Legislation

ICO Urges Businesses To Prepare For No-Deal Brexit

Posted on by Andy Miller

In a Westminster eForum event on GDPR practice in London, the director of strategic policy at the Information Commissioner’s Office, Jonathan Bamford, is reported to have urged businesses to prepare for a no-deal Brexit in terms of planning to stop interruption in data flows from Europe.

Why?

As explained by parliament.uk, three-quarters of the UK’s cross border data flows are with EU countries, and when the UK leaves the EU, it will leave the legal framework for moving data between the UK and the EU. This means that businesses may need to act to make sure that data flows can continue uninterrupted between the UK and the EU.  With a no-deal Brexit, this is going to be of particular importance because there may be no ‘adequacy agreement’ in place for some time.

What Is An Adequacy Agreement?

A decision of adequacy/adequacy agreement is made by the EC if they consider a country outside of the EU, which the UK will be after 29th March, as somewhere that provides a level of protection which is equivalent to that of the EU.  A ‘decision of adequacy’ will allow data to flow into and out of the EU without the need for other safeguards.

Unfortunately, if there is a no-deal Brexit, and there is no adequacy decision in place for some time, businesses and institutions may find themselves having to use alternative legal mechanisms that could be bureaucratic, costly, and could cause delays.

Not In Place Before Brexit

The ICO has warned that an adequacy agreement will not be in place before Brexit, hence the need for businesses to think about making some plans.

What Sort of Things May Be Affected?

Examples of things businesses may need to consider in order to maintain data flow post-Brexit include:

  • Organisations that receive data from Europe, and use cloud services based within the EU may need to think about what risks and disruption they could face if no adequacy agreement is in place, and what other mechanisms and agreements they may need to seek.
  • Finding out where company data is stored and who has access to it may be an issue.  Is your data stored in the UK or EU? There is also a need to understand data flow.
  • Possibly needing to renegotiate data services supplier contracts for GDPR (as some banks have done).
  • Global organisations operating in multiple jurisdictions may need to look at how data is transferred within their organisation and whether corporate rules need to be changed.
  • Organisations may need to look at where their riskiest and/or more important data transfers are, and plan to get Standard Contractual Clauses (SCCs) implemented i.e. contractual forms approved by the EU Commission as offering adequate protection for the personal data of individuals.

Absorbed in UK Law

For most businesses, because GDPR will be absorbed into UK law at the point of Brexit, there should no major changes to the basic data rules that businesses need to follow.

Approved Industry Codes
Some business commentators have suggested that data transfers to ‘third countries’ could be carried out under an EDPB (European Data Protection Board) approved industry code if there was no adequacy agreement in place. This, however, looks unlikely to materialise in time for Brexit.

What Does This Mean For Your Business?

The UK must be able to move data between itself and the EU in order to maintain a healthy trading relationship after Brexit.  Also, UK citizens need to be assured that their personal data will be safeguarded after the UK leaves the EU.  Yes, GDPR will be absorbed into UK law as the Data Protection Bill on leaving the EU, which should bring satisfactory parity between UK and EU data laws, but it is worrying to think that UK businesses (and consumers) could be exposed to risks because there is unlikely to be an adequacy agreement in place for some time.

A no-deal Brexit could, therefore, threaten post-Brexit data and create more bureaucracy for UK businesses that will need to work to ensure that they are seen to be ‘safe importers’ of data in data transfers agreements.

This is a complicated-enough subject for businesses anyway without considering the need to look at more pieces of the puzzle.  Businesses can find more information on the subject by studying the ICO’s guidance on ‘Data Protection if There’s No Brexit Deal’ here: https://ico.org.uk/for-organisations/data-protection-and-brexit/data-protection-if-there-s-no-brexit-deal/  and by studying the ICO’s ‘Leaving the EU – Six Steps To Take’ here: https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf.

£15K Fine For Ignoring Data Access Requests

Posted on by Andy Miller

SCL Elections, the parent company of the now defunct Cambridge Analytica which was famously involved in the Facebook profile harvesting scandal, has been fined £15,000 for failing to respond to a data access request from a US citizen, and for ignoring an enforcement notice by the UK’s Information Commissioner’s Office (ICO).

Data Protection Act

The fine was made for a breach of the Data Protection Act which was in force for all at the time of the data request, which was originally made back in 2017.  GDPR, which came into force on 25th May 2018 (to replace the Data Protection Directive) covers the data protection rights of EU citizens.

The person who made the data request in this case, however, was US citizen Professor David Carroll, and SCL Elections wrongly believed that because he was not a UK citizen, he had no more right to request access to data “than a member of the Taliban sitting in a cave in Afghanistan”.

What Happened?

Professor David Carroll, who was based in New York in May 2017 at the time of his original data request under UK Data Protection Act, asked SCL Elections’ Cambridge Analytica branch in the UK to provide all the data it had gathered on him. Under that law, SCL Elections should have responded within 40 days with a copy of the data, the source of the data, and stating if the organisation had given / intended to give the data to others.

Professor Carroll, a Democrat, was reported to have been interested from an academic perspective in the practice of political ad targeting in elections and believed that he may have been targeted with messages that criticised Secretary Hillary Clinton with falsified or exaggerated information that may have negatively affected his sentiment about her candidacy.

Sent Basic Information On A Spreadsheet

Some weeks after Professor Carroll’s subject access request in early 2017, SCL Elections sent him a spreadsheet of basic information that it held about him.

However, that information contained accurate predictions of Professor Carroll’s views on some issues and had scored Carroll a nine 9 out of 10 on what it called a “traditional social and moral values importance rank”.

Wanted To Know How

This prompted Professor Carroll to submit a second request to SCL Elections, this time to find out what that ranking meant and what it was based on, and where the data about him came from. This second request was ignored by SCL.

The CEO of Cambridge Analytica at the time, Alexander Nix, told a UK parliamentary committee that his company would not provide American citizens, like David Carroll, all the data it holds on them, or tell them where the data came from, and Nix (mistakenly) said that there was no legislation in the US that allowed individuals to make such a request.

ICO Involved

The ICO then became involved with the UK’s Information Commissioner, Elizabeth Denham, sending a letter to SCL Elections (Cambridge Analytica) asking where the data on Professor Carroll came from, and what had been done with it.  A section 40 enforcement notice was also issued in May 2018 to SCL Elections, thereby making it a criminal matter if they failed to comply by responding to the request and by providing the full records as requested by Carroll. No records were forthcoming, which resulted in the recent prosecution, the first against Cambridge Analytica.

During the case at Hendon Magistrates Court, it was revealed that SCL Elections had a turnover of £25.1m and profits of £2.3m in 2016.  The judge fined SCL Elections £15,000 for failing to comply with the section 40 enforcement notice from the ICO and ordered the company (whose affairs are being handled by administrators, Crowe UK) to pay a contribution of £6,000 to the ICO’s legal costs, and a victim surcharge of £170.

Some Mitigating Circumstances

Although Counsel for SCL Elections’ administrators acknowledged that SCL elections had failed to respond to the section 40 enforcement notice, they did highlight some mitigating circumstances, such as the company’s computer servers being seized by the ICO following a raid on the SCL Elections premises in March 2018.

What Does This Mean For Your Business?

This case shows that ignorance of data protection law is not a defence and that businesses and organisations need to protect their customers, stakeholders, and themselves by making sure that they fully understand and comply with data protection laws. This is particularly relevant in the UK since the introduction of GDPR.

As pointed out by Information Commissioner Elizabeth Denham in this case, companies and organisations that handle personal data need to respect people’s legal privacy rights and to understand that wherever a person lives in the world, if their data is being processed by a UK company, UK data protection laws apply. This case has also highlighted the fact that where there is no compliance with the law, and where ICO enforcement notices are ignored, action will be taken that could be very costly to the subject of that action.

UK Government Warns ‘No Deal’ Brexit Could Mean Get A .COM Replacement For Your .EU

Posted on by Andy Miller

The UK Government’s Department for Digital, Culture, Media and Sport has issued advice to holders of .eu domains that, in the event of a ‘no deal’ Brexit, they may need to switch to another top-level domain such as .com and may also need to seek legal advice.

What? Why??

The government guidance, published online on 21st December, says that the European Commission’s notice states that where a holder of a domain name no longer fulfils the general eligibility criteria, the registry for .eu will be entitled to revoke the domain name. This is because the rules for .eu domains are decided by the European Commission and the operator, which won a contract to run .eu, is obliged to follow these rules.

This could mean that even though you were the owner of the .eu domain up until 29 March 2019, after that date, and with a ‘no deal’ Brexit, you may no longer be able to access your .eu website or email. This may also essentially mean that .eu domains cannot be bought or renewed after Brexit by people or organisations located outside the European Union.

Is This A Real Threat?

Yes. In March last year, the European Commission announced it planned to simply cancel all 300,000 domains under the .eu top-level domain that have a UK registrant, after the UK’s departure from the European Union. EURid, the company that runs the .eu domain registry was not even consulted about the EC’s decision. 

Also, last September the EU added the .eu registry to the official State of the Union document, stating that the implementation and functioning of the .eu top-level domain name would be included alongside copyright, cybersecurity, and privacy reforms.  This means that, if the EU is serious (which it appears to be) and proposed amendments are made to the State of the Union document for post-Brexit, anyone who wants to purchase a .eu domain may need to provide proof of EU citizenship, and registry operators will need to verify that proof.

Lost Revenue

As well as damaging the profits of Eurid, the UK citizens who hold a .eu domain make 10% of the registry, and by taking such a hard line, the European Union would be reducing its own revenues by a significant amount if it simply excluded UK citizens from owning a .eu domain.

What Does This Mean For Your Business?

The government may have just lost a ‘no deal’ Brexit vote, but it looks as though the EU had already set itself on a course to stop UK citizens from owning .eu domains with Brexit anyway, even though they will lose the revenue from nearly 300,00 domains.  There had been plans to set up a Commission on the implementation of the rules, but this is unlikely to happen or to be able to change the EU’s decisions in such a short time.  This means that UK businesses holding .eu domains, having websites with those domains and using email linked to them are now faced with the cost and trouble of having to switch to another top-level domain. One key challenge here, is that they may not be able to find their .com or .uk equivalents, thereby causing even more problems.  The EU’s decision looks like being a bad deal for both UK businesses and the EU, and seeking advice both from the registry and / or other independent legal advice may be advisable at this point.

London Police Facial Recognition Trial

Posted on by Andy Miller

It has been reported that the police are conducting a trial of a facial recognition system in Soho, Piccadilly Circus and Leicester Square over two days in the run-up to Christmas in a bid to identify people among the Christmas shoppers who are wanted by the police or the courts.

Overt

Far from being used secretly, the Metropolitan Police are reported to be publicly announcing the use of the system using knee-height signs on pavements leading up to the surveillance areas, along with A4 posters on lamp posts and leaflets handed-out to members of the public by uniformed officers.

The actual surveillance using the facial recognition link-up to the police database of wanted offenders is reported to have been carried out (on Monday and Tuesday) by a green van with cameras mounted on the top. It has been also been reported that for this London trial of facial recognition, the Metropolitan Police will have been studying the crowds for 8 hours per day over the two day period, and have been specifically using a target list of 1,600 wanted people in the hope that crime and violence can be more effectively tackled.

Criticism

Criticism from privacy and freedom campaigners such as Big Brother Watch and Liberty has focused on mixed messages from police about how those who turn away from the van because they don’t want to be scanned will be treated.  For example, it has been claimed that some officers have said that this will be treated as a trigger for suspicion, whereas a Metropolitan Police press release has stated that those who decline to be scanned (as is their right) during the deployment will not be viewed as suspicious by police officers.

Concern has also been expressed by Big Brother Watch that, although the police may believe that the deployment of the system is overt and well publicised, the already prevalent signs and advertisements in the busy central London areas where it is being deployed could mean that people may not notice, thereby allowing the police to blur the line between overt and covert policing.  It has also been pointed-out by privacy groups that the deployment involves an unmarked van and plainclothes officers, which are normally associated with covert activity.

Doesn’t Work?

Big Brother Watch and Liberty are currently taking legal action against the use of live facial recognition in South Wales (the site of previous trials) and London, and ICO head Elizabeth Dunham is reported to have launched a formal investigation into how police forces use facial recognition technology (FRT) after high failure rates, misidentifications and worries about legality, bias, and privacy.

Serious questions have been raised about how effective current facial recognition systems are.  For  example, research by the University of Cardiff, which examined the use of the technology across a number of sporting and entertainment events in Cardiff for over a year, including the UEFA Champion’s League Final and the Autumn Rugby Internationals, found that for 68% of submissions made by police officers in the Identify mode, the image had too low a quality for the system to work. Also, the research found that the locate mode of the FRT system couldn’t correctly identify a person of interest for 76% of the time.

Google Not Convinced

Even Google (Cloud) has announced recently that it won’t be selling general-purpose AI-driven facial recognition technology until it is sure that any concerns over data protection and privacy have been addressed in law, and that the software is accurate.

Fooled With A Printed 3D Head!

The vulnerability of facial recognition software to errors and inaccuracy has been further exposed by a journalist, Thomas Brewster, from Forbes, who claimed that he was able to fool the facial recognition on four Android phones by using a model 3D head with his own face printed on it!

What Does This Mean For Your Business?

For the retail businesses in the physical area of the trial, anything that may deter criminal activities like theft and violence and may also catch known criminals is likely to be a good thing.

Most businesses and members of the public would probably agree that CCTV systems have a real value in helping to deter criminal activity, locating and catching perpetrators, and providing evidence for arrests and trials.  There are, however, several concerns, particularly among freedom and privacy groups, about how just how facial recognition systems are being and will be used as part of policing e.g. overt or covert, issues of consent, possible wrongful arrest due to system inaccuracies, and the widening of the scope of its purpose from the police’s stated aims.  Issues of trust where our personal data is concerned are still a problem as are worries about a ‘big brother’ situation for many people, although the police, in this case, have been clear that it is just a limited trial that has been conducted as overtly as possible with the support of literature and posters / literature to make sure the public is informed.

Liberty Wins Right To Judicial Review Into Investigatory Powers Act

Posted on by Andy Miller

The fact that Human rights group Liberty has won the right for a judicial review into the Investigatory Powers Act 2016 could mean a legal challenge in the high court as soon as next year.

The Investigatory Powers Act

The Investigatory Powers Act 2016 (also known as the ‘Snooper’s Charter’) became law in the UK November 2016. It was designed to extend the reach of state surveillance and requires web and phone companies (by law) to store everyone’s web browsing histories for 12 months and to give the police, security services and official agencies unprecedented access to that data. The Charter also means that security services, government agencies and police can hack into computers and phones and collect communications data in bulk, and that judges can sign off police requests to view journalists’ call and web records.

Long Time Coming

Liberty was given the general go-ahead by the UK High Court to make a legal challenge against the Investigatory Powers Act in July 2017 and was enabled to do so with the help of £50,000 of crowdfunding raised via CrowdJustice.

Also, Liberty’s challenge is thought to have been helped by the European Court of Justice (in a separate case, represented by Liberty lawyers back in 2016) ruling that the same powers in the old the UK state surveillance law the ‘Data Retention and Investigatory Powers Act’ (DRIPA) were unlawful, and by a ruling by the court of appeal in January 2018 also finding the same thing.

The UK government was, therefore, given until July 2018 to amend or re-write powers to require phone and internet companies to retain data on the UK population.

Part 4 of the Act

The most recent High Court ruling on 29th November gives Liberty the right to a judicial review on part 4 of the Investigatory Powers Act.  This is the part which gives many government agencies powers to collect electronic communications and records of internet use, in bulk, without reason for suspicion.

Concerns About GCHQ’s Hacking

Human rights groups and even Parliament’s Intelligence and Security Committee have become particularly concerned about an apparent shift towards the use of hacking of computer systems, networks and mobile phones for information gathering by intelligence services such as GCHQ in projects such as the ‘Computer Network Scaling’ programme.

What Does This Mean For Your Business?

The UK’s ability to spot and foil potential plots is vital. Although the Investigatory Powers Act may include measures that could help with that, many people and businesses (communications companies, social media, web companies) are still uneasy with the extent of the legislation and what it forces companies to do, how necessary it is, and what effect it will have on businesses publicly known to be snooping on their customers on behalf of the state. The 200,000+ signatures on a petition calling for the repeal of the Investigatory Powers Act after it became law, and the £50,000 crowdfunding raised from the public in less than a week to challenge parts of the Act in the courts, both emphasise the fact that UK citizens value their privacy and take the issues of privacy and data security very seriously.

Liberty is essentially arguing for what it sees as a more proportionate surveillance regime that can better balance public safety with respect for privacy. The government initially believed that this level of surveillance was necessary to counter terrorist groups and threats posed to safety and democracy by other states, but successive legal challenges by Liberty have seen them give some ground. According to the Intelligence and Security Committee, GCHQ is running a project that aims to improve the way that it complies with the Act, and MI5 has also said that it trying to operate more compliantly.  As for any additional oversight of government orders to internet and phone companies, this is estimated to be running about a year behind schedule with IT problems being blamed for the delay.

Data Protection Trust Levels Still Low After GDPR

Posted on by Andy Miller

A report by the Chartered Institute of Marketing (CIM) has shown that as 42% of consumers have received communications from businesses they had not given permission to contact them (since GDPR came into force), this could be a key reason why consumer trust in businesses is still at a low level.

Not Much Difference

The CIM report shows that only 24% of respondents believe that businesses treat people’s personal data in an honest and transparent way.  This is only slightly higher than the 18% who believed the same thing when GDPR took effect 6 months ago.

Young More Trusting

The report appears to indicate that although trust levels are generally low, younger people trust businesses more with their data.  For example, the report shows that 33% of 18-24 and 34% of 24-35 year olds trust businesses with their data, compared with only 17% of over 55s.

More Empowered But Lacking Knowledge About Rights

Consumers appear to feel more empowered by GDPR to act if they feel that organisations are not serving them with the right communications.  For example, the report showed that rather than just continuing to receive and ignoring communications from a company, 50% of those surveyed said that GDPR has motivated them to not consciously opt-in to begin with, or if opted in, make them more likely to subscribe.

This feeling of empowerment was also illustrated back in August in a report based on a study by business intelligence and data management firm SAS.  The SAS study showed that more than half of UK consumers (55%) looked likely to exercise their new GDPR rights within the first year of GDPR’s introduction.

Unfortunately, even though many people feel more empowered by GDPR, there still appears to be a lack of knowledge about exactly what rights GDPR has bestowed upon us. For example, the report shows that only 47% of respondents said they know their rights as a consumer in relation to data protection.  This figure has only increased by 5% (from 43%) since the run-up to GDPR.

What Does This Mean For Your Business?

The need to comply with the law and avoid stiff penalties, and the opportunity to put the data house in order meant that the vast majority of UK companies have taken their GDPR responsibilities seriously, and are likely to be well versed in the rights and responsibilities around it (and have an in-house ‘expert’). Unfortunately, there are always a few companies / organisations that ignore the law and continue contacting people.  The ICO has made clear examples e.g. back in October Manchester-based Oaklands Assist UK Ltd was fined £150,000 by the ICO for making approximately 64,000 nuisance direct marketing calls to people who had already opted out of automated marketing.  This is one example of a company being held accountable, but it is clear from the CIM’s research that many consumers still don’t trust businesses with their data, particularly when they hear about data breaches / data sharing on the news (e.g. Facebook), or continue to have their own experiences of unsolicited communications.

It may be, as identified by the CIM, that even though GDPR has empowered consumers to ask the right questions about their data use, marketers now need to answer these, and to prove to consumers how data collection can actually benefit them e.g. in helping to deliver relevant and personalised information.

The apparent lack of a major impact of GDPR on public trust could also indicate the need for an ongoing campaign to drive more awareness and understanding across all UK businesses.

£385,000 Data Protection Fine For Uber

Posted on by Andy Miller

Ride-hailing (and now bike and scooter-hiring) service Uber has been handed a £385,000 fine by the ICO for data protection failings during a cyber-attack back in 2016.

What Happened?

The original incident took place in October and November 2016 when hackers accessed a private GitHub coding site that was being used by Uber software engineers. Using the login details obtained via the GitHub, the attackers were able to go to the Amazon Web Services account that handled the company’s computing tasks and access an archive of rider and driver information. The result was the compromising (and theft) of data relating to 600,000 US drivers and 57 million user accounts.

The ICO’s investigation focuses on avoidable data security flaws, during the same hack, that led to the theft (using ‘credential stuffing’) of personal data, including full names, email addresses and phone numbers, of 2.7 million UK customers from the cloud-based storage system operated by Uber’s US parent company.

The ICO’s fine to Uber also relates to the record of nearly 82,000 UK-based drivers, including details of journeys made and how much they were paid.

Attackers Paid To Keep Breach Quiet

Another key failing of Uber was that not only did the company not inform affected drivers about the incident for more than a year, but Uber chose to pay the attackers $100,000 through its bug bounty programme (a deal offered by websites and software developers to offer recognition and payment to those who report software bugs), to delete the stolen data and keep quiet about the breach.

Before GDPR

Even though GDPR, which came into force on 25th May this year says that the ICO has the power to impose a fine on a data controller of up to £17m or 4% of global turnover, the Uber breach took place before GDPR.  This means that the ICO issued the £385,000 fine under the Data Protection Act 1998, which was in force before GDPR.

Other Payments and Fines

Uber also had to pay a $148m settlement agreement in a case in the US brought by 50 US states and the District of Columbia over the company’s attempt to cover up the data breach in 2016.

Also, for the same incident, Uber is facing a £533,000 fine from the data protection authority for the Netherlands, the Autoriteit Persoonsgegevens.

What Does This Mean For Your Business?

As noted by the ICO director of investigations, Steve Eckersley, as well as the data security failure, Uber’s behaviour in this case showed a total disregard for the customers and drivers whose personal information was stolen, as no steps were taken to inform anyone affected by the breach, or to offer help and support.

Sadly, Uber joins a line of well-known businesses that have made the news for all the wrong reasons where data handling is concerned e.g. Yahoo’s data breach of 500 million users’ accounts in 2014 followed by the discovery that it was the subject of the biggest data breach in history to that point back in 2013. Similar to the Uber episode is the Equifax hack where 143 million customer details were stolen (44 million possibly from UK customers), while the company waited 40 days before informing the public and three senior executives sold their shares worth almost £1.4m before the breach was publicly announced.

This story should remind businesses how important it is to invest in keeping security systems up to date and to maintain cyber resilience on all levels. This could involve keeping up to date with patching (9 out of 10 hacked businesses were compromised via un-patched vulnerabilities) and should extend to training employees in cyber-security practices, and adopting multi-layered defences that go beyond the traditional anti-virus and firewall perimeter.

Companies need to conduct security audits to make sure that no old, isolated data is stored on any old systems or platforms, thereby offering no easy access to cyber-criminals. Companies may now need to use tools that allow security devices to collect and share data and co-ordinate a unified response across the entire distributed network.

Even though the recent CIM study showed that less than one-quarter of consumers trust businesses with their data security, at least the ICO is currently sending some powerful messages to (mainly large) businesses about the consequences of not fulfilling their data protection responsibilities.  For example, as well as the big fine for Uber, back in October, the ICO fined a Manchester-based company £150,000 for making approximately 64,000 nuisance direct marketing calls to people who had opted out via the TPS, and earlier this month, a former employee of a vehicle accident repair centre who stole customer data passed it to a company that made nuisance phone calls was jailed for 6 months following an ICO investigation.

EU’s Web Copyright Directive Could Spell Trouble

Posted on by Andy Miller

A vote in January on contentious new EU copyright laws could negatively impact tech platforms and all online publishers, create risky legal grey areas for many businesses, stifle freedom of expression, and lead to more surveillance and control.

What Copyright Law?

There will be a final vote in January 2019 on an EU Directive on Copyright in the Digital Single Market. According to EU leaders, the intention in creating the new Directive is to modernise copyright laws across all EU member states, and to take account of how people now share and distribute content in the digital age.

The change in the law essentially puts a greater obligation for policing copyright infringement on those companies distributing content / making works available online e.g. tech giants, rather than on individuals for downloading it.

Key Articles

The likely introduction of the new Directive has provoked arguments, many of which relate to 2 particular articles in the Directive. These articles are Article 11, which states that new websites should be able to charge web firms for sharing links to their content, and Article 13, which puts the onus on news websites to work with copyright holders in order to prevent users from uploading content that they don’t own the rights to.

In the case of Article 11, for example, some commentators have asked whether this will mean that there will be difficulties placing a value on articles / article extracts, whether headlines and snippets will require licensing, whether payment will be required for hyper-linking (a ‘link tax’), and whether platforms publishing news e.g. Google, will have to pay compensation for providing headlines and extracts. These kinds of complications and costs could, therefore, discourage the distribution and sharing of news content, and could even discourage the sharing of things like holiday photos on the internet.

For Article 13, the requirement for the installation of ‘content filters’ to help web firms stop users sharing copyrighted content, which appears to be targeted at platforms like Facebook, Twitter and YouTube, has led critics to say that how people use the web doesn’t appear to have been taken into account by lawmakers. Article 13 could, therefore, mean that too much legitimate content is removed, thereby negatively affecting user experience, and sharing news articles online and finding good quality journalism online could become more difficult for web users.

Other Concerns

Several other concerns have been raised about the contents of the new EU copyright Directive, including:

  • This being a potential step towards the transformation of the internet from an open sharing platform to a tool for the automated surveillance and control of users.
  • Content filters creating a kind of censorship, and doubts over whether automatic content filters will be able to detect things like fair comment, satire, criticism and parody.

What Does This Mean For Your Business?

Although the stated intention for the change in the law appears to be a good one, for the tech giants this law change represents greater responsibility and control being placed upon them. The potential for increased costs and legal grey areas could create more risks for any company that simply wants to freely report or share news content. The news directive has, therefore, been widely criticised and greeted with suspicion e.g. back in June, 70 of the biggest names of the internet, including, Tim Berners-Lee, and the Wikipedia founder, Jimmy Wales, signed an open letter citing worries about the news directive being simply used as a way for governments to exert more control and extend surveillance. The use of automatic content filters and the threat of charges for using even headlines, snippets and even hyperlinks certainly look as though they could limit free speech, and discourage and deter the sharing of information and news in a way that could work against the interests of many businesses and organisations.

It remains to be seen how January’s vote goes and whether Brexit will mean that the UK will actually be subject to the directive.