Some jurisdictions have been creating new criminal offences to combat revenge porn, including Canada’s and California penal code . Victims have also pursued remedies under tort law seeking damages for��. But neither a criminal conviction nor a successful tort suit necessarily ensures the timely removal of the victim’s images from wherever they have been disseminated.

If quickly taking images down is a primary goal, does copyright law offer a better solution to the revenge porn problem?

In her paper, “”, Amanda Levendowski argues that copyright is a natural fit for combatting revenge porn. A significant portion of revenge porn is created by uploading selfies that were originally taken by the victim and then sent to the harasser before the relationship ended. In this kind of selfie-based revenge porn, the victim is not only the subject of the photos but also the creator. That means copyright in the photos lies with the victim. Even if a formal review of copyright law was not in��mind as they snapped the selfie, they likely did contemplate��something akin to the negative right – they expected to be able to control who saw the photo and where it was distributed or they would not have taken it.

Levendowski reviews the inadequacies of tort law and the First Amendment challenges to crafting criminal laws when dealing with revenge porn. She goes on to argue that copyright is not just a theoretical solution, but a practical one as well. Because the Digital Millenium Copyright Act created a self-administered notice-and-takedown scheme, revenge porn victims can use those processes to quickly and cheaply request the removal of their photos from sites where they appear. Where sites do not comply with those requests, they sacrifice their immunity for damages and may be subject to civil or criminal penalties.

Danielle Keats Citron views copyright as a solution for revenge porn with a warier eye for both theoretical and practical reasons. In an article with Mary Anne Franks, “”, she notes that the personal and social harm caused by revenge porn can not be reduced to a property claim.��Not all revenge porn is created from selfies, so not all revenge porn victims own the copyright in the nude images being posted of them.

In Citron's��book “Hate Crimes in Cyberspace”,1 she details the legal strategies of a variety of online harassment victims; these��accounts��highlight the practical difficulties of using copyright law to combat harassment. One victim spent hours sending takedown requests, but many sites did not respond or offered to remove the photos only for a fee. Despite success��in some instances, she found her photos had appeared��on new sites, renewing��the process. The victim eventually launched a civil suit based on tort claims in state court. A claim based on copyright would have required a separate action in federal court, so she didn't pursue that avenue.

Mitchell Matorin, an attorney who represents revenge porn victims, with using copyright and other civil remedies to combat revenge porn. He notes that revenge porn operators are not good citizens eager to comply with the law, as��some victims who have filed suit have found themselves subject to greater harassment. Site operators do not fear high damage awards because statutory damages are available only where the copyright is registered, which is unlikely to be the case with intimate images. Third party sites like Google may publish the takedown requests that they receive, so while they do remove links to the images from their index, anyone searching for information on the victim is informed of the existence of that content.

Derek Bombauer believes that copyright law, with its existing mechanisms for recognizing shared rights in the same property and balancing first amendment concerns, is . He sees the creation of intimate images to be a social good of the kind copyright law was designed to encourage and argues in favour of��expanding��that law to recognize a new copyright for the identifiable subjects of intimate media. The proposed new right would allow creators��to control the distribution of the images and would require written authorization for the recipient to display the images to others, whether publicly by uploading them to the web or privately by sharing them with the victim's friends, family, or employers.����This would expand copyright beyond selfies to protect even those who did not directly author their intimate images and also provide for statutory damages without prior registration of the copyright.

Copyright law can be a quick self-help tool for victims seeking remove their images from the web. But the current limitations on who can avail themselves of copyright law and how infringers respond to takedown requests make it an incomplete��solution to the problem. Viewing copyright law as the solution to revenge porn also ignores one key element: while revenge porn victims may approve of having their��intimate images removed from the web, they would undoubtedly prefer not being victimized in the first place. Current copyright law can help clean up photos retroactively, but changes are needed to compel harassers to think twice before they upload.

Jacquilynne Schlesier��is an��IPilogue Editor and a JD candidate at Osgoode Hall Law School.

1. Danielle Keats Citron, Hate Crimes in Cyberspace, (Cambridge: Harvard University Press, 2014).

��

The post Breaking-up Bad: Is Copyright the Best Tool to Fight Revenge Porn? appeared first on IPOsgoode.

The internet is not a lawless wild west. Images on the internet are not automatically public property – copyright, personality rights and all other aspects of the law apply. This article will list out the most relevant areas of the law and then analyze the situations of international dating using Canadian headshots for dating or porn site advertisements according to the each legal point.

Relevant Canadian Law to Date – A Primer

Scraping in the Law

The issue of general material scraping arose in the 2011 Supreme Court of British Columbia case . The court struggled with defining scraping in order to apply the law to it.�� The judgment included the opinion of law Professor and copyright expert in explaining that scraping content was allowable if it was indexed and transformative. Indexing is a broad term for the interconnectedness of the internet through hyperlinks and meta data that web crawlers use for searching and organizing internet material. Because the judge found the scraping in the Century 21 case qualified as a form of indexing, the issue of whether scraping was transformative was not relevant to his decision. Professor Trosow’s comment directly quoted in paragraph 53 of the judgment remains helpful,

“The relevant question in my view is whether the materials are being utilized in a transformative manner in order to provide a usable and informative aid for the end-user searching for information about listings.”

The judgement includes a thorough legal summary of the concept of transformation – which I will summarize as any change that adds something new to the original expression, thus creating a new work. The concept is used primarily in American law, but was also referenced and described in the 2002 Supreme Court of Canadsa��case, .

International Servers and the Law

The Supreme Court confirmed copyright liability for servers outside Canada. 2004’s stated, “A content provider is not immune from copyright liability by virtue only of the fact that it employs a host server outside the country.” This is a digital extension of of the ,

27. (2) It is an infringement of copyright for any person to […]��(b) distribute to such an extent as to affect prejudicially the owner of the copyright. […] a copy of a work, sound recording or fixation of a performer’s performance or of a communication signal that the person knows or should have known infringes copyright or would infringe copyright if it had been made in Canada by the person who made it. [emphasis mine]

Responsibility Regardless of Intent

The Small Claims Court of Yukon disregarded the “accident” defence in a 2012 digital website photo theft case that closely mirrors the Rehtaeh Parsons one at hand. A tour operator photo ended up on the website of its direct competitor. As stated by the Court in paragraph 12 of ,

“At the end of the day, it remains unclear how the plaintiff’s aurora photo found its way onto the defendant’s computer and website.�� However, it is not a defence to the present action that the copyright infringement was inadvertent.�� The plaintiff is still entitled to damages equal to the loss he suffered from the infringement."

Personality Rights and a Person’s Image

Identity exploitation is also a tort that is potentially relevant to photos on the internet. As I’ve outlined in a prior about a recent digital extension of personality rights,

The Ontario Court of Appeal’s 1997 decision outlined that the two requirements to satisfy the tort are identity exploitation for commercial purposes, and exploitation that clearly captures the personality of the plaintiff. The test for commercial purpose was solidified in 1996 in , which outlined the need for the likeness to be predominantly connected with the sale of the consumer merchandise.

At the root of this issue is the principle from the 1977 Ontario Supreme Court Decision that stated

". . . it is clear that Mr. Athans has a proprietary right in the exclusive marketing for gain of his personality, image and name, and that the law entitles him to protect that right, if it is invaded."

Photo Privacy in Quebec

is not within the digital sphere, but it is applicable as with regards to personality rights issues. Here in 1998, the Supreme Court confirmed, using the Quebec Civil Code and the Quebec Charter, that there is privacy infringement whenever an image is published without consent if the person is recognizable. It is unclear if such a ruling would hold Canada-wide, but it is a possibility.

Fair Dealing

The Canadian law provides for copyright violation in cases of fair dealing in .��Research, private study, education, parody or satire, criticism or review, and news reporting are all justifications for works use that do not infringe copyright. Some recent court interpretations of fair dealing law were recently released by the Supreme Court in��,�� and��. Taken as a whole, they confirm a generous interpretation of fair dealing that asserts the user right as a defence. This is particularly true of the enumerated education principle, which has now been broadly expanded to more closely match the US’ fair use exemptions for academic institutions.

User Waivers from 3^rd Party Photo Hosting

Some social media sites from which the photos are scraped require users to give up their personality or photo rights. There has yet to be a common law case in Canada or the US on the issue of personal social media site waivers. There are two closely related cases, decided divergently.

The 2012 US case , determined that website waivers are most valid when they require an affirmative acknowledgment of the contract. Conversely, in the 2011 Canadian case the Supreme Court of British Columbia determined that where there was an industry standard as such, proceeding into a website without express agreement could constitute a contract.

Application to Cases Like Parsons’

In my opinion, I don’t think dating or porn sites that use images of Canadian women have a strong legal case to defend themselves from potential legal action. Using the prior list of relevant legal issues, I will make a cohesive argument in favour of the Canadians whose images are used in these advertisings.

Scraping and the Law

The photos may be scraped off a prior website, but they are likely not indexed or hyperlinked to that prior website. The creators of these advertisements likely want there to be little link between the original source photo and the eventual advertisement featuring the photo. Thus, by the definition presented in Century 21, the photo reuse is a new type of non-indexed scraping.

Without indexing, the only remaining argument is transformative. The advertisement creators could argue that by adding in additional text – in the example of the Parsons case “"meet Canadian girls and women for friendship, dating or relationships” – that the addition is significantly transformative. I would argue that because the advertisement doesn’t change the photo, but just adds or overlays texts, the advertisement is arguably drawing attention to the original work rather than creating a new work.

International Servers and the Law

The Supreme Court statement from�� is helpful because it keeps open the possibility that Canadians whose photos are in circulation on any server around the world can potentially use the Canadian legal system to defend their rights. In the case of the Parsons dating site, which was based out of Vietnam, it means that Canadian courts could go after the Vietnamese infringers.

Responsibility Regardless of Intent

The�� case is an indicator of the direction courts might take in response to plaintiffs claiming ignorance. This is immensely important in regards to technology-based conflict. It’s important for court judges to demand parties in a conflict demonstrate a reasonable amount of understanding of and responsibility for their actions. In the case of dating site administrators, it’s my strongly held opinion that “I didn’t know it wasn’t okay to take photos of young women off the internet and put them in my Facebook ads” will not protect these parties as it is consistent with the general legal axiom that ignorance of the law is an unacceptable defence.

Personality Rights

Identity exploitation also presents a strong tort for Canadian victims of image scraping. To have one’s photo used in an advertisement without consent meets the Krouse and Gould threshold because the dating or porn site garners a commercial purpose. The advertisement facilitates traffic for new member signups on the porn or dating site. In the advertisement at hand, Parsons likeness is clearly captured; it is unmistakably her face.

Photo Privacy

Similarly there is a strong case when the�� precedent is considered. That said, there is a chance it might not hold for victims outside Quebec, as indicated by the use of Quebec-specific law in the judgment.

Fair dealing

It’s my opinion that image scrapers would be hard-pressed to find any fair dealing justification for their activities in either the Copyright Act or even Supreme Court decisions expanding user rights via fair dealing.

I don’t believe companies trolling the internet for photos – with software or by hand – have the protection of a fair dealing defence. Writ large, I feel the culmination of all recent, major copyright cases in Canada makes clear this principle of application; whether the fair air dealing exception is applied broadly or narrowly based on the public good or commercial profits accrued. The more public good provided, the more broad the fair dealing exception. The more commercial profits provided, the more narrow the fair dealing exception. By this broad, over-arching principle, the use of Canadians' images by dating and porn sites provide us little public good but do provide the site administrators profits. Instinctively, the companies using these images would face a more narrow application of the fair dealing exceptions.

But this conceptual analysis is insufficient to discard fair dealing altogether. To dig into the heart of this legal matter, the companies engaging in this behaviour would have to prove that their dealing falls within one of the enumerated principles of fair dealing, and then would have to prove, by a contextual analysis of the facts, that their dealing is fair in accordance with the six factors as elicited in :

• the purpose of the dealing;
• the character of the dealing;
• the amount of the dealing;
• the alternatives to the dealing;
• the nature of the work; and
• the effect of the dealing on the work
  
  

It is my opinion that it is unlikely for the analysis to surpass the first stage of the fair dealing test, as the dealing does not fit into any of the (research, private study, education, parody, satire, criticism or review, and news reporting). However, if it were to pass this stage of the fair dealing analysis, it is my opinion that a contextual analysis of the facts would result in a finding that no fair dealing exists in this case. I would arrive at this conclusion by arguing that there are legitimate alternatives to the dealing (models could be hired and photoshoots done by the advertisers), that the amount of the dealing is unfair (pictures are being substantially reproduced), that the character of the dealing does not support fair use (pictures are being used for commercial gain), and that the effect on the work is prejudicial (the images and the reputation of those pictured are potentially harmed).

User Waivers from 3^rd Party Photo Hosting

Dating and porn sites may have a strong argument if they only scrape Canadians’ images from third party websites or social media networks with sign-up contracts that ask users to waive rights to their likeness. This legal reality may be unpopular in the court of public opinion. concerns about the tension between consumer rights and lengthy digital contracts. A movement is burgeoning to demand more proactive and legible terms to be disclosed to consumers. Services to of these contracts and rumours of apps in development to provide layperson translations to contract legalese showcase the problems that these contracts pose.

I would tend to agree. In my opinion, these contracts are unreasonable because they are extremely lengthy and overly legalistic. The majority of users are not able to understand these agreements, which is a big problem. It also points to potential invalidity due to the unconscionability doctrine.

To start, there are many seminal “ticket cases” in the UK that call into question contracts where one party does not adequately appreciate the terms of the contract such as the 1970 case . 


Similarly, Canadian contracts can be set aside for inadequacy of consideration or unequal bargaining power ( and ). contains a lengthy list of factors to consider in order to properly assess bargaining power: a plaintiff’s ignorance of business, illiteracy, ignorance of language of the bargain, blindness, deafness, illness, developmental disabilities, and other similar challenges. is another foundational case in Canadian unconscionability law. A more holistic approach to bargaining inequality, recently emerged in , where the Supreme Court said there is no definitive list of factors; courts should be alive to conditions of the parties circumstances, unique pressures and situational vulnerabilities. Meanwhile, focused on the “distress of the weaker”, and ��used the word “disparity” in its analysis of unconscionability.

Whether the highest ranking or recent cases lay out a definition of unconscionability that would cover third party website waivers is uncertain. I do believe – for some more-vulnerable users – our growing reliance on the largest social media sites and their ubiquity in our day-to-day lives may meet the power imbalance threshold required for unconscionable bargaining. The more users depend on a service for the function of their day-to-day lives, the more the potential for imbalance and disparity in bargaining power. Dependancy creates bargaining weakness.

Two Systemic Criticisms: Statutory & Social Failure

In my opinion, lack of political action and social concern are failing young Canadians who don’t want to show up in an advertisement for an online dating or porn site.

I.���������������������������� The Statutory Problem: Not Going After the Scrapers

There exist easy alternatives to image scraping. There are to access free images. Governments should take steps to protect individuals – both by demanding websites only accept advertising from companies who agree to ethical photo sourcing standards and by establishing a regime to police and crack down on scrapers. Scrapers operate with software and servers from countries around the world, so it would likely be necessary to create a global framework of international agreements to combat this activity. It would be onerous, but I believe it’s worth the work involved.

II.����������������������The Social Problem: Blaming the Photo Posters

In observing the aftermath, the Rehtaeh Parson’s case has caused a rash of victim blaming mirrored by that seen in many cases of sexual violence. For instance, the of the Parsons image scandal ended with an inappropriate call-to-action for increased conservatism in photo posting. A media professor from Queen's University says the unfortunate use of Parsons' image in an ad could be a "teachable moment" for parents trying to instruct their children to be vigilant about uploading photos to the internet.

"We are in a new day where people think that if they find something on the web it's free to use, and that's not necessarily the case," she says. "In this case, we're seeing the hurt that that can cause."

In another instance, the included a similar warning from the Ontario Privacy Commissioner.

"Ann Cavoukian, Information & Privacy Commissioner of Ontario, described what happened with Parsons’s image as a 'strong reminder that we can rarely control the use of our pictures once we share them online.[']

'The unfortunate reality is that people give out far too much information about themselves, believing that their information is ‘private’ and they are safe behind their screen. You are not!' Cavoukian said in an email statement to the Star.

'We all need to take steps to protect ourselves online, especially on social networks,' she added. 'Young people must be especially careful to consider the potential risks, and make it a practice to only post photos that they want everyone to see, including strangers and prospective future employers.[']

'If not, don’t post it!'"

Given that Canada has not acted to regulate against scraping of its citizens’ photos, it’s disappointing to me that the go-to response to the Parsons photo misuse was to tell people to be more careful about what they post online rather than condemn and go after the wrong-doers. I believe it’s a particularly insensitive approach when you consider the root of the Parsons case. Rape culture tells young women to avoid walking alone, to watch what they wear, and to restrict their own liberties in order to avoid sexual violence. Rarely does it focus on .

Here, where we should have a vigorous call to go after those social media sites and scrapers who expropriate and commoditize photos of young women, we are instead turning to young women and telling them to restrict the images they put online.

I conclude this post with , Rehtaeh’s mother, written in response to uncovering the dating site photo. It makes the link between photos and human rights better than I can.

"It is disgusting that even in death, my daughter's image is still being exploited. When I see these violations, whether it be the singles ad stealing Rehtaeh's photos -- or the people who contact me and to say negative things such as she should not have been drinking, she was a troubled teen, she was in the wrong crowd -- I sit back and reflect on the reality of who Rehtaeh truly was. Then I think: So what if someone is a troubled teen or was drinking -- as if their behavior or emotional state somehow give permission for others to abuse them."

Denise Brunsdon��is an IPilogue Editor, a Western University JD/MBA Candidate, and researcher for GRAND (Graphics, Research and New Media) Centre and Commercialization Engine. She is also the social media volunteer at Sexual Assault Centre London.

The post Dating Sites Scrape Internet for Women’s Photos, Including Those of Deceased appeared first on IPOsgoode.

What is a Reverse Payment Agreement (RPA)?

As has , an RPA is a settlement agreement that has come to be known as a “pay-for-delay deal”.�� In such an agreement, a patent holder pays the allegedly infringing generic drug company to delay entering the market until a particular date, thus delaying litigation on the patent. The payment is “reverse” because the money flows in the opposite direction from a typical exchange between licensee and patent holder.

In some ways, RPAs make economic sense for all companies involved. "Brand-names" can maintain market exclusivity, while "Generics" potentially generate more revenue than if they had released the product into the market.�� Consumers, however, are arguably short-changed because the prices of pharmaceuticals remain high as a result of this delayed competition.

The AndroGel “Reverse Payment”

In 2000, Solvay’s patent for a formulation of testosterone - AndroGel - was approved.�� In 2003, Watson and Paddock filed their intent to manufacture generic versions of AndroGel with the FDA, alleging that Solvay’s patent was invalid.�� In response, Solvay sued for patent infringement.�� . The settlement involved a payment from Solvay to Watson of $19-30 million annually until 2015.�� During that time, Watson would not sell its version (unless another generic entered the market) and would assist Solvay in marketing AndroGel to urologists.

The FTC Argument: RPAs Illegally Allow "Brand-Name" Manufacturers to Extend Patent Monopolies

The FTC argued that these agreements had little actual value to Solvay, and that the real purpose of the settlement was to protect Solvay’s patent from being challenged and delay generic entry into the market. As a result, the FTC believed that Solvay had unlawfully extended its monopoly on AndroGel through payments to its competitors.�� This sort of agreement is a prima facie violation of US antitrust laws, because the agreement between Solvay and the generic manufacturers resembled a horizontal agreement to suppress competition and extend a monopoly.�� Thus, the FTC argued that settlements involving RPAs should be made presumptively illegal.

The "Brand-Name" Response: A Valid Patent Should Immunize RPAs from Antitrust Scrutiny

In response, the pharmaceutical companies argued that the existence of a valid patent should immunize settlements involving RPAs from antitrust scrutiny.�� Since the settlement agreement allowed Watson to enter the market 65 months��before��Solvay’s patent ended, and since patents are legitimate exercises of market exclusivity, the "Brand-names" argued that RPAs are a legitimate exercise of their patent rights and there should be no concern about abuse of monopoly power.

They further argued that unless the companies took action outside the “scope of the patent” (for example, by extending market exclusivity past the patent expiration date or expanding the scope of the exclusivity beyond the patent claims), the fact that Solvay held a valid patent should allow it to choose to exclude others from the marketplace at its discretion, including by settling cases with potential competitors using RPAs.

The Supreme Court’s Decision in FTC v Actavis: The FTC Has the Right to Prove Antitrust Claim

, Justice Stephen Breyer held that a broad allowance of all RPAs under a registered patent was an improper outcome given that the patent itself may be invalid.�� At the same time, Justice Breyer did not find RPAs to be so unjustifiable that they should be evaluated under the “presumptively illegal” framework proposed by the FTC.�� Instead, Breyer J struck a balance and held that the FTC has the right to be given an opportunity to “prove its antitrust claim.”

The Dissent

In a dissenting opinion, Chief Justice John Roberts supported the "Brand-name" position.�� He argued that so long as the parties held a valid patent, the patent itself��gave the owner the right to choose who could use their property. ��This right includes the use of reverse payments to settle litigation.�� While Chief Justice Roberts acknowledged that antitrust laws are intended to encourage competition, he��worried that the majority opinion would discourage settlements in patent litigation.�� He wondered whether the costs of protracted litigation would lead fewer "Generics" to challenge "Brand-name" patents in the first place.

The Impact of the Decision

While the majority decision seems to strike a balance between two extreme positions, one wonders if SCOTUS has not opened a new can of worms with this decision. By allowing the FTC to make an antitrust case against RPAs, courts are now faced with the difficult task of deciding which agreements are anti-competitive. Justice Breyer does provide some guidance on this assessment by stating that the anti-competitive nature of an RPA would be based on “its size, its scale in relation to the payor’s anticipated future litigation costs, its independence from other services for which it might represent payment, and the lack of any other convincing justification.” He also warned against “large and unjustified” RPAs. It is worth noting, however, that the merits of the patent were not part of Breyer’s consideration.

Only time will tell if this decision will prevent truly anti-competitive practices or if it will prevent legitimate agreements that would have allowed innovators of beneficial drugs to recoup their costs.

The post Splitting the Difference Between Antitrust and Intellectual Property: FTC v Actavis appeared first on IPOsgoode.

A Northern Ireland court recently discussed the confidentiality of Facebook comments in . These proceedings related to failed investments by the plaintiffs made through the defendant in his capacity as a solicitor. Following a hearing on the matter, Mr. Giambrone posted the following comment on his Facebook site, “they thought they knocked me down, now they will see the full scale of my reaction. F*** them, just f*** them. They will be left with nothing.”

On the basis of this comment, a Mareva Injunction, which prevents the liquidation of assets, was obtained against Mr. Giambrone. In response, the defendant suggested that using his comment in this way constitutes a breach of confidence since he ensured that his profile was accessible to “friends” only.

The court stated that even if the post was confidential, such a determination would not preclude it from disclosure as part of the discovery. The court went on, however, to comment that notwithstanding their acceptance of this post as evidence, the use of his comment in order to obtain an injunction does not constitute a breach of confidence.

The test for breach of confidence in Ireland requires that the information be:

(1) Confidential and/or private, and

(2) The plaintiffs must have known that it was confidential and/or private.

The court determined that the information was not confidential because it was posted to the Internet and therefore in the public domain. Even if the comment was only accessible to his “friends” it was posted with the knowledge that his "friends" could forward the post to anyone. Regarding the second stage of the analysis, when someone receives information and knows or ought to know that it is fairly and reasonably confidential, a duty of confidence arises. The court determined that none of his "friends" could have understood that this comment bound them to a duty of confidence and were more likely to the come to the conclusion that this post was a statement of defiance. As a result, it was decided that the use of this comment to obtain an injunction would not constitute a breach of confidence.

In Canada the test for breach of confidential information is drawn from . This is a three-part test, which requires:

(1) The information was confidential (based on an objective standard),

(2) The information was communicated in a relationship of confidence (express, implied by customs, or implied by law), and

(3) The information was misused by the party to whom it was communicated

The similarities between the tests make it likely that no breach of confidence would have been found, had the case been determined by a Canadian court. Information will be considered confidential if it is subject to measures to protect its secrecy; however, simply limiting your profile so that only “friends” can view comments may not be enough to be considered confidential on an objective standard. Additionally, a Facebook comment is unlikely to produce an express or implied relationship of confidence. While “misuse of information” may be found, as misuse has been understood as being any use not requested by the confider, it appears that this allegation would likely fail the first two requirements of this test.

This case serves as another demonstration of the possibilities for legal liability that are found on the Internet. It is essential to recognize that although it is easy to believe that only your friends will be reading your posts and comments, any information you provide on social media sites are likely to be considered in the public domain.�� Before posting comments on your friend's Facebook wall, it may be worth taking a moment to consider whether you are willing to see it again in a court of law.

The post Breach of Confidence: Your “Friends” Can’t Protect You appeared first on IPOsgoode.

The authors point out that in the age where cyber threats are growing in number and sophistication, corporations are often the victims of cyber crimes. This situation, the authors contend, presents corporations with a difficult dilemma. On the one hand, they are encouraged to cooperate with law enforcement authorities, where premature disclosure may compromise investigatory efforts. On the other hand, corporations have a duty to inform investors about significant business risks. The risks are especially prominent where a company has significant intellectual property assets. In those cases a cyber attack may be fatal to the business, which militates in favour of prompt disclosure.

For these reasons, the authors contend, there is a need for clear disclosure rules with respect to cyber crime. Unfortunately, the US Securities and Exchange Commission (SEC) has done relatively little in that respect. Authors point out that the SEC has issued����for disclosure, but failed to provide clear and binding rules. Notably, the SEC����the guidelines.

The authors briefly discuss one possible and undoubtedly only partial solution, which is to allow����The article points out that there is a strong potential for abuse if the rule were implemented. Corporate citizens are likely to rely on the rule to simply stave off disclosure for as long as possible because of its negative effect on consumer and investor confidence.

Concerns about potential abuse of the proposed solution underscore the important role fulfilled by the government in combating cyber crime. Foregoing disclosure can only be justified if it is assumed that the relevant law enforcement agencies can effectively address the issue. Investors and corporate leaders need to be assured that withholding information regarding material risks is justifiable in practice. Thus, if law enforcement is ill-equipped to deal with cyber crime, then delaying disclosure to facilitate an investigation starts to look less reasonable from an investor's point of view.

In addition, rules regarding disclosure obligations have to take into account that corporate entities often operate in multiple jurisdictions. For instance, a cyber attack that takes place in Ontario may nonetheless affect investors in another province or even abroad. A particularly problematic scenario arises where one jurisdiction may demand that a company withhold information regarding an attack while another jurisdiction demands prompt disclosure. Therefore, a coordinated and uniform approach to disclosure rules and cyber security in general should be a priority.

A brief look at����is reassuring as it reflects the foregoing concerns. Indeed, the Government explicitly recognizes intellectual property as an especially attractive target for criminals and provides��. Canada’s strategy also places heavy emphasis on cooperation among local, provincial and international partnerships in improving online security. When it comes to effective law enforcement, the Government has established the����to assist non-government systems with security issues and committed��

The problems surrounding cyber attack disclosure rules for publicly traded companies have not been widely discussed or debated domestically. Perhaps Canada is waiting for the US to take the lead on the issue in order to implement a coordinated approach; or perhaps the current state of cyber security in Canada is still in its infancy, making the debate premature. Whatever the reason, the general strategy adopted by the Government is promising to the extent that it demonstrates awareness of the issues that will inevitably affect the shape of disclosure rules whenever the time is right to have that discussion.

Anatoly Zhitnik is a JD Candidate at Osgoode Hall Law School.

The post Cyber Attacks: Unsure About Disclosure appeared first on IPOsgoode.

Max Schrems used����to request his personal user data from Facebook international headquarters in Ireland. The first round of disclosure from Facebook was����of much of the detailed information that the social network tracks. But more concerning was that when Facebook provided fuller user data,����that Schrem had deleted from his profile, such as automatic tags or chat messages; this was information that Facebook was legally required to remove from its database.

Schrem then successfully encouraged thousands of other Europeans to demand their user records and launched the organization����to raise awareness of and funds for his fight to demand greater privacy and disclosure from Facebook.

Facebook responded with – or coincidentally announced – proposed updates to its Data Use Policy and governance procedures under a letter posted in the Facebook Newsroom from Elliot Schrage, VP Communications, Public Policy and Marketing.

The letter, titled “”, allowed for user comments until 9 AM PST on November 28, 2012. In terms of privacy, the letter calls out pro-privacy and pro-disclosure changes like their new “Ask the Chief Privacy Officer” page, Facebook “Live Events” to answer privacy questions and additional Data Use Policy updates such as reminders “about what’s visible to other people on Facebook.” ��In terms of governance, the proposed changes����user voting rights.

Both sets of changes stimulated backlash. The privacy changes inspired a����of pseudo-legalese that users seemed to believe would protect them from privacy and copyright breaches by Facebook. The removal of member voting rights sparked uproar by����and����alike.

Putting aside the red herring that is disenfranchisement (a right that few people used anyway), the lack of substantive privacy and disclosure remains troubling.

The privacy changes put forward by Facebook are cosmetic and unnecessarily security-centric. In short, they are retail politics. As Schrems and those coalescing around him will tell you, users don’t need Facebook to protect them from privacy breaches by other citizens, they need governments to protect them from privacy breaches by Facebook.

The question for Canadians is whether, like the EU, we are entitled to request access to the full gamut of information collected about us, and whether sites like Facebook are obligated to purge information that we have chosen to delete.

Though slow and����freedom of information acts and������generally guarantee that government organizations provide information to citizens on demand. Private institutions like Facebook are not subject to these requests.

The����(PIPEDA) was constructed in a pre-Facebook world and focuses more on preventing an organization from releasing information about a citizen than it does laying out the depths to which an organization is obligated to provide information to citizens about their individual profiles on request.

Similarly, S.9 of PIPEDA prevents the release of personal information if doing so would reveal personal information about a third party. In the world of social networking, how many degrees of separation in Facebook data sufficiently satisfies this requirement, and could Facebook lawyers use this as a shield to prevent requests by Canadians to view their profile information?

PIPEDA establishes the Privacy Commissioner as the ombudsperson for complaints and concerns, but the Privacy Commissioner’s office seems slow to grasp the technologies of and data amalgamated by Facebook.����from the office shows they remained distracted by the same shiny security and retail politics material that populated the recent Facebook Newsroom post from VP Schrage.

Luckily, the Information and Privacy Commissioner is decidedly more in tune with privacy and disclosure needs, as evidence by last month’s white paper��.

Unfortunately, no wealth of suggestions from either privacy commissioners will fill the gap between the EU and Canada in terms of legal tools available to hold Facebook to account for what personal information it retains, for how long or how much it should disclose to users.

Denise Brunsdon is a JD/MBA Candidate at Western University.

The post Defriend: Privacy Concerns are back in the Newsfeed appeared first on IPOsgoode.

Background

The harassment apparently began when , a pilot for British Airlines and a member of the British Airline Pilots Association was identified as having trained as a volunteer cabin crew member when BASSA, a subset of the Unite union, was threatening an action. Afterwards, Mr. Patel and other pilots who trained as volunteer cabin crew were threatened and harassed online and elsewhere. Mr. Patel blames this abuse on the widespread publicity that resulted from his being identified in the abusive and defamatory postings on the BASSA forum. He claims these postings were libelous and raises a second cause of action under the . The postings alleged that Mr. Patel was unsafe to fly with, had lied, was unfit to be a captain, behaved erratically and illegally, fired innocent cabin crew and was involved in police corruption. All the postings were made under anonymous usernames and, without disclosure of the identities of the writers, Mr. Patel cannot bring his proceedings against those responsible.

BASSA’s forum is operated by , the larges union in the UK.�� The terms and conditions of the website “reserve the right to disclose the true identities of users to third parties, if requested, subject to the user’s data protection rights.” In June or July 2011 Unite took the forum offline and published a statement that the allegations made about Mr. Patel were untrue, but did not identify the users who made the postings, as requested by Mr. Patel.

On 30 September 2011, Mr. Patel was granted a order which obliged Unite to carry out a reasonable search to locate and��identity the��home address and IP address of the persons associated with the usernames collected by Mr. Patel.

According to the site’s administrators it was not possible to comply with the order because since the site had been taken down, all that remained was a dated backup. The backup would only reveal the identity of the members using a particular username at that particular date. Apparently it was common practice for members to change usernames in order to hide their identities from British Airlines, as well as reuse names. Therefore associating a user with a username at the date the backup was taken would not guarantee it was the same user who had made the posts at issue at the time the posts were made. ��Furthermore, the administrator claimed the retrieving of the IP address of the users in question was not possible.

Application

Mr. Patel, unsatisfied with this response, made a second application that “in the event of Unite not being able to provide some or all of the information sought, an independent expert should be given access to all available copies of the BASSA forum database and permitted to make an image of the database and/or such other electronic copy of data on the database (existing or deleted) as the expert might consider necessary in order to prepare a report limited to the identification of the information sought” (para 13). According to Mr. Patel, the initial search made by BASSA was unreasonable because they failed to supply the information requested or explain what happened to it.�� Mr. Patel had technical experts who stated that since the forum was run on widely understood software��(phpBB version 3 and MySQL), identification of the IP addresses from where the posts were made would be possible.

Mr. Patel then sent BASSA instructions on how to retrieve the requested information. The site administrator, a BASSA branch secretary with a non-technical background, said this was not possible as the posts had been deleted and the first step in the instruction required the relevant post. Justice Parks notes that it might be though curious that BASSA took the forum off line and did not make a back-up (para 11). Mr. Patel and his experts noted that previous searches had yielded portions of the allegedly defamatory posts.

Instead of taking the position that BASSA is being wilfully unhelpful or untruthful, he claims that they lack the technical capability to carry out this search themselves. Hence his request to allow a third party to examine the forum database.

Reasoning

Justice Parkes acknowledges that the order sought by Mr. Patel is intrusive (para 28) and that there were no authorities on point. He relies on a paragraph from which states that only if necessary and proportionate can the court order access to be given to a party’s computer or database. Parkes J does find necessary and proportionate to make the order.�� Especially because the requested order is necessitated by the lack of compliance with the previous judicial order. Furthermore, when faced with evidence from Mr. Patel’s experts, BASSA’s representatives were not able to conclusively show what information had been deleted and what remained on the database.

Unite claimed that the personal data of union members contained on the database was protected under Article 8 of the and that information about trade union membership fell within the definition of sensitive personal data under the . Parkes J writes that “the information involved is not of the most sensitive kind: we are not talking here about information relating to religious beliefs, or sexual life, or medical matters” (para 30). He finds that the order is proportional and necessary, even though contrary to the Data Protection Act,��because there is no other way which the harm done to Mr. Patel could be exposed. He states “In this case, as in many other Norwich Pharmical cases, necessity and proportionality might go hand in hand.”

Finally, Parke J references the terms and conditions agreed to by those who posted on the BASSA forum that the right to disclose their identities was reserved. And that damage done to innocent parties who posted on the forum, can be mitigated by having an independent third party carry out the analysis.

Comments

Issues of user privacy are a topic of vocal public debate in a Canada at present, especially surrounding . Manish v Patel, and the Norwich Pharmacal line of cases demonstrate a common law approach to orders requiring disclosure of user information when linked to a cause of action and shown to be necessary and proportional. ��In Canada the debate mostly centres around the roles of ISPs in providing user data, though many point out that often ISPs are quite forthcoming and accommodating of law enforcement.

Beyond illustrating the irony that there is no apparent solidarity between pilots and flight attendants and their respective unions, one of the differentiating elements of this case was the lack of compliance on the part of BASSA, with the initial, less intrusive disclosure order. Manish v Patel shows how the court may respond to lack of compliance or lack of technical capability with a more intrusive order, while balancing innocent user’s privacy rights.

The future for this line of reasoning will be interesting, especially as different causes of action are tried. Here the cause of action is harassment and defamation, whether an order will be made for third party experts to independently review a website’s data with regard to a copyright infringement claim remains to be seen.

Kalen Lumsden is a JD candidate at Osgoode Hall Law School.

The post Spat Between Pilot and Attendants’ Unions Results in Intrusive Disclosure Order appeared first on IPOsgoode.

Only one post remains on the and it is tellingly tagged "RIP" and "the dion effect."��Dion's lawyers sent Nick Angiolillo, the New 91��ɫ blogger who runs the satirical Tumblr site which mocks silly photos of the singer, letter that him to remove all the original posts.

Angiolillo claims that he is likely in the right, but that he doesn't have the financial resources to engage counsel to respond; a wise choice on his part. There are a lot of issues at play here. Firstly, there may be a marked difference between the privacy rights and image/likeness sovereignty that can be demanded by an average citizen as opposed to a celebrity. Another issue here is practically a staple of many IP dilemmas: one nation's protection may be different than another’s, but a URL is, for the most part, international.

What about the fact that they are in many cases the work of photographers? What would be most interesting to know is whether or not Angiolillo purchased the images and rights��from photobanks or simply cribbed them off a Google search. If the latter, then Celine Dion's cease and desist letter��may only have been the first of several to arrive.

This brings us to an interesting point: attributing the rights of a photo to the photographer may be an outdated and archaic way of organizing online property. Indeed, now that one cultivates, fosters and monitors their online presence, one’s reputation seems to be more valuable than a single photo (or in this case, many). When photographs were primarily utilized by print sources, their regulation and distribution could be easily controlled by the Copyright Act. The world of Internet, however, leads one to ask: what are the rights of the subjects of these photos?

And finally, on the self-expression side, is there any sympathy for the fact that the blog was a genuine piece of tongue-in-cheek parody and not some kind of explosive and commercialized meme? A similar, but intensely more sophisticated site, , has t-shirts and advertising and thus the bloggers in this case are making money by making fun of celebrities. Angiolillo's grassroots site stands in remarked contrast.

Canadian courts have the 'parody defence' of material subject to the Copyright Act. This case, however, would likely be subject to US standards of 'fair use', where using material for parody purposes has been established a .

The ultimate lesson, however, is that in the early days of any legal arena with many suits pending and little precedent work – as most certainly the case with digital intellectual property and likeness law – those with the money to engage lawyers��have the upper hand.

The post Celine Dion Takes On Satirical Blogger In David And Goliath Fight (Spoiler: Goliath Wins) appeared first on IPOsgoode.