European Court: Internet providers can't be forced to monitor users

The European Court of Justice (ECJ) on Thursday overturned a Belgian court's ruling requiring Internet service providers (ISPs) to snoop on users' private data, in a major victory for the ISPs and digital rights advocates over content owners worried about online copyright infringement. 

The ECJ, the European Union's highest court, struck down an injunction by the Belgian national courts that required Benelux telecom provider Scarlet to monitor copyright infringement among its users.  SABAM, the Belgian association of authors, composers, and publishers, sought the injunction to protect the royalties of its members.

The high court ruled that the injunction failed to comply with an EU ban on "imposing a general monitoring obligation" on ISPs and with the requirement to strike a fair balance between the right to intellectual property, freedom to conduct business and, in a key decision, "the right to protection of personal data and the freedom to receive or impart information."

The ruling will boost legal protections for both ISPs and individual users across Europe, since as an EU court, the ECJ's ruling has consequences for laws across all 27 EU member states. 

"In general terms with ECJ judgments, the way they are interpreted by national courts is always a question," says Richard Dissman, an expert in contentious intellectual property issues at Munich law firm Bird and Bird.

Mr. Dissman says the ECJ ruling is not the end of the matter, but that it does form a cornerstone for future dealings. "My experience with other ECJ judgments is the rights owners will find a way to live with it. They will certainly lobby for new legislation, arguing it's a pirates' charter, but they will also find ways to work with this regime."

Victor Vazquez-Lopez, senior legal counsel with the World Intellectual Property Organization (WIPO), says the ECJ ruling underscores current legal procedure.

"There is a very basic principle which derives from our 1996 internet treaties […] that Internet intermediaries [such as ISPs and websites that host user-uploaded content] are not directly liable, but that does not mean they do not have an indirect liability and several countries have legislated on that basis, such as the United States' Digital Millennium Copyright Act in 1998 and the EU's [2000] Electronic Commerce Directive."

'A confirmation of longstanding principles'

SABAM issued a press statement saying it "takes note of this decision and shall propose alternative measures in order to protect the authors and their works."

Both ISPs and digital rights advocates welcomed the judgment.

ISPs had complained that monitoring their networks for copyright infringement would create an onerous regulatory regime that could harm Europe's economy. 

"Considering the major contribution that the internet industry can make to the economic recovery, it was indeed not the time to put the innovation of the internet at risk, and it is of fundamental importance for the future of the internet that the principles reaffirmed in the ruling are respected,” said Malcolm Hutty, president of the European Internet Service Providers' Association (EuroISPA).

Smaller ISPs in particular were concerned that they would suffer a competitive disadvantage against major telecoms companies, as they would be unable to afford the necessary monitoring.

Digital rights groups, meanwhile, see the ruling as a recognition of common sense.

"It's not so much a victory as a confirmation of longstanding principles," says Joe McNamee of European Digital Rights (EDRI), a Brussels-based group which coordinates lobbying and activism on internet issues in all 45 Council of Europe member states, including the 27-member EU.

Mr. McNamee sees the decision as a vindication of Internet freedom: "Above anything else, we shouldn't be in a situation where our communications are manipulated by private companies operating on a whim."

Practical implications for telecoms

One implication of the judgment is the definition of IP addresses, a number given to every device on the Internet allowing it to be identified in order to send and receive data, as "protected personal data."

Irish telecom company Eircom has been operating a "three strikes and you're out" rule on illegal file-sharing since May 2010 and the ruling has implications for this policy.

"We do not monitor our network [for infringement]," says Eircom head of communications Paul Bradley. "What happens at the moment was [the result of] an out-of-court settlement where [it is] the record companies that go onto file-sharing networks and collate IP addresses, supply them to us and we run then against our customer records and correspond with our customers."

Even this, where no personally identifying information is passed to rights holders, may now be prohibited by the ECJ ruling.  

"We're considering the judgment […] whether or not an IP address is personal data," says Mr. Bradley.

Eircom offers a free legal music streaming service to all of its customers: "There is a balance to be had in all of this," says Mr. Bradley.

Ireland's Data Protection Commissioner confirmed to The Christian Science Monitor it was already investigating the "three strikes" policy but a spokesperson said they could not confirm any details at present.

Sharp contrast with SOPA

The ECJ ruling comes as the US government considers moving in the opposite direction, as the contentious Stop Online Piracy Act [SOPA], which includes similar monitoring requirements, works its way through Congress.  Although proponents of SOPA like Rep. Lamar Smith (R) of Texas argue that the act will target only rogue, foreign websites that infringe copyrights, US Internet rights groups like the Electronic Frontier Foundation call it "the worst piece of IP legislation we’ve seen in the last decade," which would "sabotage the domain name system" and "threaten to effectively eliminate the DMCA safe harbors that, while imperfect, have spurred much economic growth and online creativity."

And European experts warn that SOPA could also affect US-EU relations. "The US exports vast amounts of audio-visual content and needs to get into overseas markets," says Joe McNamee of European Digital Rights (EDRI), a Brussels-based group which coordinates lobbying and activism on internet issues in all 45 Council of Europe member states, including the 27-member EU.

Mr. McNamee argues SOPA could open-up a Pandora's box of international feuding. "Has it considered the dangers of protectionism? What if people [respond to SOPA] saying 'Let's keep American culture out?'"