Exporting personal data I: introduction (and a small Brexit niggle)

Well, I'm back.

I hope to carry on blogging about the law from the slightly different perspective that I have adopted in the past. In particular, I want to try talking about some difficult questions that I come across while working with clients and which I can't help thinking about in my spare time. Thank you for helping me scratch that itch.

This post is just an introduction. If you are familiar with how the GDPR works, then you should skip to the bit about Brexit.

The export of personal data

I want to start by talking about the General Data Protection Regulation, or GDPR as it is affectionately known, which will have been in force for two years in May. In particular, I want to talk about the regime create by the GDPR for the international transfer of data. From a technical point of view, transferring data around the world is, thanks to the Internet, not only straightforward but often invisible. However, from a legal perspective it is not so simple.

The reason why the GDPR tries to control international transfers of data is simple to see. The GDPR's aim is to create a region of really strong protection for personal data in the European Union and the European Economic Area. If someone processing personal data could simply transfer it outside that region and do whatever they liked with it, it would be really easy to get around the GDPR. The protection it gives would be much less useful.

How exports are controlled

The GDPR divides the world into two parts: a "safe" part, which at the moment contains the EU and the EEA; and a potentially wild and dangerous part consisting of what are called "third countries". By the way, there is (as far as I have been able to discover) no formal definition of "third country" as you might expect. It seems to be understood to mean anywhere that isn't a member state of the EU or the EEA, but maybe other countries (eg the UK after Brexit) could escape being "third countries" in the same way as the EEA members have done.

By default, moving data from the safe part of the world to a third country is forbidden, unless one of a (long) list of conditions is met. I plan to look through some of these conditions over this blog series, but in a moment, I will give a brief summary of two that are particularly significant.

Adequacy

The European Commission can declare that a country has "adequate" protection. Even though the country is a mere third country, it has done enough to live up to the high standards set by Europeans and data may be exported there.

This is a sort of data imperialism, perhaps with the hope that European data protection law will dominate the world. Given the steadily increasing list of countries declared "adequate", this may be working.

But, a word of caution about adequacy. Adequacy decisions can be made that are limited to certain kinds of transfer. In other words, just because a country is in the list, does not mean that you can just export data there without further thought. A few countries, for example the United States and Japan have adequacy decisions that are limited in various ways.

For example, the United States clearly does not think that it has to play along with the EU's data protection rules but has set up a system known as the "Privacy Shield" which allows companies to opt into a lightweight version of the GDPR. The USA only counts as having "adequate" protection for transfer to companies who are members of the Privacy Shield. I will have quite a bit to say about the Privacy Shield in a later blog.

Standard Contractual Clauses

A very popular option is for the export and importer to sign an agreement which contains a set of standard clauses approved by the European Commission (or in theory by another regulator). These are, in essence, a promise by the importer that they will not take advantage of the fact that the data is now outside the "safe" part of the world to do evil and/or unspeakable things to it and that they will in all ways be good. The standard clauses are meant to be enforceable by individuals whose personal data is being processed and they contain their own rules controlling further export of the data.

At first sight this system seems very flexible. Most transfer of data will either be internal to a company (in which case each part can sign the standard clauses) or be made subject to some terms or conditions, even if they are standard terms on a website. Including some standard material cut and pasted from the European Commission or elsewhere should be easy enough.

In practice there are quite a few difficulties with the standard clauses, which I intend to look at in some detail later in this series.

What about Brexit?

Unless something dramatic happens between now and then (given past history this is not entirely impossible), the effect of the EU-UK withdrawal agreement and the European Union (Withdrawal Agreement) Act 2020 is that the UK will leave the EU next week on the 31 January 2020.

Article 127 of the withdrawal agreement and section 1 of the Act keep EU law going in the UK for the time being during what is known as the "implementation period" until 31 December 2020 at 11.00pm GMT, though of course that data could end up being renegotiated. So at first sight it would appear that nothing will change for a while yet.

But I still have a concern. From the many examples I have seen, many agreements for sharing, selling or otherwise transferring personal data have provisions in them saying something like "... shall not transfer any personal data outside the European Economic Area..." or wording like that. The problem here is that, despite all the magic words about the implementation period, the UK will not as a matter of fact be in the European Economic Area and so any transfer within or to the UK may well end up being in breach of contract.

I have, since Brexit became a clear possibility, tried to press different wording on clients and their contracting partners. Typically I swap in "third country" for "outside the European Economic Area". It seems to me that the effect of the withdrawal agreement will be that the UK is not a "third country" until at least the end of the implementation period. The alternative would be to include a section attempting to explore all the possibilities along the lines of "If the UK is a member of ...." which seems complicated and fragile.

Does any of this matter? English courts are quite good at preventing over-literal readings of a contract. It's quite possible that a court would be generous and decide that the parties didn't intend that transfer to a country subject to EU law would be prohibited. But I can see the counter-argument quite easily. Not least that the UK is now not nearly as "safe" in GDPR terms as the EU was because in less than a year it could leave the whole protection framework behind. 

That is why I have called this a "niggle" and not a problem. Even so, it is much better to avoid having courts sort your contracts out for you. In my experience, ambiguities make it easier for an aggrieved party to get legal proceedings off the ground, even if they ultimately lose, or to refuse to comply with a contract without being taken to court. It is something that is worth correcting if you can.

Defamation - staying protected

In March, with the wonderful support of mySociety, I presented a half-day training session at Mozilla London about the English law of defamation and its relevance to people running websites with user-generated content. There has been some interesting new law (including the Defamation Act 2013) which bears close examination.

People seemed to have fun and mySociety have kindly produced a video of me giving the event. I am not sure how watchable this really is because I was not presenting for a video, but for an audience. My slides (in PDF format) and some notes should be available on github pages.

My apologies for the very many errors and formatting infelicities there are bound to be. I am still new at publishing things in this way. Comments welcome, but errors, missing material or other areas where you think there may be room for improvement are best raised as github issues.

Private copying - a new copyright exception in the UK

Hooray! We (in the UK) now have a "private copy" exception to copyright. About time too. Until recently, many forms of private copying were infringements of copyright. In particular format shifting such as copying music from your old CD's and DVD's onto your phone or making a "mix tape" for your own use were infringements of copyright and, if you believe some of the rhetoric of the music industry, morally equivalent to theft.

By contrast, almost everyone seemed both to engage in private copying and to think it was OK. Indeed a recent survey I conducted suggests that the vast majority of people think that format shifting is OK (a 95% credible interval of 89 - 93% of the population). So it is very surprising that the law continued to turn its face against something subject to such overwhelming approval.

Analysis

The new law comes in the form of the Copyright and Rights in Performances (Personal Copies for Private Use) Regulations 2014, which is as yet only available in draft. It will come into force on 1st October and add a new section 28B to the Copyright, Designs and Patents Act 1988.

The effect of the new law is that making a copy of a work is not an infringement, subject to 3 conditions:

• the source of the copy (i.e. what you are copying from) is either your "own copy" or a "personal copy"
• it is made for your private use
• it is made for ends which are "neither directly nor indirectly commercial"

Own copy

Your "own copy" of a work is one which:

• you have lawfully acquired
• on a "permanent basis"
• is not an infringing copy
• has not been made under any exception to copyright

This means that you cannot use the private copy exception to "launder" an infringement, eg by copying a work from a friend (still an infringement) and then making a copy of that copy. Similarly, a copy made for private study or research (an exception to copyright under section 29 of the 1988 Act) or a temporary copy, such as one in the browser's cache (see section 28A) is not your "own copy" and so cannot be safely duplicated under the private copy exception.

Your "own copy" is not necessarily a copy that you "own" in the intellectual property law sense. As I read it "lawfully acquired" includes a download which is only made available under licence. In the long run almost all digital content will be downloaded in some fashion rather than bought on a physical medium so a restriction to "owned" copies would be hopelessly restrictive.

The tricky part of the definition is likely to be what is meant by "lawfully acquired on a permanent basis"?

The new section 28B(4) "helpfully" give a short list of examples of copies that are or are not "lawfully acquired on a permanent basis". I am not sure they help all that much. Unsurprisingly copies which have been borrowed, rented, broadcast or streamed are not "acquired on a permanent basis". The same applies to a "download enabling no more than temporary access to a copy", whereas any other download that arises from a purchase or gift would be lawfully acquired on a permanent basis.

Could a copyright owner get around this exception by selling works for very long periods (decades perhaps) with a provision that the work reverts to the owner at the end? I doubt it. My hope is that the courts apply a normal English understanding to the words "temporary" and "permanent". For example, if I say I have a temporary job, you would be a bit surprised to learn that I have a fixed term of 30 years. You are more likely to describe my post as permanent.

Personal copies

A further example of something that is not your "own copy" is a copy made under the private copy exception. These are known as "personal copies". For example a lawful backup copy of an mp3 music file is not your "own copy", but it is a "personal copy". This means, as you would expect, that you can copy your backup copies.

Private use and file lockers

Just in case there was any doubt, the new s28B will make it clear that making back up copies and format shifting are certainly private use. Interestingly s28B(5)(c) makes it clear that storing a copy online so that you can access it later is also "private use" even though the file will be accessible to the file host as well.

This means that you will be able to store your own and personal copies of files on Dropbox (privately at least) and on similar servers.

Transfers

Section 28B will apply fairly common-sense provisions to transfers. If you transfer a personal copy (i.e. one of the copies you have made under this exception) to someone else, you will be infringing copyright unless the copyright owner has given you permission to do so. Personal copies are not meant to change hands. Even if the transfer is otherwise lawful, you would infringe copyright if you retained any of your other personal copies.

For example: if you buy a DVD, make a back up, and then sell the DVD second-hand (something you are entitled to do under section 18(3) of the 1988 Act), you must delete that back up copy. If you keep the back up copy it becomes and infringing copy and stops being a "personal copy".

Is lending OK?

But wait there is something a little odd here. Section 28B(6) says "Copyright in a work is infringed if an individual transfers a personal copy of the work to another person (otherwise than on a private and temporary basis)...". That appears to suggest that it is OK to transfer a personal copy of the work to another person if it is done on a private and temporary basis.

Could my "private use" include lending copies - on a temporary basis only - to friends? There is certainly material in s28B for such an argument. Whether it would run in court is another matter.

Restrictions by the copyright owner

One point that (bafflingly) appears to have upset a number of politicians is the new 28B(10) which blocks copyright owners from preventing private copying by contract. Clearly without such a clause it would be routine to add a provision that private copying was in breach of contract and we might as well not have bothered.

Copyright owners could also use a form of digital rights management to prevent private copying. Circumventing that protection may, at least for something that is not a computer program, itself be an infringement contrary to s296ZA.

It is already the law that, where digital rights management (what is referred to in the legislation as "effective technological measures) prevents one of a list of "permitted acts" (found in schedule 5A of the 1988 Act) then anyone prevented from doing the permitted act may complain to the Secretary of State, who may then do something about it.

This has always seemed to me a rather weak remedy since the Secretary of State is not obliged to do anything about it. When I last asked, no valid complaints appear ever to have been made.

Rather than make private copying another "permitted act" and thus apply the existing mechanism to it, the regulations will create a new s296ZEA. The main difference from 296ZE appears to be that it applies not only when the making of personal copies is prevented, but also when there is a technological restriction that restricts the number of personal copies which may be made. Whether anyone complains to the Secretary of State remains to be seen, please let me know if you do.

Legacy copies

If you made a copy in the past that would have been a "personal copy" if the new law had been in force back then - for example it would have to have been made from your "own copy" and been for individual private use - then that copy is now a personal copy.

Those old mix tapes that people made will become (on 1st October) "personal copies" and so may be lawfully backed up etc provided of course the mix tape was made from their owners "own copy" etc. Oddly the making of the copy (in the past) is still an infringement and so a copyright owner could, in principle, sue you for making private copies in the past, but nothing can be done about your use or possession of them now.

What about compensation?

One objection to these regulations raised by some rights owners is that there should be provision for them to receive some form of compensation for the private copying.

The power used to make the regulations derives from article 5(2)(b) of the Information Society Directive (2001/29/EC) which allows member states of the EU to provide for exceptions to the "reproduction right" (i.e. the right to copy):

in respect of reproductions on any medium made by a natural person for private use and for ends that are neither directly nor indirectly commercial, on condition that the rightholders receive fair compensation which takes account of the application or non-application of technological measures referred to in Article 6 to the work or subject-matter concerned

This would appear to mean that some form of "fair compensation" is required. In many EU countries this takes the form of a levy, for example on CD's, that is then distributed via collecting societies.

But recital 35 of the directive says that in assessing the level of fair compensation "account should be taken of the circumstances of each case" and "In cases where rightholders have already received payment in some other form, for instance as part of a licence fee, no specific or separate payment may be due.". The argument made by the UK government is that because private copying is restricted to a lawfully acquired work, the rights owner will have already priced in any private copying when charging for that access and so there is no need for any further payment. The level of "fair compensation" is nil.

Whether this argument is likely to be challenged by any part of the copyright industry I do not know. Given that private copying, of the kind that will be permitted by section 28B, is almost universal, it is hard to believe that these regulations will impose any further, quantifiable, loss on rights owners. It seems tome that the very limited private copy exception should not entitle rights owners to any further compensation. We shall see.

Copynorm survey - answering some questions

Thank you for everyone who has responded to the survey so far. I have just short of 500 responses, it would be really great to double that before the survey closes, so please share with your friends.

The survey has generated a lot of comments and I think I owe it to those who have bothered to comment to collect together some of their questions and address them here. Unfortunately I can't discuss the thinking behind the questions - otherwise I might bias the answer - and so I won't talk about specific questions.

The unexplored

There are a lot of interesting areas that I have left unexplored. That is deliberate. In order to keep the survey reasonably short and within various technical constraints I had to pare down the range of things I explored considerably.

Penniless artists

For example: does the status of the creator of the work make a difference? Some people do seem to think that a very wealthy rock star has less right to complain about copying of their work than a penniless artist: others disagree. It would be very interesting to know what difference that made and I considered asking questions to explore that distinction. Unfortunately those questions had to be cut.

A similar example is given by a commenter known as Julian:

... if the artist gets paid 0.02p out of a £15.99 product, or is dead, then it's a little difficult to argue that copying the CD counts as stealing from them.

Intention

It is often asserted that people who illegally download music (in particular) are more likely to buy music than people who do not. I have no idea whether that is true, but there is clearly a view that it is OK to circumvent a publisher and download something without paying if you are "testing" the work out. Provided you actually buy a copy if you keep it, then you have done nothing wrong.

An anonymous commenter said:

in the situation where [someone] wants to listen to an album but doesn't want to pay for it, while I marked that I thought it was OK, there needs to be a little nuance there. If he wants an album so he can hear it and decide whether or not he likes it and is willing to spend money, that's totally fine. If he wants it specifically so he doesn't ever have to pay for it, that's a problem.

This was another of the questions I wanted to ask but fell on the cutting room floor.

The law

One of the main aims of this survey is to find out what people think is acceptable not what people think is legal. But that causes a problem for some people who believe there is inherent value in obeying the law whatever their own morality might be.

"James" says:

whilst I believe that the law relating to copyright, patents, trademarks and other forms of so-called "intellectual property" ought to be drastically liberalised, I believe that people ought to obey the law even though they disagree with it this distinction is not recorded by the survey

James's position is to give what philosophers call "deontological value" to the law. His concern is that the survey doesn't capture that distinction.

In fact I am in roughly the same position as James. As a child I was enormously influenced by the character of Sir Thomas More as brilliantly portrayed by Paul Scofield in Fred Zinnemann's A Man for All Seasons and in particular by the following quote:

William Roper: So, now you give the Devil the benefit of law!
Sir Thomas More: Yes! What would you do? Cut a great road through the law to get after the Devil?
William Roper: Yes, I'd cut down every law in England to do that!
Sir Thomas More: Oh? And when the last law was down, and the Devil turned 'round on you, where would you hide, Roper, the laws all being flat? This country is planted thick with laws, from coast to coast, Man's laws, not God's! And if you cut them down, and you're just the man to do it, do you really think you could stand upright in the winds that would blow then? Yes, I'd give the Devil benefit of law, for my own safety's sake!

(courtesy IMDB) 

The answer to James is that I am aware that the law affects people's views on right and wrong and I will try to take that into account. If I have sufficient responses from different jurisdictions world-wide (I am hopeful) then I may be able to analyse whether the jurisdiction in which someone lives affects their views.

Gervase Markham also wonders why I don't ask people "do you think this should be legal so you could do this". That would be a fascinating. In fact my first plan for the project was to find out what people thought was or was not legal. I think it would be really interesting to know what people think the law actually is and that seems to me logically prior to asking them whether they want the law to be changed (you can't want to change the law if you don't know what it is).

All I can say is that what my supervisor and I ended up thrashing out was different. However if anyone wants to help out with a survey of that or something else of interest later in the year, I would be very interested in suggestions (see my remarks at the end).

Charles Oppenheim says:

Another problem with the survey is that, assuming the changes go through, UK copyright law will permit some of the actions outlined in the survey that are currently illegal.

That may be right (there's a lot of "it depends") and if people would like me to I would be happy to produce an analysis of all the questions and their legality once I am finished with the dissertation.

The world as it is 

Reuben Thomas is unhappy that his answers may not reflect his true belief. 

I said "yes" to almost every part of every question, but that does not mean that I think that it's good if everyone copies and shares everything; it's rather that the current situation is bad in so many ways.

He then goes on to give a number of situations where (to paraphrase) the market is distorted, which in turn may justify behaviour that would not be justified if those distortions were not present. Origami Girl and Saxon Christopher raise similar points.

My hope was that people would understand the survey to be about the world as it is with all its perfections and oddities. I wanted to avoid being overly abstract. I thought that concrete "real world" situations might bring clearer answers. Whether I am right about that remains to be seen. However the point is taken and, if I had more space, would be something worth exploring.

Ethics

Paul and Gervase both suggest asking a question along the lines of "would you do this?". That would be a logical since I ask what other people would do, why don't I ask what the person answering the survey would do. The simple answer is that I am constrained by university rules on ethics. If I ask whether someone would do something that may be unlawful (or in some places and cases criminal) that is very much more intrusive than asking them what they think is OK. It is also very close to asking them "have you ever done this?", which would be an even more intrusive question.

Much as I would like to know, I have had to avoid questions like this altogether.

Free text

I considered allowing free text comments in the survey (either for each question or for the survey as a whole). Maybe I should have allowed them as an option. I was keen to keep things short and simple and I thought the value of adding free text might be less than the cost in additional cognitive load on people answering the survey.

Given the very interesting questions and comments from people on completion, maybe that was a mistake and I should have added something to let people express their frustration at the narrowness of the categories offered (something I struggle with in surveys) and to offer me the benefit of their wisdom. I am grateful that so many have bothered to add their comments to the survey.

Finally

Thank you for all your comments. I am sorry if I haven't (yet) addressed something you have said. I am really grateful for all the feedback.

One of the main themes seems to be that I didn't answer questions people wanted answering. I hope to have this dissertation done and dusted by May / June, but I will still have some time left on my surveymonkey subscription so if anyone wanted to do the hard work of canvassing people to answer another more detailed survey, or a survey about other things (eg what you think the law should be) I would be more than happy to offer legal, technical and statistical advice and support. 

I think we know far too little about what the general population thinks about copying and the law, so the more the merrier. Maybe a kickstarter to raise funds to buy a properly sampled audience is something to try.

I hope to be able to publish the data in open data format and some commentary on the final results later in the year, but for now please keep sharing and let's see if we can hit 1,000 respondents.

Copying, sharing and remixing - what do you think?

I am completing a part-time LLM (masters) in computer and communications law with Queen Mary University London. I would really appreciate your help in completing a survey. It should take less than 5 minutes to complete. If you want to know more about the survey, read on...

I, like many lawyers, spend a lot of time thinking, talking and writing about intellectual property law and, in particular, copyright. But law is not the whole story. People do what they do for all sorts of reasons: what the law says is only one of them.

People may also be driven by socially accepted rules of conduct known as social norms. In simple terms: what they think is OK. Norms are complicated things. For example you may have your own views about what is OK, but you might also pay attention to:

• what you think other people think is OK
• what you think other people actually do

Obviously law affects social norms. I'm sure it would be a fun an interesting exercise to find out what people think they are allowed to do by the law. But that is not what I am trying to find out - this time anyway.

For my research I have created a to try to find out something about social norms for a number of common situations where someone might want to copy, share or remix an existing work. I hope that learning what people actually think will be illuminating.

I would therefore be extremely grateful if you could try the survey out for yourself and also pass it on to as many of your friends, relatives, colleagues (and really anyone else you know) as you can.

I hope to post the results of the survey in July of this year (2014) and discuss some of the results as they come in. For now I won't say any more about the design so that I do not influence you when you fill it in (which I am sure you are going to do). If you don't want to read my other blog posts restrict yourself to the tag copynorms.

Here is the link for the survey again in case you missed it.

Open up data about justice

Very recently the government published the Shakespeare Review on open data. I have recently been told that:

The government, in response to the Shakespeare Review of Public Sector Information, has committed itself to publishing a core reference dataset, listing unpublished datasets together with a schedule of release. Government departments have been going through a process of identifying the data they hold and prioritising their release.

What I am given to understand is that we should all be telling the Government, right now, that particular datasets need to be released.

As a lawyer, I am particularly interested in information about the workings of the court system. data.gov does not appear to allow me to search for unpublished datasets belonging to the court service only, but it does allow me to pull up unpublished datasets for the Ministry of Justice.

I am not entirely sure what is there or how useful it might be. For example there is a case management system called caseman that is used by county courts. I suspect that there is a lot of potential in opening up that dataset, but it is hard to tell without more information. 

There is even a dataset described as:

Tribunals Service Case Management systems including: ARIA, ETHOS (and Caseflow), GAPs 2, MARTHA, CICA and a set of SQL and Access based systems, and manual case records.

I have told the MOJ that they might as well have described this as "stuff" for all it really helps me. But it is quite possible there is much of interest there too.

Each dataset allows (signed up users) to give feedback on release of the data. Feedback is supposed to be focussed particularly on economic and social growth - nothing persuades governments like "if you release this dataset, there will be a £100M growth in GDP".

Sadly, to date, almost all the interesting datasets have attracted no comments at all. I wonder whether this is to do with lack of publicity or whether people (like me) feel that it is difficult to make concrete comments on datasets about which they know nothing. If any reader of this blog feels strongly about open data, can I invite you to give feedback on some (or all) of these datasets.

Note: I have blogged elsewhere on this topic already with a slightly different emphasis.

 

Orphan Works - the new law in the UK

My social media feeds have been full links to alarmist stories about a recent change to UK copyright law that allows for the licensing of orphan works. Photographers have been particularly concerned after one site (which I won't dignify with a link) used the headline "ALL your pics belong to everyone now". So much alarm has been created that the UK's intellectual property office felt moved to publish a PDF debunking some of the myths that have arisen. I was waiting until the Enterprise and Regulatory Reform Act 2013 was published on the government's legislation website before making my own comment.

The problem of orphan works is well known. Copyright lasts for a long time. In the UK it will usually be for 70 years after the death of the author. Discovering the author of a work to discover whether it is, or is not, protected by copyright can be difficult, let alone discovering the present owner of that copyright in order to ask them for a licence. The effect of that is that many works are either not used, or used only by organisations that care little about copyright on the ask forgiveness not permission principle.

There are radical solutions to this problem, for example we could require that copyright owners register their copyrights in order to enforce them, as the United States did until relatively recently. Or we could adopt William Patry's more modest proposal where no registration would be required for an initial, but relatively short, copyright term. To extend the life of a work's copyright, the copyright owner would be required to register. Such a system would make it very easy to discover who was the owner of a work older than the short initial period of copyright, but of course there would be administrative costs associated with it. Legislators have been more timid in their response.

The European Directive

One solution that has already been enacted is the European the orphan works directive (2012/28/EU), although the UK does not have to transpose it into UK law until 29 October 2014.

The orphan works directive is an exceptionally modest provision. Its beneficiaries are public libraries, education establishments, museums and archives. Any institution wishing to use an orphan work must first carry out a "diligent search" in good faith from "appropriate sources". The directive itself lists some "appropriate sources" which would have to be searched, but member states may add to the list, which varies depending on the type of work involved.

Records have to be kept by the institutions of their diligent searches which must be sent to their national government which in turn must make the results available on a publicly searchable website (good to see that governments are beginning to understand open data). This ought to make it easy for copyright owners to discover whether one of their works has been designated as an "orphan" and, having found out, make sure that oprhan status is rescinded.

Institutions may only use the works to achieve their "public-interest missions" and may only charge in order to recover costs of copying or making available to the public. They may not exploit the works commercially.

Canada

The orphan works directive tries to maintain the broad integrity of copyright by delegating the task of carrying out a diligent search and managing the orphan works system to trusted public institutions. By contrast Canada has been using an orphan works law which relies on a central authority, theCopyright Board of Canada.

Section 77 of the Canadian Copyright Act 1985, entitled "owners who cannot be located", requires anyone seeking a licence for what we call orphan works to satisfy the Copyright Board that they have made "reasonable efforts to locate the owner". The Board may then issue a non-eclusive licence on any terms it chooses to specify. According to their brochure they will usually require the payment of a licence fee, which will be paid to a collecting society. If the owner of the copyright appears within 5 years of they expiry of the licence, they may claim the licence fee. Where the fee was paid to a collecting society, the society will pay the owner.

The Board do not issue very many licences - roughly 22 a year since 1990. Not all applications for a licence are accepted. Whether "it works" in Canada I do not know, but copyright has clearly not come to an end there.

The United Kingdom

So where does that leave us? Section 77 of the Enterprise and Regulatory Reform Act 2013 introduces a new section 116A of the Copyright, Designs and Patents Act 1988 concerned with orphan works. Section 116A is a mere skeleton. It allows the government to make regulations that would allow someone (an authorised person) or alternatively some people to be chosen by someone designated for the purpose, to grant licences to orphan works. The content and circumstances of the licences we do not know. All we do know is:

• a work will not be an orphan work unless a diligent search is made for the copyright owner
• what counts as a "diligent search" will be defined in the regulations
• the licences may not be exclusive
• nor may they be granted to a person authorised to grant licences

Now in theory this means we could end up with a Wild West system where there was little real control over licensing of orphan works. The regulations could be very lax on what counted as a "diligent search" and very generous about the licensing terms. That is always a risk with open-ended legislative provisions (and why they should not be used by Parliament).

The reality, according to the intellectual property office, is that we will end up with something similar to the Canadian system. Licences will not be free. Copyright owners will be able to claim fees that have been paid. There will almost certainly be a fairly tight and prescriptive description of what counts as a "diligent search". It will not be enough simply to look at the metadata on a photograph, shrug one's shoulders, and go ahead.

Extended Collective Licensing

In parallel to section 116A is a new 116B which will allow collecting societies in sectors where they now organise (eg books and music) to be given permission to license works that they do not have any existing right to license - eg where they do not own the rights and the author has not given the society permission to license them. This is not an orphan work provision. It applies even though the society knows full well who the author of a work might be. I mention it because it has been mixed into some of the reports about the orphan works provisions.

I have my doubts about extended collective licensing, but it will at least be an "opt out" system. No-one has to participate if they do not want to. In a sector where most licensing is direct (author to user) such as photography, there may never be such a system as the intellectual property office has indicated.

Consultation

The intellectual property office tell me that there will be extensive consultation on the detail of any regulations. Anyone having an interest in these provisions should make sure they engage with the consultation or join with others to represent them collectively. I am sure the open rights group will be making representations.