Naked Law

Purchasing a domain name?

So, picture this scenario that we recently came across.  You've got an idea for a product, you've thought of a really clever name for it and you've tracked down who owns the domain name reallyclevername.com.  You've even negotiated a deal with the domain name owner for the sale of reallyclevername.com, and have a contract ready for signature.  You're virtually ready to launch the product, right?  Wrong.

It's easy to forget that using a domain name could infringe someone else's trade mark, even if you had no intention of taking unfair advantage of that trade mark. 

Under ICAAN's Uniform Domain Name Dispute Resolution Policy (UDRP), to succeed in an action against a domain name owner, the complainant must show that (a) the domain name is identical or confusingly similar to a trade mark in which the complainant has rights, (b) the domain name owner has no rights or legitimate interest in the name, and (c) the domain name is being used in bad faith.  Now we'd imagine that you're not going to use the domain name in bad faith, so you should be able to defend an action under the UDRP.

However, if someone else has registered really clever name for goods or services that are identical to those you wish to provide, your use of reallyclevername.com will almost certainly infringe their trade mark and entitle them to damages, an account of profits and/or an injunction requiring you to stop using the reallyclevername.com domain name.  Your reallyclevername.com domain name could also infringe another person's trade mark if it is similar to the trade mark, is used in connection with similar goods or services and its use is likely to confuse the public into believing that there is a link between your reallyclevername.com domain name and the other party's trade mark.  That would be quite annoying if you'd paid a substantial amount for reallyclevername.com, and so our advice when you are looking to purchase a domain name is to always check the trade mark registry in your jurisdiction (in the UK, this is the Intellectual Property Office) and to carry out an internet search to see if the really clever name is being used by any other entities before you go ahead and buy reallyclevername.com.

Has the Faccenda Chicken come home to roost?

We've been working on a social media policy for a client.  As a point of reference, we took a look at a precedent on a popular legal information service.  This suggests the following:

You are not permitted to add business contacts made during the course of your employment to personal social networking accounts, such as Facebook accounts or LinkedIn accounts.

OR

The contact details of business contacts made during the course of your employment are regarded as our confidential information, and as such you will be required to delete all such details from your personal social networking accounts, such as Facebook accounts or LinkedIn accounts, on termination of employment.

I understand why these have been included.  Lists of contacts (and more particularly customers) are valuable to businesses and typically protected in employment contracts through confidentiality provisions and restrictive covenants.  The advent of social networking sites has meant that businesses have lost control of this information (because it is held by employees within their personal accounts).  These clauses are intended to limit the risk - but I just can't see them working.

The clauses suppose that lists of contacts are still the company's information ("our confidential information").  But most LinkedIn users can now see each others' lists of contacts - are they really "confidential"?  I can see the first option (no use of LinkedIn) working - but for most businesses I'd have thought that the adverse effect on business development of a blanket ban on business social networking would outweight the benefit of retaining control of the customer list.

My feeling is that businesses will need to rely on restrictions over what ex-employees do with information rather than which information they are entitled to have.  Claiming "ownership" over someone's list of contacts is rather outmoded and out of keeping with social media norms.  For example, a company could hardly require staff to hand over all their LinkedIn contacts when leaving - apart from anything, this would probably breach the Data Protection Act (you link to the individual, not the company).  So you can keep the list - but you can't sell competing products to them.

This made me wonder whether the notion of customer lists being protectable trade secrets is sustainable in the era of social media.  Will it seem quaint or Big Brotherish in the future that companies tried to "own" the social capital created by their employees?

The rules on cookies are changing – are you prepared?

Most people will be aware that the rules on the way in which you are able to use website cookies are about to change. The new rules are causing quite a fuss in the media, but will they really make any difference to the way businesses operate their websites?

For now, I think the answer to that is probably no.

The EC Directive governing use of cookies - the EU Privacy and Electronic Communications Directive, otherwise known as the “e-Privacy Directive”, currently requires website owners to inform visitors about the use of cookies, the purpose for which they will be used and the right to opt-out. The amended Directive places an obligation on website owners to obtain “explicit consent” from visitors before using cookies.

But at the moment the Government is unsure how to tackle these changes.

As a result, it has not yet published any guidance or recommended solutions for implementing the new rules before they come into force on 25 May. The Information Commissioner’s Office (ICO), who will be responsible for enforcing the rules once they come into force, has also confirmed that it is unlikely to take any enforcement action against businesses in the short term. So come 25 May, in practice the new rules will have little impact.

However businesses do need to start thinking about what they should be doing to comply with the rules now. Why? Well here are some examples:

1. You don’t want to be caught unawares and then face a mad panic to comply when things start moving forward.
2. It will probably take some time to decide on a useful and workable approach for your business.
3. Once the Government’s guidance is published, the ICO is likely to be less lenient in enforcing the rules.

So, although the new rules will not make much difference at this stage, they are likely to at some point in the near future. As a result, I would recommend adopting the famous scouting motto - Be Prepared!

Advertising broadband speeds – Ofcom has its say

Ofcom has recommended that ISPs should stop advertising broadband services as being ‘up to’ a maximum speed and instead use a typical speed range (TSR). But will this really make any difference to the average consumer?

The latest research published by Ofcom found that only 14% of users on ‘up to’ 20Mbit/s received average download speeds of over 12Mbit/s, while 58% received average download speeds of 6Mbit/s or less. It recommended that a TSR is used by ISPs in adverts for their broadband services, because that would offer consumers a more informed choice on the basis of speed.

That’s all very well and good if you live in an area with a large choice of providers, not too far from an exchange, or are lucky enough to have fibre connections rather than copper lines, but if you don’t, what difference is the change in advertising actually going to make?

In my experience (having moved fairly recently) the limited choice of ISPs operating in the same semi-rural area offer you around the same speed. The reason being that they are all subject to similar service constraints. Looking at TSRs would not improve my chances of receiving a high-speed broadband service, as, stating the obvious, I can only get what is actually available.

Also, if the TSR is calculated nationally, I don’t see how this will assist people making a decision in a specific area. It is already possible to check your estimated speed on most ISPs’ websites before signing up, just by providing your telephone number and post code. Surely this is more use than a national range?

Basically what I’m saying is yes Ofcom, the advertising can be annoying, but I’d rather you just concentrated on getting me a faster service…

Are copyright laws out of date? The government thinks so…..

Due to the continued evolution of the internet, it seems that many of our existing laws are being adapted to accommodate the unique challenges that the online world presents. Often, this process involves a relaxing of UK laws to increase profitability of online businesses - but when does ‘relaxed’ become 'too relaxed'?

This question is dividing opinion following David Cameron’s announcement earlier this month that IP laws are to be reviewed to make them fit for the internet age.  He suggested that the law could be relaxed to be closer to the laws in the US, and to allow greater use of copyright material without the permission of the owner. He noted that the founders of Google ‘have said that they could never have started their company in Britain.’

Some internet campaigners have welcomed the announcement, saying that it will boost small businesses, whilst the film and music industries are likely to continue to resist reform.

UK law firm Taylor Wessing, meanwhile, has said that it does not believe that the Government can introduce a US-style fair use exemption without renegotiating the text of the European Copyright Directive 2001/29/EC, which sought to harmonise copyright law across Europe.

It remains to be seen whether the Government will achieve the right balance between accessibility and practicality. Professor Ian Hargreaves, the current chair of Digital Economy at the Cardiff School of Journalism, Media and Cultural Studies and Cardiff Business School, will be leading the review.

ICO issues first penalties for data protection breaches

In recent times, mass loss of personal data has become major news, particularly where it involves well-known organisations or sensitive information.  We reported back in January that guidance from the Information Commissioner’s Office on monetary penalties for serious data protection breaches had been approved by the government. It is only now, however, that the first monetary penalties have been served by the on those found guilty.

The first of the two penalties issued was for £100,000 and was served on Hertfordshire County Council for two serious incidents where employees faxed personal details involving child sexual abuse and care proceedings. One of the main reasons for such a high penalty in this case was the fact that the local authority had allowed the breach to happen twice in two weeks and had not learnt from the original mistake.  Rather embarrassingly, both faxes had been sent from the Council’s legal department!

The second penalty of £60,000 was served on employment services company A4e for the loss of an unencrypted laptop containing personal information about 24,000 people, including their names, income levels and dates of birth.

These penalties are a stark warning to organisations that the ICO is willing to use the full weight of its enforcement powers where necessary, including issuing monetary penalties of up to £500,000.

Will the Digital Economy Act ever be fully implemented?

You may remember back in July that we mentioned the ongoing Digital Economy Act debate.  Well, suffice to say that the discussion on the Act is now turning from a debate into a saga , as TalkTalk and BT have been granted judicial review of the Digital Economy Act by the High Court.

By way of recap, one of the issues that BT and TalkTalk had with the Act was not only its content, but the way in which it had been debated. The companies argued, along with a number of MPs, that the legislation had been ‘rushed through parliament’ before the election, and was debated too briefly for its complex nature, with apparently only 6% of MPs attending the debate.’

Another problem the internet service providers have with the Act is that parts of it require them to take action against suspected illegal file sharers where the ISP has 400,000 or more subscribers. Both BT and TalkTalk were concerned that this would drive their customers to smaller ISPs. Part of the review will consider whether these parts of the Act are in breach of the e-commerce directive, which rules that ISPs cannot be held liable for traffic on their networks.

Now the courts will look at the Act in detail and consider whether it is legal and justifiable.

Andrew Heaney, director of strategy and regulation at TalkTalk, has called on the government to put the legislation on hold pending the enquiry. On the other side are the music industry, who believe the Act is necessary to reduce online copyright infringement by way of file sharing. But is either side going to be satisfied with the judge’s ruling?

We will keep you updated on this…..

Terms & Conditions - in clear English!

As mentioned elsewhere (see "In defence of the Information Commissioner"), a recent Parliamentary debate touched on the terms and conditions typically found on websites.  The MP for East Hampshire (Damian Hinds) claimed that the Information Commissioner's 36-page code of practice on the collection of personal information online "...is challenged, in terms of length and density, only by the typical set of terms and conditions found on most websites".

Mr Hinds suggested that: "One baby step...might be to encourage all websites to produce a much simpler version of their terms and conditions - perhaps only half a page, explaining in clear English the sorts of uses to which their data will be put."

This is something we have assisted clients with on a number of occasions previously.  We are used to providing short data protection and privacy statements for inclusion on websites and are not surprised to see further calls for clear statements about how data collected online will be used.  This is in line with ICO guidance, which states that: "When you collect information about people they should know who you are and what you're going to do with their information.  There should be a clear, prominent explanation of this on any website through which personal information is collected."

Although a data protection and privacy statement should not replace website terms of use dealing with (amongst other things) intellectual property ownership and liability, the use of a separate, clear, data protection and privacy statement is obviously now being strongly encouraged.  If you have a website through which you collect personal information and would like assistance putting together a data protection and privacy statement, do get in touch.

In defence of the Information Commissioner

There has been a recent Parliamentary debate about the impact of the Internet on personal privacy, led by the MP for Wantage & Didcot (Edward Vaizey).  It has been widely reported that Mr Vaizey is proposing to sit down with Internet Service Providers and discuss the possibility of setting up a mediation service for Internet users who are concerned that their privacy has been breached, or that their personal information displayed online is inaccurate.  However, this Naked Lawyer's eye was caught by those comments relating to the Information Commissioner's code of practice on the collection of personal information online and the comments about the terms and conditions typically found on websites (see "Terms & Conditions - in clear English!").

In respect of the code of practice, Mr Vaizey stated: "It is 36 pages long and densely printed - I do not think the commissioner has worked in public relations - so I am not sure that it is being read in the Dog and Duck, but at least the details exists."

As one who regularly checks guidance published by the Information Commissioner's Office (ICO) to ensure our advice to clients is up-to-date, I would like to stand up for the ICO here.  The code of practice is intended to give good practice advice to organisations that do business online and so, from that point of view, the more advice it provides, the better.  It is not aimed at consumers who use the Internet - the ICO provides short, clear guidance to consumers elsewhere on the ICO website - and, furthermore, the ICO provides a clear and concise two-page checklist for small and medium sized businesses that collect personal information online.  In my view, if you are conducting business online, the ICO website can be a very useful place to find guidance on the requirements about data collection and data sharing - it's well worth a look!

Online copyright infringement - both sides of the debate weigh in!

Last week saw some interesting activity in the ongoing debate over the hot topic of online copyright infringement (something we've been blogging about fairly regularly of late - see here).

The ‘Open Rights Group’ (ORG) is a UK-based organisation that, amongst other things, campaigns against digital rights management. They have recently criticised the draft code of conduct that Ofcom recently released. Their criticisms include issues relating to gathering evidence: the Digital Economy Act requires the definition of evidential standards and in their view the code fails to do this. They also cite a number of other perceived deficiencies in the draft code.

Consequently, ORG are concerned about the authenticity and accuracy of any evidence which is gathered under the Act, and are calling for a new code to be published. Ofcom's consultation on the draft code closed on 30 July - although ORG do not appear to be on the list of responses.

An organisation which, predictably, is taking a polar-opposite view of this issue to ORG is the record label ‘Ministry of Sound’. An interview with on of their lawyers confirms they have "decided to take a stand" against file sharers, and have recently sent out letters to (allegedly) guilty parties (of the 40,000 or so illegal up loaders of infringing material they have identified, about 2,000 have been sent letters). The letters themselves set out the evidence that has been gathered, whilst also threatening legal action, before inviting the recipient of the letter to settle the matter for £375.

Before any ISPs will disclose the name and address of an offender, the Ministry of Sound had needed to demonstrate an arguable case to a court, and subsequently obtain a court order. Up to that point, they could only identify people by their IP addresses. If Ofcom gets its way, this information-seeking requirement is set to disappear with ISPs coming under an obligation to gather information on illegal file-sharing activity, and pass such information on to copyright owners when it reaches a certain threshold.

It looks like the debate on this one could run for quite a while yet, although organisations such as the Ministry of Sound are hoping that their actions will encourage file-sharers towards legitimate sources of legal downloads, such as Last.fm or Spotify.