefónica argued that Spanish law prevented it revealing user details except in criminal cases. Music rights-holders' group Promusicae, though, said that law was inconsistent with the EU directive protecting copyright.

The Spanish court asked the ECJ whether Spain was allowed to have a rule preventing disclosure in civil cases. The ECJ said that such a rule was okay. The ECJ did not say that all member States had to prevent disclosure in civil cases to protect privacy rights as has been reported.

The court, very even-handedly, said that the issue put two crucial rights in fundamental opposition: an internet user's right to privacy and a music producer's right to protect its copyright.

Each side in the argument had an entire EU directive on its side, and the ECJ was asked to choose between them. It didn't, instead telling EU nations that they could create their own laws provided they balanced the two rights properly.

Spain, then, was allowed to keep a law that said names can only be revealed in civil cases, as long as its law overall kept a proportional balance between the right to privacy and protection for copyright holders. And here's the nub of the issue, it is a criminal offence to host copyright-infringing material in Spain for profit or on a commercial scale, even if not for profit.

The music industry executive should be marginally happier now, but the one industry it could unsettle is the telecoms business. What practical effect will the ruling have in the hard world of commerce?

One potential effect is forum shopping.

UK music fans generally can't subscribe to ISPs in Spain, because Spanish ISPs don't lay cables along the streets of Britain or install kit in British telephone exchanges (and satellite broadband is an expensive solution for free downloads). But they might use a Spanish web host to store copyright-infringing files. Entire companies could relocate to countries that would not order names to be revealed in civil cases, to pick up this business, and countries that do reveal names, such as the UK, might find their ISP businesses suffering.

So what might be relief for the record industry executive might well become a headache for his counterpart in a telecoms firm. But probably only a minor headache.

Monday, 03 December 2007

The semantics of web advertising

For the first time in my life I feel sorry for insurance salesmen. The Financial Services Authority has taken a big red pen to their use of the words "save up to £200 with our insurance" in the text of their sponsored links. That's because the FSA is concerned that these advertisers fail to substantiate the percentage of people actually receiving the savings. So the FSA says these ads are misleading.

There are two things I don't get. First, is anyone actually misled by such ads? If I see the words "save up to £200," I have enough shopping experience to know that I'm unlikely to save the full £200 but that some people will (or should). I don't object to the ad when I learn that I won't save the full £200. (I'm carrying 3 points on my licence; I don't expect the ad to know that). It's surely just a ubiquitous advertising puff. Second, how do you write compelling copy while also substantiating that £200 saving in two lines of text, each with a maximum of 35 characters? "Four per cent of customers saved £200" won't make me click.

Wednesday, 26 September 2007

Patently obvious

The US patent system is under fire from all sides. While open sourcers hate it just for existing and for granting philosophically distasteful tech monopolies to giant companies, big business attacks it for being too slow and backlogged, while other businesses claim that it awards patents too easily and broadly.

The giant organisation admits that it is in trouble: Commissioner for Patents John Doll told OUT-LAW Radio that if he closed the doors to new patent applications tomorrow it would be two and a half years before the current backlog is cleared.

What to do? Well the US Patents and Trademarks Office (USPTO) has taken a bold step. Kind of. It has embraced the mania of the day, the theory of the wisdom of crowds, and will attempt to harness all of our knowledge to help improve the quality of patents.

The new scheme relates to prior art, which is the name given to evidence that a patent application is not new, that someone had invented or patented something similar in the past.

The USPTO has signed up to a scheme invented at the New York Law School which throws open the search for prior art to the world. You can now look at a patent application online and submit anything you know of that would count as prior art and invalidate the patent application.

This is a fantastic idea, solving a number of problems. It reduces the workload of, and pressure on, beleaguered patent examiners by providing them with relevant, free information. It increases the likelihood that patent hoodwinkers will be caught, which in turn reduces future patent litigation, an expensive and time consuming process that has been the death knell of many a fine company.
Best of all, it does it in an open, transparent way which involves the technological community and gives them both responsibility and credit for the smooth operation of the system, while allowing the USPTO to stay firmly in charge.

There is, though, a problem. When I said that the USPTO has embraced the scheme, that was a lie. Their's is more of the kind of half-hug you give awkwardly at parties when you don't know someone that well.

They have signed up to the system, but only on a 12-month pilot, which is fair enough, and only for those who opt into the system.

There is a legal snag, you see. Third parties are barred by law from submitting prior art to the USPTO, except for in a very short window early on in the process. So participants in the trial have to waive their right not to have prior art submitted by other people.

Imagine that you are a wily inventor or purchaser of the rights to technology looking to slip in a quick patent application to put your proto-business on sound footing. You know that your application is maybe a little too broad, or a little too close to an existing one. But there are millions of patents out there and only one examiner with just 17 or 18 hours allocated to your application. What are the chances of them finding that one little patent from 20 years ago?

Are you going to sign up to the Peer-to-Patent system? No chance.

So the plan is a good one, and could radically improve the quality of an under-fire patent system. But if the full programme adopts the same mealy-mouthed approach and allows patent applicants to opt out, it will wither and die as only the least controversial applications will pass through its filtering system.

This project is designed for the controversial, the sneaky and the dishonest. Everyone's application should be forced through the system, otherwise it is a waste of the wisdom of an already tetchy crowd.


Thursday, 23 August 2007

Facebook and friends

While the press were salivating over story-of-the -summer Facebook and the gee-whiz news that its founder Mark Zuckerberg was being sued for allegedly stealing the whole idea from some college acquaintances, it went un-noticed that Facebook is itself suing - that's right, those same college acquaintances.

ConnectU was a startup social networking site whose founders say they employed Zuckerberg. Their suit claims he took their ideas and built Facebook out of them.

But in the background lies another suit, in which Facebook accuses ConnectU of hiring programmers to break into its system, read address books and send ConnectU marketing material to Facebook members' friends, apparently on behalf of those members.

The system was designed, says Facebook, to work with other sites as well as its own, but it said that some elements of it were specifically designed to evade detection by Facebook.

The case stumbled on a dispute over jurisdiction, but Judge Richard Seeborg, who will also oversee the high-profile case between Zuckerberg and ConnectU, said that the Californian court's reach could extend to some Washington-based defendants.

That ruling in itself could set a vital precedent for ecommerce cases.

Seeborg said that jurisdiction can be asserted over people who take action against a person or company even if they don't know that person's physical location.

That is a law change that could have wide ramifications, but in this dispute most people's eyes will be on just how heated and vicious the series of cases between ConnectU and trend-of-the-hour Facebook will get.

Google may be forced to grow up in public

Google is facing yet another challenge to its advertising system, AdWords. The system has been challenged before by brand holders such as GEICO and American Blind & Wallpaper Factory (ABWF), but the latest is from one of the world's most famous companies, American Airlines.

The beef is simple in outline, but complex in detail. Google sells ads beside your internet searches which are related to whatever you typed into its search box. The problem is what happens when you type American Airlines or AA into that box.

AA wants only its ads to appear. Google sells the right to display ads next to that term to whoever buys the space. That is the conflict.

A US court ruled in one previous case that using trademarks as triggers was OK, but using those trademarks in the ads themselves was probably a no-no. That, said the judge, caused consumer confusion. We were just about to get blessed clarification on whose fault that would be when Google settled in secret with the other half of that case, GEICO.

Another case involving ABWF has had an initial hearing but will proceed to a full jury trial.

AA is clearly not happy with the outcome of the GEICO case, and has been pretty stiff in its pre-trial verbiage about Google's policies. It says its trademark policy is "manifestly deficient" and it wants a jury trial and punitive damages.

Google has not yet fought this battle with as large, as experienced and as deep-pocketed an opponent as AA. It has another possible adversary, though: Google Europe.

While Google allows US and Canadian trademarks to be bought as keywords, its rest-of-the-world policy allows no such thing. In Europe, it blocks the use of trademarks even behind the scenes as keywords.

"Google appears to have the ability to structure and configure its programming to stop this misuse of the Amercian Airlines marks because it has already implemented procedures with respect to European internet users," says the AA case.

So Google will have to defend in court a policy that its European arm does not practice against a battle-hardened business veteran from a cut-throat competitive and highly litigious industry. If Google hasn't grown up yet, it will soon.

Monday, 13 August 2007

Making money out of typos - Icann must act

Quietly, while no-one was looking, a minor scam on the outskirts of the law has turned into a major business, creating fast-dealing millionaires and causing the world's brand owners an almighty headache.

Typosquatting is now officially big business: it reportedly earns millions a year for scamsters and new research from Out-Law.com has found that every one of the world's 500 biggest companies is affected.
But why is the business such a raging success for squatters? One of the main reasons is the phenomenon of domain 'tasting'. As a well-meaning aid for people who made a mistake when registering a domain, internet registrar Icann introduced the ability for an address to be returned after five days at no cost.

Though a charming concession to those who might have second thoughts over an address, the practice could almost be designed as an aid to typosquatting. With domain costs resting at an incredible $6 a year, a site has to make less money than ever to turn a profit. What tasting does is allow squatters to find out exactly which sites will deliver the goods.

A typosquatter just has to register a name, monitor the income from ads and do a quick sum to see if it makes enough that it will make a profit over the course of a year. If it doesn't, it gets returned at no cost to the typosquatter.

It is the most incredibly accurate, focused market research opportunity, and it's free. It could be custom-designed to help people to exploit the world's biggest brands for their own profit.

Icann could do something about it, and perhaps it is time to do a cost-benefit analysis. Is any benefit in the grace period really balanced by the vast sums that brand owners say they are losing in the dilution of their brand investment? Isn't it time to change the rules, to force a restocking fee on bulk buyers? It certainly should be food for thought over at Icann.

Wednesday, 01 August 2007

Not quite a victory for European passenger privacy

It did not look good for the European Commission last week. It announced the result of a long, protracted negotiation over the amount of information handed over about Europeans when they fly into the US.

The Commission lost serious ground to the US except in one area. On further examining, though, the one apparent negotiating victory disappeared in a cloud of clerical pedantry.

Passenger name records (PNR) are the 34 pieces of information which must be sent to US authorities by airlines on any passenger travelling to the US from Europe. Put in place after the terrorist attacks of 11 September 2001, the PNR transfer scheme has long been opposed by privacy activists in Europe.

US security agencies - no slouches, one imagines, when it comes to deal brokering - seemed to have won some pretty major concessions on a new deal to replace one which ran out at the end of July.

US authorities could keep data for longer and they could transfer it to other agencies; even the fact that there was a deal at all on passenger name records (PNR) was seen by the European Parliament and privacy officials as a defeat.

Yet there was one glimmer of light: in the press statement released by several EU bodies and the US, Europe seemed to have won one concession.

"The number of data collected will be of 19, instead of 34 as foreseen by the interim Agreement," said a joint statement from the US and the European Commission, the Council of the European Union and the Presidency of the Council.

So they reduced the amount of information sent to the US, right? That is, surely, the only inference to be drawn from such a statement, isn't it?

Turns out the reader should not be so innocent, or so trusting. What the EU agencies agreed to was that almost all of the data collected in the old agreement would be collected in the new one. The only difference is that they will be collected in 19, not 34, fields.

They argue it makes more sense that way: fine. They say that it puts more order into the system: OK.

It is hard, though, to shake the impression that the EU bodies tried to put a gloss on a bad news day by shuffling some columns around and hoping that nobody looked too closely. Thankfully, it didn't work.

Wednesday, 25 July 2007

Government backs private copying, ignores compensation

The government said this week that it will consult this autumn on an exemption from copyright law for people who are moving music on to MP3 players

That makes lots of sense: everyone copies music in this way and, provided the music isn't also BitTorrented, the music industry turns a blind eye. A simple tweak to copyright laws should do the trick, right?

If only it were that simple. Trouble is, our laws on this are set by Europe. The Copyright Directive said you can let people copy music to iPods provided you also give fair compensation to copyright holders.

The UK's solution to date has been simple: ban private copying. In other countries that do allow private copying, like France and Germany, there's a levy on blank media. The report from the Parliamentary Select Committee on culture, media and sport scoffs that approach. A tax on blank CDs is a blunt instrument, it says.

So what is proposed instead? No idea. This report doesn't say. Perhaps it hopes that nobody will ask that question. But the music industry surely will.

Andrew Gowers, who reviewed our IP laws last year, was the one who recommended legislative reform to allow private copying. He was brave enough to suggest how it could work: if the music industry thinks it will lose money it can reflect that in the price of recorded music. So we'll add a quid to CDs, perhaps. That won't be popular; but far less popular would be his idea for legalising the music that's already on our iPods and computers. He proposed a licence for the right to keep playing our back catalogues. Will consumers accept, say, the price of an iPhone for the right to legalise their back catalogues? Not a chance.

Thursday, 12 July 2007

The world of law is full of flawed logic

A US court has just ruled that we must not hold credit card companies responsible for the piratical exploits of copyright-flouting scallywags.

As our transatlantic cousins would have it themselves: dude, duh!

The world of law is full of flawed logic and claims that stretch the imagination, the world of technology law being no exception.

When nudie picture firm Perfect 10 sought to hold Visa and Mastercard responsible for people stealing their photos it was a bad day for logic.

It got worse when one of the judges in Perfect 10's appeal against an initial rejection of its argument actually said he thought credit card firms should be responsible. The court, in California, sent Perfect 10 packing, but not before judge Alex Kozinski dissented with the majority verdict. "If cards don't process payment, pirates don't deliver booty."

"The credit cards, in fact, control distribution of the infringing material," he said. "It does not serve the interests of a free market, or a free society, to abet marauders who pilfer the property of law-abiding, tax-paying rights holders, and who turn consumers into recipients of stolen property."

Credit cards create a financial bridge between infringer and buyer, he said. The cider tap creates a financial bridge between students and penury, should they sue Strongbow because they only have enough cash for coleslaw and sausages at the end of term?

This drive to deal with a problem by suing everyone involved at any stage of a process when something bad happens is utterly lamentable.

That is not to say that credit card firms have no role in the prevention of crimes. When the US banned online gambling they did so by making it illegal for financial services firms, including credit card companies, to process online gambling transactions for US residents.

As an instrument for public policy they can be useful. But that doesn't mean that every time somebody charges for something they shouldn't, the credit card companies take a hit.


Contacts

Powered by TypePad
© 1995-2006 All rights reserved