Time to Data Protection Monetary Penalties

Fog in Channel; Continent Cut Off

Whilst the headline “Fog in Channel; Continent Cut Off” may be apocryphal, there are certainly a number of examples of “they do things differently over there” that arise out of European law.

The most recent is the way the Lisbon Treaty has amended the numbering of all the continuing articles from the Treaty of Rome (creating the European Economic Community (EEC)) or the Maastricht Treaty (creating the European Community (EC)) from its effective date, 1 December 2009.  Almost all references to the EEC or EC are replaced by references to the European Union (EU), which now has its own legal identity.

In the UK a statute, unless it is consolidated, survives for as long as it contains provisions that are not repealed.  Provisions that are not amended can therefore continue with their original numbering.  New clauses inserted into statutes are given supplementary numbers (e.g. section 55A to 55E of the Data Protection Act 1998 discussed in out last post).  This can mean that a statute can survive with only one clause in force (e.g. Statute of Frauds 1677)

In Europe, however, each major treaty consolidates and amends former treaties.  Provisions that have not been amended since their introduction in the Treaty of Rome signed in 1957 have therefore regularly been renumbered, to the annoyance of practitioners.  However, for competition and regulatory lawyers and fans of George Orwell, there is at least the consolation that the article dealing with anti-competitive agreements that was formerly Article 85 EEC then Article 81 EC is now Article 101 TFEU (Treaty for the Functioning of the European Union).  The abuse of dominance article becomes Article 102 TFEU.

Disputes will also now be heard first by the General Court (formerly Court of First Instance) or by the Court of Justice  (formerly the European Court of Justice or ECJ).  References to the Court of Justice will be made under Article 267 TFEU (formerly Article 177 EEC or Article 234 EC).

Expect a certain amount of confusion until everyone gets used to the new numbering.

Monetary Penalties under the Data Protection Act 1998

It has been a long time coming, but finally the Information Commissioner is about to get fining powers to enforce the Data Protection Act 1998.  Not all the required orders and regulations required to bring the relevant sections of the Act into effect (ss. 55A to 55E) are in place, but yesterday two important steps were made.

The first was that maximum penalty has now been set: £500,000. (See Data Protection (Monetary Penalties)(Maximum Penalty and Notices) Regulations 2010).

The second was that certain procedural steps regarding the issue of a monetary penalty following a notice of intent have been prescribed. (See Data Protection (Montery Penalties) Order 2010).

Both these instruments are stated to come into force on the same date, which must be the intended date when monetary penalties will be brought into effect.  This date for your diary is:

6 April 2010

Dumb or Dumber Prize Competitions

If you need evidence that prosecuting authorities consider that the general public in the UK is intellectually challenged, then consider the application of the skill and judgment test in the law governing prize competitions.  This test is currently in the Gambling Act 2005 (s.14(5)), but existed in its predecessor, the Lotteries and Amusements Act 1976 (s.14(1)(b)).

The law on prize competitions is that persons operating a prize competition are not regulated by the Gambling Commission and do not need an operating licence under the Gambling Act 2005 if the prize competition is not a lottery.  To be a lottery, the competition must allocate one or more prizes wholly by chance and participants are required to pay to take part.  This covers competitions where there is an indirect payment, such as a charge in addition to the network costs of sending a text message in a competition with entry by mobile phone or entering a competition by phone with a premium rate number.

However, if there is an element in the competition that requires participants to exercise a degree of skill or judgement or display knowledge, then the competition will not be a lottery.  The degree of skill, judgement or knowledge required is that which can “reasonably be expected to prevent a significant proportion of persons” from participating or winning a prize.

The Gambling Commission has published revised guidance on prize competitions and free draws.  In the guidance it makes clear that only a court can definitively interpret the skill and judgement test.  In its guidance, however, the Commission points out that “competitions that ask one simple question, the answer to which is widely and commonly known or is blatantly obvious from the material accompanying the competition” do not in its opinion pass the test.  Yet these competitions appear to be everywhere.

So is the proliferation of these one-question competitions evidence that:

1. the Commission is avoiding using its prosecution powers for some undisclosed internal policy reason (such as to preserve limited resources)?
2. the Commission is unwilling or unable to use its prosecution powers for a lack of certainty about how a court would interpret the skill and judgment test? or
3. prize competition organisers have been able to prove to the Commission’s satisfaction that significant proportions of participants are unable to answer simple questions?

Once bitten; twice shy?

Humberside Police will forever be remembered in data protection circles for being the police force that blamed the Data Protection Act 1998 for its policy of deleting information relating to allegations about the commission of criminal offences, including those of the Soham murderer Ian Huntley (aka Ian Nixon).  Huntley was thus able to secure a position as a school caretaker despite the fact that he had been investigated in the past for sexual offences (one act of indecent assault, four acts or underage sex and three rapes – he had even been charged with rape, but the case was dropped by the Crown Prosecution Service for lack of evidence) and burglary.  His only recorded conviction was for riding a motorcycle without a licence or insurance.

The pendulum has clearly swung the other way, as Humberside and four other constabularies were the subject of separate enforcement notices from the Information Commissioner for retaining records of convictions that were spent under the terms of the Rehabilitation of Offenders Act 1974.  The constabularies appealed to the Information Tribunal.  The decision of the Information Tribunal was to uphold the Information Commissioner’s enforcement notices.  The constabularies appealed to the Court of Appeal, where they were successful. The Court of Appeal judgement has recently been published.

The Court of Appeal decided that the Information Commissioner and Information Tribunal had misconstrued the data protection principles to determine that as the records were not necessary for the “core” police purpose of the detection of crime, they should be deleted.  It was for the data controller to determine the purposes for which personal data was processed, including determining the necessary retention period for data to meet those purposes.  The only restriction in the Data Protection Act 1998 was that those purposes had to be fair and lawful, which included being communicated to the data subject (and included on the data controller’s notification/registration).

It is clear that there is continuing unease about retention of criminal records or other information by police forces, which first became evident in the cases involving indefinite retention of DNA and fingerprint information on persons who have not been charged.  This practice has been ruled to be against an individual’s right to privacy under Article 8 of the European Convention on Human Rights by the European Court of Human Rights in Strasburg (see the S and Marper -v- United Kingdom).

Whilst the constabularies are correct to apply their own judgement to the appropriate retention period for criminal records, this is a sensitive area that calls for legislative intervention. After a consultation on the retention of DNA database records, the Home Office reported in November 2009 that it is considering a limit of six years for the retention of DNA data for innocent persons, but there has been no Home Office response to the Court of Appeal case on the retention of other police records.

Pay up Pompey; Pompey pay up!

It has been reported that on 23 December 2009 Portsmouth Football Club received an extremely unwelcome Christmas present: a winding up petition served by HM Revenue & Customs.  The date set for the winding up hearing is said to be 10 February 2010.  The fixture will be played out at the High Court in The Strand, London.  No details have come into the public domain on the amount owed by Pompey to HMRC, or the grounds for the winding up petition.  However, the grounds are most likely to be that Pompey is unable to pay its debts (s.122(1)(f) of the Insolvency Act 1986).

In response to these reports, Pompey has issued a press release, but this does not appear to make it clear whether a petition has or has not been served.

It seems that just about every Saints fan I know has thoughtfully contacted me with the “Pay up Pompey” version of the Pompey Chimes and to ask what will happen now.

Charles Russell has a well-respected sports law team, whom I could ask, but sadly none of the sports regulatory lawyers are in the office this afternoon.  So rather than bothering any of them, this blog sets out my understanding of the position if a winding up petition has been served, after a quick bit of research (afterall, legal research is one of a lawyer’s core skills!). The situation is, of course, unprecedented.

As far as any winding up petition goes, this can be avoided by Pompey if it agrees a repayment schedule with HMRC before the hearing in February.  If the grounds for the petition are the “just and equitable” grounds (s.122(1)(g)), then Pompey’s lawyers will have to put up a good argument to the court that not winding up the company would be more likely to protect creditors.  It must be remembered that Pompey does have guaranteed broadcasting revenue, and a parachute payment will be paid if it is relegated to the Coca Cola League Championship.

What about its position under the Rules of the Premier League?  Firstly, being served with a winding up petition is not itself an “Event of Insolvency” under Rule C.50, so that there is no immediate league table points deduction.  If the finances at Pompey are so perilous and the club has no realistic ability to avoid the threat of winding up, then it may seek to go into administration.  This will be an Event of Insolvency, which will result in Pompey getting a 9 points deduction (Saints got a 10 point deduction under the equivalent Football League sanction).  Given that Pompey is 4 points adrift of avoiding the relegation zone, a 9 point deduction would surely result in Pompey going down at the end of this season, if it managed to avoid being wound up.

However, if an order is made on 10 February 2010 or if Pompey is wound up before the end of the season, then it will be game over for Pompey.  It will cease to exist as a company.  All the results of its fixtures would be expunged (Rule B.29).  Only two Premier League clubs would be relegated at the end of the season, according to Rule B.29, to keep the league at 20 clubs (the Regulations of the Football League state that three League Championships clubs must be promoted at the end of the season (Regulation 7.4)).

This would leave the First Division of the League Championship one club short.  Regulation 5.2 states that the First and Second Divisions must consist of 24 clubs each, but the promotion and relegation rules as Regulation 10.1.2 do not make clear how this shortfall would be sorted out.  I would therefore expect the legal battles to be between First Division and Second Division clubs, rather than between play-off placed First Division clubs trying to argue that three Premier League clubs should be relegated and four First Division clubs promoted, but given the financial implications of remaining in the First Division, one play-off club might consider making a claim.

Obviously, as a Pompey fan I do not want to see the club wound up, and the club’s press release stenuously denies that Pompey is in financial trouble. From a legal/regulatory point of view it would be interesting to see how the situation would develop at the end of the season if the Premiership did become temporarily a league of 19 clubs.

Help me, Obi-Wan Jacobi; you’re my only hope!

A long time ago in a galaxy far, far away… well, in 1976 California, Lucasfilm began developing Star Wars.  The iconic Imperial stormtrooper helmets and uniforms were made by Andrew Ainsworth and his company Shepperton Design Studios Limited in England.  He kept the moulds for the vacuum-forming of the plastic parts.  In 2004 he began selling stormtrooper helmets, including helmets to a value of approximately $14,500 to some US customers.

As a result, a copyright infringement, unfair competition and trade mark infringement action was brought by Lucasfilm Limited and the associated rights holders (together, “Lucasfilm”) against Ainsworth in a District Court in California.  That action succeeded, with Lucasfilm awarded $5m damages for copyright infringement, $5m for trade mark infringement and unfair competition, together with an additional $10m compensatory damages.

Lucasfilm sought to have the US judgement enforced in the UK, as well as bringing a UK copyright infringement action.  In a High Court judgement given on 31 July 2008, Lucasfilm largely failed. They appealed. Lord Justice Jacob gave the Court of Appeal judgement yesterday. It should not be a surprise to Star Wars fans that the lone crusader overcame the might of the Lucasfilm “Empire”, but how did the Court of Appeal save the “plucky Brit” from certain bankruptcy and ruin?

UK Copyright

Part of the Lucasfilm claim was that the helmets were a sculpture.  A sculpture is an “artistic work” within the meaning of s.4(1)(a) of the Copyright, Designs and Patents Act 1988, which, by s.4(2)(b), includes a cast or model made for purposes of sculpture.  If Lucasfilm were able to show that the prototype helmet was a sculpture, then copyright in it would have been protected for 70 years from the death of the author/sculptor (s.12(2)).  If the helmet was not a sculpture, then protection of the drawings of the helmet in which Lucasfilm held the copyright would only be for a period of 15 years from the first marketing of reproductions, a period that has expired.  How the period of protection ends up being 15 years is set out in the High Court judgement; it is largely the result of transitional provisions in the 1988 Act, so that the 15 years protection in s.10 of the Copyright Act 1956 applies.  If the helmets had been reproduced after the effective date of the relevant provision in the 1988 Act, s.52 (1 August 1989), then the protection period would have been 25 years.

The Court of Appeal upheld the High Court judgement that the prototype helmet was not a sculpture.  

The Court of Appeal upheld the application of the s.51 defence by the High Court, which permits the making or copying of an article to a copyright design document for anything other than an artistic work or typeface.  It also upheld the application of the s.52 defence, which allows anyone to copy an article after a set period from when the article has been subject to mass production under an industrial process and marketed by a copyright owner (or licensee).  In applying the defence of s.52, it was noted that Lucasfilm had licensed the reproduction of the helmet design in toy stormtroopers, so that the defence applied. 

Lucasfilm’s UK copyright actions therefore failed.

US Copyright

It was clear that the Court of Appeal was not minded to allow Lucasfilm to enforce US copyright in the UK.  Having determined that it was not bound by any binding authority, the Court of Appeal decided that foreign, non-EU (or Lugano Convention) copyrights are non-justiciable in England and that the application of forum non conveniens did not apply to international copyright cases.  This part of the judgement was well argued, as it is one of the points in the judgement that is more likely to be appealed to the Supreme Court by Lucasfilm. 

It was also clear that the UK courts were not sympathetic to the plea by Lucasfilm to enforce the US copyright judgement, particularly as the damages awarded under the US system were massively out of step with what a UK court would award.  This came down to the fact that Andrew Ainsworth had no physical presence in the US, and his website offering the sale of the helmets, although priced in £ and US$ with shipping charges for the US (and Canada), was not determined to be directed at the US, even though there was some advertising of it in the US.  This is an interesting finding for all internet and web-related cases.  The Court of Appeal was not persuaded that owning and operating a website meant that the website owner has a presence in another jurisdiction.

Possible Appeal

As has been noted in other blogs, Star Wars features have tended to come in threes.  Given that we’ve had a High Court Star Wars I and Court of Appeal Star Wars II, we only need the Supreme Court appeal to make the set.  Given the importance of the legal principles raised in the judgements, and the willingness of Lucasfilm to defend its rights in all aspects of the Star Wars films by whatever means, it is to be expected that there will be a Star Wars III.

In defence of the ICO (and regulators)

The ICO was recently criticised in an opinion piece in The Lawyer for disclosing that staff at an unnamed mobile network operator had allegedly sold details of customers.  The piece rightly pointed out that with only 5 operators to whom this could relate, it was only a matter of time before T-Mobile were identified as the operator affected.  It was suggested that whilst this outing led to extensive press coverage, it damaged “the trust relationship between the regulator and regulated” and would lead to less transparency about security failures.  The article noted, “Effective regulation is not just about tougher powers and penalties. Substantial improvements in practices could be achieved through a step change in thinking about the relationship between the regulator and regulated.” 

My personal view (and not that of Charles Russell), is that regulators should not be overly concerned about their relationship with the regulated.  Their guide should be their statutory duties and aims.  They should only consider the state of their relationship with the regulated to the extent that this hinders or promotes those statutory duties.  Undue concern about the relationship leads to regulatory capture by major regulated entities or regulatory paralysis. 

In the case of the ICO, the lack of proper enforcement or rule-making powers has meant that a cooperative, educative or consultative approach has been the only one available since 24 October 1998, or earlier if you include the limited powers of the Data Protection Registry (being the ICO as it existed under the Data Protection Act 1984).  The recent spate of massive data security breaches do not suggest that this has been an altogether successful approach, nor has the limited fines awarded for criminal offences under the Data Protection Act 1998 acted as a serious deterrent.  It is therefore no wonder that the ICO has lost patience with the regulated, and seeks the enforcement powers to be able to use an effective “stick” as well as carrot approach. 

As far as T-Mobile are concerned, whilst they may have suffered some unwelcome and unanticipated adverse publicity as a result of the ICO disclosure, they are probably all too well aware of the amendments agreed to the Privacy and Electronic Communications Directive 2002/58/EC and set out in the Citizens’ Rights Directive 2009/136/EC, which include new obligations on electronic communications service providers to report security breaches to the competent national authority.  Measures must be adopted in the UK in approximately 18 months time to implement this new obligation (the exact date will depend upon when the Citizens’ Rights Directive is published in the Official Journal).  Arguably any breakdown in trust between the ICO and electronic communications service providers who have volunteered information about security breaches will therefore soon be immaterial.  The European Commission is already discussing proposals to broaden the new breach notification obligation to all data controllers, too.

Shareholders, Directors and Bonuses

As the informal lawyer to my group of fellow commuters on the 0634 from Havant to Waterloo, I was asked yesterday to explain why directors of the Royal Bank of Scotland plc (RBS) might consider it necessary to resign if they were not permitted to pay what appears to the general public to be obscene levels of bonuses.  The answer lies in the codified version of the old common law that directors owe a duty to act in the best interests of their company. 

Under s.172 of the Companies Act 2006 directors have a duty to promote the success of the company, with six factors to consider set out at s.172(1).  One of these factors includes acting fairly as between shareholders (s.172(1)(f)).  Where one shareholder demands a particular course of action that in the opinion of the directors is not best suited to promote the success of the company or disadvantages another class of shareholders, they can claim to be put in a difficult position.  The demand by HM Treasury for control over the RBS 2009 bonus pool as a condition of RBS entry into the Governments Asset Protection Scheme is arguably such a course of action, if you consider that the lack of bonuses will lead to the inability of RBS to retain and motivate high performers amongst its staff, so damaging its success and the share value for those minority shareholders not demanding direct control over bonuses.

However, the directors would have no difficulty if they were compelled by a shareholders’ resolution to act in a particular way.  In particular, if the Articles of the company dictated a bonus policy on the company, the directors would be bound to follow the policy or risk derivative action by the shareholders.  In the case of RBS, HM Treasury initially held 70.3% of its shares through UK Financial Investments Limited.  It now holds an 84% economic interest in RBS following RBS’ entry into the Asset Protection Scheme, but the Government has no more than 75% of the shareholders’ votes (otherwise RBS would be required to delist).

It therefore remains open for the Government to call an extraordinary general meeting of RBS shareholders (as it owns more than 10% of the shares, it can demand that the directors call an EGM under s.303 of the Companies Act 2006), and table a special resolution to amend the Articles accordingly (s.21(1); this will need 75% vote (s.283)).  The EGM would be the required route as only private companies can resort to written resolutions under the Companies Act 2006 (s.281(2)).

“Life is not fair; get used to it.”

Yesterday for the first time the handing down of a Supreme Court judgement was a major news event.  The outcome of OFT -v- Abbey National & ors was eagerly awaited.  Many bank customers had hoped for some good news and some cash back from their banks – always handy just before Christmas.  Sadly, the Supreme Court appears to have played Scrooge or the Grinch, and in today’s press the Court is given a rough ride for seeming to side with the banks.  This is slightly unfair, but as Bill Gates is often quoted as saying, “Life is not fair.  Get used to it.”

Fairness was not, as many reports wrongly assume, the central issue for the Supreme Court.  They did not rule that the banks’ charging mechanisms for unauthorised overdrafts were fair.  Instead, the Supreme Court decided that the banks charges for unauthorised overdrafts  (and other bank charges at issue) were part of the banks’ price and remuneration for providing retail banking services.  On that analysis, given that Regulation 6(2)(b) of the Unfair Terms in Consumer Contracts Regulations 1999 (the “Unfair Terms Regulations”) states that the assessment of the fairness of a term in a contract “shall not relate . . .to the adequacy of the price or remuneration, as against the goods or services supplied in exchange”, it was clear that the Office of Fair Trading did not have jurisdiction to assess whether the banks’ unauthorised overdraft charges are fair using its powers under the Unfair Terms Regulations.

So how did this case reach the Supreme Court?  A crude summary suggests that at High Court the overdraft charges were considered not to be “in exchange” for any service, so fell outside the scope of Regulation 6(2)(b).  In the Court of Appeal, the charges were considered to be part of an overall package of services provided by the banks, but were considered to be ”incidental or ancillary” and not part of the “core or essential bargain” between the banks and their customers.  As “incidental or ancillary”, the charges were ruled not to be within the scope of Regulation 6(2)(b). This meant that the OFT had power to assess the fairness of the charges.  Clearly, the banks thought otherwise and have been vindicated in their appeal to the highest court.

So is this the end of the battle for repayment of unauthorised overdraft charges?  As the Supreme Court were at pains to make clear, they were only called upon to make a ruling upon a narrow point of law.  It remains open for the OFT to consider if the terms governing the banks’ overdraft charges are unfair ”if, contrary to the requirement of good faith, [they cause] a significant imbalance in the parties’ rights and obligations arising under the contract, to the detriment of the consumer” (Regulation 5(1)), as in almost all cases consumers accept banks’ standard terms and do not negotiate their retail banking services agreements.