Recently, the Court of Justice of the European Union (breviter “Court”) ruled on an important case regarding the protection of Intellectual Property online.

In fact, on July 9th the fifth Chamber of the Court ruled the Case C-264/19 in which Constantin Film Verleih GmbH (breviter “Constantin”, a film distributor established in Germany) was opposed to the Internet giants YouTube LLC and Google Inc.

The dispute arose because of users’ communication via YouTube of cinematographic works on which Constantin Film holds exclusive rights in Germany.

YouTube is a web 2.0 platform that allows users to watch, upload and share contents and digital works since 2005. After a huge success all over the world, YouTube was acquired by Google in 2006 and become the n.1 video-sharing site on the Web (according to “The top 500 sites on the web”, https://www.alexa.com/topsites).

The case law

Constantin acted in front the German court because of the violation of its intellectual property rights. In fact, some users uploaded and shared via YouTube the full version of cinematographic works which Constantin holds exclusive exploitation rights. Indeed, prior to the legal proceeding, Constantin asked Google for the data of users who had unlawfully shared the cinematographic works via YouTube.

The German company only obtained fictitious names used by users to access the online platform, i.e. username. This information proved to be useless for the protection of the interests and rights of the German company.

For this reason, Constantin brought an action before the Frankfurt Court ordering YouTube and Google to provide additional information to identify the users who infringed its intellectual property rights. In particular, the German company asked to obtain:

• e-mail addresses;
• mobile phone numbers;
• IP addresses used by users for uploading files;
• the exact time of uploading works online;
• the IP address used by the users for the last access to their Google account.

At the end of the proceeding, the requests by Constantin were rejected.

In second-instance, they were partially granted since the Oberlandesgericht Frankfurt am Main (Higher Regional Court, Frankfurt am Main, Germany) ordered Google to provide users’ e-mail addresses.

At this point, Constantin appealed to the Bundesgerichtshof (Federal Court of Justice, Germany), insisting to force YouTube and Google to communicate the telephone numbers and IP addresses of users.

Instead, the US companies applied for (1) the rejection of the appeal in its entirety and (2) the redrafting of the judgment which obliged Google and YouTube to communicate the users’ e-mail addresses.

The request for a preliminary ruling of the Court under Article 267 TFEU

In the light of the requests of the parties and the differing guidelines within the same German legal system, the German Federal Court of Justice stayed the proceedings in order to request to the Court of Justice of EU for a preliminary ruling.

In the following, it is reported the request by the German Court:

“(1) Do the addresses of the producers, manufacturers, distributors, suppliers and other previous holders of the goods or services, as well as the intended wholesalers and retailers, mentioned in Article 8(2)(a) of Directive [2004/48] and covered, as appropriate, by the information referred to in Article 8(1) of Directive [2004/48], also include (a) the email addresses of service users and/or (b) the telephone numbers of service users and/or (c) the IP addresses used by service users to upload infringing files, together with the precise point in time at which such uploading took place?

(2) If the answer to Question 1(c) is in the affermative:

Does the information to be provided under Article 8(2)(a) of Directive [2004/48] also cover the IP address that a user who has previously uploaded infringing files last used to access his or her Google/YouTube user account, together with the precise point in time at which access took place, irrespective of whether any infringement [of intellectual property rights] was committed when that account was last accessed?”

Intellectual Property infringements online …

The controversy between Constantin and Google + YouTube occurred due to the recent technological advances and the creation of online platforms and social networks such as YouTube or Facebook, which have had a great impact on the lives of users, revolutionizing the communication and contributing to the birth of the c.d. “information society”[1].

Web 2.0 allows to reach, in a pervasive way, devices able to process data, exchange information and share files at any time, from one end of the globe to the other and at very high speed[2].

Ergo, digital works (as Constantin’s films) can be shared online at such a speed. This makes obsolete the “classic” protection methods, showing the obvious limitations in a scenario completely different from the one in which these methods were conceived.

To address this need for protection, the European Community (now the “European Union”) laid the foundations to ensure full respect for intellectual property with the Directive n. 2004/48 on the enforcement of intellectual property rights (so-called “IPRED”), in accordance with art. Article 17, par. 2, of the Charter of Nice.

With this Directive was established that “Member States shall provide for the measures, procedures and remedies necessary to ensure the enforcement of the intellectual property rights covered by this Directive. Those measures, procedures and remedies shall be fair and equitable and shall not be unnecessarily complicated or costly, or entail unreasonable time-limits or unwarranted delays. Those measures, procedures and remedies shall also be effective, proportionate and dissuasive and shall be applied in such a manner as to avoid the creation of barriers to legitimate trade and to provide for safeguards against their abuse” (cfr. Article 3).

In the context of the protection instruments set out in the IPRED, it is noted that Article 8 (“Right of information”) states that, in response to a justified and proportionate request of the claimant, i.e. the holder of the infringed right, the competent authority may order that in the context of proceedings concerning an infringement of an intellectual property right and the competent judicial authorities may order to disclose information on the origin and distribution networks of the goods or services which infringe an intellectual property right be provided by the infringer (and/or any other person connected to the infringment).

In particular, Article 8, paragraph 2, adds to point a) that, where appropriate, the information may comprise: “the names and addresses of the producers, manufacturers, distributors, suppliers and other previous holders of the goods or services, as well as the intended wholesalers and retailers”.

However, it is necessary to consider that, as far back as 2004, the legislator took care to establish that the communication of the information referred to in paragraphs 1 and 2 must necessarily take into account “the protection of confidentiality of information sources or the processing of personal data” (paragraph 3, e).

… and data protection

Privacy is a fundamental right of the individuals, whose discipline has been carefully reviewed in the light of technological evolution and globalization. In fact, data protection in the European context has a source to the same founding Treaties of the European Union and the principles underlying it were recently amended by Regulation (EU) 2016/679 (also called “GDPR”), which is directly applicable since May 25, 2018 in all Member States.

The processing of personal data (which includes the information of users requested by Constantin to Google and YouTube), is now regulated in the light of the aforementioned legislation which strengthened the protection of the data subjects’ rights, providing for important sanctions (administrative and criminal), which may extend in cases of greater severity up to a maximum of Euro 20M or, for businesses (such as Google), up to 4% of the total worldwide annual turnover of the previous year, whichever is higher.

Therefore, in the application of legislation relating to the protection of economic rights (such as the exploitation of intellectual property rights upon digital works) it should be taken into account the right to privacy, that has been modified in order to provide for greater protection of citizens’ rights, including in the cyberspace.

Conclusions

The Court of Justice of the European Union in its ruling under Article 267 TFEU requested by the Bundesgerichtshof (German Federal Court of Justice), has considered the GDPR in its interpretation of art. 8 of the “IPRED” (Directive n. 2004/48).

The Court affirmed that “Article 8(2)(a) of Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights must be interpreted as meaning that “the term ‘addresses’ contained in that provision does not cover, in respect of a user who has uploaded files which infringe an intellectual property right, his or her email address, telephone number and IP address used to upload those files or the IP address used when the user’s account was last accessed”.

The Court with this decision did not endorse a broad interpretation of the notion of «address» (supported by Constantin) because of the implications in the fields of data protection and “information” could have been catastrophic.

It should be noted that the decision of the Court was based on a literal and systematic interpretation of the notion of «address», in the absence of any (hoped-for) clear and decisive reference to the innovative legislation on the privacy protection on the Internet.

Giulio Riccio

[1]   S. CRAWFORD, The Origin and Development of a Concept: The Information Society, 1983, Bull. Med. Libr. Assoc. 71(4) October, 380.

[2]   M. HARDT, A. NEGRI, Multitude: War and Democracy in the Age of the Empire, 2005, New York: Hamish Hamilton, 108.