Introduction
The Digital Economy Act 2010 (C.24) received Royal Assent on 8 April 2010. It is intended to take forward some of the recommendations which were contained in the Digital Britain: Final Report (Cm 7650) published in June 2009.
All information professionals concerned about copyright infringement problems arising from internet use should consider the Digital Economy Act (DEA) which crept in as part of the Parliamentary “wash-up” process before the election. Perhaps that should just be “all information professionals” given the far reaching implications of the DEA. Copyright in digital material is only one of a list of diverse topics covered by the Act, ranging from the switch-over to digital radio to the classification of video games, but what it sets out to do about online copyright infringement is very significant. P2P (Person to Person) file-sharing is presumably the main target of the legislation, but it is couched in more general terms which could cover any internet-based infringement of copyright.
Communications Act 2003
The DEA creates a series of new sections (124A to 124N) to be inserted in the Communications Act 2003 and these sections contain a web of new duties and procedures. In this article I will refer to the legislation using those section numbers. The complexity of the drafting makes it difficult to summarise the DEA, but these are some of the main strands:
New duties for Internet Service Providers (ISPs)
There is a new duty on internet service providers to co-operate with copyright owners in identifying and pursuing “apparent infringements” of their copyright, using a new and carefully designed procedure.
The “Copyright Infringement Report” or CIR is the starting point. It is the vehicle for copyright owners who are monitoring possible breaches of their copyright on the internet to inform the relevant ISP of apparent infringements. The ISPs then have a duty to notify those subscribers who appear to be the guilty parties in the alleged infringement.
ISPs also have a new duty to maintain details of “apparent infringements” reported to them by copyright owners and to provide anonymised lists to the relevant copyright owners when requested. To be included in the list a subscriber must have reached a certain threshold in terms of repeated alleged copyright breaches.
The record keeping and reporting of potentially infringing acts will be based initially on internet protocol addresses. There is provision for copyright owners to apply for a court order to oblige the ISPs to identify the individual subscribers in serious cases.
New responsibilities for Ofcom and the Codes
Ofcom has also been handed an extensive set of responsibilities concerned with administering and enforcing the new procedures, including awarding compensation (up to a maximum of £250,000). Although the Act seems to be highly detailed at first glance, it is necessarily vague in some respects because the legislation requires a new Initial Obligations Code to spell out the really specific details, such as how long the ISPs should retain the information on their subscribers and the thresholds for entering the list of apparent infringers.
There are also new procedures for “Technical Obligations” to restrict the internet access of subscribers if it seems justified, subject to a future decision by the Secretary of State. Should he make such a decision, Ofcom would then be required to establish a Technical Obligations Code to control the use of the approved technical measures.These measures could limit internet access by speed or capacity or by limiting access to certain material, but could also result in complete suspension of service. The wording is very open-ended in the Act [124G].
Among the other areas of responsibility for Ofcom under the DEA:
• Procedures for subscriber appeals
• Safeguards for data protection
• Measures for sharing the costs of the new regime between ISPs, copyright owners and subscribers
• Monitoring and reporting trends in online copyright infringement
• Measuring the effectiveness of the new duties placed upon ISPs in addressing infringement
• Policing the accuracy/effectiveness of the technical procedures of both the copyright owners and the ISPs.
Initial Obligations Code
Under the terms of the DEA, Ofcom must either approve the new code (if written by someone else) or must produce it. It is clear that the Initial Obligations Code is absolutely vital to the practical application of the Act.
The DEA requires that the Code is implemented within eight months of Royal Assent, ie by January 8th 2011. This period includes obtaining approval from the European Commission.
In the event, Ofcom have been quick off the blocks with their snappily titled Online Copyright Infringement Initial Obligations Code, published at the end of May for consultation until 30th July, http://www.ofcom.org.uk/consult/condocs/copyright-infringement/
This Code is the essential first step in applying the measures to tackle online breach of copyright in the DEA. It provides the ground rules for a new system and fills in the details left open by the DEA itself. In the following account references to “the Code” mean the draft Initial Obligations Code and the numbering refers to numbered sections within the draft code.
The Code creates a carefully defined channel for copyright owners to require co-operation from internet service providers when it appears to the copyright owner that they have evidence of infringement by a subscriber of the ISP.
Evidence of infringement, rather than proof, is all that is required for your IP address to find its way into this new system, but there are checks and balances to protect the individual subscriber. Here is a summary of some of them:
1. Only “repeat offenders” will end up on the Copyright Infringement List, which can be requested from the ISP by the copyright owner. The first copyright infringement report from the copyright owner to the ISP triggers a notification to the subscriber. More CIRs may follow if infringing acts continue and any CIR sent to the ISP one month after the first notification triggers a second notification to the subscriber. One month on from the 2nd notification, if a further CIR is received by the ISP that will trigger a third, more forcefully expressed notification and significantly, the subscriber will be added to the ISP's list of apparent infringers. The subscriber's details will then be included (in an anonymised form) in the Copyright Infringement List which the ISP is obliged to provide to the rights owner when requested.
2. In order to obtain your personal details, as opposed to a list of IP addresses, the copyright owner will need a court order.
3. How reliable will the information be? The mistaken targeting of subscribers as apparent infringers looks like an obvious possibility. Ofcom have anticipated that danger with their requirement for an annual Quality Assurance Report (Code 4.4) from the copyright owners in relation to their technical processes.
“For the notification process to be credible, effective and fair for consumers it is essential that the allegations of copyright infringement are evidentially robust and accurate”
A Quality Assurance Report is also required from the ISPs in relation to their listing of apparent infringers and matching IP addresses to individual subscribers. Both can be required to improve their methods by Ofcom if they are judged to be inadequate. Ofcom can also insist on audits by an independent third party if it decides to do so. Perhaps this should rather be a firm requirement?
Naturally this quality control approach cannot be presumed to eliminate mistakes. In all likelihood some subscribers will still receive incorrect notification that they are responsible for copyright infringement.
4. There will be a separate body established to receive appeals from subscribers who feel that they have been wrongly targeted. ISPs will also be able to reject CIRs which are unsatisfactory for a number of possible reasons which are listed (Code 5.3).
Where do libraries stand?
What seems less well thought through is the place of libraries and other providers of wi-fi access in the new landscape. It seems possible that we could be regarded as ISPs if we provide internet access to clients. The range of services which could be defined as ISPs is discussed at length in the draft Code, sections 3.19 – 3.28. In the Act the definition is broad: “internet service provider - a person who provides an internet access service” (Section 124N of the Act). As the Code says, this could cover everyone from BT to Starbucks by way of community wi-fi access.
If this definition catches libraries, then the new duties of ISPs would also apply. Initially it is clear that those duties will not apply, as Ofcom has decided to apply the new measures to the big players, fixed ISPs with more than 400,000 subscribers, the likes of BT, Orange and Virgin. This could be extended to cover other categories of ISPs if judged necessary by Ofcom at some point in the future so, even if we are ISPs, for the moment we are not “qualifying ISPs” but this could change.
To be an ISP you also need to have “an agreement” with your subscribers, so in principle some libraries could be judged to be ISPs, whilst others are not. In any case is it preferable to be an ISP, “subscriber” or a “communications provider”? As subscribers we could receive copyright infringement reports and find ourselves listed on a copyright infringement list supplied to the copyright owner as a result of the alleged infringing activities of our clients. How much control are we able to exercise over that? If we are subscribers the provisions in the draft Code, if adopted as they stand, would apply to libraries immediately.
The draft Code leaves us with a considerable degree of uncertainty as to where libraries or other providers of wi-fi internet access, from cafes to rail companies will stand in relation to the new duties created by the DEA.
The draft Code includes standard letters of notification to subscribers suspected of infringement (Annex 6 to the draft Code) and some useful FAQs intended to assist those subscribers in understanding the reasons for the notification and the implications.
Who picks up the bill?
As a general point it is clear from the legislation that the Government is keen for the costs of the new process to be met, collectively, by the parties involved: copyright owners, ISPs and to a limited extent subscribers. This is of course very significant for libraries because if they are caught by the new process they may find there is a substantial financial burden. Points to note:
Appeals
The consultation leaves open the suggestion that subscribers who feel that they have been wrongly identified as infringers will have to pay an up-front fee to use the appeals process. Ofcom seem to be sensitive to the need to make the appeal route readily accessible to people who feel they have been wrongly accused, while cautious about the possibility of everyone appealing if there is no cost. (Code 7.14).
Cost sharing
A separate consultation by the Department for Business Innovation and Skills on sharing the costs of the new process has already taken place, including a draft statutory instrument under section 124M of the Act, http://www.bis.gov.uk/assets/biscore/business-sectors/docs/10-915-consultation-online-infringement-of-copyright.pdf.
The Government may follow up on the results as early as July.
The basic concept is that the copyright owners will have to pay the ISPs for the cost of processing copyright infringement reports (CIRs) storing that information, sending notifications to suspected infringers among their customer base etc. The rights owners will need to specify in advance how many CIRs they expect to send to a given ISP over the course of a year and pay a fee per CIR up front, that fee having been set by Ofcom. The costs incurred by Ofcom will be shared by the ISPs and copyright owners in the ratio of 75 (Rights owners): 25 (ISPs). Naturally copyright owners will be responsible for all their own expenses in investigating and reporting apparent infringements.
Extrapolating from this information it is clear that the procedure is designed to assist those rights holders with a really serious financial interest in preventing misuse of their intellectual property via the internet, such as record companies and video games publishers, large commercial organisations who will be prepared to invest a substantial amount in order to reduce even more substantial loss of income through P2P file sharing and the like.
The new procedure is unlikely to be of much help to a rights owner with smaller resources who wishes to take action in response to a perceived infringement of their rights. On the other hand, the DEA does not of course remove any of the existing legal remedies which are open to rights owners. An interesting point in itself from the perspective of libraries as potential “ISPs” or “subscribers” in that they may already have the expense of addressing rights owner approaches using existing remedies and any burdens placed on them by the DEA will be additional.
Where do we go from here? Likely timetable
According to the existing timetable the draft Code is to be followed by two further consultations, the first on the enforcement of the Code and resolving industry disputes in July and the second on tariff setting and cost sharing (which is dependent on the outcome of the consultation on the draft cost sharing SI) in September.
The Initial Obligations Code itself, once finalised, needs to be approved by the European Union Standards and Technical Regulations Committee. This could take three months (September to December 2010). Then the Code could be in force at an early point in 2011 following final approval by Parliament.
If at some point in the future “technical measures” are introduced to limit or curtail the internet access of repeat offenders (strictly speaking, apparent offenders), then further consultations will be necessary including a system of appeal to a “First tier tribunal”. This would need a ministerial decision and can only happen after the Initial Obligations Code has been in operation for at least one year.
The bonfire of the quangos?
Needless to say the DEA is the brain child of the previous government. It remains to be seen how keen the new coalition government is to continue with the implementation of its complex provisions. This may have implications for the timetable even if not for the survival of the new process to address digital copyright infringement.
What should libraries be doing?
It seems that libraries, along with the cultural sector generally, and other organisations offering wi-fi access, are unlikely to be drawn into the new procedures as “qualifying ISPs” when the Code first comes into force. The reason for this is that the stated intention of Ofcom is to target the big and more obvious ISPs initially.
Nevertheless there is plenty of reason for concern: The discussion in the draft Code makes it very clear that there is a lot of fluidity (indecision?) about the actual status of libraries and other organisations offering wi-fi access under the terms of the Code. Also if we are indeed “ISPs” then Ofcom could decide to extend the provisions of the Code to cover libraries at some future time. There is certainly an assumption that libraries will be caught by the definitions in the Code (arising from the Act) in some capacity and that could have serious financial and other implications.
Section 3.28 of the Code refers to libraries specifically as potential ISPs, along with pay as you go mobile broadband operators. It notes that as things stand they do not necessarily keep the required information on their individual subscribers in order to comply with the Code if the scope is widened by Ofcom to include them as qualifying ISPs. The conclusion of Ofcom is that if and when they are included they must start keeping that data to be compliant.
Conclusion
Given that the draft Code is up for consultation until the end of July there is time (at the time of writing) for library organisations to submit responses to Ofcom and this would seem highly advisable. As the BIALL representative on LACA (the Library and Archives Copyright Alliance) I know that LACA intends to submit a response.
The most pressing need it seems to me is for more clarity under the Code about the role of libraries in offering wi-fi access and perhaps some recognition of our special status, so that we are not caught up in cumbersome measures designed to curb large scale copyright infringement which are not appropriate to the nature or scale of the services we offer to our clients.
That is not to say of course that there may not be other serious issues with the Code that we may also wish to discuss in a response to the consultation, given the specific insights we can bring to bear as information professionals.
