UK'S IMPLEMENTATION OF THE ANTI-CIRCUMVENTION PROVISIONS OF THE EU COPYRIGHT DIRECTIVE: AN ANALYSIS

Abstract

The debate surrounding utilization of technological protection measures to secure copyrighted works in the digital arena has raised many an eyebrow in the past few years. Technological protection measures are broadly bifurcated into two categories: access control measures such as cryptography, passwords and digital signatures that secure the access to information and protected content, and copy control measures such as the serial copy management system for audio digital taping devices and content scrambling systems for DVDs that prevent third parties from exploiting the exclusive rights of the copyright owners. Copyright owners have been wary of the digital environment to exploit and distribute their works and therefore employ technological protection measures, whereas consumers and proponents of "free speech" favor the free and unrestricted access, use and dissemination of copyrighted works digitally.

Introduction

¶          The debate surrounding utilization of technological protection measures to secure copyrighted works in the digital arena has raised many an eyebrow in the past few years. Technological protection measures are broadly bifurcated into two categories: access control measures such as cryptography, passwords and digital signatures that secure the access to information and protected content, and copy control measures such as the serial copy management system for audio digital taping devices and content scrambling systems ("CSS") for DVDs that prevent third parties from exploiting the exclusive rights of the copyright owners.² Copyright owners have been wary of the digital environment to exploit and distribute their works and therefore employ technological protection measures, whereas consumers and proponents of "free speech" favor the free and unrestricted access, use and dissemination of copyrighted works digitally.

¶          In December 1996, the World Intellectual Property Organization ("WIPO") adopted the WIPO Copyright Treaty³ ("WCT"), which is principally aimed at adapting the legal paradigm of copyrights to new technology.⁴ Article 11 of the WCT obligates "contracting parties to provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law."⁵ Pursuant to the WCT, several signatories have enacted laws to implement this international obligation.⁶ The European Union ("EU") promulgated Directive 2001/29/EC on May 22, 2001 on Harmonisation of Certain Aspects of Copyright and Related Rights in the Information Society ("the EUCD"),⁷ inter alia, to enable EU members to implement the WCT.⁸ 

¶          While the EUCD required EU member nations to implement it by December 22, 2002,⁹ only Greece¹⁰ and Denmark managed to abide by the prescribed timeframe.¹¹ The United Kingdom ("UK") released its Consultation Document on implementation of the EUCD on August 7, 2002¹² and invited comments from the public regarding the implementation.¹³ Due to the overwhelming critical responses that the Patent Office received, the EUCD provisions were not implemented in UK by the proposed date.¹⁴ This being said, this article now summarily discusses the anti-circumvention provisions of the EUCD, and briefly analyses the anti-circumvention provisions of the proposed UK consultation document and the subsequent implementation of the EUCD through the Copyright and Related Rights Regulations 2003 ("2003 Regulations").

I. ANTI-CIRCUMVENTION PROVISIONS UNDER THE EUCD: A SYNOPSIS

¶          The EU has been a proponent of providing legal protection for technological protection measures ever since 1988 when the Commission of the European Communities published the "Green Paper on Copyright and the Challenge of Technology - Copyright Issues Requiring Immediate Action."¹⁵ However, the Green Paper did not see the need for explicit legal protection against circumvention.¹⁶ As mentioned above, the EU ultimately acquired impetus to regulate on this issue after the WCT was formulated. After three and a half years of rigorous debate, the EU finally adopted the EUCD.¹⁷ It is important to note that the provisions of the EUCD¹⁸ do not affect the specific legal protection given to computer programs under the EC Software Directive 91/250/EEC ("Software Directive").¹⁹ 

¶          Article 6 of the EUCD (which is by far the most controversial part of the directive)²⁰ embodies provisions pertaining to protection of technological measures. Member states are required to provide "adequate" legal protection against circumvention of "effective" access control, as well as copy-control technological measures.²¹ This enlarges the scope of circumvention as compared to the U.S. Digital Millennium Copyright Act, 1998 ("DMCA") which confines circumvention to access control measures only.²² However, the EUCD²³ does limit the extension of protection for technical measures by stating that the protection should not prevent "normal operation of electronic equipment and its technological development"; nor should technological measures be required in products or services.²⁴

¶          Further, the EUCD imposes a knowledge criterion, whereby the person circumventing the technological measure must know or have reasonable grounds to know that he or she is pursuing the objective.²⁵ This provision may provide the circumventor a legal basis for arguing that he did not know or had no reasonable grounds to know that he was violating the law. The DMCA does not require the circumventor to possess any knowledge whatsoever, thereby making it a strict liability offense.²⁶ 

¶          Akin to the DMCA,²⁷ manufacture, importation, distribution, sale, rental, advertisement for sale or rental, or possession for commercial purposes of devices, products or components, or provision of services that (a) are promoted, advertised or marketed for the purpose of circumvention of, or (b) have only a limited commercially significant purpose or use other than to circumvent, or (c) are primarily designed, produced, adapted or performed for the purpose of enabling or facilitating the circumvention of any effective technological measures should be protected against.²⁸

¶          Technological measures that are applied voluntarily by rightsholders (i.e. the copyright owners) and those that are applied in implementation of the national law both enjoy legal protection against circumvention.²⁹ Nevertheless, whilst prohibiting circumvention or facilitation of circumvention of technological measures, the EUCD requires the rightsholders to provide certain exceptions or limitations. The EUCD, at first, requests rightsholders to adopt voluntary measures, such as agreements between rightsholders and concerned parties,³⁰ which allow the exercise of certain exemptions.³¹ If they fail to take such measures within a "reasonable" period of time, it requires the member states to take "appropriate measures" to ensure that citizens benefit from certain exceptions or limitations to the prohibition of circumvention, where the beneficiaries of the exceptions already have legal access to the protected work or subject matter.³² It could thus be argued that the exceptions concern circumvention of copy-control measures rather than access control. However, these exceptions "shall not apply to works or other subject matter made available to the public on agreed contractual terms in such a way that the members of the public may access them from a place and at a time individually chosen by them."³³ 

¶          Article 6(4) of the EUCD directs member nations to make seven exceptions that may be broadly described as the following:³⁴ photocopying,³⁵ archival copying,³⁶ broadcaster's,³⁷ non-commercial broadcast,³⁸ teaching and research,³⁹ disability-related⁴⁰ and governmental.⁴¹ It also makes it voluntary for member states to adopt the home-copying exception.⁴² 

¶          By explicitly specifying that member nations adopt only eight of the twenty exceptions under Article 5 for the anti-circumvention provisions, it could be implied that the remaining exceptions may be inapplicable to Article 6.⁴³ This disunity could spawn problematic situations. For instance while Article 5(2)(k) provides an exemption for the reproduction right for the purpose of caricature, parody or pastiche, if a person copies a copyrighted work for the purpose of caricature, parody or pastiche by circumventing some technological measures, the same is prohibited. This likely renders the particular exemption potentially futile, or at least drastically limits its scope. However, on the other hand, culling out only eight of the twenty exceptions for the anti-circumvention provisions could also mean that the member nations have to provide for at least eight exceptions, and they may decide, based on their domestic preferences, whether to adopt the remaining exceptions with regard to anti-circumvention provisions. Further, the EUCD may also fail to achieve its goal of harmonizing copyright law in the EU,⁴⁴ as adoption of most of the exceptions under Article 5 is voluntary except for Article 5(1).⁴⁵ Moreover, the creation of such pigeonholed exemptions relating to technological developments tends to ossify the law in a constantly evolving area. Unlike the WCT,⁴⁶ the EUCD does not seem to provide member nations with a free hand in devising exceptions and limitations for the digital environment.⁴⁷ 

¶          Nevertheless, despite its ambiguities, the EUCD is definitely a step in the right direction. It is now up to the member nations to ensure that they implement the EUCD within their domestic forums appropriately and - optimistically - devoid of any uncertainties.

II. Implementation of the EUCD in the United KINGDOM

¶          The UK Patent Office released a consultation paper on August 2, 2002 concerning implementation of the EUCD. The consultation paper summarized the impact of the EUCD, indicated the amendments to be made to the Copyright, Designs and Patents Act, 1988 ("the UK Act") and invited public comments on the draft amendments by October 31, 2002.⁴⁸ Due to the overwhelming responses that the UK Patent Offices received, they postponed the implementation from March 31, 2003⁴⁹ to June 18, 2003 and it was postponed on an "as soon as possible" basis.⁵⁰ However, as aforementioned, the 2003 Regulations have come into effect as of October 31, 2003 to implement the EUCD.

¶          Sections 296 through 299 of the UK Act contained provisions that broadly prohibited the circumvention of copy-protection devices, including those for computer programs, scrambling of encrypted transmission or reception of conditional access services, including trafficking in devices or services to aid in such endeavors.⁵¹ The past § 296 applied only when copies of a copyrighted work were issued to the public in an electronic form which was copy protected. Further, § 296 pertained to the manufacture and distribution of circumvention devices and not the use of circumvention devices on technological measures.

¶          The EUCD expands the scope of protection available to copyright owners. Firstly, the EUCD applies to all types of technological measures, and is not restricted to those currently under the UK Act. Secondly, the EUCD applies to technological measures used on copyrighted works in any form, and not necessarily in electronic form. Thirdly, the EUCD also proscribes the very act of circumvention and the use of circumvention devices to circumvent technological measures.

¶          The consultation paper proposed that § 296 of the UK Act be reworded to apply only to computer programs, and new §§ 296ZA - 296ZD be added.

¶          The proposed amendments to the UK Act prohibited the act of circumventing technological measures and certain acts that facilitate or enable the circumvention of technological measures.

¶          Section 296ZA prohibited circumvention of a technological measure on a copyrighted work, provided the following conditions were satisfied:⁵²

1. the work must be a work other than a computer program;
2. the copies must be issued or communicated to the public by or with a license of the copyright owner;
3. effective technological measures should have been applied to the copies
4. a third person must circumvent the technological measures with the knowledge or having reason to believe that he is circumventing the measures.

¶          The implementation of this provision would, amongst other things, make it illegal to decrypt the CSS on DVDs or even break their "region locks."

¶          Section 296ZB proposed to make it an offence to facilitate or enable the circumvention of an effective technological measure. Any person who performs any of the following activities⁵³ relating to a device, product or component which is primarily designed, produced, or adapted for the purpose of enabling or facilitating the circumvention of effective technological measures is criminally liable:⁵⁴

1. makes for sale or hire;
2. imports otherwise than for private or domestic use;
3. sells or lets for hire, offers or exposes for sale or hire, advertises for sale, possesses or distributes in the course of business; or
4. distributes otherwise than in the course of business so as to affect the copyright owner prejudicially.

¶          The use of the term 'primarily' would immunize manufacturers of devices or products that are manufactured for a legal purpose, but can also be used for circumvention of technological measures. Further, § 296ZC also provided for rights and remedies against a person who performed the acts mentioned in § 296ZB relating to a device, product or component that has a limited commercially significant purpose other than to circumvent technological measures.⁵⁵

¶          Moreover, any person who provided, promoted, advertised or marketed a service in the course of business or otherwise so as to prejudicially affect the copyright owner, with the purpose of enabling or facilitating circumvention, was also said to have committed an offence.⁵⁶ 

¶          Nevertheless, the alleged offender may defend his position by proving that he had no knowledge or reasonable ground for believing that the device, product, component or services provided enabled or facilitated the circumvention.⁵⁷

¶          As aforementioned, circumvention or facilitation thereof, of "effective technological measures" is prohibited. The proposed amendments define "technological measures" as any technology, device or component, which is intended in the normal course of its operation to protect a copyrighted work other than a computer program.⁵⁸ Further, the technological measures would be considered effective if the use of the work is controlled either by access control or copy control mechanisms. Therefore, the meaning is broad enough to include any type of technological measures used to protect copyrighted works in electronic or any other form under its purview.⁵⁹

¶          The proposed amendments provided not only the copyright owner, but also the person issuing or communicating copies of the work to the public, with rights against the alleged circumventor. In all the instances where circumvention of effective technological measures or facilitation/enablement thereof is prohibited, the copyright owner or person issuing copies to the public would have the same rights available as those in an infringement action.⁶⁰ These rights were available concurrently.⁶¹ Further, they could also ask for delivery up or seizure of any devices, products or components in possession, custody or control of the alleged offender, which were intended to be used for circumvention.⁶² 

¶          The proposed amendments also made it a criminal offence to facilitate or enable the circumvention of effective technological measures. On being found guilty, the alleged offender may be punished with imprisonment up to three months and/or a fine not exceeding the statutory maximum (in case of a summary conviction), and with imprisonment up to two years and/or fine (in case of conviction on indictment).⁶³

¶          The Consultation Paper also proposed various amendments to the extant sections of the UK Act to incorporate the exceptions under the EUCD.⁶⁴ However, if the beneficiaries of these exceptions do not obtain the benefit of a copyrighted work due to the application of an effective technological measure, the beneficiary may issue a notice of complaint to the Secretary of State.⁶⁵ The Secretary of State could issue written directions to the copyright owner or exclusive licensee of the work to establish whether a voluntary measure or agreement relating to such a work exists, or in its absence enable the complainant to benefit from the work.⁶⁶ The person to whom such a direction was issued would be under an obligation to comply with the same, failing which he/it could be liable for a breach of duty.⁶⁷ However, such a procedure would be inapplicable in cases where the copyright work was made available by an on-demand service, or was obtained unlawfully.⁶⁸

¶          The UK Government conducted a detailed analysis of the various responses to the consultation document⁶⁹ and thereafter issued the 2003 Regulations to ultimately implement the EUCD.

¶          The 2003 Regulations do not materially alter the proposed amendments under the UK consultation document concerning anti-circumvention of technological measures on works other than computer programs. They, by and large, maintain the same provisions for prevention of circumvention of technological measures on works other than computer programs.⁷⁰ The key differences are that the 2003 Regulations provide for exceptions for cryptographic research⁷¹ and reverse engineering⁷² (as discussed below), they do not require that the copyrighted work should be issued or communicated to the public by the copyright owner or his licensee,⁷³ and they do not limit the civil sanctions to works that are only issued or communicated to the public.⁷⁴ 

¶          While the Consultation Paper was a worthwhile attempt to implement the EUCD, it did have some drawbacks that should not have passed unchecked. It is uncertain whether these drawbacks could have been changed dramatically by the 2003 Regulations, as they directly sprung from ambiguities and loopholes in the EUCD. However, some explanation on these issues would have helped avoid the vagueness in the implementation.

¶          As aforementioned, the EUCD and consequently, the UK implementation do not apply to existing Community legal provisions relating to computer programs and software. Section 296 of UK Act in its pre-EUCD form prohibited the facilitation of circumventing copy-protection (and not access control) mechanisms on computer programs, provided that the device or means were specifically designed to circumvent. If the sole purpose of a device or means was not circumvention, its manufacture, sale, etc., was not restricted.⁷⁵ The proposed amendments and the 2003 Regulations did not alter the then extant section relating to computer programs. As a result, other copyrighted works will enjoy greater protection than computer programs.

¶          This situation can be exemplified using the following illustration. Company A distributes an encrypted version of software over the Internet. The software is also protected by a copy protection mechanism that prevents users from duplicating or disseminating it to third parties. The Company also vends encrypted and copy-protected movies in DVD format on its website. Hacker X uses a computer program manufactured by Company B to circumvent the access control and copy-control systems protecting the software as well as DVDs and commercially distributes thousands of copies to the public. The computer program manufactured by Company B can however be used for several legitimate purposes, and facilitating hacking is only one of its uses. Nevertheless, upon investigation, it is found that a majority of the customers use Company B's program for hacking. Under the pre-EUCD Act, the proposed Consultation Paper and the 2003 Regulations, Hacker X would not be liable for circumventing the access-control and copy protection mechanism on the software, as the former do not make the act of circumventing access-control or copy protection measures on computer programs an offense. However, the hacker would be liable for circumventing the technological measures used on the DVDs. Further, Company X may not be liable for manufacturing the computer program used by the hacker in relation to the software because enabling circumvention was not the 'sole' purpose of designing the software. Nevertheless, Company X could be liable under the proposed amendments for facilitating circumvention of the technical measures of the DVD-format movies.

¶          It is crucial for the software industry that the imbalance in protection accorded to computer programs and other copyright works be corrected. The EUCD mandates that it shall leave intact the existing provisions for computer programs⁷⁶ and shall not inhibit or prevent the development or use of any means for circumventing technological measures necessary under Articles 5 (exceptions) and 6 (de-compilation) of the Software Directive.⁷⁷ However, by providing additional and more effective protection for computer programs, the UK implementation would not have in any way inhibited the activities under Article 5 and 6 of the Software Directive. It was estimated that software piracy, which is nearly at $12 billion worldwide, and $3 billion in Western Europe could be reduced by at least one-third if the WCT and EUCD provisions were implemented efficaciously.⁷⁸ But since the above-mentioned irregularity remains unchecked, piracy figures may not drop substantially.

¶          As discussed above, the pre-EUCD UK Act prevented circumvention of only copy-control mechanisms on computer programs. Therefore, if an access control mechanism was circumvented, the same would not have been punishable. This could have created a problem that may have invalidated one of the purposes underlying the proposed changes, namely fostering of creativity and innovation.⁷⁹ We know that most (if not all) of the methods of encryption for digital works are some form of computer software. If the access control measure on the encryption software were circumvented, it would not create any liability as the pre-EUCD UK Act and the UK consultation document did not penalize the very action of circumventing technological measures on computer programs, and penalizes only facilitation of circumvention of copy-control mechanisms on software. This implied that once a hacker knew how to circumvent particular encryption software (and is not even punished for the same), copyright owners would be extremely uncomfortable using that encryption software. This problem would continue with each and every new form of encryption software that were developed, unless the law were changed to penalize such pirates.

¶          The 2003 Regulations widen the scope of protection by proscribing anti-circumvention of any "technical device" that has been applied to a computer program.⁸⁰ Technical device in relation to a computer program has been defined as "any device intended to prevent or restrict acts that are not authorized by the copyright owner of that computer program and are restricted by copyright."⁸¹ This certainly increases the scope of protection offered in the pre-EUCD UK Act and the proposed UK consultation paper with respect to only 'copy-protection' measures.

¶          Though the EUCD requires that legal protection against circumvention of technological measures should not hinder cryptographic research,⁸² neither the EUCD nor the UK Consultation Paper contained substantive provisions that explicitly permitted research into cryptography.⁸³ Cryptographers generally review algorithms proposed by their peers, examine the algorithms and devices and publish the results of their research for advancement of knowledge in cryptography and enable correction of flaws in algorithms.⁸⁴ However, if an algorithm forms part of a technological measure, and the cryptographer investigates and discovers weaknesses in the algorithm, could he have been prosecuted under § 296ZA of the proposal for circumvention? Further, would the publication of research results have amounted to "provision of service" under §§ 296ZB and 296ZC, and have made the cryptographer liable? It would be useful to clarify the extent to which cryptographic research is exempt and who qualifies as a "cryptographic researcher"⁸⁵ in order to eliminate ambiguities.

¶          Pursuant to the responses of several academic and research organizations,⁸⁶ a specific exception has been carved out for cryptographic research under the 2003 Regulations.⁸⁷ Section 296ZA(2) states that provisions prohibiting circumvention of technological measures shall not apply where a person, for the purposes of research into cryptography, does anything that circumvents effective technological measures. However, if any such circumvention for cryptographic research or issuance of any information obtained during the research prejudicially affects the rights of the copyright owner, the exemption would not apply. The Regulations do not explain any circumstances in which the interests of the copyright owner are prejudicially affected and it is therefore left to the interpretation of the courts.

¶          Unlike its US counterpart which explicitly exempts reverse engineering,⁸⁸ the Consultation Paper did not suggest whether reverse engineering, which was permitted under § 50B and § 296A of the pre-EUCD UK Act, would be permitted if a copyright work is protected by an effective technological measure. While the absence of a clear provision might have suggested that reverse engineering would still be permitted, it was be advisable to obtain a clarification to this extent. In order to reverse engineer the work, a person would have to circumvent the technological measure, which could in turn make the person liable. Reverse engineering is critical in the software industry to develop inter-operable products. It was urged that restricting reverse engineering for creating inter-operable products would retard software development and indirectly grant a monopoly to copyright owners over related products.⁸⁹

¶          Section 50BA of the 2003 Regulations states that when a lawful user of a copy of a computer program observes, studies or tests the functioning of the program in order to determine the ideas and principles which underlie any element of the program, he would not be liable for infringement of the copyright in the program.⁹⁰ However, he must do so while loading, displaying, running, transmitting or storing the program which he is entitled to do. Thus, the 2003 Regulations specifically carve out an exemption for reverse engineering and circumventing technological measures for such purposes would be permitted.

¶          There was also a fear that § 296ZC(1)(b) of the Consultation Paper which prohibited "any device, product or component which has only a limited commercially significant purpose or use other than to circumvent" would cause problems for open-source or free software.⁹¹ The language in the EUCD⁹² mentions the legal protection offered under the EUCD must not prohibit devices or activities that have a "commercially significant purpose or use" other than circumventing the technological measures. However, the EUCD fails to define or explain the term "commercially significant" thereby leaving it to the interpretation of the European Court of Justice or the national legislatures and courts. It has been urged that even though open-source or free software is not sold commercially, it may have a commercially significant use and therefore member states must create a special or explicit provision concerning the same.⁹³ However, §296ZD(1)(b)(ii) of the 2003 Regulations merely reiterates the provisions of the Consultation paper.

¶          Under the proposed amendment to § 67 of the UK Act, non-profit organizations, clubs and societies that are permitted to play sound recordings at events for a charge or access to the event, can do so only if the charge does not exceed what is necessary to cover the cost to the organization for holding the event or the operating costs of the organization in relation to that place. This does not seem to be a reasonable condition, as the costs of organizing community events are usually not fixed.⁹⁴ Organizations with interests in licensing of public performances of sound recordings argued that §67 should be entirely deleted.⁹⁵ However, the Government was concerned that such organizations would conduct activities on a quasi-commercial basis⁹⁶ and had therefore imposed the condition of the charges not to exceed the cost of the event. Pursuant to the responses, it amended the proposed changes in the Consultation Paper concerning fixation of costs by imposing certain safeguards to prevent the organizations from commercially benefiting from such activities.⁹⁷ 

¶          Further, the complaint procedure to the Secretary of State under the proposed Consultation Paper and the 2003 Regulations is time-consuming (as the Secretary may be flooded with complaints) and impractical (if a complaint has to be made every time a technological measure needs to be circumvented).⁹⁸ It has been suggested that in order to save time, once a complaint has been made to the Secretary of State in a particular regard, others would not have to make a complaint on the same issue or reactivate the entire procedure.⁹⁹ It is also proposed that the copyright owners should be statutorily obligated to permit circumvention of technological measures,¹⁰⁰ and that effective enforcement mechanisms be put in place for the same.¹⁰¹ Another lacuna in the proposed complaint procedure is to have a right of appeal if the Secretary of State does not respond adequately to the complaint.¹⁰² Other member states, such as Denmark, Greece, France and Italy have provided for an appeals process in their legislation and draft legislation respectively.¹⁰³

Conclusion

¶          While technological measures are not fool-proof, they do provide copyright owners with a safety cushion when exploiting works in a digital environment. Moreover, legal protection against circumvention of these measures by pirates and hackers enhances the security level of copyright owners. Consequently, consumers would benefit from the access to and use of legitimate and superior quality copies of copyrighted works.

¶          Though the EUCD implementation aimed at maintaining the essential and eternally elusive balance in copyright law between ownership rights and exceptions for the benefit of legitimate users,¹⁰⁴ certain ambiguities are still unresolved, such as the imbalance between protection for software and other copyrighted works and the permissibility of open-source software provided it does not prejudice copyright owners. The remedial characteristics of the paradigm should also have been modeled on a less time consuming and more efficient pattern.

¶          It is hoped that the implementation of the EUCD has enabled UK to confirm to its international obligations and also economically benefit the copyright and related industries.

Footnotes