Euro privacy watchdog raises eyebrows at mulled EU copyright law

[Len]

Warns that wording needs to be 'as precise and clear as possible'

Europe's top data expert has given a tentative green light to a proposed European copyright law – but warned that it needs to be very carefully written if it's not to distort markets or interfere with fundamental rights.

European Data Protection Supervisor (EDPS) Giovanni Buttarelli was asked to contribute his thoughts about the controversial Article 13 of the draft EU Directive on Copyright in the Digital Single Market; a piece of legislation that would require large internet platforms to introduce automated filters that block uploads of copyrighted content.

Buttarelli does not have a legal right to force changes in the mulled legislation but his position is taken seriously and any recommendations he makes to legislation are expected to be fully considered as it passes through the legislative process.

As such, his nine-page response [PDF] reflects pretty much what every other expert has said so far: the idea of getting web giants to proactively stop copyrighted material from appearing online is a good one in theory, but in practice is fraught with danger.

Large media companies, musicians, writers, artists, and other content creators, and intellectual property lawyers argue that it is essential for businesses to use the latest technology to stop pirated material from appearing online, rather than today's unworkable system of requiring them to report millions of infractions every day by hand or by bot.

And some outfits and luminaries are deeply concerned that it will end up undermining a fundamental freedom of the internet, resulting in widespread censorship and creating a huge burden on relatively medium-sized businesses. Small firms are spared in the draft law.

Law storm

Buttarelli notes that he is all too aware of the debate over the matter, but focuses in on the wording and whether it is liable to break any existing laws and rights as it relates to privacy and data protection.

Broadly his response is that Article 13 doesn't break anything, but that it has the potential to cause a lot of harm if applied badly or worded poorly.

"The provisions contained in this proposal… do not aim to mandate general surveillance of activities on the internet," he notes, but adds there "is a risk that this proposal would exacerbate the situation if the measures taken prove not to be 'appropriate and proportionate'."

As such he recommends "strict scrutiny… and supervision of the measures taken by service providers and rightholders." In other words, a close eye on how aggressively companies like Disney enforce the new law, and how companies like Facebook or Google respond.

When it comes to fundamental rights to privacy, he is also not opposed to Article 13 but is a little wary. He recommends that lawmakers "continue to reflect carefully on likely practical consequences of the obligations created" and on "the potential for distorting competition in ways which will harm fundamental rights."

Noting that it is a "delicate area" his proposed solution is that the wording of the law must be tightened up to be "as precise and clear as possible." And again he recommends that the EU "vigilantly evaluate the implementation of the directive and ensure that data protection by design and other safeguards are effectively put into place."

He's also concerned that the law may distort markets because whatever legal language is finally agreed upon, it is inevitable that any company will try to stay outside the lines and so not be subject to its provisions.

Subset

Article 13 would, he notes, creates "a newly-defined subset of information society services" and as such "it is reasonable to expect that, where in doubt and to avoid litigation, information society services would be inclined to comply with these new obligations."

But if a company can avoid those obligations, it will, even if that means they "cease activities which might bring them within the scope of the provision."

Effectively, rather than agreeing with the argument that the burden will fall on small internet companies and so give the big boys – Amazon, Facebook, Google etc – a leg up, Buttarelli fears that smaller companies will simply stop offering any services that fall within the new law. Which would also be giving the large companies a clear advantage in the market by acting as a barrier to entry.

He notes, as many have throughout the debate, there the goal is to strike a "fair balance" between "the protection of copyright on the one hand and, on the other hand, the protection of the fundamental rights of other persons."

He says that Article 13's inclusion of the term "appropriate and proportionate measures" fits that balance but worries that about what those measures would actually be and how they would be judged as appropriate or proportionate.

Those opposed to Article 13 have jumped on the comments as evidence that the directive is poorly worded or that he has flagged it needs to be rewritten. But in actuality the view of the European Data Protection Supervisor is that the law is fine in theory, yet needs to be carefully monitored in practice.

"The EU will need to be vigilant to ensure that implementation of the provisions does not exacerbate the already excessive monitoring of people on the internet currently endemic to digital society," he concludes.