That Irish "three strikes" ruling: a explanation

On Friday the IPKat posted a "breaking news" item on an Irish case, EMI Records (Ireland) Ltd and others v Eircom Ltd [2010] IEHC 108, which he somewhat unhelpfully described as being the first Irish decision on that country's "three strikes" law (the Irish "three strikes" being the result of a consensual arrangement, not legislation). The Kat had planned to dedicate part of the weekend to reading the decision and producing a note on it. However, David Brophy (FRKelly) has fortuitously saved him the trouble by sending him this summary. Say David:

"The question being decided was whether a "three strikes" protocol agreed between the four major record labels (EMI, Sony, Universal and Warner) and the largest of Ireland's ISPs (Eircom) was objectionable on data protection grounds. Briefly, the arrangement was that the record labels would operate software to identify file-sharing of files in which they claimed copyright, where one of the parties was operating from an IP address assigned to Eircom. Eircom would be notified of the alleged infringement, and agreed it would implement a "three strikes" procedure ultimately leading to termination of the subscriber's internet access on the third such notification.

The Data Protection Commissioner wrote to the solicitors for EMI, expressing concern over their intention to collect, share and process IP addresses which might constitute "personal data" and/or "sensitive personal data". The judge was asked to make a ruling on three questions which can be summarised, simplified and rephrased for context as follows:

(1) Do IP addresses, in the hands of EMI, constitute “personal data” for the purposes of the Data Protection Acts 1988-2003, such that EMI must comply with certain specified provisions of the Data Protection Acts?

Held: No. Since the subscriber cannot be identified from the IP address, and it is not likely that the record labels can combine the IP address with other information, or will even attempt to do so, the IP addresses are not personal data within the meaning of the Act.

(2) Assuming that the processing by Eircom of “personal data” when terminating an internet user's subscription is potentially permissible under the Data Protection Acts, is it nevertheless prohibited because the termination of internet access represents “unwarranted [processing] by reasons of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject”?

Held: No. Terminating an internet user's subscription is not unwarranted and therefore not prohibited. Copyright is a personal property right under the Irish Constitution which the Courts have a duty to protect. By imposing on subscribers, as a condition of internet access, a prohibition on copyright infringement, Eircom as an ISP is acting legitimately to support a third party's constitutional right, and the sanction of terminating access is not excessive and is consented to by the subscriber. Enforcing this sanction, using the automated system agreed with the record labels, is similarly not excessive or unwarranted.

(3) Is it open to EMI and/or Eircom under the Data Protection Acts to implement the three strikes process, and in particular, the termination of an internet user’s subscription, in circumstances where:
(a) In doing so they would be engaged in the processing of "personal data" and/or "sensitive personal data", including the provision of such data from one private entity to another private entity; and
(b) The termination of an internet user’s subscription by Eircom would be predicated on the user having committed an offence (i.e. the uploading of copyright-protected material to a third party by means of a peer-to-peer application) but without any such offence having been the subject of investigation by an authorised body; and, further, without any determination having been made by a court of competent jurisdiction, following the conduct of a fair and impartial hearing, to the effect that an offence had in fact been committed.

Held: Yes. It was open to the parties to operate the three strikes process. The judge reasoned that the parties were not really concerned with whether any criminal offence had been committed (this would require a showing of knowledge or intent, which was beyond the scope of the detection and notification procedures), and that their only concern, in operating the three strikes process, was in detecting and preventing civil copyright infringement. As such, the issues associated with "sensitive personal data" and the more stringent controls on processing data relating to criminal offences, did not require consideration.

It is noteworthy that the Data Protection Commissioner was not represented before the Court, nor was there any representation for the consumer, for digital advocacy groups, or for any party strongly opposed to the implementation of the three strikes system. The overall tenor of the judgment strongly champions the rights of the copyright holder, and one can only speculate if this would be different in a case where the legitimate interests of the data subject were strongly advocated. The judgment is particularly striking for the language used to describe the act of copyright infringement ("theft", "stealing", "filching"), and the data subjects, whose interests the case is of course addressing, become "copyright thieves" when their IP addresses have been identified as having been involved in file-sharing.

Finally, it should be noted that this three strikes procedure arises from a settlement between the record labels and a single ISP, namely Eircom. No other ISP has yet agreed to implement this three strikes rule, and some have said that they will fight any attempt to impose this solution on them. All of this suggests that this is not the last word on the three strikes system from the Irish courts".

The IPKat thanks David for his lucid exposition of the decision and also for his observations concerning it. Merpel says, it will be interesting to see whether internet users migrate from Eircom to other ISPs in result of this ruling, or whether most remain indifferent to it.