ISPs agree to 'five strikes' graduated response

Hogan Lovells partner Daniel Brenner speculates on the impact of the July 2011 Memorandum of Understanding between major U.S. ISPs and content owners.   The Center for Copyright Information (CCI) will be responsible for administering the new gradu ated response system, and for defining privacy standards that right holders and ISPs must apply.  Will the mitigation measures promised by ISPs be effective in curbing copyright piracy?   Will the MOU's limitation to P2P exchanges limit the system's effectiveness?   Read the full story here.

Network Neutrality Advances in the E.U.

By Dan Brenner, Technonology, Media and Telecoms Practice

The network neutrality debate in the U.S. has moved to the appeal courts as the 2010 FCC Order, which becomes effective on Nov. 20, awaits review.  Meanwhile, two E.U. developments presage more regulatory steps forward. The result is movement away from the European Commission’s wait-and-see communique announced just last April. 

On Oct. 7, the European Data Protection Supervisor Opined on network neutrality and protection of privacy. The decision represents a relatively balanced review of the need for internet service providers (ISPs) to manage traffic and the impulse for “function creep where the initial purposes could easily evolve into commercial or other exploitation of information collected.” The Opinion recognizes that both the content and the traffic data processed by ISPs are protected by the right of confidentiality of correspondence of the E.U. Charter.   Use of either requires “free, specific and informed indication of wishes”.

The Opinion concludes that a website can’t require consent to collect personal data from a user as a condition for subscribing “[g]iven that the Internet has become an essential tool both for work and for leisure purposes.” Thus, websites that condition entry on personal data are not allowed. Moreover, it opines that consent must be obtained from “all users” in a communication. Query whether and how this would apply to a data-mining free email account, where the subscriber has consented but her correspondent has not. 

The Opinion recognizes that consent to inspect a customer’s traffic or content data may not always be possible, or necessary, for all monitoring functions. But the Opinion is likely to be cited by those seeking to link privacy rights and personal data to the network neutrality cause; in the US, privacy has not been in the forefront of this debate. 

On Nov. 20 neutrality advocates in Europe inched their efforts forward when the Industry, Research and Energy Committee (ITRE) of the European Parliament voted to ask the EC to come up with more guidance on network neutrality. This step, too, marks a backing away from last spring’s “wait-and-see” stance.   Among other things, the resolution calls on the European Commission to ensure that ISPs “do not block, interfere with, discriminate against, impair, or degrade the ability of any person to use a broadband service to access, use, send, post, receive, or offer any lawful content, application, or service made available via the Internet.” This language actually goes farther than the FCC’s neutrality rules, which bars only “unreasonable” discrimination. There appears to be an E.U. carve-out for mobile Internet traffic, similar to the FCC’s reduced treatment for this presumably bandwidth-constricted technology.

 One reason the E.U. has lagged the U.S. in net neutrality regulation is that European telcos have generally been required to unbundle their last mile copper plant. Multiple ISPs, in theory anyway, can serve a residence. With ISP competition possible to every residence, a customer can switch if she doesn’t like the ISP’s terms and conditions. 

In the U.S., telcos were freed from unbundling in 2005, and cable networks were never generally subject to the requirement. Despite extensive head-to-head broadband competition in most of the country, competition is not universal in all 50 states. U.S. Regulatory proponents note this lack of competition in rejecting a market-based solution to issues of ISP conduct.

EU Article 29 Working Party Report on ISP and Telecom Carrier Data Retention for Law Enforcement Purposes

Winston Maxwell, a partner in Hogan Lovells’ Paris Office prepared this entry.

On July 13, 2010 the EU’s Article 29 Data Protection Working Party adopted a report (http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2010/wp172_en.pdf ) describing how ISPs and telecom carriers retain traffic data for law enforcement purposes in Europe. The European Data Retention Directive 2006/24/EC (http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32006L0024:EN:HTML) was supposed to harmonize national laws on data retention. But according to the working party’s report, harmonization is seriously flawed in a number of respects.

 

The report confirms what we have heard from a number of our communications clients: each Member State has slightly different rules for retaining traffic data for law enforcement purposes, particularly when it comes to IP-based communications. The duration for retaining the data are different from country to country, and the kind of data to be retained are in many cases different. For a pan-European communications providers, this creates a real headache, because specific procedures and systems have to be created for each Member State where the communications provider does business. 

The Article 29 working party comes at this from the angle of protecting European citizens, and complains that the lack of harmonization creates different levels of protection of personal data between different Member States, defeating the Data Retention Directive’s objective of harmonization. In this particular case, however, the interests of communications providers and EU citizens converge, because different rules on data retention create additional costs for communications providers, as well as different risks for citizens. The directive currently allows Member States to apply data retention periods of between 6 and 24 months. Several of the large EU Member States have chosen a period of 12 months, and the Article 29 working party recommends that the directive be amended to impose a single harmonized period instead of giving Member States a choice. 

The legislation of Member States is fairly consistent regarding the kind of data to be retained for traditional voice communications, but for IP-based communications the practices vary. On this point, the Article 29 working party emphasizes that the only data that Member States can require service providers to retain are those listed in Article 5 of the Directive. In particular, the destination IP address and the URLs of web sites cannot be retained, because those data provide information on the content of the communication, which is prohibited. The working party deplores that many operators do not apply automatic erasure procedures at the end of the legally mandated retention period, and that many operators do not conduct security audits. Finally, the report complains that Member States have different definitions of what a “serious crime” is that would justify the communication of data to law enforcement personnel. The report recommends harmonization on this point too.

 

Although not specifically mentioned by the working party, the question of whether illegal downloading of copyrighted material is a “serious crime” is obviously a key issue, because several European countries are putting into place graduated response mechanisms that rely on the ISP communicating traffic data to a court or administrative body for the purpose of identifying the alleged infringer. On that front, BT and Talk Talk have lodged a complaint in the UK claiming that the Digital Economy Act, which allows OFCOM to send warning letters to individual infringers, violates fundamental privacy laws http://www.guardian.co.uk/technology/2010/jul/08/bt-talktalk-challenge-digital-economy-act

 

Some courts are also questioning the constitutionality of national data retention laws enacted to transpose the Data Retention Directive. Last March, the German Supreme Court held that the implementation of a German law on data retention violated fundamental privacy rights, and ordered that the application of the law be suspended until such time as the government narrows its scope http://news.cnet.com/8301-13578_3-10462117-38.html .