Sections of this issue:

ISP-Liability & Media Law

• Brussels Court of Appeal rules Google News and Google's cached web search should obtain prior approval before storing or displaying news articles
• Further clarification of Internet Service Providers' (ISPs) liability as the Court of Justice of the European Union (CJEU) issues its decision in the "L'Oréal v. eBay" case. At a national level the Antwerp Court of Appeal rules in the "The Pirate Bay" case

Privacy & Data Protection

• Opinion of the Article 29 Working Party on the definition of "consent"

Contracts & E-Commerce

• Competition inquiries into Google's practices: an update

---

ISP-LIABILITY & MEDIA LAW

Brussels Court of Appeal rules Google News and Google's cached web search should obtain prior approval before storing or displaying news articles

On 5 May 2011, the Brussels Court of Appeal largely confirmed a ruling of 13 February 2007 issued by the President of the Brussels Court of First Instance, finding Google guilty of and ordering it to cease copyright violations committed through its Google News and Google Search caching services. The Court of Appeal held, as did the first judge, that Google, when displaying titles and extracts of news articles via its Google News service and/or when copying news articles to its cache memory and making them available to internet users from that memory, it could not benefit from any of the exceptions provided for by the Belgian Copyright Act, nor from any of the intermediary liability exemptions provided for by the e-commerce Act. The Court's ruling i.a. raises the question of whether such strict legal requirements of explicit prior consent for news extracts are still compatible with today's fast-moving internet environment and the fact that users are increasingly accustomed to having immediate access to rapidly changing and updated news facts.

Background of the case

The original Plaintiffs in these proceedings (the Respondents on appeal) were three copyright collecting societies, namely Copiepresse (representing Belgian Francophone and German-language editors), the Société de droit d'Auteur des Journalistes (SAJ) (representing the corresponding journalists) and Assucopie (representing scholars and other scientific and/or university authors).

The original Defendant and Appellant in the appeal proceedings, Google, is of course very well-known as being the world's leading search engine of which the mission statement is « to organize the world's information and make it universally accessible and useful ». In order to achieve this mission, Google has been offering a free web search service ever since its creation in 1998. Of course, it is not possible for Google's robots to search the whole of the internet in real time at any given moment an internet user enters a search term, so the search is actually performed on Google's servers, where snapshots of web pages taken at the time they were indexed are stored (in Google's cache memory). That could mean the copy of the page accessed is either minutes or months old, depending on when Google last crawled (i.e. automatically downloaded and indexed) it. Using these cached links, users can hence access almost any web page, including web pages that are no longer available on the original web site at the time of the search request.

In addition to its original and best known web search service, Google's services have been extended over the years to include Google Finance, Google Maps, Google Images, Google Videos, Google Books, Google Blog Search, Google Product Search, Google Groups and Google News.

This last service, targeted in the proceedings before the Court of Appeal, is a fully automated news aggregator which scans a vast number of news publications found on the Internet and sorts them, by relevance, into different categories. Google then shows these results on Google News' main page (customizable by users) and in news-specific search results. The following information is displayed: the title of the article, the first two or three lines, its author (sometimes), the source and (usually) a small picture taken from the article. Users wishing to read the complete articles can then click on the title or the picture displayed by Google News, which in principle activates a "deep link" to the original web page.

Again, however, web searches are not performed in real time but in Google's cache memory. And although the main purpose of this cache function is to display websites that might temporarily be inaccessible, it also gives users the possibility to view pages that have been removed from the Internet, such as news articles that have been deleted from the site on which they were originally published or news articles that have become accessible only after the payment of a subscription fee.

The claimed violation of economical and moral rights

According to Respondents' members and the Court of Appeal, the Google News service makes the newspapers less attractive for subscribers, which in turn causes the newspapers to lose advertisers' interest. Indeed, in their view, the title and first few lines of a news article as featured in Google News together constitute the eye-catcher and take away the reader's need to actually consult the newspaper('s website) for the article itself. In addition, in Google's cache memory, access to the news articles as initially posted on the publisher's website remained possible for free for 30 days, while this might not have been the case on the publisher's website. In short, this is why the Google News service could not benefit from any of the "citation" or "current news" exceptions contained in the Belgian Copyright Act nor from the "caching" exemption as provided for in the e-commerce Act. Moreover, and in addition to this violation of the authors' economical rights, the Court also found that Google News had infringed upon the authors' moral rights by failing to always mention the name of the author of the news article and by modifying the article when only an excerpt was displayed.

Discussion and conclusion

As the content displayed on Google News was copyright protected (this was at least not contested), Google was not allowed to reproduce it or communicate it to the public without having obtained the prior explicit and written consent of the authors and right holders concerned.

However, and although the Brussels Court of Appeal was of a different opinion, Google could have arguably benefited from the Belgian Copyright Act's "citation" exception, according to which the citation of part of a text, picture or drawing is permitted without prior consent as long as:

• the information has been published by the author (which was always the case for Google News);
• the citation is short (not defined in the Copyright Act, but several lines of text and/or a picture should be acceptable);
• the citation is made for the purpose of criticism, polemic discussion, education or in the framework of scientific research (education and/or discussion purposes are arguably Google News' goal(s));
• the citation is made in good faith, i.e. in conformity with professional rules and justified (arguably the case);
• the citation expressly mentions the source and name of the author (Google News always mentioned the source and sometimes the author).

In any case, even if one would agree that the "citation" exception does not apply to Google News, the question remains whether the prior written approval mechanism of the Belgian Copyright Act is desirable or even practically feasible in an internet context. Indeed, it may well be possible for Google to sign a flat-fee licensing deal with Copiepresse, SAJ and Assucopie in Belgium, but what about all the other collecting societies and all of the independent, unaffiliated authors and publishers of this world ? And what about the authors' moral rights, which are inalienable and hence cannot be transferred to the publishers ? Can any author then simply ask Google to stop displaying his or her article at any given point in time despite agreements made with and payments made to collecting societies ? And what about users' access to information in certain case, e.g. when authors change their minds or certain licensing deals fall through ?

Another important question is whether copyright actions such as the ones at issue may not actually be counterproductive in the end, even for the publishers and authors themselves. Indeed, the fact that (excerpts from) news articles can be easily found via Google and Google News, thus reaching hundreds of millions of internet users, is undeniably a source of publicity and revenue for the articles' authors and publishers. If their excerpts are not displayed on Google news and their web pages are not reproduced in Google's cache memory (what they are asking), these might not be readily available for users at all, since (as explained above) real time searches are not feasible in practice. Actually, this is what happened as of mid July 2011, when Google removed material belonging to Copiepresse's members from its index – not just from Google News – arguing that this was necessary in order to comply with the Court's judgment (removal from its cache memory). This was met by heavy protest on the part of Copiepresse's members, after which the material was restored to Google's indexing system. So it appears that the right holders do want Google reproducing their content on its servers for a certain period of time, but where to draw the line ?

In the end, it may well be that news publishers and authors are harming themselves when asking for strict prior consent rules to be enforced, much in the same way the music industry did by combating instead of embracing certain features of the online environment because of their challenge to the traditional business methods used. Nowadays, thousands of news items and articles are posted on the internet every day by users of Facebook, Twitter, netlog, etc., thereby effectively rendering this kind of repressive actions virtually moot. Moreover, what is happening now is that Google News simply displays excerpts from news articles in the same language (French and German), on the same topics, but not from publishers belonging to the copiepresse, SAJ or Assucopie societies, which may well have a detrimental impact on their members' future.

In conclusion, it would seem that the ruling of the Court of Appeal may have all too easily concluded that Google, especially seen its financial capabilities, should simply "buy blanket licenses from the Respondents for reproduction and communication to the public", without in any way attributing much importance to the added value of Google's free of charge indexing and news referencing system as well as to the internet's specific and particular dynamics.

References: Bruxelles (9ème chambre),5 mai 2011, not yet published

Links:

• Text of the Brussels Court of Appeal's ruling on www.scribd.com.
• Copiepresse news: a Pyrrhic victory? By Flip Petillion [PDF]

For more information, contact: Flip Petillion.

---

ISP-LIABILITY & MEDIA LAW

Further clarification of Internet Service Providers' (ISPs) liability as the Court of Justice of the European Union (CJEU) issues its decision in the "L'Oréal v. eBay" case. At a national level the Antwerp Court of Appeal rules in the "The Pirate Bay" case.

The CJEU decided on July 12, 2011, that operators of an online marketplace that provide assistance to their users which entails, in particular, optimizing the presentation of the offers for sale or promoting them, will not benefit from the exemption from liability for "hosting providers". According to the CJEU decision this will also be the case if the operator failed to act expeditiously with regard to offers of which it had knowledge and of which "a diligent economic operator" would have realized that they were unlawful. National courts must be able to order the operator of an online marketplace to take measures which contribute to preventing further infringements of that kind. However, those injunctions must be effective, proportionate and dissuasive and must not create barriers to legitimate trade. In its ruling of September 14, 2011, the Antwerp Court of Appeal applied these principles in a mere access context and required Telenet and Belgacom, 2 Belgian internet access providers, to block the access to 11 specified domain names. The Court expressly stated that Telenet and Belgacom are deemed to comply with the order as soon as the blocking measure is implemented.

I. L'Oréal v. eBay

A. Background

1. For the background of the L'Oréal v. eBay case, we refer to our Newsletter of May 2011.

B. Questions relating to ISP liability

1. The exemption of Article 14(1) of Directive 2000/31

The question raised by the UK High Court to the CJEU was whether the service provided by ane operator of an online marketplace is covered by Article 14(1) of Directive 2000/31, i.e. "hosting", and, if so, in what circumstances it may be concluded that such operator has 'awareness' of illegal information within the meaning of Article 14(1) of Directive 2000/31.

The CJEU first confirmed that an internet service consisting in facilitating relations between sellers and buyers of goods can, in principle, qualify as an information society service within the meaning of Directive 2000/31. However, the fact that the service provided by the operator of an online marketplace includes the storage of information is not in itself a sufficient ground for concluding that that service falls, in all situations, within the scope of Article 14(1) of Directive 2000/31 ("hosting"). Indeed, this will not be the case when the service provider, instead of confining itself to providing its service neutrally by a merely technical and automatic processing of data, plays an active role of such a kind as to give it knowledge of, or control over, those data (cf. also Google France and Google, paragraphs 114 and 120). For example, where an operator provides assistance which entails, in particular, optimizing the presentation of the offers for sale in question or promoting those offers, it must be considered not to have taken a neutral position.

According to Article 14(1) of Directive 2000/31, the provider will be exempted from liability for unlawful data that it has stored on condition that (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.

With regard to the concept of 'awareness' in the context of claims for damages, the CJEU stated that it is sufficient, in order for the ISP to be denied entitlement to the exemption from liability, for it to have been aware of facts or circumstances on the basis of which a diligent economic operator should have identified the illegality in question and hence should have acted in accordance with Article 14(1)(b) of Directive 2000/31.

According to the CJEU, this covers in particular the situation where the ISP uncovers itself illegal information as well as the situation where the operator is notified of such information. However, a notification cannot automatically preclude the exemption from liability, given that the notification may turn out to be insufficiently precise or inadequately substantiated. Nonetheless, such notification represents a factor of which the national court must take account when determining, in the light of the information transmitted to the operator, whether the latter was actually aware of facts or circumstances on the basis of which a diligent economic operator should have identified the illegality.

2. Injunctions against the operator of the online marketplace

The High Court furthermore asked the CJEU whether injunctions may be issued against the operator of a website requiring the latter to take measures to prevent future infringements of certain rights, and, if so, what those measures might be.

The CJEU first considered that national courts must be allowed to order an ISP, such as operators of online marketplaces, to take measures that contribute not only to bringing to an end infringements committed through that marketplace, but also to preventing further infringements.

As to the measures that can be imposed thereto, the CJEU first reminded that an active and general monitoring obligation cannot be imposed. Further, the measures must also be (i) fair and proportionate, (ii) may not be excessively costly and (iii) may not create barriers to legitimate trade. Despite these limitations, however, injunctions which are both effective and proportionate may be issued against ISPs such as operators of online marketplaces. This means that, if the operator of the online marketplace does not decide, on its own initiative, to suspend the account of the infringer in order to prevent further infringements of that kind by the same user in respect of the same trademarks, it may be ordered, by means of an injunction, to do so.

II. The Pirate Bay

In 2010, the Belgian Anti-piracy Federation (BAF) initiated proceedings against Telenet and Belgacom, the two largest internet access providers in Belgium, to block the access to several websites of The Pirate Bay. Through these websites, users are able to download and share copyright protected material. In July 2010, the Antwerp Court of First Instance dismissed BAF's claim because, among other reasons, the requested measure of DNS-blocking could be easily circumvented by the users of The Pirate Bay (e.g. by using another DNS-server). The case was then brought before the Court of Appeal of Antwerp.

This Court of Appeal first considered that issuing an injunction against internet access providers to block a certain website does not affect their ability to benefit from the exemption from liability as set out in Article 12 of Directive 2000/31 ("mere access"). As the providers merely have to block the access to a certain website, they do not become liable for the information that is transmitted through their network. Moreover, blocking the access to specific websites does not imply a monitoring obligation by the ISPs. Once implemented, ISPs are not required to verify whether subscribers still have access to the blocked websites or not.

The Court of Appeal furthermore considered that the measure that it imposed should be proportionate and should be feasible to the ISPs, at acceptable costs. The measure should, however, contribute to bringing an end to the infringements committed by the users of the websites of The Pirate Bay. According to the Court of Appeal, even though a blocking measure may not render every infringement impossible, it will contribute to limiting the number of infringements.

On the basis of these considerations, the Court of Appeal decided to impose a DNS-blocking measure on Telenet and Belgacom with regard to 11 website addresses of The Pirate Bay. The injunction is limited to these specific addresses and Telenet and Belgacom do not have an obligation to search for other websites under which The Pirate Bay is available to its users. Also, the Court expressly stated that Telenet and Belgacom complied with the order as soon as the blocking measure is implemented.

III. Conclusions

Both the CJEU and the Antwerp Court of Appeal confirmed that measures imposed on ISPs must be (i) fair and proportionate, (ii) may not be excessively costly and (iii) may not create barriers to legitimate trade. Active and general monitoring obligations are excluded. Preferably, injunctions consist of technical measures that are clearly specified and can be easily implemented at a modest cost.

For more information, contact: Karel Janssens.

---

PRIVACY & DATA PROTECTION

Opinion of the Article 29 Working Party on the definition of "consent"

On July 13, 2011, the Article 29 Working Party adopted an opinion (the "Opinion") on the definition of "consent" as used in Directive 95/46/EC (the "Data Protection Directive") and Directive 2002/58/EC (the "e-Privacy Directive"). Consent is one of several legal grounds that can be invoked to validly process an individual's personal data.

The Opinion at the one hand provides an analysis of the concept of consent as currently used in the Data Protection Directive and in the e-Privacy Directive. This useful analysis lists the different elements and requirements necessary for consent to be valid under applicable law so that it can be used as a basis for the processing of personal data.

The opinion also provides input and recommendations to the Commission in the context of the ongoing review of the Data Protection Directive.

1. After an overview of the legislative history and role of consent in data protection legislation, the Opinion first examines the different elements and requirements for consent to be valid under applicable law, illustrated with practical examples based on national experiences.
In short, the existing legal framework described in the Opinion is based on the following articles of the Data Protection and e-Privacy Directives:

• Article 2 (h) of the Data Protection Directive defines consent as "any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed".
• Article 7 of the Data Protection Directive, sets forth the legal basis for processing personal data, and sets out unambiguous consent as one of the legal grounds.
• Article 8 requires explicit consent as a legal ground to process sensitive data.
• Article 26.1 of the Data Protection Directive and various provisions of the e-Privacy Directive require consent to carry out specific data processing activities within their scope of application.

2. The Opinion aims at clarifying these various elements of the existing legal framework, illustrated by useful practical examples. At the end of its analysis, the Article 29 Working Party i.a. comes to the following conclusions:

• For consent to be valid, it must be freely given (cf. article 2 (h) of the Privacy Directive).
  
  According to the Opinion, this means that there must be no risk of deception, intimidation or significant negative consequences for the data subject if he does not consent. As such, data processing operations in the employment environment where there is an element of subordination, as well as in the context of government services such as health may require careful assessment of whether individuals are free to consent.

• Consent must be specific (cf. article 2 (h) of the Privacy Directive).
  
  The Opinion states that blanket consent without determination of the exact purposes does not meet the threshold. The Opinion finds that rather than inserting the information in the general conditions of the contract, this calls for the use of specific consent clauses, separated from the general terms and conditions.

• Consent must be informed.
  
  Articles 10 and 11 of the Data Protection Directive list the type of information that must necessarily be provided to individuals. The information provided must be sufficient to guarantee that individuals can make well informed decisions about the processing of their personal data. The need for consent to be "informed" translates into two additional requirements.
  
  First, the way in which the information is given must ensure the use of appropriate language so that data subjects understand what they are consenting to and for what purposes.
  
  Second, the information provided to users should be clear and sufficiently conspicuous so that users cannot overlook it. The information must be provided directly to individuals. It is not enough for it to be merely available somewhere.

• Explicit consent is required to process sensitive data (cf. article 8 of the Privacy Directive).
  
  According to the Opinion, this means an active response, oral or in writing, whereby the individual expresses his wish to have his personal data processed for certain purposes. Therefore, express consent cannot be obtained by the presence of a pre-ticked box. The data subject must take some positive action to signify consent and must be free not to consent.

• For personal data other than sensitive data, consent should be unambiguous (cf. article 7 of the Data Protection Directive).
  
  According to the Opinion, unambiguous consent calls for the use of mechanisms to obtain consent that leave no doubt as to the individual's intention to provide consent. In practical terms, this requirement enables data controllers to use different types of mechanisms to seek consent, ranging from statements to indicate agreement (express consent), to mechanisms that rely on actions that aim at indicating agreement. According to the Opinion, consent based on an individual's inaction or silence would normally not constitute valid consent, especially in an on-line context.

• Reliance on consent to process personal data does not relieve the data controller from his obligation to meet the other requirements of the data protection legal framework, for example, to comply with the principle of proportionality.

Some of these conclusions (i.a. with respect to obtaining consent via general terms and conditions or via the individual's inaction or silence) constitute a rather severe view of applicable laws. In our opinion, applicable laws should be interpreted in a pragmatic sense and cannot make it impossible or very hard for companies, who do comply with privacy laws on a common sense basis and make a reasonable analysis of the balances of interest between the company and the data subject, to perform their business.

3. With respect to the input and recommendations to the Commission in the context of the ongoing review of the Data Protection Directive, the Article 29 Working Party considers that the current data protection framework contains a well thought out set of rules that establish the conditions for consent to be valid in order to legitimize data processing operations. In practice however, establishing when consent is needed and more particularly the requirements for valid consent, including how to apply them concretely, is not always easy because of a lack of uniformity across Member States.

The Article 29 Working Party therefore i.a. lists the following possible changes to the Data Protection Directive:

• The Article 29 Working Party considers that the wording "unambiguous" would benefit from further clarification as a part of the revision of the general data protection framework. According to the Article 29 Working Party, clarification should aim at emphasizing that unambiguous consent requires the use of mechanisms that leave no doubt of the data subject's intention to consent. At the same time it should be made clear that the use of default options which the data subject is required to modify in order to reject the processing (consent based on silence) does not in itself constitute unambiguous consent. This would be especially true in the on-line environment.
• The Article 29 Working Party is not convinced that the legal framework should require explicit consent as a general rule for all types of processing operations, including those currently covered by article 7 of the Data Protection Directive. It considers that unambiguous consent which encompasses explicit consent but also consent resulting from unambiguous actions should remain the required standard. This choice would give more flexibility to data controllers to collect consent and the overall procedure may be quicker and more user friendly.
• With regard to individuals lacking legal capacity, such as minors, provisions ensuring enhanced protection could be foreseen (such as requiring online age verification mechanisms and information that is understandable to children). Consent should not provide a basis for targeting underage consumers in the context of online behavioral advertising.

Links: A copy of the Opinion can be found at:
The Article 29 Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data protection and privacy. Its tasks are described in Article 30 of Directive 95/46/EC and Article 15 of Directive 2002/58/EC.

For more information, contact: Frederik Van Remoortel.

---

CONTRACTS & E-COMMERCE

Competition inquiries into Google's practices: an update

In November 2010, the European Commission opened an investigation regarding whether Google is abusing the power it holds on the internet search and advertising markets. The Commission is determining whether the company holds a dominant position in the relevant markets, but has not yet reached a conclusion. In the meantime, several companies have tried to stand up against Google's practices by initiating proceedings with the national Competition Authorities or Courts. However it appears, at least from the recent developments in France and Germany, that proving Google's alleged abusive behavior is not an easy task.

Recent judgments of the Commercial Court of Paris

At the end of 2010, the French Competition Authority published the results of an inquiry relative to the operation of competition in the online advertising sector (see previous coverage here). Even though the Authority concluded that Google holds a dominant position on the advertising market linked to search engines, it did not amount to a formal finding against the company.

Several companies have therefore tried their luck by initiating judicial proceedings against Google. However, in three recent judgments, the Commercial Court of Paris dismissed the allegations of website developers Webdeviin, Telemaque and E-Kanopi, arguing that Google abused its dominant position on the market for online advertising. The proceedings at hand were initiated when Google decided to cancel or temporarily suspend the developers' advertising accounts, which it deemed in breach of the Google Adwords contract terms. While the reasons behind the suspension of the accounts varied from case to case, the three companies argued that this blockage jeopardized their viability on the market, and highlighted their dependence on Google to survive.

Yet, in all three cases, the judge – even though referring to the findings of the French Competition Authority in December 2010 – concluded that Google's move to block the publicity campaigns was justified and did not qualify as a "brutal", "discriminatory" or "abusive" termination of contracts.

According to the Paris Commercial Court, the serious breaches of the Adwords contract terms indeed legitimized the abrupt suspension by Google.

Several other cases, such as the damage claims of search-engine developer 1plusV and mapping company Navx, are currently still pending at the Paris court.

The German authority declines to take up antitrust complaints against Google

Also the German Competition Authority recently dismissed two antitrust complaints against Google. In 2010, Euro-Cities, a company that provides online maps, filed a first complaint with the Bundeskartellamt, claiming that Google abused its alleged dominant position. Certain aspects of this case were referred to the EU-level, and in particular the accusations over the preferential ranking of websites were included in the abovementioned investigation of the European Commission.

But the Bundeskartellamt retained the review of the predatory pricing allegations, namely whether Google's decision to offer its mapping services for free disadvantaged others – such as Euro-Cities – and is contrary to German competition law. However, the Authority decided to reject the complaint without opening formal proceedings against Google.

A second complaint was lodged by Euro-Cities in May 2011, accusing Google of entering into an anti-competitive agreement with directory-services provider Gelbe Seiten Marketing. However, also in this case, both the European Commission and the German Authority recently decided not to launch an investigation.