4
The extent to which right holders obtain access to detailed users information varies depending on
countries. In Belgium, right holders have been requesting the collaboration of ISPs to send
warnings to users. In the United-States, ISPs were requested to communicate the ID of their clients
directly to the music industry representatives, without Court order
4
. This led to several court
decisions (i.e., the Verizon case – December 2003), where finally such direct communication of
information to right holders was considered illegal by the Court. As another example, the
Australian legislation (through the “Anton Pilar order”) permits the search of inquiries, including
domiciliary visits, by private actors such as holders of IP rights.
In order to connect alleged infringements with users responsible and to complete the profile of the
user, attempt is made by right holders to use existing public registers, such as “Whois” databases,
which keep personal details about those who have registered a domain name. It contains in
particular information as to the name of the contact-point for the domain name, including phone
number, e-mail address and other personal data. Some information is accessed directly on-line,
while other details are kept off-line and must thus be requested to the controller of the database.
Finally, the Working Party notes that, considering the fact that the collection of personal
information by right holders is regulated by data protection principles, discussions are taking place
in several countries with stake holders in order to give them more flexibility as to the processing of
personal data. In this context, the French data protection legislation, for example, now includes an
exemption aiming specifically at allowing the processing of judicial data by specific right holders
defined by the law
5
, in certain circumstances and subject to prior authorisation by the French
DPA
6
.
The Working Party deems it necessary, in this changing context, to recall the main data protection
principles and the extent to which they apply in the framework of digital right management and
enforcement of copyright.
II. The management of intellectual property rights
The legitimate purpose followed by right holders to prevent misuse of protected information often
results in the tracing of users and the monitoring of their preferences. In particular, the use of
unique identifiers linked with the personal information collected leads to the processing of detailed
personal data. Directive 95/46 on the protection of personal data provides for several principles that
shall be complied with by any right holder in such case where personal data are being processed.
Article 2(3) (a) of Directive 2004/48/EC, on the enforcement of intellectual property rights
confirmed the principle that the Directive 2004/48/EC does not affect Directive 95/46 and therefore
the application of the data protection principles.
4
Copyright holders based their request on Section 512 of the Digital Millennium Copyright Act, on Limitations on
liability relating to material online. According to these provisions any copyright holder or his/her representative can
ask a justice auxiliary of a federal court to deliver an injunction to an ISP to provide the identity of a user suspected of
activities infringing copyright. This procedure is quite flexible as it allows obtaining personal data related to the user
without starting a whole judicial process.
5
The exemption applies to legal persons as exhaustively enumerated by articles L. 321-1 and L. 331-1 of the
Intellectual Property Code, and having as object the defense of interests of right holders.
6
The CNIL shall have to precise the quality of judicial information included in the files, as well as the duration of its
storage. It will also have the duty to ensure that such processing is adequate with regard to what is strictly needed to
fight counterfeiting (Decision of the “Conseil Constitutionnel” n°2004-499 DC, 29 July 2004). It should be noted that,
according to the Constitutional Court, identification by users through their IP address can only be allowed in the
framework of a judicial procedure.