File Sharing, Kazaa, Intellectual Property Rights and Privacy: Case C-275/06
It goes like this. In the blue corner you have several EC Directives protecting intellectual property rights, like Directive 2000/31/EC on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, Directive 2001/29/EC on the harmonization of certain aspects of copyright and related rights in the information society, and Directive 2004/48/EC on the enforcement of intellectual property rights. In the red corner you have Directive 2002/58 concerning the processing of personal data and the protection of privacy in the electronic communications sector. And in the middle you have folks using Kazaa on the internet, access to which is provided by an internet service provider like Telefónica in Spain.
Promusicae, a Spanish organization of producers and publishers of musical and audiovisual recordings, applied to the Spanish courts for an order that Telefónica should disclose the identities and physical addresses of people whom it provided with internet access services, and who were allegedly using the KaZaA file exchange program to share musical and audiovisual files. It sought disclosure of that information to be able to bring civil proceedings against the persons concerned.
Under Spanish law the communication of the data sought by Promusicae was permitted only in a criminal investigation or for the purpose of safeguarding public security and national defence. What Promusicae wanted to commence were clearly civil, not criminal proceedings. Thus, the question was referred to the Court of Justice whether EC law requires member States to lay down, in order to ensure effective protection of copyright, an obligation to communicate personal data in the context of civil proceedings.
The Court held that EC law as it currently stands does not require member States to render mandatory the disclosure of the sort of information requested by Promusicae to commence civil proceedings to protect intellectual rights.
As a result, the file sharers can have their data protected in Spain and it won't be disclosed to the likes of Promusicae to commence civil proceedings against them.
The question is therefore whether Spain could change its law to render disclosure of the personal data sought obligatory in the context of commencing civil proceedings.
The Court held that EC law does not preclude the mandatory disclosure of such information. But when member States introduce legislation to render such disclosure mandatory, the Court held that they must, when transposing the directives on intellectual property and the protection of personal data, rely on an interpretation of those directives which allows a fair balance to be struck between the various fundamental rights protected by the EC legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with the directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality (see Case C-101/01 Lindqvist, paragraph 87, and Case C-305/05 Ordre des barreaux francophones et germanophones and Others, paragraph 28 - a case we noted here.
A close reading of the Court's judgment and of the Advocate General's Opinion shows a divergence of view on disclosure of such personal data could ever be made mandatory in the context of civil proceedings.
The Advocate General in paragraphs 84 to 86 of her opinion came to the conclusion that Directive 2002/58 does not allow member States to render mandatory disclosure of personal data in the context of civil proceedings brought to protect the rights of others. She pointed out that Article 15(1) of Directive 2002/58 set out two types of bases for exceptions, namely, on the one hand, in the first four alternatives, national security (that is, State security), defense, public security, and the prevention, investigation, detection and prosecution of criminal offenses and, on the other, in the fifth alternative, unauthorized use of the electronic communication system. In addition, Article 15(1) of Directive 2002/58 refers to Article 13(1) of Directive 95/46, which contains further grounds of exception. The question was what exactly did that reference to Article 13(1) of Directive 95/46 mean. She noted that Article 13(1)(g) of Directive 95/46 allows the communication of personal data for the protection of the rights and freedoms of others. Unlike the grounds of exception in Article 13(1) of Directive 95/46, this ground is not expressly listed in Article 15(1) of Directive 2002/58.
Viewed in isolation, that could be understood as a reference to all the grounds of exception under Article 13(1) of Directive 95/46. However, that is contradicted, she opined, by the fact that Article 15(1) of Directive 2002/58 itself mentions grounds of exception which are intended to allow a restriction ‘in accordance with Article 13(1) of Directive 95/46’. Those grounds correspond only in part to the grounds in Article 13(1) of Directive 95/46 and do not include the exception for the rights of others, mentioned under (g). Consequently, the grounds mentioned in Article 13(1) of Directive 95/46 are applicable in the electronic communications sector only in so far as they are expressly included in Article 15(1) of Directive 2002/58. As the protection of the rights and freedoms of others was clearly omitted from the list in Article 15(1) of Directive 2002/58, the reference to Article 13(1) of Directive 95/46 could not incorporate it indirectly.
The Court of Justice took the opposite view in its judgment. It held in paragraph 53 of its judgment:
"It is clear, however, that Article 15(1) of Directive 2002/58 ends the list of the above exceptions with an express reference to Article 13(1) of Directive 95/46. That provision also authorises the Member States to adopt legislative measures to restrict the obligation of confidentiality of personal data where that restriction is necessary inter alia for the protection of the rights and freedoms of others. As they do not specify the rights and freedoms concerned, those provisions of Article 15(1) of Directive 2002/58 must be interpreted as expressing the Community legislature’s intention not to exclude from their scope the protection of the right to property or situations in which authors seek to obtain that protection in civil proceedings."