13 August 2015

Wilmslow versus the Bahamas: Dawson-Damer and Others v Taylor Wessing and Others

Source Wikipedia
Reproduced under a Creative Commons Licence

Probably because it implements an EU directive and costs small business owners money to support a bureaucracy in Wilmslow and is cited by petty officials as an excuse for all sorts of irritations the Data Protection Act 1998 is one of the least understood and most maligned and least appreciated Acts of Parliament on the statute book. It does have its used of course and I for one would keep but I suspect that I am in a minority. If Parliament were ever to repeal this legislation the population would breath a mighty and very audible sigh of relief.

In Dawson-Damer and Others v Taylor Wessing LLP and Others [2015] EWHC 2366 (Ch) (6 Aug 2015) the claimants in an action in the Bahamas over the administration of a trust sued solicitors who had advised the trustees of that trust in England for an order under s.7 (9) of the Data Protection Act 1998. The order that they sought would have required Taylor Wessing to deliver all data of which those claimants were the data subject (including data in which they were identified expressly or by inference) in the solicitors' possession custody or power.  Taylor Wessing resisted the claim on the ground that the data were exempt from the subject access provisions of the Act by reason of paragraph 10 of Schedule 7.  The action came on before His Honour Judge Behrens sitting as a judge of the Hight Court.

The relevant statutory provisions are as follows.  S. 7 (1) of the Data Protection Act 1998 provides inter alia:
"Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled—
(a)  to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b)  if that is the case, to be given by the data controller a description of—
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are being or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be disclosed,
(c) to have communicated to him in an intelligible form—
(i) the information constituting any personal data of which that individual is the data subject, and
(ii) any information available to the data controller as to the source of those data ........"
Paragraph 10 of Schedule 7 provides:
"Personal data are exempt from the subject information provisions if the data consist of information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality of communications could be maintained in legal proceedings."
The court has a discretion under s.7 (9) to compel compliance with subject access requests under s.7 (1):
"If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request."
The issues that the judge was asked to decide were the extent of the discretion and whether the paragraph 10 exemption extends to overseas proceedings or even to proceedings between trustee and beneficiary in the courts of England and Wales.

His Honour summarized the claimants' case at paragraph [6] of his judgment:
"Mr Swift QC on behalf of the Claimants accepts that the 1998 Act contains an exemption in respect of data in respect of which a claim for legal professional privilege could be made in legal proceedings. He contends that the exemption should be construed narrowly. It does not extend to the rules of equity in England and Wales under which trustees are not required to disclose trust documents to beneficiaries. Equally it does not extend to local Bahamian rules which apply to disclosure in respect of trust litigation in the Bahamian courts. He submits that as Ashley [the first named claimant] is a beneficiary under the Glenfinnan Settlement [the trust which was the subject of the litigation in the Bahamas] any privilege attaching to Grampian resulting from advice taken is a joint privilege with the result that Grampian cannot rely on the privilege against Ashley. Mr Swift QC invited me to take a narrow view of the discretion afforded to the Court in s 7(9) of the 1998 Act. In particular he drew my attention to the large number of exceptions in Part IV and Schedule 7 and of the power of the Secretary of State in s 38 to make further exceptions. He submitted that the Court should not, as a matter of principle, use its discretionary powers under s7(9) to make further exceptions. In general terms he submitted that if the data was not within one of the exemptions the Court should normally order its disclosure. He accepted that one of the motives for making the subject access requests may have been to obtain documents which might be of use in the Bahamian proceedings but he contended that the Claimants could also verify if the data was correct and, if necessary, take steps to have it corrected."
Judge Behrens  rejected all those contentions.

As to the whether the first (namely whether paragraph 10 of Sched 7 should be construed narrowly so as to exclude overseas proceedings) the judge referred to the Court of Appeal's decision n Durrant v Financial Services Authority [2003] EWCA 1746.  Lord Justice Auld said at paragraph [27] of his judgment in that appeal:
"In conformity with the 1981 Convention and the Directive, the purpose of section 7, in entitling an individual to have access to information in the form of his “personal data” is to enable him to check whether the data controller’s processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in sections 10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties."
Relying on that passage His Honour concluded at at sub-paragraph (2) of paragraph [62] that the purpose of the legislation is "to protect the Claimants' right to privacy and accuracy of the information held" on him and that  it "is no part of its purpose to provide the Claimants with information or disclosure of documents which may assist them in litigation against Grampian whether in England or the Bahamas." He therefore held at paragraph [62] that "paragraph 10 of Schedule 7 should be interpreted purposively so as to include all the documents in respect of which Grampian would be entitled to resist compulsory disclosure in Bahamian proceedings."

As he had decided that the subject access request was exempted by paragraph 10 of Sched. 7 the exercise of his discretion did not arise but the judge added at paragraph [73] that he would have declined as a matter of discretion to order Taylor Wessing to comply with the subject access requests for the following reasons:
"1. In my view the real purpose of the subject access requests was to obtain information to be used in connection with the Bahamian proceedings. As Mr Taube QC said at the beginning of his oral submissions – "context is everything". These requests were made after MWE had written the letter of 18 February 2014 challenging the validity of the 2006 and 2009 appointments and TW had sent a detailed reply on 9 July 2014. It is, to my mind, of considerable significance that MWE stated in their letter of 4 August 2014 that they would reply to the letter of 9 July 2014 when they have received the documents. Furthermore there is no suggestion in any of the evidence filed on behalf of the Claimant that they wish to check the accuracy of the information held by TW and to have it corrected if it is inaccurate. In my view the Claimants would not have brought the application at all if it had not been for the purpose of assisting in the Bahamian proceedings which were being contemplated. As Auld LJ makes clear in paragraph 27 of Durant this is not a proper purpose.
2. In my view Mr Taube QC's arguments on the question of whether it is reasonable and proportionate to expect TW to carry out a search are just as valid on the question of the exercise of the discretion under s 7(9) of the 1998 Act. This is a case where the question of which documents are discoverable will have to be determined in the Bahamian proceedings according to Bahamian law. The extent to which disclosure will be ordered may depend (if Sir Michael is correct) on the allegations that Ashley makes in those proceedings. The parties in the Bahamian proceedings are the trustee and the beneficiary. It is plainly more desirable that the issue be determined between those parties rather than between TW and the beneficiary. It seems quite unnecessary that the matter should be determined by the English Court in addition to the Bahamian Court.
3. If and in so far as the exception in paragraph 10 of Schedule 7 is restricted to the English law of disclosure and if and in so far as the documents discoverable under English law are more extensive than those under Bahamian law it does not seem to me a proper use of the 1998 Act to enable the Claimants to obtain documents that they could not obtain in the Bahamian proceedings."
Although the judge gave the defendants permission to appeal I should be very surprised if the Court of Appeal overrules him. The purpose of the Act is to regulate "the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information" and it is not to introduce novel and far-reaching procedures which would undermine  our own and foreign judicial systems. The data protection legislation has received a very bad press lately particularly over the right to be forgotten (see Right to be forgotten: a Transatlantic Dialogue 1 Aug 2015). Had the case been decided differently the legislation would have been even further discredited. 

05 August 2015

Ukulele Wars: The Ukulele Orchestra of Great Britain v Clausen

Although Judge Hacon's decision in The Ukulele Orchestra of Great Britain v Clausen and Another [2015] EWHC 1772 (IPEC)  was reported as a "victory" in the Independent (The Ukulele Orchestra of Great Britain wins duel with German 'copycat' 3 July 2015) it was somewhat of the pyrrhic kind.  The Ukulele Orchestra of Great Britain sued The United Kingdom Ukulele Orchestra for trade mark infringement, copyright infringement and passing off and applied to strike out the defence on the grounds of abuse of process less than two weeks before the trial. The claim succeeded on passing off but failed on all other counts. The claimants lost their Community trade mark and the judge saw no merit in the strike out application whatever.

The case is an interesting one because it considers what can be protected by intellectual property. The parties were very similar acts.  The claimants' was described as follows by Judge Hacon at paragraph [1] pf his judgmenrt:
"The Claimant ("UOGB") is a partnership of two individuals, George Hinchliffe and Marian Lux. In 1985 they founded and have since operated a group of musicians who play ukuleles and who collectively perform under the name 'The Ukulele Orchestra of Great Britain'. Over the years their gigs have developed a certain style, with the members wearing evening dress – black tie or gowns as the case may be – telling jokes and delivering mostly well known rock songs and film themes on their ukuleles. UOGB has enjoyed considerable success, particularly in this country and in Germany."
Here they are playing Wagner at the Proms:

And here are the defendants playing Bach:

They are a limited partnership under German law based in Germany but consisting of British players.

The claimants had registered THE UKULELE ORCHESTRA OF GREAT BRITAIN as a Community trade mark for
"Organisation, management, staging and provision of live events, concerts, musical performances, and theatre and stage productions; concert services, orchestra services, production of radio and television programmes; publication of electronic publications relating to music and musical instruments; entertainments services"
in class 41 as well as for various goods in classes 9, 15, 16, 18, 25 and 28.

The judge held that had that CTM registration been valid the defendants would have infringed it under art 9 (1) (b) and (c) of the Community trade mark regulation (Council Regulation (EC) No 207/2009of 26 February 2009on the Community trade mark OJ 24.3.2009 L78/1).  After considering paragraphs [33] to [39] of Lord Justice Floyd's judgment in JW Spear & Sons Ltd & Ors v Zynga Inc [2015] FSR 19, [2015] EWCA Civ 290 Judge Hacon concluded at paragraph [57]:
"The CTM and the accused sign are visually and aurally similar to the extent that they both contain the words 'ukulele orchestra'. I think this is an instance in which conceptual similarity is likely to register strongly with the average consumer. In that regard mark and sign are extremely close. As was pointed out at trial, it is certainly true that 'Great Britain' and 'the United Kingdom' do not mean the same thing. But even in this country some pedants might hesitate before getting the difference right. I doubt that the distinction either means anything or matters at all to the vast majority of people elsewhere in the EU. The average consumer, in short, would regard mark and sign as having the same meaning."
Basing himself just on that and the other matters to be taken into account as directed by the above passage from Spear v Zynga he reached the view that there was a likelihood of confusion.

There was also some actual evidence of confusion. The judge observed at paragraph [68]:
"It is possible that if all these instances had been fully explored and tested in cross-examination, some would have fallen away as not being proof of relevant confusion. I was left with the impression that many would support UOGB's case on confusion. In my view, if the CTM had been valid, it would have been infringed by UKUO pursuant to art.9(1)(b)."
That same evidence was relied on in the action for passing off. Judge Hacon said at [92]:
"I am satisfied that the evidence adduced in support of the likelihood of confusion pursuant to art.9(1)(b) establishes that Yellow Promotion's use of the trade name 'The United Kingdom Ukulele Orchestra' misrepresents to a substantial proportion of the public in this country who recognise 'The Ukulele Orchestra of Great Britain' as the trade name of a particular musical group, that UOGB and UKUO are the same group or are otherwise commercially connected. I am also satisfied that this has caused damage to UOGB's goodwill, particularly by way of loss of control over UOGB's reputation as performers."
That was the one bit of the case upon which the claimants succeeded.

As for the remainder of the case the judge threw out the trade mark infringement claim and invalidated the CTM registration on the ground that it was descriptive within the meaning of art 7 (1) (c). The copyright claim failed on the basis that no copyright could subsists in the claimants' act though it might subsist in recordings of one or more of their performances. The strike out application was based on an inference that the defendants had doctored evidence and that a fair trial was not possible. The judge disagreed.

The judge was right to decide this case as did. This was an attempt to suppress a lookalike or to put it another way to monopolize an entertainment style. That would have had very profound and deleterious effects on the performing arts had it succeeded. It would have outlawed not just tribute bands but many legitimate artists who may be influenced by an earlier work and create something new in the same style without copying it.

Should anyone wish to discuss this case with me he or she should call me on 020 7404 5252 during office houses or send a message through my contact form.

01 August 2015

Right to be forgotten: a Transatlantic Dialogue

Cathy Gellis
Jane Lambert

On 12 June 2014 La Commission Nationale de l'Informatique et des Libertés (CNIL). the French data protection authority, issued a notice requiring Google to apply de-listing from all platforms of its search engine such as Google Sierra Leone and Google Mongolia and not just those like Google UK, Google France and Google Deutschland that are marketed to residents of EU member states. In his post Implementing a European, not global, right to be forgotten 30 July 2915 Google's privacy counsel Peter Flecischer stated that Google had refused to implement that notice and had asked the CNIL to withdraw it.

It is possible that the CNIL will change its mind and do so but it is more likely that it won't.  In that case the President of the Commission could nominate a Rapporteur and ask him or her to draft a report recommending sanctions to be imposed on Google for such non-compliance. Google could of course challenge the CNIL's decision in the Conseil d'État. As the obligation that the CNIL purports to enforce arises under EU law  the Conseil d'État will be urged to seek a preliminary ruling under art 267 of the Treaty on the Functioning of the European Union ("TFEU") from the Court of Justice of the European Union ("CJEU") on the nature and extent of the so-called right to be forgotten.

I say "so-called" because you will struggle if you look for the right to be forgotten in the Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data OJ L 281 , 23/11/1995 pages 31 - 50) or member states' implementing legislation. The phrase "right to be forgotten" may not have been coined by the CJEU in C‑131/12 Google Spain SL and Another v Agencia Española de Protección de Datos (AEPD) ex parte Costeja 36 BHRC 589, [2014] 3 CMLR 50, [2014] EMLR 27, EU:C:2014:317, ECLI:EU:C:2014:317, [2014] All ER (EC) 717, [2014] 3 WLR 659, [2014] ECDR 16, [2014] 2 All ER (Comm) 301, [2014] EUECJ C-131/12, [2014] 1 QB 1022, [2014] QB 1022 bur it entered everyday speech after that judgment.

The Costeja case was a reference for a preliminary ruling under art 267 TFEU from the Audencia Nacional in Spain. It was made in an application by Google Spain and its US parent company to quash an order of the AEPD, the Spanish data protection authority. The AEPD required Google to withhold from its search results URLs to advertisements that had appeared in a Spanish newspaper many years ago of an auction of Mr Costeja's property that had been seized and sold to pay his social security arrears. Mr Costeja had complained to the AEPD that the advertisements came up on every search of his name. He had rebuilt his life since then and those advertisements were a constant embarrassment.  He asked the AEPD to order the newspaper to remove the advertisements and Google to stop including them in its search results.  The AEPD rejected his request in respect of the newspaper since the advertisements had been ordered by the Spanish Ministry of Labour but upheld it against Google.

In the Audencia Nacional the Google companies had argued that Spanish data protection law did not apply to search engines. They argued that search engines were not "data controllers", that they did not process personal data and that in any case they were not within the Spanish courts' jurisdiction. As the Spanish legislation purported to implement the Data Protection Directive the Audencia Nacional referred those questions to the CJEU. The actual questions and reply are lengthy but paragraph [1] of the CJEU's judgment summarizes them conveniently:
"This request for a preliminary ruling concerns the interpretation of Article 2(b) and (d), Article 4(1)(a) and (c), Article 12(b) and sub-paragraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) and of Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’)."
The CJEU recognized at paragraph [19] that it had to apply a 1995 directive to technologies that had emerged after the adoption of that legislation.

Essentially, the CJEU held that Google (and no doubt all other search engines including Yahoo and Bing) were data controllers and that they processed personal data. It followed that Spanish data protection law applied to their activities and that they had to comply with its data quality and subject access provisions just like everybody else. One consequence of the CJEU's decision was that Google and other search engine operators were subject to enforcement notices from national data protection authorities. Also, they could be sued by data subjects in national courts for any loss or damage that might arise from breaches of their obligations under those laws.

Google responded to that judgment by establishing procedures for handling requests for search result removals. It prepared a simple form and FAQ for such requests. As of 31 July 2015 Google had received 291,243 removal requests and considered nearly 1,6 million URLs since Costeja. It had removed 41.3% of those URLs and had rejected removal requests in respect of 58.7%. Its Transparency Report gives examples of requests that it has accepted and others that have been rejected. Those whose requests are rejected are, of course, free to complain to their national data protection authority or bring proceedings in their national courts. It is not known how many have done so. Bing and Yahoo have established similar procedures. Bing's request form is here and Yahoo's is here.

Although Mr Fleischer characterized the right to be forgotten as a European right and not a global one, similar rights seem to exist elsewhere. In Melvin v Reid and Others 112 Cal.App. 285 (Cal. Ct. App. 1931), for example, the California Court of Appeal allowed a claim against a film maker who had exposed the claimant's early life as a prostitute on the ground that the film had invaded her privacy. It seems to me that the issues in that case as well as the outcome were very similar to those in Costeja.

Should anyone wish to discuss this article with me, the right to be forgotten or data protection generally, he or she should call me on 020 7404 5252 during office hours and send a message through my contact form.

Post Script

As I wrote this post at the suggestion of Cathy Gellis who practises IP and internet law in California I drew it to her attention by twitter to which she kindly replied:
Helpfully, she also made the following observations:
@nipclaw or let me rephrase: the right to privacy may remain, but not such that deletion would be a recognized remedy.
Adding in her next tweet
@nipclaw especially not by a party not connected to the act that invaded the privacy. Section 230 would also preclude.
I am sure Cathy is right but nobody even in Europe argues that excluding URLs from a search report is the only or even in many cases the appropriate remedy.

I replied:
@CathyGellis I think Melvin was an action for damages rather than an injunction. The point is that the cause of action appears to subsist.
I added:
CathyGellis The cause of action in Melvin seems to be invasion of privacy which is essentially what data protection is all about.
And concluded
@CathyGellis my point is that the right to be forgotten (subject access and data quality) exists well beyond the shores of the EU states.
We shall have to see how this area of the law develops on both sides of the Atlantic but one thing of which I am very sure is that Americans don't take injustice and invasion of privacy lying down. Had Mr Costeja lived in San Francisco rather than Spain I suspect he would have consulted Cathy or some other US lawyer and asked whether there was anything to be done about the embarrassing search records. Knowing Cathy as I do, it is more than likely that she would have found a way to help him.

Further Reading

Farhad Manjoo  ‘Right to Be Forgotten’ Online Could Spread 5 Aug 2015 NYT