Music firms in data legal challenge

Four major music companies have brought a legal challenge to a notice of the Data Protection Commissioner that they fear will effectively unwind their "three strikes and you're out" agreement with Eircom aimed at fighting the widespread illegal downloading of music.

The companies claim the commissioner’s enforcement notice of December 5th last directing Eircom to stop implementing the three strikes agreement, arising from his view it breaches data protection and privacy laws, amounts to an unlawful and irrational attempt by the commissioner to reopen data protection issues already determined in their favour by the High Court.

Mr Justice Peter Kelly this week granted leave to EMI Records (Ireland) Ltd, Sony Music Entertainment Ireland Ltd, Universal Music Ireland Ltd and Warner Music Ireland Ltd to bring judicial review proceedings against the commissioner aimed at quashing that notice.

The judge will deal on March 12th with their application to have the case fast-tracked by the Commercial Court. The granting of leave operates as a stay on a separate Circuit Court appeal by Eircom against the Commissioner’s notice, he also said.

The disputed notice was issued by the commissioner under the Data Protection Acts 1988 and 2003 and EC Privacy and Electronic Communications Regulations 2011 following his investigation into a complaint from an Eircom subscriber about receiving a notification under the three strikes agreement or Graduated Response Protocol.

That protocol, agreed with Eircom under a January 2009 settlement of court proceedings by the companies against it, requires Eircom to issue three warnings to persons suspected of engaging in illegal downloading after which, if they persist in illegal downloading, their broadband account is terminated.

Under the settlement, the companies were to supply Eircom with Internet Protocol addresses of persons suspected of illegal downloading. The case was largely aimed at cutting off access to peer-to-peer music sharing groups..

After the commissioner expressed a view in 2009 that implementation of the protocol would breach the data protection laws, the companies re-entered the case for the purpose of getting a court declaration such implementation would not be unlawful. The commissioner, for costs reasons, did not participate in that but asked that a number of issues be decided.

In his judgment on those proceedings in 2010, Mr Justice Peter Charleton ruled the concerns raised by the commissioner, including about the rights of access to the internet, did not prevent the settlement measures being implemented. The measures were lawful and compatible with the data protection legislation, he found.

In January 2011, the commissioner notified Eircom he intended to investigate a complaint against it by a subscriber who had received a notification under the Protocol. The complainant insisted he was not engaged in any illegal downloading.

Eircom carried out an investigation and told the commissioner in February 2011 it had discovered, due to a “minor technical issue”, its notification to that subscriber and 390 others was incorrectly issued.

Eircom said it had amended its record to remove any record of infringement from the relevant accounts and had written to all the affected customers explaining its error. The technical error arose because, when the hour went back on October 31st, 2010, for daylight saving, a manual code change had not taken place resulting in the incorrect notifications being sent, it said.

In September 2011, the commissioner told Eircom the complainant subscriber had restated his original complaint - which included a complaint Eircom’s monitoring of his internet use breached his data protection rights.

The commissioner contended the monitoring activities being carried out by Eircom as an agent of the music companies under the settlement scheme were not permitted unless the internet users in question had consented to such monitoring.

In November 2011, the commissioner informed Eircom he believed the three strikes protocol contravened provisions of the Data Protection Acts and 2011 regulations and set out a proposed enforcement notice. He also said a European Court of Justice decision the previous day made clear the protocol being operated by Eircom was unlawful under European law.

Eircom responded that the European Court’s judgment appeared of little relevance to its operation of the protocol.

On December 5th, the commissioner issued the enforcement notice directing Eircom take all necessary steps within 60 days to comply with the data acts, to cease obtaining subscriber data so as to operate the protocol and to destroy any subscriber data processed by it for the purposes of the protocol.

The music companies said both they and Eircom understood from that notice, which Eircom has appealed, that the commissioner’s view was that continued implementation of the three strikes protocol would breach the Data Protection Acts and 2011 regulations.

Given the settlement of the earlier proceedings and the later High Court decision on the data protection issues raised, the commissioner had acted in excess of his powers, irrationally, disproportionately and in a manner prejudicial to their interests, they claim.