As with enforcement of rights in the analogue environment, enforcement of copyright online presupposes that the infringer is identified or that an intermediary takes action. However, it can often be difficult to identify the infringer, for example as regards so-called (illegal) file sharers. The only information related to the alleged infringer which is normally known to the right holder is the IP number – related to a specific internet connection (subscription) – used by the alleged infringer at the time of the alleged infringement. Data or information on the identity of the person behind the IP number at a specific time is however not known to the right holder.
Article 8 of Directive 2004/48/EC on the civil enforcement of intellectual property rights aims to, to some degree, provide a solution to this problem. By providing right holders with a “right of information”, they can ask an Internet Service Provider (ISP) to provide information/data related to an alleged infringer, such as his or her identity. Hence, the provision on right of information is crucial – if not indispensable – for the civil enforcement by right holders against online infringers such as (illegal) file sharers (as compared to criminal enforcement or enforcement against contributory or secondary infringers such as Internet Service Providers).
However, any provision on right of information in national law presupposes that the ISP has retained the relevant information/data on the identity of the alleged infringer. At present there is no specific EU legislation taking aim at the mandatory retention of such data for the purpose of civil enforcement of copyright in the online environment. There are, however, provisions on data retention for other purposes in Directive 2006/24/EC.
The issue of data retention for the purpose of civil enforcement of copyright online, including inter alia the relationship between Article 8 of Directive 2004/48/EC and Directive 2006/24/EC, has been subject to a case before the Court of Justice of the European Union (CJEU), case C-461/10 (Bonnier Audio and Others). The CJEU held that Directive 2006/24/EC must be interpreted as not precluding the application of national legislation based on Article 8 of Directive 2004/48/EC which, in order to identify an internet subscriber or user, permits an internet service provider in civil proceedings to be ordered to give a copyright holder or its representative information on the subscriber to whom the internet service provider provided an IP address which was allegedly used in an infringement. The Court also held that certain directives on processing of personal data and protection of privacy must, given certain conditions, be interpreted as not precluding such national legislation as just mentioned.
In its judgment, the CJEU effectively rejected the opinion by the Advocate General (AG), who had held that the information – on the subscriber to whom the internet service provider provided an IP address which was allegedly used in an infringement – must have been retained in order to be disclosed and used for that purpose in accordance with detailed national statutory provisions which have been adopted in compliance with EU law on the protection of personal data. To my knowledge, such legislation is almost non-present within the Member States of the EU. Thus, one could say that the CJEU by its decision has “defended” or “safeguarded” the right of civil enforcement by right holders against direct online infringers. In my opinion this possibility is fundamental. Without the possibility of enforcement, the right holders have no true “exclusive rights”. One can just imagine what the consequences would have been for the protection of copyright in the online environment if the CJEU had sided with the AG. In any case, the European Commission is considering amending Directive 2004/48, as the Commission deemes that “it has become apparent that the Directive was not designed with the challenge posed by the Internet to the enforcement of intellectual property rights in mind.” In this contenxt the Commission is considering whether to amend the provisions on procedures to gather and preserve evidence (including the relationship between the right of information and protection of privacy).