From the beginning of 2019 we will be transitioning from Onyx Online Law to Onyx Legal.
Why? Well, as a forward looking business we give strategic consideration each year to where we are headed, and revisit what we have achieved toward the end of the year. As part of that process we consider the feedback we have received from our clients and the very kind people who refer our services to others.
One piece of feedback we have been receiving is that the whole ‘online’ reference confuses people and that based on our name, some people think we are either only helping people ‘online’, or don’t provide full services in the corporate and commercial legal space.
So, to clear up any confusion, we thought we’d review our name. We wanted to stick with Onyx, it represents who we are and how we help people really well. So it we just had to work out what went with it, and made sense to our clients and potential clients.
In growing into the new Onyx Legal brand, we have to say that the availability of the new top level domain name .legal did have a little bit to do with it. We thought it would be cool to have a .legal domain name.
So, that’s how we got here. Over the next year you will see our rebranding come out and a new website.
Thank you for your support and we look forward to continuing to work with you into the future!
The Onyx Legal Team
The Onyx Legal Newsroom Sign-up
Would you like legal tips to better run your business? Sign up below for monthly advice.
If your business is not in Europe, should you be worried about GDPR?
GDPR has the potential to impact any business that might be doing business with a European resident, whether the business is online or not. This article covers some of the most frequently asked questions we have received from clients, to help you decide what level of action you need to take to protect your business, and how soon.
For those of you who haven’t heard anything about it yet, GDPR is the General Data Protection Regulation introduced by the European Parliament back in April 2016, and came into effect on 25 May 2018.
What is GDPR?
GDPR is the General Data Protection Regulation (GDPR) is an European Union law which came into effect on 25 May 2018 across all European Union nations including the UK. The GDPR is designed to strengthen privacy rules and requirements around how information relating to individuals can be collected and used and updates and unifies data protection laws across Europe.
How does GDPR apply to Australian business?
Australian businesses may need to comply with the GDPR if:
they have an office in the EU (regardless of where they actually process personal data); or
they offer goods or services to individuals of the EU (these services can be free or for money); or
they monitor the behaviour of individuals in the EU.
A business will be considered to offer goods or services if they have actual clients or members who live in the EU or if their business could be used by and is intended to be used by individuals in the EU eg. you sell goods online and have a shopping cart that displays as an option the purchase amount in Euros.
How is GDPR different from current Australian Privacy Laws?
The good news is that both the Australian Privacy Act 1988 (Cth) and the GDPR have similar requirements. This means many businesses will have already started the process required to be GDPR compliant. The GDPR does however have additional requirements. It introduces higher standards for the manner and basis on which data is collected and gives more rights to an individual to control their data.
We have European customers, does GDPR affect us?
Short answer – yes. The intent of the legislation is to protect personal data of data subjects in the European Union. If you already have that data, you should comply.
On the other hand, if you don’t already have that data, the legislation appears to consider your intent about collecting it.
Does your business ‘envisage offering services’ to people in Europe?
If you have random purchases from European residents, or surprise inquiries from European residents, then you might not actually have planned to do business in Europe, it could merely be coincidental. The recitals for GDPR (the 173 introductory paragraphs before the Regulation provisions) talk about whether a business ‘envisages offering services’ to people in Europe and infers that there must be an intent to do business in Europe, not merely happenstance.
Just because people in Europe can find your website, or contact details, that is not enough to demonstrate that you plan to do business in Europe. On the other hand, if you’ve designed your business so that it can be translated, or has pages in languages most commonly used in Europe, enables people to pay with Euros and is otherwise targetting European customers in some way, you are demonstrating an intent to do business with EU residents and must comply with GDPR.
It is all very up in the air at the moment as to what some of the regulations actually mean, and there will be a period of settling in, as well as prosecutions of non-compliant companies, before we have a clear idea about how GDPR will be enforced.
EXAMPLE:
Australian business not affected by GDPR
You have a website that displays pretty pictures about growing fruit in Queensland, Australia. When individuals go onto your site, cookies collect information about them and google advertising gets this information and uses it to target advertising to that individual about fruit trees.
In this example it is not clear if a goods or services are being offered as there is no actual connection between individuals viewing the site and the site owner. Potentially there is a service of information being offered but really it is not clear. Then you would go and use the next part of the article to determine if in fact the site owner does envisage offering goods or services in EU – you would look at the text languages on offer, currency (although not selling anything) and would conclude, no, they are not providing goods or services to individuals in EU.
example:
Non-European business affected by GDPR
An accountant in the United States does tax work for a client in the United Kingdom for money and keeps personal information of the client on file. Does the accountant offer goods or services to an individual in the EU – yes. We don’t think you then have to look any further at the business intentions etc. to decide if GDPR applies.
To avoid HAVING TO BE GDPR COMPLIANT, should I go through my client list and just delete anyone who is in Europe?
GDPR is certainly an opportunity to clear out those old email lists. I know of one person who never deletes their unsubscribed people and then ends up with them back on his list every time he changes auto-responder systems. Really annoying! Not to mention completely disrespectful of the people who’s information he holds. This is part of the reason for GDPR – encouraging business to be more aware of the value of the personal data they have collected, and giving individuals greater control over what happens to it.
There are lots of businesses that are taking action delete EU residents from their lists, and block EU access to their websites. If Europe isn’t your target market and you don’t want another regulatory burden, this is certainly an option. If other countries decide to adopt any of the GDPR provisions however, you may still face greater compliance burdens in future.
How do we let people know we don’t want personal information from people in Europe?
If you really don’t want to deal with European residents, one option is to include a notice in your privacy policy, which could read something like this:
EU – GDPR
We do not promote our business in the European Union and aim not to collect personal information about EU residents. We have not taken action to comply with the General Data Protection Regulation (GDPR). We have taken reasonable action to block access to our services from EU residents.
Who is GDPR intended to protect?
Although the GDPR will have worldwide impact on business, it is only designed to protect the use of personal information for people in the EU.
There is no time limit on how long a person has to be in Europe for their collected data to be protected. The GDPR cover information collected about natural persons in The European Union, or their behaviour in the EU.
If you think about travelers to Europe, local business that they collect personal data will have to comply with the protection of information about anyone in Europe, however temporarily. The collection must relate to the offer of goods or services to data subjects. So a tour operator who takes you name and passport number for a one day stopover will have to comply with GDPR.
What is a ‘data subject’ under GDPR?
A data subject for GDPR is a natural person whose personal information has been collected.
A tourist coming through any European Union airport or seaport who is captured on surveillance video, even if they only transit through Europe, will be a ‘data subject’ because their personal information (image) has been captured on the way through.
For business, a data subject is any natural person whose personal information you have collected, however briefly.
What data does GDPR cover? What data does GDPR not cover?
GDPR covers personal data about natural persons. Personal data is any information relating to a natural person that identifies that person, or can be used to identify that person. Some examples are set out under the next question below.
You don’t have to worry about the birthday diary you keep (for those who don’t rely on social media reminders), because information collected by a natural person for purely personal or household activity is specifically excluded.
What is Personal Data for GDPR?
Personal data is , in general, any information relating to an individual. It can identify the person either directly (eg their name) or indirectly, in combination with other data (eg a location marker in combination with other information known about the individual may identify them).
Personal data includes obvious information such as an individual’s name, address and contact details however it also includes things such as online identifications like IP addresses and location data.
There is a special category of Sensitive Personal Data that includes information on racial or ethnic background, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, physical or mental health and sexuality or sexual orientation. The rules regarding Sensitive Personal Data are much stricter.
Should I keep personal data about European Union residents separate from data about my customers in other parts of the world?
You could put in place systems to separate the information you hold about people in different countries, but consider which is the highest cost and most difficult for your business – having one set of policies you comply with, with different systems, or multiple policies and systems?
What are the GDPR principles?
There are 6 key principles. Data must be:
Processed lawfully, fairly and transparently.
Collected for specific and allowable purposes and only used for these purposes.
Adequate, relevant and limited to what is necessary.
Accurate and kept up to date.
Only kept for as long as necessary for the purpose it was obtained.
Processed in a manner which ensures appropriate security.
What does processing of personal data mean?
Processing is anything that is done with personal information whether by electronic means or otherwise. The term is very wide and includes everything from collection through to storage, use, manipulation and destruction.
What is the difference between a data controller and a data processor?
Basically, the data controller is the person or entity that determines the purpose and means of the processing ie. they control why the information is collected and what it is used for.
The data processor stores or manipulates the data at the request of the controller.
Both the controller and the processor have significant obligations under the GDPR and your business may be a data controller, a data processor or both.
What are some examples of personal data under GDPR?
Some personal information typically collected by businesses are:
• name and contact details – phone, email, social media profile link • role or title, school, occupation, employer, qualifications • age, date of birth, gender, ethnicity • residential address, business address, postal address, location • photograph, likeness, identification number • allergies, health conditions, dietary requirements • finger print, facial recognition, DNA scan • opinions and beliefs collected via surveys and questionnaires
What risk to my business if I don’t apply an EU geo-blocker to my website?
It’s not worth me being in breach of the GDPR
If you have a small business, located outside Europe, that is not intentionally aimed at European residents, your risk of prosecution under GDPR is likely to be very low.
It is likely that the EU regulators have already identified target companies for audit and potential prosecution to test the enforce-ability of their new provisions. As with all government regulators, they will only have limited funding available and will be looking to make an impact that gets picked up and shared in popular media. As with any new laws, there is usually a settling in period while everyone gets used to the new regime. Lots of regulators look for cooperation rather than prosecution, simply because it is cheaper and less time consuming.
On what basis can I collect personal data under GDPR?
The allowable reasons that data may be collected/processed are:
By consent of the individual giving the data
Because it is necessary to take steps to enter into a contract with the individual or for the performance of a contract with the individual.
It is necessary for compliance with a legal obligation.
It is necessary to protect the vital interests of the individual or another person (eg. in an emergency you access a data base you wouldn’t otherwise have access to, to check for allergies and call 000/ 411/ 911 or the applicable emergency number to save the individual’s life)
It is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority.
It is necessary for the legitimate interest of the controller (so long as this doesn’t harm the interests, rights or freedoms of the individual)
The allowable reasons for Sensitive Personal Data are even narrower and are quite specific.
how does GDPR affect google analytics?
If you use Google Analytics you should have received an email recently suggesting you check and update your account settings. If you don’t your historical data will disappear. It is worth reading through the email from Google to better understand the impact on your account.
Do I need to collect consent from my database again for GDPR?
There are competing schools of thought here.
There are a bunch of Articles (commentary to the GDPR) that absolve you of liability if you have consent, so for the risk averse, consent is what you want. However, there are also a bunch of Articles that say provisions don’t apply if…
One of the ‘ifs’ is if the processing of information is necessary for the performance of a contract the individual is party to, which is what a lot of organisations appear to be relying on to avoid seeking consent. You already have an existing contract for services in place, and to be able to continue to provide those services, you do so under contract. If you are happy to ‘hang your hat’ on that provision, then you can do what a lot of other organisations are doing and just give notice of update.
The benefit of recording consent again is you then have a record of it…
Some businesses are actually including in their policy update notices that users can change their settings and opt out at any time, rather than asking for renewed consent.
Does GDPR mean websites must first ask for consent before placing cookies?
The GDPR is set out in the Articles (rather than the recitals), which make no mention of cookies.
GDPR doesn’t actually address cookie usage it deals only with personal information. Most cookies don’t collect personal information – session cookies and those used to remember login details are likely to collect personal information. GDPR works alongside cookie legislation.
What is and is not consent is discussed in the recitals rather than the articles. For example recital 42 refers to ‘For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.’
That is not dealing with cookies necessarily, but addresses the use of personal information. So, if a person wants to have their login details remembered for next time, they need to be asked if they want them remembered (which is already what usually happens) rather than the details automatically being retained without their knowledge.
Should I appoint a Data Protection Officer?
No! Well, not unless you have to.
The GDPR is very specific on the qualifications and experience required of a data protection officer and you are only required to appoint one as a government entity or if you are processing sensitive personal data on a large scale.
However, you can opt-in and it is easy to do so. If you call someone in your business a Data Protection Officer, you opt-in. The trouble there is that you then have to meet all the obligations around the qualifications and experience that person must have and can be in breach of the Regulation if you don’t. You can appoint someone external who is qualified and these businesses are now popping up around the world.
How can Onyx Legal help you?
If you are not sure whether you have to comply with GDPR, or know you do, and need your policies brought up to appropriate compliance standards.
Do you remember the old Lemmings computer game? It came out in around the early nineties. Lots of tiny blue and green figures with pick-axes trying to work their way through tunnels and mounds without falling off cliffs.
That’s the picture I get when talking about crypto mining, but its a long way from what really happens. The details are quite complicated, and my background is not technical, so we’ll stick with the basics.
Crypto mining basics
Lifewire are ahead of Wikipedia on this one. Their explanation – “crypto mining is providing bookkeeping services for cryptocurrency, for which you get paid a fraction of each coin“.
A lot of computational power (processing power and speed) is needed to verify cryptocurrency transactions. The why is quite technical and to do with blockchain tech, so I leave you to check that out yourselves.
If you started crypto mining early, you might have made a little money. If you’d invested in cryptocurrency (different to crypto mining) early, you would have made more.
Because crypto mining requires a lot of computational power, there are miners out there now adding little bits of code to unsuspecting websites to harvest computing power. It doesn’t just use the website where the code sits, but also grabs power from visitors to your website.
It has been reported that currently available cryptocurrencies use more energy than Iceland, Syria and Jordan.
This can be done in two ways – legitimately with permission, secretly, without permission.
Cryptomining as Malware
It is the “secretly, without permission” group that is a problem here. Providers like CoinHive and Authedmine enable website owners to embed code onto a website that can access the computer power of visitors to that website for crypto mining. CoinHive does promote full notice to website visitors and opt-in use. This is legitimate.
However, Wordfence have recently reported that some enterprising hackers are already using vulnerabilities in WordPress websites to add code to sites without the website owners knowledge. The code then accesses the computing power of visitors. This can slow down the loading time and user experience of the website affected, and also increase the power used by the visitor’s computer – increasing their costs. Payments for crypto mining go to the hacker, not the website owner and no one is any the wiser, unless they are checking CPU usage.
Cryptomining as Revenue
Apart from website access, there are people around the world who have set up hardware systems to supply processing power for bitcoin. One popular marketplace for connecting sellers of computer power for crypto mining is NiceHash.
In addition, websites with high visitor numbers and decreasing adWords revenue can now use coding to provide their visitors with the option of paying for access, or allowing crypto mining using the visitor‘s computer power for using the website. By way of example, some sites add a button or image that provides visitors with the option of donating computing power to you instead of recieving advertising.
One site I have seen calls it a crypto mining donation, with the explanation “As long as you keep this page open you will support my efforts by donating your computer’s idle time“; although I’m not sure whether it is only idle time that would be used. That would depend upon what code was applied.
Check out this post from Authority Hacker to learn more about the legality and morality of monetising crypto mining.
What does this mean for you?
Firstly – Understand whether crypto mining makes any sense in the context of your business or services. If it does, consider providing visitors with the choice of supporting your business with computing power, and what that means for them. You can do this with FAQs, a disclaimer and or terms and conditions.
Secondly – check your website for crypto mining code that might have been put there without your knowledge. Get a professional to help you clean it off.
Thirdly – If crypto mining has no part of your business, leave it alone.
How can Onyx Legal help you?
If you’d like to add cryptomining to your website and encourage visitors to use it, then you need help with terms of use and appropriate FAQs.
Are Contracts written by lawyers better than Templates?
It helps if you have an idea whether the template you want to use was written by a lawyer in the country where you are, and you know that it is right for the purpose you want to use it for.
Basic website terms of use, a simply Australia privacy policy, an agreement to buy a piece of furniture; these can all be fairly simply documents, until you have something out of the ordinary. For example, a privacy policy will be more detailed if you collect health information, and terms of use for a website will be more detailed if you have a membership area people can login to.
Templates are easy. Or seem to be. Fill in a few gaps and off you go. For a predictable business with low risk, templates may well be sufficient.
But, if you have anything unique about your business or the deal that you are trying to achieve, then a lawyer can help you to cover everything that needs to be covered in your agreement, rather than relying on a template full of gaps. Consider that standard business sale contracts in some Australian States still don’t adequately cover the online assets of a business, like a website, email list or social media pages.
While a very simple contract may be able to be automated, more complex contracts will be a hybrid of automated and manual terms. While contracts generally don’t cover all eventualities, they are created in the context of broader contract law, and therefore the solutions to various contractual issues can be found in the system into which those contracts are born. Molly Thomas, Proctor 12/2016
What can go wrong with a template agreement?
Templates have to be generic to be effective, and are often limited. If you have specific requirements for your business, they probably won’t all be addressed in a stock standard template, and at that point you need additional help.
The trouble with templates is that if you ask a lawyer to review it and amend it to fit your circumstances, and they did not write it, it might take longer than them drafting it. This is because most lawyers have their own compilation of templates they are already familiar with. Something in a new format has to be understood first.
Not all templates are the same value or quality.
Some have lots of guidance to help you complete yourself, others have none. Different laws apply in different countries, as well as different ways of presenting information. So a contract written for an English company might be similar to something written for an Australian company, and completely different from something written for a company in the United States. If you pick the wrong law, your template might not have any effect, or might even contradict the law that applies.
For example, we had a client who bought a business using a contract from a different jurisdiction. There were some items that simply didn’t apply to the deal, but were included in the document.
The parties ended up in dispute and the dispute was much more expensive to resolve than it would have been if an appropriate contract had been used. It would have helped if either or both parties had sought legal advice before the deal.
Is there a set format or language for contracts?
Some contracts are clearly written for the lawyers involved and have only passing application to what the client actually wants to achieve.
Many lawyers out there might consider that statement harsh, but we do believe that if a client can’t understand what you have written for them without needing you to interpret it for them, then the contract was not written for the client.
On the other hand, downloadable templates are now prolific, both paid and for free. Again, not always written in a way that makes sense to the lay (non-legal) person.
You will see that the way contracts are written in the United States the documents contain more legalese than something written in Australia.
The format followed for writing contracts is more from convention and is not a requirement. An exchange of emails, with no formal layout or order, can be read together to create a contract.
Why is a written Contract better than a handshake?
If you can remember in clear detail everything you did on Friday of last week, congratulations. You have a better memory than 99.99% of the population.
Not only do most people have limited memory, but neuroscience has shown that our memories are selective. You might remember a clear event from your childhood that your sibling, who was there with you, has no memory of at all.
Given that memory is so unreliable, why would you not put a contract in writing? Particularly an agreement you want to keep in place and rely upon for years to come?
What are Smart Contracts?
Technology is constantly evolving.
The next step in evolution is to create ‘smart contracts’. Smart contracts are generated on the basis of your response to a catalogue of questions and are supposed to adapt to your requirements. Smart forms and smart contracts will work in circumstances where there are limited variables, but may not be effective where a novel approach is required.
It is possible that smart contracts might become normal for employment contracts, shareholder agreements and other contracts that have defined limits, but not where creativity and flexibility are required.
The worst thing you can do is sign something you don’t understand.
What is a Mandatory Data Breach Notification for Privacy? – FAQs
Do mandatory data breach notifications apply to you?
If you are in Australia and collect personal information from clients, customers, suppliers, partners or anyone else for that matter, then maybe they do. But a compliance perspective, these laws don’t affect you unless you are already required to comply with Australian Privacy law. Which means, you must comply if:
you operate a public, private or not for profit organisation with more than $3m turnover per year
you are a health service provider (not just doctors, this can include gyms, childcare centres, life coaches and schools), regardless of turnover
you are part of a federal government agency
you are part of a credit reporting agency
your business buys or sells personal information
What are mandatory data breach notifications about?
Data breach falls within Australian privacy laws and is all about cyber security.
The objective of the new law is to give individuals (those who care) confidence that their privacy is being protected. The laws apply regardless of technology, and encourage transparency and accountability.
What does it mean if you have an eligible data breach?
Mandatory data breach notifications only related to personal information. Personal information is defined in the Privacy Act as:
Personal information is –
information or an opinion about an identified individual, or an individual who is reasonably identifiable:
– whether the information or opinion is true or not; and– whether the information or opinion is recorded in a material form or not.
So if your business is hacked and you lose commercial information, that is irrelevant to this law.
The key components of a data breach are:
it involves personal information
it does not have to be bulk data, personal information about one person may be enough
the data has been accessed or disclosed
the data has been lost in circumstances where it is likely to be accessed or disclosed (like when NASA employees left a laptop containing access codes to the space station in a cab…)
there is a likely risk of serious harm to the people who have had their personal information accessed, disclosed or lost
What does ‘Serious Harm’ mean for a data breach?
Serious harm is a broad concept including physical, psychological, emotional, economic, financial or reputational harm (like when Ashley Madison got hacked and all those people cheating on their partners risked being exposed…)
What is serious harm is likely to be different for each organisation and probably associated with the reason why data has been collected. Customers of a financial institution might risk economic loss, and customers of a medical clinic might risk psychological, emotional or reputation damage.
Think about what is important to your customers, or the people who’s personal information and data you collect.
What should you have in place to handle mandatory data breach notifications?
Not surprisingly, a large proportion of small businesses have adhoc systems in place and no real understanding of what they collect, or how they control their data. This is particularly the case when using third party systems that also store data, like Eventbrite.
IT, management and communications teams will need to work together for data breach notifications.
The top 10 things to consider are:
Every organisation covered by these laws should have a clear understanding of how their data is collected, stored and used and the vulnerabilities of those systems.
Identify ‘who’ in the organisation is responsible for managing data.
Identify the likelihood and consequence of an eligible data breach.
Put in place staff training and security measures to reduce the chance of an eligible data breach.
Understand what ‘serious harm’ could arise if there was a breach.
Work out what would need to happen to avoid ‘serious harm’ and how quickly that could be implemented if there was a breach.
Put in place a recovery plan in case of a breach.
Put in place a communications plan that includes (as a minimum) the communication to those affected, a press release to reduce reputational damage, and the notification to the Privacy Commissioner.
Check the business cyber insurance to see that it covers data breaches and the consequences.
Test a data breach scenario to ensure your business has the ability to manage an eligible data breach.
And lastly…
Remember that data breach laws are technology neutral.
Just because you still operate with a largely paper based system does not mean that this law will not apply.
As someone pointed out to me, most filing cabinets can be unlocked with a paperclip.
How can Onyx Legal help you?
If you need help identifying risks to disclosure of personal information in your business and procedures to manage those risks, or need support developing policies and procedures for managing personal information, then make an appointment to find out how we can help you.
On 3 February 2017, Australian television broadcaster Foxtel televised a highly anticipated boxing match between two well-known boxers, Danny Green and Anthony Mundine. To watch the fight, viewers were required to subscribe through Foxtel and pay a fee to watch the fight live on TV.
Australian resident Darren Sharpe was a genuine Foxtel subscriber who paid the required fee to watch the fight live. For those who aren’t exactly sure what live streaming is, it’s the ability to broadcast audio and video as it happens. Any time you want to “go live” you can and anyone watching your posts on Facebook can see you, or whatever it is you are streaming.
Sharpe made the mistake of using his phone to record the fight and stream it live through Facebook Live. While he was live streaming the fight, Sharpe received a call from Foxtel asking him to stop. It was reported that he said he couldn’t, because he has 70,000+ people watching it, which was exactly Foxtel’s point. While Sharpe was allowing a bundle of people to watch the fight for free, Foxtel and all those Sports Bars out there were losing revenue.
When Sharpe refused to stop the streaming, Foxtel immediately suspended his subscription, himself and his followers missing the rest of the fight.
Sharpe did what he did on purpose, and continued after receiving notice of infringement. You should also be aware of the risk of accidental infringement. You might have seen some television shows blur posters, signs, t-shirt branding and other images. It is usually because what has been blurred is protected by copyright and the producer didn’t get permission. It is easy to blur a background image when you have the ability to edit, but not in live streaming. If you infringe someone’s copyright, even accidentally, there can be consequences you didn’t anticipate.
Originally Foxtel claimed that it would pursue legal action against Mr. Sharpe for breaching copyright. Luckily for Mr. Sharpe, that legal action was dropped after he posted a carefully worded public apology on his Facebook page. It is unclear what conversations occurred between Foxtel and Facebook. Given that Mr. Sharpe was able to so easily live stream the fight from his Facebook page, it raises the question –
Should Facebook be responsible for copyright infringement?
Probably not.
One side of the argument is that Facebook should be more responsible for what users post as it has the ability to police the content on its website and act quickly to disable infringing material. On the other hand it is costly and time-consuming to monitor the Facebook page of over 1 billion users. Facebook terms and conditions do require all users to have permission to use the content they upload, whether written, audio, video, or as is now available, through live streaming.
United States legislation requires online service providers, such as Facebook, to take action against copyright infringement. The Digital Millennium Copyright Act (“DCMA”) exempts online service provides from liability for copyright infringement by its users in certain situations. There is no Australian equivalent. The exemption requires online service providers to take down, remove or disable access to infringing material where it is given notice that offending material has been posted on its network. It is clearly working. Facebook’s copyright policy provides rights holders with an easy mechanism to give notice to Facebook that intellectual property have been infringed and have the offending material removed or have a user’s profile disabled.
Can Facebook be over zealous in taking down infringing content?
Has the DCMA and its safe harbours caused Facebook to be over zealous when taking down material and disabling profiles?
Facebook page administrators are given no warning that the page would be shut down. Anybody with an email address, real or fake, can make a complaint to Facebook without having to validate the claim, effectively giving anyone the ability to shutter any page without proof.
Facebook has suffered criticism in the past (Huffington Post) for shutting down pages where copyright has been alleged, when in fact no copyright infringement existed. The above extract of Facebook terms shows the ‘hands off’ approach taken by the company after Facebook has removed content. What is worse, is when a business page is removed without warning, taking potential customers and contacts with it. In late 2017 a Queensland client had their page removed and received email notification from Facebook referring them to the company that lodged the complaint.
Hello,
We’ve removed or disabled access to the following content that you posted on Facebook because a third party reported that the content infringes or otherwise violates their trademark rights:
Page: ###
Facebook is not in a position to adjudicate disputes between third parties. If you believe that this content should not have been removed from Facebook, you can contact the complaining party directly to resolve your issue:
Notice #: ###
Contact Information Rights Owner: ## Inc. Email: ## Trademark: ##
If an agreement is reached to restore the reported content, please have the complaining party email us with their consent and include the original reference number. We will not be able to restore this content to Facebook unless we receive explicit notice of consent from the complaining party. Please note that the complaining party is not required to respond to your request.
We strongly encourage you to review the content you have posted to Facebook to make sure that you have not posted any other infringing content, as it is our policy to terminate the accounts of repeat infringers when appropriate.
For more information about intellectual property, please visit our Help Center at https://www.facebook.com/help/370657876338359/.
The Facebook Team
In this instance, the rights holder had a trade mark registered in the United States. Intellectual property rights are not granted worldwide. The Queensland company had the same trade mark registration pending in Australia. Facebook appears to be very U.S.- centric in how it reviews rights. The help centre information suggested that an appeal process would be available, but then failed to respond to any communication.
Facebook’s aggressive stance on copyright and trade mark infringement may hinder the impact of genuine rights holders. Where someone in the United States and Australia have the same trademark in respect of similar goods, both are equally as enforceable as each other in their respective territories.
Facebook has put the onus back on rights holders to work the details of the infringement out for themselves. Their copyright policy states that users can follow up (by email) with the person who alleges the infringement. It also provides guidance on how to file an appeal if the content was removed due to a take down notice under the DMCA.
Facebook’s policy surrounding two legitimate rights holders is not clear but it appears they are acting cautiously. It may be the case that whoever gets in first to lodge infringement with Facebook may be the winner.
However, in the case of live streaming, Facebook’s response time might simply not be quick enough to protect their interests and alternate avenues will have to be explored.
How can Onyx Legal help you?
If you have any questions about copyright or trade marks, make an appointment to find out how we can help.
Recent Comments