21. IP and data issues in the cloud – the UK legal
perspective
Ukraine IT Conference – 9 September 2014
Daniel Tozer, Partner
Notes de l'éditeur
Welcome and intro
Contents
Definitions
Issues re Cloud storage/B2C Cloud entertainment services: copyright protection in the Cloud
“Time shifting” and “space shifting”
Private use/copying exception
Issues for service providers: patents
Protection
Infringement
Protecting IP/data/confidential information in the Cloud
Users of Cloud services upload IP/confidential information to the Cloud
Business sensitive information
CRM data and other databases
Sales information
Personal data
Copyright works (e.g. using collaborative Cloud based word processing apps)
Other digital content
Practical and legal issues
Where is your data?
What IP laws are there to protect your data where it is stored?
Processing data outside the EEA?
Who owns any newly created IP rights?
Database rights
Copyright
Bespoke software (APIs)
GUIs
Applicable law
Practical and legal issues
How secure is your data?
Which personnel can access your data? Subcontractors?
Who else shares the server(s) on which your data is stored?
Disaster recovery
Who else has access to your data?
Individuals
Governments
Other 3rd parties
Can you recover losses in the event of a security breach?
Regulatory fines
PR damage
Internal costs dealing with fall out
Practical and legal issues
Liability for IP infringement
Infringing service
Liability of the Cloud customer
Liability of the service provider
Infringing content/data
Liability of the Cloud customer
Liability of the service provider
Software licensing
Do you have the right to have a third party host your applications?
What are the cost implications?
How to protect yourself
Mostly a question of contractual protections
Cloud service contracts are often click-wrap contracts – no negotiation?
Pro-service provider
Commonly derived from a B2C style contract
Might not be appropriate for sensitive IP assets
Need to consider on a case by case basis
Evaluate nature of assets going in the Cloud and negotiate the contract appropriately
What service are you paying for?
Are you hiring a bus, a Rolls Royce or an armoured car?
What you should be looking for/things to consider
Ownership of IP rights
Disclaimers/limits on liability
Indemnities
IP infringement
Unauthorised disclosure of data
Rights to specify location of data
Tier 1, Tier 2, Tier 3 data centres
Dedicated server(s)?
Approval of sub-contractors/other personnel
NDA obligations
Audit rights
Re security measures and access
Post term return of data
How quickly
Format
Personal use
No general “fair use” exception
“Time Shifting” - s70 of CDPA
“making in domestic premises of for private and domestic use of a recording of a broadcast … solely for the purpose of enabling it to be viewed or listened to at a more convenient time does not infringe the copyright in the broadcast”
Obvious application to video recorders, recordable DVDs, set top boxes
What about Cloud services such as network PVRs?
“Space Shifting”
Record in one place, view from another. Personal copying?
s70 may apply
Again, what about network PVRs
2 key copyright issues – reproduction and communication right
New private copying exemption came into force 1 October 2014
“Format Shifting” already tolerated by content industries in practice
New s28B CDPA will permit:
Personal copy of work by an individual
For private non-commercial use only
How will this be applied in context of network PVR services?
ITV vs TV Catch Up
Live streaming of free to air TV over the internet
March 2013 ECJ ruled streaming did constitute a new ‘communication to the public’ and therefore required authorisation
But s73 CDPA exception for live retransmission by cable of PSBs broadcasts
TV Catch UP has now also launched cloud based on demand catch up functionality
Watch this space
Capitol sued
music file was migrated not reproduced
Any distribution was non-infringing because of available defences?
Fair use doctrine
First sale doctrine (ie exhaustion)
Court held
Reproduction right infringed
“when a user downloads a digital music file or digital sequence to his hard disk, the file is reproduced on a new phonorecord within the meaning of the Copyright Act”
“Significantly, [reproduction] is not defined as ‘to produce again while the original exists’”
Distribution right infringed
“electronic file transfer is plainly within … the definition of “distribution”
ReDigi did not contest this
Regarding ReDigi’s defences, Court held:
Fair use
Uploading music files to Cloud Locker for personal use (“space shifting”) was within fair use doctrine – not contested by Capitol
However, uploading music files incident to sale was outside the scope of fair use – use is commercial in nature and deprives content owner of commercial value
First sale
First sale doctrine applies to distribution “by the owner of a particular copy or a phonorecord … of that copy or phonorecord”
Or, first sale doctrine applies to material items
New technologies/business models mean new patent wars – follow the money
Cloud service providers want to protect their services
Copyright
Patents
Jurisdictional issues
Patents are territorial in nature
Consider a UK patent covering a Cloud service
UK patent covers server side and client side aspects of a Cloud service
Competing service operated from US
UK users use competing service
Can the UK patent owner sue the US competitor?
s60 Patents Act 1977
s60(1) provides that a UK patent is infringed only if a person does any of the following acts in the UK
Makes, disposes of, uses or imports the product covered by the invention
Uses the process covered by the invention or offers it for use in the UK
Disposes, uses or imports any product obtained by means of a process covered by the patent
s60(2) deals with secondary infringement
Supplies or offers to supply in the UK a person with the means of putting the invention into effect in the UK
Options for the UK Cloud provider (patent owner)
Sue the users
Direct infringement: is the user using the patented invention in the UK?
Might not be particularly attractive
Sue the competitor
Direct infringement: joint liability with user?
Direct infringement: use of server side aspects of patented invention, but is it in the UK?
Indirect infringement: does supply of client side software amount to supply of essential means?