Very Very IP

Où l'on reparle de la protection internationale de la vie privée et des données personnelles...

2010-10-25T16:01:00.006-04:00

La réunion de Public Voice, organisée aujourd’hui à Jérusalem sur le thème Next Generation Privacy Challenges and Opportunities, a été l’occasion de rappeler comment les autres pays considèrent le droit à la vie privée et le droit à la protection des données personnelles.

Le débat Establishing International Frameworks for Privacy Protection a permis aux participants et aux auditeurs d’en apprendre plus sur ce sujet.

Rappelons simplement qu’en France le droit à la vie privée est considéré comme un droit de l’homme. Le Conseil constitutionnel, dans sa décision n. 99-416 DC du 23 juillet 1999 a précisé que le droit à la liberté proclamé par l'article 2 de la Déclaration des droits de l'homme et du citoyen implique le respect de la vie privée. L’article 1er de la loi du 6 janvier 1978 rappelle que l’informatique ne doit porter atteinte, ni à l’ídentité humaine, ni aux droits de l’homme, ni à la vie privée, ni aux libertés fondamentales ou publiques.

La directive 95/46 donne aux États membres le devoir d’assurer « la protection des libertés et droits fondamentaux des personnes physiques, notamment dans leur vie privée, à l’égard du traitement des données à caractère personnel ». Marie-Hélène Boulanger, Chef d’unité « protection des données » à la Commission européenne, a d’ailleurs rappelé aujourd'hui que ces lois ne distinguaient pas le sujet citoyen de l’Union européenne du sujet non citoyen.

Kirsten Bock, de l’autorité administrative indépendante de protection des donnés personnelles du Schleswig-Holstein, a évoqué la possibilité d’un privacy seal européen , alors que, selon elle, le droit de l’Union Européenne en matière de protection des données personnelles est dépassé et doit être mis à jour. Il faudra donner plus de pouvoirs aux organisations non-gouvernementales de défense des droits de l’homme.

Rajan R. Gandhi, un représentant de Society in Action Group, une ONG indienne, a rappelé qu’en Inde le droit à la vie privée est considéré comme un droit de l’homme. Si les données personnelles sont détournées de leur emploi, ce détournement est considéré comme un abus dans la confiance du sujet. La société indienne accorde en effet beaucoup d’importance à la confiance. Pourtant, les intrusions dans la vie privée des Indiens sont de plus en plus fréquentes, et l’Inde n’a pas, au contraire de l’Europe, des lois permettant la protection des données personnelles et de la vie privée des citoyens. L’Inde considère que la violation de la vie privée est une violation d’un droit de l’homme.

Un projet, Digital Privacy in Asia , lancé à l’initiative de The International Development Research Centre, une ONG canadienne, doit permettre aux Indiens, les chercheurs et le grand public, de se familiariser avec les différents moyens généraux de protéger la vie privée, afin d’ouvrir le débat.

Merci à tous les participants qui ont suivi la conférence sur Twitter et posté leurs notes avec le hashtag #thepublicvoice !

"Emerging Privacy Issue": Les Compteurs Intelligents

2010-10-25T07:29:00.005-04:00

Michiel Karskens a présenté aujourd’hui à la réunion organisée par The Public Voice « Next Generation Privacy Challenges and Opportunities », les dangers que les compteurs intelligents peuvent présenter pour la vie privée.

Ces compteurs intelligents permettent de surveiller avec une grande précision la consommation électrique d’un foyer, ou bien sa consommation de gaz ou d’eau. Pratique ? Certes. Ces compteurs permettent de connaître précisément quels sont les appareils les plus gourmands, et ce presque en temps réel (souvent de demi-heure en demi heure). Les compteurs intelligents peuvent ainsi nous permettent à la fois de faire des économies et d’adopter des habitudes de consommation plus écologiques.

Mais ces compteurs intelligents peuvent représenter un nouveau danger pour la vie privée des consommateurs. Le fournisseur d’énergie va pouvoir déduire de la somme d’informations précises sur la consommation d’un ménage des informations d’ordre privé, le nombre d’habitants au foyer, leurs âges, et leurs habitudes. Nous sommes de gros consommateurs d’énergie, et nos besoins trahissent notre parcours dans le foyer, du salon à la chambre à coucher, l’heure de notre diner, nos habitudes hygiéniques (combien de douches par jour ?) et l’heure de notre coucher (télévision ou bien livre avant d’aller dormir ?) Sommes- nous insomniaques ? Sommes-nous gourmands ? Le compteur intelligent le sait.

Qui pourrait avoir accès à ces données ? Combien de temps ces donnés seraient-elles conservées ? Sommes-nous prêts à échanger les avantages des compteurs intelligents contre l’inconvénient de divulguer encore plus notre vie privée ? Le débat s’est déjà engagé aux États-Unis, mais il est encore très timide en France. A nous de nous y engager.

La réunion se poursuit, et peut être suivie en streaming ici.

Email, Cloud, Privacy and the ECPA

2010-09-24T08:51:00.004-04:00

Congress passed the Electronic Communications Privacy Act (ECPA) in 1986. This federal law is comprised of three different Acts: the Wiretap Act, amending Title III of the Omnibus Crime Control and Safe Street Act of 1968, the Stored Communication Act (SCA), and the Pen Register Act.

It is now time to reform the ECPA, and this reform is on Congress’ agenda. The House of Representative Committee on the Judiciary, Subcommittee on the Constitution, Civil Rights, and Civil Liberties, heard testimonies on September 23 regarding “ECPA Reform and the Revolution in Cloud Computing.”

The Fourth Amendment of the United States Constitution guarantees the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” The Supreme Court held in Katz v. United States, that the government cannot eavesdrop on telephone communications held in a place where one has an actual (subjective) expectation of privacy that society is prepared to recognize as reasonable (J.Harlan, concurring).The Court noted that it had emphasized “over and again… that the mandate of the [Fourth] Amendment requires adherence to judicial processes, and that searches conducted outside the judicial process, without prior approval by judge or magistrate, are per se unreasonable under the Fourth Amendment subject only to a few specifically established and well-delineated exceptions…” Indeed, pursuant to the Fourth Amendment, warrants may only be issued upon probable cause, and must “particularly describe the place to be searched, and the persons or things to be seized.”

In Berger v. New York, the Supreme Court emphasized that “the need for particularity and evidence of reliability in the showing required when judicial authorization of a search is sought is especially great in the case of eavesdropping. By its very nature eavesdropping involves an intrusion on privacy that is broad in scope…”

Enacted after Katz and Berger, Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (the “Wiretap Act”), as amended in 1986 by the ECPA, defines electronic communication as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce, but does not include — (A) any wire or oral communication.”18. U.S.C. §2510(12) Electronic storage is defined as “(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.” 18. U.S.C. §2510(17)

The ECPA was enacted in 1986 to set a "fair balance between the privacy expectations of American citizens and the legitimate needs of law enforcement agencies." (Senate Report No. 99-541, 99th Cong., 2d Sess. 5 (1986). At this time, only a few Americans had heard about the Internet. Storing data was expensive. In his testimony, Richard Salgado, Google’s Senior Counsel, Law Enforcement and Information Security, noted that it took $650 in 1986 to buy a 10 megabyte hard drive with room to store “about two high resolutions photos”, whereas today it will cost less than $100 to buy a 1.5 terabyte hard drive !

Data was not tucked in a cloud. A Gartner survey showed this month that cloud-computing services represents in 2010 10 percent of spending on external IT services. A Pew Research Center survey revealed in 2008 that 69% of only Americans store data online or use a web-based software application.

New technologies, new privacy challenges. In his testimony, Michael Hintze, Microsoft Associate General Counsel, argued that the ECPA, since having been enacted in to law in 1986, has failed to keep pace with technology. He took the example of the difference made by the ECPA between emails stored for less than 180 days and those stored for more than 180 days, and concluded that this distinction no longer makes any sense.

Indeed, the SCA, as codified at 18. U.S.C. §2703 (a), allows the government to require the disclosure by an electronic communication service provider of the contents of a wire or electronic communication that is in electronic storage in an electronic communications system for 180 days or less, but only if the government first obtains a federal or state court-issued warrant. If the data has been in storage for more than 180 days, the government can require the provider to disclose the data without prior notice to the subscriber or customer if it first obtains a federal or state court-issued warrant. If the government provides prior notice to the subscriber or customer, the government must still obtain (i) an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena; or (ii) obtain a court order for such disclosure. 18. U.S.C. §2703 (b)

Therefore the ECPA provides more protection for emails stored for less than 180 days, than for emails stored for more than 180 days. That made sense in 1986, when storing data was extremely costly, but we are now living in a world where some of us keep emails for months, sometime years, tucked in the cloud. Should the privacy of these emails be less protected than when they were first arrived in our mailboxes?
The first version of Microsoft Exchange was released in 1996. The user was able to download emails from a server to a local machine. One could then conceive that an email which had not been downloaded after 180 days had been abandoned by the recipient, and thus had no expectation of privacy in the message. However, Hotmail, offered for the first time in 1997, stored emails in the cloud. The cloud retained the message even after its intended recipient had read it. Yet, data storing capacity was still limited in 1997, but it is no longer the case. Mr. Hintze concludes that users reasonably expect their data to be as private on day 181 as it is on day 179. It is hard to disagree with that statement.

A coalition of companies and non-profit organizations, the Digital Due Process Coalition, has also been advocating SCA reform. Members of the coalition include among others, the American Civil Liberties Union, the Center for Democracy and Technology, the Electronic Frontier Foundation, Google, Microsoft, IBM, and AT&T.

The coalition recommends the Act to be reformed so that the government could only require electronic communications providers to give it access to the non-public content of communications if producing a search warrant based on probable cause, and this “regardless of the age of the communication, the means or status of its storage or the provider’s access to or use of the content in its business operations.” (see p. 5 of Becky Burr, ECPA: PRINCIPLES FOR REFORM)

New Blog Post on the "Information Security Breaches & the Law" blog

2010-08-28T10:44:00.001-04:00

This blog is a bit on hold right now, as I write more for the "Information Security Breaches & the Law" blog.

Latest blog post, written with Cédric Laurant: "Will France adopt a law requiring the notification of security breaches? "

Second Circuit: The FCC indecency policy is unconstitutionally vague

2010-07-16T07:08:00.002-04:00

The Second Circuit held on July 13 that the Federal Communications Commission‘s indecency policy “violates the First Amendment because it is unconstitutionally vague, creating a chilling effect that goes far beyond the fleeting expletives at issue here.”

In Fox Television Stations, Inc. v. FCC, 489 F.3d 444, (2d Cir. 2007), the Second Circuit had found that the Federal Communication Commission’s (“FCC”) policy banning fleeting expletive was arbitrary and capricious on three grounds under the Administrative Procedure Act (“APA”), 5 U.S.C. § 706(2)(A). First, the FCC had failed to explain why it had not previously banned such expletives as harmful. Second, such policy would require it to ban all broadcast of expletives, and by failing to do so, the FCC had undermined the coherence of its rationale. Thirdly, the Second Circuit was not convinced by the FCC argument that an exemption for fleeting expletives would then lead to a increased use of one-at-a-time expletives.

The Supreme Court did not find these arguments persuasive and reversed. Fox Television Stations, Inc. v. FCC, 129 S.Ct. 1800 (2009). A federal agency has the right, after all, to change its opinion: “the fact that an agency had a prior stance does not alone prevent it from changing its view or create a higher hurdle for doing so.” The Supreme Court noted that the FCC had always drawn distinctions between the offensiveness of some words, particularly taking their context into account. The Supreme Court sided with the FCC’s argument that a complete immunity for fleeting expletives would lead to their increase. The Supreme Court reversed and remanded for consideration of petitioner’s constitutional arguments.

The petition for review came on remand before the Second Circuit, and, on July 13, 2010, it vacated the FCC indecency policy because it is unconstitutionally vague.

What is the FCC’s indecency policy?

Section 1464 of Title 18 of United States Code provides that “[w]hoever utters any obscene, indecent, or profane language by means of radio communication shall be fined under this title or imprisoned not more than two years, or both.”

In 2001, the FCC published an indecency policy, the Industry Guidance, “to provide guidance to the broadcast industry regarding our case law interpreting 18 U.S.C. § 1464 and our enforcement policies with respect to broadcast indecency.” Material is indecent if it “describe[s] or depict[s] sexual or excretory organs or activities, and if the broadcast is “patently offensive as measured by contemporary community standards for the broadcast medium.”

The FCC also explained that it considered three factors to determine whether a broadcast is patently offensive:

(1) “the explicitness or graphic nature of the description or depiction;

(2) whether the material dwells on or repeats at length” the description or depiction; and

(3) whether the material appears to pander or is used to titillate, or whether the materials appears to have been presented for its shock value.”

On the difficulty to clean a Prada bag when soiled by cow excrement: fleeting expletives and the FCC

Nicole Ritchie explained during the 2003 Billboard Music Awards, broadcasted on Fox, that it is difficult to clean a Prada bag if soiled by cow excrement, but did so in somewhat different terms, with the help of both the F and the S words. A year earlier, Cher had used a solo expletive to comment on her receiving a Billboard Music Award. The FCC found Fox liable in both cases.

In 2004, the FCC declared for the first time, in the so-called Golden Globes Order, that an expletive use of the F-word and the S-word could be actionably indecent, even if the word is used only once, In re Complaints Against Various Broadcast Licensees Regarding Their Airing of the “Golden Globe Awards” Program, 19 FCC Rcd. 4975, 4976, n. 4 (2004.

Before this Order, an isolated or fleeting use of such words had not been considered indecent, and the FCC declared that “any such interpretation is no longer good law.” 19 FCC Rcd., at 4980. After it issued the Golden Globes Order, the FCC also started to fine broadcast licensees for indecency violations. It imposed $8 million in fines in 2004.

The 1978 Pacifica case

Indecent speech is protected by the First Amendment, unless it is obscene: “Where obscenity is not involved, …the fact that protected speech may be offensive to some does not justify its suppression.” Reno v. ACLU, 521 U.S. 844, 874-75 (1997).

In the Seventies, a father had complained to the FCC that George Carlin’s “Filthy Words” monologue, had been broadcast it in the afternoon and that he heard it while driving with his young son. In a declaratory order, Pacifica Foundation, 56 F.C.C. 2d 94, 98, the FCC defined indecent speech as “language that describes, in terms patently offensive as measured by contemporary community standards for the broadcast medium, sexual or excretory activities or organs, at times of the day when there is a reasonable risk that children may be in the audience.” 56 F.C.C. 2d, at 98. The FCC granted the father’s complaint, and held that Pacifica, the broadcaster, “could have been the subject of administrative sanctions.” 56 F.C.C. 2d 94,99.

A Court of Appeals reversed, and the Supreme Court held in FCC v. Pacifica Found., 438 U.S. 726 (1978), that indecent speech could be banned. However, the holding was very narrow.

Indecent speech could be banned because of two reasons, Pacifica, at 748-749, which the Second Circuit describes in its July 2010 ruling as “the twin pillars of pervasiveness and accessibility to children.”(our emphasis).

(1) the “uniquely pervasive presence” of the medium and

(2) the fact that the broadcasted program featuring such language is “uniquely accessible to children.”

The Supreme Court did not specify what level of scrutiny must be applied on broadcast speech.

Section 326 of the Federal Communication Act of 1934 prohibits censorship by the FCC, as it clearly states that the FCC has no power of censorship over radio communications, and that it cannot interfere with the right of free speech by means of radio communication. However, in Pacifica, the Supreme Court held that section 326 does not limit the FCC’s authority to sanction licensees engaging in obscene, indecent, or profane broadcasting. The FCC has the power to deprive a broadcaster of his license if the FCC decides that it would serve the public interest, convenience and necessity.

The FCC from then on interpreted Pacifica as permitting it to sanction indecent speech, whereas the broadcasters interpreted it, because of the narrowness of the holding, as setting limits to the power of the FCC by defining indecent speech only as speech having “shock value.”

Towards an overruling of Pacifica?

The Second Circuit was careful to state that they are bound by Supreme Court precedent, even though the world has changed since Pacifica: “The Supreme Court may decide in due course to overrule Pacifica and subject speech restrictions in the broadcast context to strict scrutiny.”

One of the arguments made by the Second Circuit in its July 2010 opinion is the fact that the media landscape has changed significantly since Pacifica. The Internet did not exist then, with its myriad of sites claiming our attention (the Second Circuit gives as examples Facebook, Twitter and Youtube). Cable television was “still in its infancy.” The Second Circuit, quoting Pacifica, argues that broadcast television no longer has that “uniquely pervasive presence in the lives of all Americans.”
Indeed, the “twin pillars” of Pacifica are shaking down.

First twin pillar broken: pervasiveness

Broadcast television is longer pervasive. It is just one of the many choices offered to us. The Second Circuit notes that 87% of households now subscribe to a cable or a satellite service, and that remote controls allow us to shift swiftly through channels. The Internet claims an important part of our attention as well.

Second twin pillar broken: accessibility to children

The Second Circuit also argued that, “as the FCC itself acknowledges, “[c]hildren today live in a media environment that is dramatically different from the one in which their parents and grandparents grew up decades ago.”” In the Matter of Empowering Parents and Protecting Children in an Evolving Media Landscape, 24 F.C.C. Rcd. 13171, at ¶ 11 (2009), for example, parents now have the power, thanks to the V-chip, to monitor which programs their children are watching on television.

The Second Circuit cited United States v. Playboy Entm't Group, 529 U.S. 803, 815(2000): “…targeted blocking enables the Government to support parental authority without affecting the First Amendment interests of speakers and willing listeners – listeners for whom, if the speech is unpopular or indecent, the privacy of their own homes may be the optimal place of receipt.

The FCC indecency policy is unconstitutional

The Second Circuit held that “the FCC indecency policy is unconstitutional because it is impermissibly vague.” A law or regulation is vague if it does not give a person of ordinary intelligence a reasonable opportunity to know what is prohibited.

The Second Circuit gave examples where the FCC had determined that “bullshit” was patently offensive, whereas “dickhead” was not. True, it is rather difficult to understand why one word would be deemed “vulgar, graphic and explicit,” but not the other one.

The Second Circuit also argued that, since the standards used by the FCC are “indiscernible,” there is a risk that they “will be enforced in a discriminatory manner.” However, the Second Circuit “ha[s] no reason to suspect that the FCC is using its indecency policy as a means of suppressing particular points of view.” The mere risk of subjectivity is a chill to speech protected by the First Amendment.

Safe Harbor: Blog Post

2010-07-13T08:12:00.004-04:00

Last April, the Düsseldorfer Kreis, an informal group of German data protection authorities, published a decision that could have significant repercussions on U.S. companies importing personal data from organizations operating in the European Union.

Cédric Laurant and I cowrote a blog post about this decision: "The Safe Harbor Framework: not a “safe harbor” anymore for US companies? German expert body insists on stronger compliance stance."

Online Impersonation

2010-07-02T13:19:00.000-04:00

I have started a new blog covering online reputation and the law. Here is my first post on the California Senate Bill 1411 dealing with Online Impersonation

City of Ontario, California, v. Quon

2010-06-17T15:53:00.005-04:00

The SCOTUS ruled unanimously today in City of Ontario v. Quon that a Police Department had the right to search text-messages sent by police officers on government-issued pagers.

The California City of Ontario (the City) had distributed pagers to some of its employees, including some police officers. Under the City’s contract with Arch Wireless, the company providing the text-messaging service to the City, each pager was allotted 25,000 characters per month, after which the City had to pay additional fees. Employees were requested to reimburse the City for overcharges.

Some police officers were given pagers, among them respondent Quon. Mr. Quon and some of his colleagues used more than 25, 000 characters for several months and thus had to pay overcharges, which they did. The Ontario Police Department (OPD) decided in 2002 to audit its text-messaging practices. In order to determine whether messages were work-related, or whether messages were personal, the City asked Arch Wireless to mail them the transcripts of all messages. Some of these messages turned out to be sexually explicit, and most of them were of personal nature. Respondent Quon was disciplined for violating OPD’s rules.

Indeed, the City had a “Computer Usage, Internet and E-Mail policy” that applied to all of its employees. It specified that the City “reserves the right to monitor and log all network activity including e-mail and Internet use, with or without notice. Users should have no expectation of privacy when using these resources. Respondent Quon had signed an acknowledgment of that policy in 2000. Thes policy did not explicitly cover text messages, but, during a 2002 staff meeting, police officers were told that messages sent on the pagers were considered e-mails.

Mr. Quon and some of his colleagues filed a suit against the City, alleging inter alia that, by obtaining a transcript of their text messages, the City had violated their Fourth Amendment rights and the Stored Communications Act (SCA). The District Court granted Arch Wireless‘ motion for summary judgment on the SCA claim, but denied petitioner’s motion for summary judgment on the Fourth Amendment claims, as it determined that Mr. Quon had a reasonable expectation of privacy in his text messages.

The District Court distinguished between two types of audit. First, an audit could be made to find out whether the officer was using his pager for personal reasons. It found that such an audit is not reasonable. Second, an audit can be made to find out whether the existing character limits were inadequate, thus leading to officers having to pay for work-related messages. Such an audit would be reasonable. At trial, the District Court held that petioners had not violated the police officer’s Fourth Amendment rights.

Mr. Quon appealed, and the Ninth Circuit reversed in part. Quon had a reasonable expectation of privacy in his text messages, and the search was not reasonable, as there were “less-intrusive means” by which the OPD could have verified the efficacy of the 25,000 character limit. The Ninth Circuit also concluded that Arch Wireless had violated the SCA by turning over the transcript of the messages to the City. Arch Wireless was an Electronic Communications Service provider (ECS) to the City. The City was a subscriber, not an addressee or intended recipient of the communications, and it thus violated the SCA, 18 § 2702 (a)(1). Unfortunately, the merits of the SCA claim were not before the SCOTUS.

The Ninth Circuit denied a petition for rehearing en banc. The Supreme Court granted certiorari.

Fourth Amendment

The Fourth Amendment states: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated . . . .” It applies when the Government acts in its capacity as an employer.

In O’Connor v. Ortega, 480, U.S. 709, 717 (1987), the SCOTUS had held that “[i]ndividuals do not lose Fourth Amendment rights merely because they work for the government instead of a private employer.” O’Connor also set a two-step test to determine whether a government employment should have a reasonable expectation of privacy.

First, the court must determine on a case-by-case basis whether the government office is so open to fellow employees or the public that no expectation of privacy is reasonable. Second, if the employee indeed does have a reasonable expectation of privacy, the court must determine whether or not the employer may intrude on that expectation “for non investigatory, work-related purposes, as well as for investigations of work-related misconduct, should be judged by the standard of reasonableness under all the circumstances.” O’Connor, at 725–726.

Justice Scalia concurred in O’Connor, but would have dispensed with an inquiry into “operational realities” and would conclude “that the offices of government employees . . . are covered by Fourth Amendment protections as a general matter” Id., at 731. Justice Scalia would also have held “that government searches to retrieve work-related materials or to investigate violations of workplace rules—searches of the sort that are regarded as reasonable and normal in the private-employer context—do not violate the Fourth Amendment,” Id., at 732.

So there are two methods, but Justice Kennedy, who delivered today’s opinion, wrote that both methods would lead to the same results in the Quon case.

Did Quon have a reasonable expectation of privacy in his text messages?

Unfortunately, the SCOTUS shied away from answering that question.

The OPPD had a Computer Policy which extended to text messaging. Respondent contended that he had been told that an audit would not be necessary if he would pay for the overage, and thus had a reasonable expectation of privacy in the contents of his messages.

The SCOTUS expressed caution when having to consider “the concept of privacy expectations in communications made on electronic equipment owned by a government employer” as “the judiciary risks error by elaborating too fully on the Fourth Amendment implications of emerging technology before its role in society has become clear” in cases such as Olmstead or Katz. Thus, “prudence counsels caution before the facts in the instant case are used to establish far-reaching premises that define the existence, and extent, of privacy expectations enjoyed by employees when using employer-provided communication devices.”

The message is clear: the SCOTUS does not want Quon to become the reference case setting the threshold for an employee’s expectation of privacy in their messages sent using the numerous communications devices provided to them by their employer. Indeed, the “rapid changes in the dynamics of communications” make it difficult to predict “how employees’ privacy expectations will be shaped by those changes or the degree to which society will be prepared to recognize those expectations as reasonable.“ So “a broad holding concerning employees’ privacy expectations vis-à-vis employer-provided technological equipment might have implications for future cases that cannot be predicted. It is preferable to dispose of this case on narrower grounds.“

Searches without warrant are per se unreasonable under the Fourth Amendment, but there are some exceptions, and the SCOTUs held in O’Connor that “special needs” of the workplace justify one such exception, if the search is “justified at its inception” and if “the measures adopted are reasonably related to the objectives of the search and not excessively intrusive in light of” the circumstances giving rise to the search, 480 U. S., at 725-726. Such was the case in this matter according to the SCOTUS.

The Ninth Circuit had reversed because the search was not reasonable, as there were many simple ways by which the OPD could have verified the efficacy of the 25,000 character limit, without intruding on respondent’s Fourth Amendment rights. The SCOTUS held that this approach was inconsistent with controlling precedents, as the SCOTUS has “repeatedly refused to declare that only the ‘least intrusive’ search practicable can be reasonable under the Fourth Amendment.” Vernonia School District , 515 U.S. 646, 663.

Since the search was motivated by a legitimate work-related purpose, and because it was not excessive in scope, it was reasonable under the O’Connor approach. The SCOTUS reverses the judgment of the Ninth Circuit.

Are Communications Made through Social Networking Sites “Readily Accessible “ to the Public?

2010-06-16T10:28:00.005-04:00

Defendant in Crispin v. Audigier, a copyright infringement case, served subpoenas to four web sites, among them Facebook and MySpace, seeking the disclosure of wall postings and private messages from plaintiff’s accounts.

Plaintiff moved to quash the subpoenas, arguing that the subpoenas sought electronic communications that ISPs are prohibited from disclosing under the Stored Communications Act(SCA).

Judge McDermott rejected the motion to quash. The Judge found that the SCA only prohibits the disclosure of communications held in “electronic storage” by the ECS provider, and that material held by the social networking sites are not in electronic storage as defined in the SCA.

Plaintiff then moved for reconsideration of Judge McDermott’s decision. The Central District Court of California quashed portions of the subpoenas, distinguishing between private messages sent through the social networking sites, and wall postings and comments.

The Stored Communications Act

The SCA was passed by Congress in 1986 as part of the Electronic Communications Privacy Act (ECPA). The Act was passed to extend the reach of Title III of the Omnibus Crime Control and Safe Streets Act of 1968 to electronic communications, including stored electronic communications. It protects stored e-mails, voicemails, and non-content records. Does it also protect emails sent through social networking sites, Facebook wall postings, and MySpace comments?

The statute applies to “any service which provides to users thereof the ability to send or receive wire or electronic communications.” 18 U.S.C. §§ 2510(15 It protects the privacy of stored Internet communications by preventing providers of communication services from divulging private information to governmental entities or private persons.

The SCA “was enacted because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address,” http://www.jdsupra.com/post/documentViewer.aspx?fid=aeb48a5a-eab7-4106-af6c-99238d446d1c , 529 F.3d 892, 902 (9th Circ. 2008), quoting an article by Orin Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 GEO> WASH.L.REV. 1208 (2004).

The SCA distinguishes between “remote computing services”(RCS) and “electronic communication services”(RCS). Both an RCS and an ECS can divulge private information to, or with the lawful consent of the “addressee or intended recipient of such communications.” However, only an RCS may release this information with the lawful consent of the subscriber, 18 U.S.C. §§ 2502(b)(3)

What is an Electronic Communication Service Provider?

An Electronic Communication Service Provider(ECP) is defined by the SCA as “any service which provides to users thereof the ability to send or receive wire or electronic communications.” 18 U.S.C. § 2510(15)

The SCA prohibits an ECS from “knowingly divulge[ing] to any person or entity the contents of a communication while in electronic storage by that service”, unless, among other exceptions, that person or entity is “an addressee or intended recipient of such communications.” 18 U.S.C. §§ 2702(a)(1), (b)(1), (b)(3)

An ECS is prohibited from divulging “the contents of a communication while in electronic storage by that service. ” 18 U.S.C. §§ 2702(a)(1). “Electronic storage” is defined as “(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication” 18 U.S.C. § 2510(17).

What is a Remote Computing Service?

The SCA distinguishes an ECP from a remote computing service (RCS) provider which is defined as “the provision to the public of computer storage or processing services by means of an electronic communications systems” 18 U.S.C. § 2511(2).They also are prohibited from “knowingly divulge[ing] to any person or entity the contents of any communication which is carried or maintained on that service.” 18 U.S.C. § 2702(a)(2)

A RCS may not divulge the content of any communication received by electronic transmission that is carried or maintained on its service for a customer or subscriber “solely for the purpose of providing storage or computer processing services to [the] subscriber or customer, if the provider is not authorized to access the contents of [the] communications for purposes of providing … service other than storage or computer processing.” 18 U.S.C. § 2511(a)(2)

The SCA prohibits an RCS from “knowingly divulge[ing] to any person or entity the contents of any communication which is carried or maintained on that service.”

The fact that a company provides storage is however not enough to decide whether a company is an ECS provider or a RCS provider, as an ECS provider may also provide storage of communications, whether it be temporary storage incidental to the communication, or storage for backup protection, 18 U.S.C. § 2510(17). If the provider store electronic communications as a backup, it is an ECS provider, Quon.

Judge McDermott had cited Quon for the proposition that a company is an ECS provider if it “served a conduit for the transmission of electronic communications from one user to another, and stored those communications as a backup for the user.” Judge McDermott then applied that definition to social networking sites and held that they were ECS providers only if they “provid[ed] internet access or operate as conduits for the transmission of data from one location to another”. Since the social networking sites are used only for public display, Judge McDermott found that they were not ECS providers.

However, the Central District Court of California found that Judge McDermott had read Quon too broadly , as Quon is only applicable to text-messaging paper service. Instead, the Court recognized that the three social networking sites were providing private messaging or email services, and felt “compelled to apply the voluminous case law … that establishes that such services constitutes ECS.”

As Facebook wall posting and MySpace comments are not really “public”, but are rather accessible only to individuals selected by the user, the Central District Court of California also found case law regarding private electronic bulletin board services (BBS) as relevant. In MTV Networks v. Curry, 867 F. Supp. 202, 204 (S.D>N.Y. 1994), the Southern Department of New York describing computer bulletin boards as “generally offer[ing] both private electronic mail service and newsgroup. The later is essentially email directed to the community at large, rather than a private recipient.”

In Konop v. Hawaaiian Airlines, Inc., 302 F.3d 868, 875 (9h Cir. 2002), the Ninth Circuit noted that “the legislative history of the [SCA} suggests that Congress wanted to protect electronic communications that are configured to be private, such as email and private electronic bulletin boards.”

However, a completely public BBS is not protected by the SCA. The SCA legislator wrote that “the bill does not for example hinder the development or use of electronic bulletin boards or other similar services where the availability of information about the service, and the readily accessible nature of the service are widely known and the service does not require any special access code or warning to indicate that the information is private. To access a communication in such a public system is not a violation of the Act, since the general public has been ‘authorized’ to do so by the facility provider”. (S. REP. NO. 99-541, at 36)

Since neither Facebook nor MySpace allow their user’s pages to be publicly accessible, but rather, only to persons having access to the user’s profile page, the Central District Court of California concluded that “there is no basis for distinguishing between a restricted-access BBS and a user’s Facebook wall or MySpace comments.”

The court finally concluded that Facebook and MySpace are either ECS or RCS providers, and thus within the meaning of the SCA.

Are private messages and postings on social networking sites electronic storage within the meaning of the SCA?

In Konop,the Ninth Circuit held that a secure website or a private bulletin board was covered by the SCA. (302 F3d at 874). Such a secure website was an ECS provider and the communications stored on the site were so under § 2510(17).

The Central District Court of California found persuasive Snow v. DIRECTTV, Inc., 2005 WL 1226158 (M.D. Fla. May 9, 2005), where the district court found that there could be no temporary, intermediate storage in the context of a BBS, as no one could “allege that the messages are being stored on his particular web site while waiting to be transferred to a final destination.” The BBS is the final destination, just as the social networking sites are the final destination., and postings made on such a site are not protectable as a form or temporary, intermediate storage.

The Central District Court of California interpreted Konop as holding that the postings, once made, are stored for backup purpose. Social networking sites are ECS providers as respects to wall postings and comments , and these communications are in electronic storage within the meaning of the SCA.

The importance of one’s privacy’s settings

Plaintiff argued that, if it it true that both Facebook and MySPace have privacy settings available to their users, their setting have to be sufficient to make a Facebook wall or a MySpace comments section sufficiently restricted as to not make them readily available to the general public. Indeed, under 18 U.S.C. § 2511(2)(g), “it shall not be unlawful under [the SCA] for any person … to intercept or access an electronic communication made through an electronic communication system that is configured so that suc electronic communications I readily accessible to the general public.”

The Central District Court of California held webmail and private messaging, which are inherently private. However, the evidentiary record presented to the Judge regarding Facebook wall postings and MySpace comments were not sufficient to determine whether the subpoenas should be quashed, and remanded so that Judge McDermott could direct the parties to develop a fuller evidentiary record regarding the plaintiff’s privacy setting.

Orin Kerr wrote that the SCA created a set of fourth Amendment-like protection by statute, GEO. WASH. L.REV. 1208, 1212. Does an Internet user have a “reasonable expectation of privacy” in remotely stored files held by a social networking site? We do not have a reasonable expectation of privacy in statements that we expose in plain view of outsiders . Such communications are not protected “because no intention to keep them to [one]self has been exhibited.” (Katz. V. U.S., Justice Harlan , concurring). Just as “it shall not be unlawful under [the SCA] for any person… to intercept of access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.” 18 U.S.C. §§ 2511(2)(g)

Setting their privacy on social networking sites is indeed an active way for users to state the extent to which they expect their communications to be private.

The French Flag is Burning: No Pictures Please!

2010-06-07T11:59:00.007-04:00

I wrote last week about a French bill which aims at suppressing the crime of offending the French President, and noted the differences in this matter between the U.S. and the French law.

Well, here is another example of these fundamental differences on the point of freedom of expression. Another French bill, this time sponsored by Senators on the right side of the political spectrum, proposes to criminalize the act of publicly insulting the flag or the national anthem, or to publish an image inciting others to publicly insult these two symbols.

Currently, article 433-5-1 of the French criminal Code punishes by a fine of €7,500 the act of publicly insulting the French national anthem, or the French flag, at a demonstration organized or regulated by the public authorities.

This article was added to the criminal Code by a 2003 law, which has been declared constitutional by the Conseil Constitutionnel in a March 13, 2003 decision. However, the Council noted that works of the mind were excluded from the scope of article 433-5-1, as were private acts and public acts performed at events not organized by public authorities nor regulated by them.

This decision limits considerably the scope of article 433-5-1. In so many words, it is illegal to insult the flag on Bastille Day while watching the military parade on the Champs Elysées, but it is still legal to do so in one’s own backyard, or at the annual meeting of one’s bridge club. It is also legal if this insult is a work of the mind, that is a work protected by Intellectual Property.

The 2010 bill would considerably enlarge the scope of article 433-5-1 as it would criminalize offering, making available, or disseminating an image or a representation of contempt for the French flag or the national anthem, when such actions incite someone to commit the offense of publicly insulting these symbols.

Why all this legislative activity? It is the answer to a photographic contest organized earlier this year by FNAC, a famous chain of media stores. One of the winning pictures showed a man, standing with his back turned toward a wall, using the French flag to wipe the part of his body one commonly uses to sit down.

Publishing this image is fortunately still legal in France, as it was not done in the course of a public demonstration. The new bill would, as I read it, make it illegal to publish and disseminate this image only if such publication or dissemination incites someone to commit an offence publicly.

First question: how could one possibly prove such crime? It would be very difficult to prove causation, unless the suspect confesses that, after viewing such photographs, he had the sudden urge to rush outside and publicly offend the flag or the national anthem.

Second question: does this mean that every image showing the flag being insulted will be deemed to incite the viewer to insult it in public? That would show a very poor respect of the free mind of the viewer, and would completely ignore the 2003 Conseil Constitutionnel’s decision.

It is highly ironical that France,a country proud of its image as a country defending human rights, would make a crime to insult the flag or the national anthem.

Although many in the U.S. have tried to amend the Constitution and make flag-burning unconstitutional, burning a flag is legal in the U.S. The U.S. Supreme Court held 5 to 4 in 1989, in Texas v. Johnson, that burning a flag is an expressive conduct protected under the First Amendment. In an often-quoted phrase, Justice Brennan wrote that “If there is a bedrock principle underlying the First Amendment, it is that the Government may not prohibit the expression of an idea simply because society finds the idea itself offensive or disagreeable.”

The French government would be well inspired to meditate on that statement.

Offending the French President is Still a Crime

2010-06-01T08:46:00.005-04:00

A recent French bill proposes to abrogate article 26 of the 1881 French Freedom of the Press law, which makes it a crime to make an “offence” toward the President of the French Republic.

The Freedom of Press law is a venerable old lady which regulates the “press” in France, that is, the media, Internet included. It has been modified many times to adapt to new times and new technologies.

Article 26 incriminates “offences” to the President of the Republic, whether the offence is made by «speech, shouts, threats uttered in public places or during public meetings, or by writings, printed materials, drawings, engravings, paintings, emblems, images or any other medium of written words, spoken words, or images sold, distributed, or displayed in public places or public meetings or by any way of electronic communication to the public.” The author of this felony may be punished by a 45,000 euro fine, a rather hefty sum.

This is not the first time that French legislators have tried to abrogate article 26.A French Senator sponsored a similar bill in November 2008. The 2008 Senate bill was never enacted, and the 2010 Parliament bill may very well share the same fate.

Article 26 had been used six times during the 59 years of the Third Republic (1870-1940) and has been used only once during the Fifth Republic, by President Georges Pompidou. It was thus quite dormant and not triggering much attention from the public. However, the current President, Nicolas Sarkozy, has used it several times since his election in 2007. One man was sentenced to pay a 30 euro fine for having held a piece of paper on a route taken by Mr. Sarkozy where he had written “Get lost, you jerk!”, a quote from the much-publicized insult made to another citizen a few weeks earlier by… the President himself.

What constitutes an offence to the President?

The law does not define what constitutes an “offence” to the President. Criminal laws must be strictly interpreted by the French judge (article 111-4 of the French criminal Code). Since what constitutes an offence is not defined by law, the courts have latitude to interpret article 26.

The French Supreme Court (Cour de cassation) defines this crime as any defamatory imputation, which is likely to affect the honor and dignity of the President, whether in his capacity as President, or in his private life. Thus the definition of “offence” certainly does include defamation and insults, but could also include mere jests.

In this regard, the difference between the French law and the American law is really staggering. In the U.S., a public official has to prove by clear and convincing evidence that the libelous statement was made with ‘actual malice’ (New York Times v. Sullivan, 1964). However, Sullivan applies only if the slander at cause was critical of the official conduct of the public official. In contrast, article 26 does not distinguish whether the offensive statement was made against the French President in his official capacity or in his private life, and the President does not have to prove actual malice.

The broad powers of the French President

The representatives sponsoring the new bill explained their motivation as wanting to eliminate what is, in essence, a remnant of the Ancien Régime lèse-majesté crime, which was abrogated in 1830. This crime was the most despicable of crimes when France still had a King, as the French king was sovereign “by divine right.” Any attempt to strike his body was thus also an attempt to injure god. After the French Revolution, the 1791 criminal Code started to refer to this crime as “lèse-nation.” It was no longer the King who is the victim, but the Nation he represented. This new conception of the crime was confirmed in the 1810 criminal Code.

Well, France does not have a King any more, and the French Republic is headed by Presidents directly elected by all voters for five years. However, as a holdover of the Ancien Régime, the French President also has the title of Co-Prince of Andorra, just as the Sun King had in the 17th Century.

When the Freedom of the Press law was enacted in 1881, the President of the Republic did not have broad powers. It was rather the Président du Conseil, a sort of Prime Minister, which was governing the country. The public was able to criticize him freely as article 26 only mentions the President of the Republic.

However, that changed in 1958 when France’s current Constitution, the Fifth Constitution, was enacted under the influence of Charles de Gaulle. The famous General became the first President of the Fifth Republic, at a time when France was still fighting a war in Algeria, and thus the Constitution was written to give broad powers to the President. For instance, article 16 of the Constitution authorizes the President to take measures required by special circumstances, that is if ‘the integrity of [France’s] territory or the fulfillment of its international commitments are under serious and immediate threats, and where the proper functioning of the constitutional authorities is interrupted.” These decisions cannot be checked by the courts: no checks and balances!

It is no longer a crime to offend a foreign head of state under French law

Since 2004, insulting a foreign head of state is no longer in crime in France. The European Court of Human Rights held against France on June 25, 2002 (Colombani and others against France), finding that France had violated the right to freedom of expression as guaranteed by article 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms (the Convention).
Article 36 of the Freedom of the Press law had made it an offence, punishable by one’s year’s imprisonment or a 300 000 francs fine (more or less $60,000) to insult a foreign head of state, a foreign head of government, or the minister for foreign affairs of a foreign government. After the Colombani judgment, France abolished article 36 of the Freedom of the Press law.

The European Court of Human Rights noted in Colombani the similarity of article 36 and article 26 of the Freedom of Press law. Will article 26 be abolished only after, and if, the European Court of Human Rights holds that it violates article 10 of the Convention? I do not know of any case pending which would give the Court the opportunity to do so
.
The May 2010 bill is sponsored by Representatives on the left side of the House, and will probably not be able to gain enough support for approval. Let’s hope for a bi-partisan bill which would allow France to honorably abolish artic

Thrift Store T-Shirt

2010-05-28T08:25:00.011-04:00

It has been a while since I posted a thrift store t-shirt entry.

Here are the rules : I go to a thrift store, comb the t-shirts racks to find a t-shirt which probably infringes on someone's IP rights.

Find of the day pictured here.

Article in French on Internet Defamation

2010-05-26T08:26:00.005-04:00

I just published this article (in French) on Legalbiznext, a French legal news Site, on Internet defamation and the right to be forgotten.

A slightly different version of the article is published on Owni.

Data as speech: we could become our own censors, in the name of privacy

2010-05-23T17:38:00.009-04:00

The Electronic Frontier Foundation published on its site this week a proposal for “A Bill of Privacy Rights for Social Network Users.”

After Facebook (numerous) privacy policy changes which occurred recently, and the recent report in The Wall Street Journal that advertising companies were receiving information from Facebook and MySpace that could be then used to look up individual profiles, we certainly need to reassess the rights of social media users.

As a privacy advocate, I certainly applaud the proposed EFF bill of privacy rights. Privacy needs to be protected, especially online. It seems that social media users also need to be protected from themselves, and the right to delete embarrassing picture is certainly appealing.

But if I wear my First Amendment advocate hat, number 3 on the bill of privacy rights, The Right to Leave, does not seem to be such a good idea.

The author of the Bill, Kurt Opsahl, summarizes point 3 in this formula: “Users giveth, and users should have the right to taketh away."Social media users should have “the right to delete data or her entire account from a social network service.”

If I delete my data, should I have the right to take everything with me, including what I have posted on a friend’s wall? This is data, sure, but it is also speech after all.

I am not sure if the bill of privacy rights would cover only personal data. Point 3 refers to “data” or “uploaded information.” It could mean only personal data, but it could also mean all the information I have posted on social media sites, whether on my page, or on other’s people’s page. If the user chose to delete all of the information she uploaded over time on the social network, doesn’t this give her a right to censor other people speech?

Should we have a right to be forgotten online? Of course, we have the right to change opinion, anytime. You know how the saying goes, “Only stupid people never change their opinion,” and it is quite true. Having an opinion is one of the most difficult things one can achieve, and informing oneself, weighting different aspects of an issue, making a decision, should not be a process set in stone. A new piece of information, a new technology, a new event, may entice us to change opinion.

And we have opinions about just anything, right? Let’s just say I wrote years ago on my BFF’s Facebook wall: “I just so love kittens and sunsets on the beach!” Well, I have since changed my mind, and I now make a living in Alaska raising dogs. My formerly-professed love of kittens could damage my professional reputation.

This is just an opinion, and it is not defamatory, just maybe embarrassing for me. Should I be able to take these comments away, when I leave the site? What if my BFF had answered me: ”I love them too !” Her comment is now left tangling in cyberspace…

And should this Bill of Privacy Rights also apply to Twitter? Actually, that would be impossible right now, as Twitter has donated its entire archive of tweets to the Library of Congress.

According to Librarian of Congress James H. Billington: "The Twitter digital archive has extraordinary potential for research into our contemporary way of life. (...) The collection also documents a remarkable range of social trends. Anyone who wants to understand how an ever-broadening public is using social media to engage in an ongoing debate regarding social and cultural issues will have need of this material."

Our tweets are valuable speech indeed, and even the most mundane of tweets (aka the infamous what-I-ate-for-lunch tweet) could have great importance in the future.OK, so maybe Twitter is not a traditional social network site, and may be better defined as a micro-blogging, everything-is-public site, but it has a lot of social networking aspects.It also has been used, and probably will be used again, by eye witnesses to report important events instantly. Should they later be allowed to take this data away?

Should we have a right to be forgotten online? There is a bill recently introduced in the House that would allow us to be forgotten online. H.R.5108, the Cyber Privacy Act Bill, would “require certain Internet websites that contain personal information of individual's to remove such information at the request of such individuals.” The Act would define “personal information” as “any information about an individual that includes, at minimum, the individual's name together with either a telephone number of such individual or an address of such individual”.

The sponsors of this bill probably have in mind the protection of privacy, again, a very worthy cause! However, couldn’t this bill, if enacted, be used to have one’s name deleted from a message we have posted? (I love kittens, signed Jane Smith)

Est-ce que les Blogueurs Français Vont Tous Devenir des Directeurs de la Publication?

2010-05-21T09:38:00.004-04:00

Un projet de loi du Sénateur Jean-Louis Masson propose de « faciliter l'identification des éditeurs de sites de communication en ligne et en particulier des « blogueurs » professionnels et non professionnels ».

Qui bénéficierait de cette loi ? Les « personnes nommément mises en cause par des auteurs anonyme », qui sauraient ainsi à qui s’adresser si elles ont fait l’objet de propos sur la toile qu’elles jugent diffamatoires à leur égard.

Pour ce, l'article unique de la proposition de loi, et ce, curieusement, « par mesure de simplification » souhaite assimiler l'éditeur non professionnel au directeur de la publication. Les blogueurs français deviendraient, grâce au législateur, des directeurs de la publication.

Il n’est pas nécessaire d’en arriver là, et promulguer cette loi serait dangereux pour la liberté d’expression. Il existe déjà un droit de réponse en ligne, mis en place après bien des hésitations et des atermoiements, en raison de la tension entre la liberté d’expression et le droit de chacun à protéger sa réputation.

Le droit de réponse en ligne

L'article 2-IV du projet de loi pour la confiance dans l'économie numérique prévoyait en 2004 que toute personne nommée ou désignée dans un service de communication en ligne pouvait exiger un droit de réponse, si sa demande était « présentée dans un délai de trois mois à compter de la date à laquelle cesse la mise à disposition du public du message justifiant cette demande ». Le législateur tentait là de mettre fin à la jurisprudence de la Cour de cassation, selon laquelle « lorsque des poursuites pour l'une des infractions prévues par la loi précitée sont engagées à raison d'une diffusion sur le réseau internet, d'un message figurant sur un site, le point du départ du délai de prescription de l'action publique prévu par l'article 65 de la loi du 29 juillet 1881 doit être fixé à la date de du premier acte de publication ; que cette date est celle à laquelle le message a été mis pour la première fois à la disposition des utilisateurs » (Crim. 27 novembre 2001, J-L C / Ministère Public, LDH, MRAP, UEJF).

Mais, par une décision du 10 juin 2004, le Conseil Constitutionnel déclara que ce texte n’était pas conforme à la Constitution. Dès lors, le texte finalement adoptée prévoit que le délai de prescription pour ce droit de réponse commence à courir, non à partir de la date où le message cesse d’être mis à la disposition du public, mais commence à courir à partir de la date où le message est mis à la disposition du public. Cette décision est heureuse en ce qu’elle protège à la fois la liberté d’expression et les intérêts des personnes diffamées. Trois mois devrait être un délai suffisant pour découvrir que l’on a té diffamé par un message publié sur Internet, du moins si nous utilisons régulièrement les moteurs de recherche afin de vérifier ce qui se dit sur nous sur la toile.

La demande de droit de réponse en ligne doit être adressée au directeur de la publication si l’auteur des propos diffamatoires est connu. Mais si la personne éditant à titre non professionnel a conservé l'anonymat « cette demande est adressée à l’hébergeur (…) qui la transmet sans délai au directeur de la publication » (article 6 IV de la loi du 21 juin 2004)et ce, sous 24 heures sous peine d’amende (décret du 24 octobre 2007).

Demeurer anonyme sur Internet
Il est légal de demeurer anonyme en France. En fait, demeurer anonyme est la norme sur Internet, et non l’exception. En effet, selon l'article L. 34-1 du Code des postes et des communications électroniques, «Les opérateurs de communications électroniques, et notamment les personnes dont l'activité est d'offrir un accès à des services de communication au public en ligne, effacent ou rendent anonyme toute donnée relative au trafic».

Il existe deux exceptions à ce principe d’anonymat. Tout d’abord, les données peuvent être conservées à des fins de facturation, du moins jusqu'à la fin de la période au cours de laquelle la facture peut être légalement contestée. Ensuite, les opérateurs peuvent différer à rendre les données anonymes afin de permettre la poursuite d’infractions pénales, et ce pour une durée maximale d'un an. Cette exception s’étend également aux personnes offrant une communication en ligne au titre d'une activité professionnelle, qu’elle soit principale ou accessoire, par exemple, les cyber-cafés.

Rappelons, et c’est toujours un véritable plaisir de le faire, que le droit à la liberté d’expression est protégé en droit français par l’article 11 de la Déclaration des droits de l’homme et du citoyen de 1789 qui dispose que «la libre communication des pensées et des opinions est un des droits les plus précieux de l’homme ; tout citoyen peut donc parler, écrire, imprimer librement, sauf à répondre de l’abus de cette liberté dans les cas déterminés par la loi ». La liberté d’expression est également protégée par l’article 10 de la Convention Européenne des droits de l’homme, qui a valeur constitutionnelle en droit français. Cet article prévoit également que le droit à la liberté d’expression puisse être restreint par la loi.

La liberté d’expression doit comporter le droit à demeurer anonyme, si les propos tenus le sont dans les limites de loi. Exiger que les blogueurs se dévoilent, avant même que leurs propos aient été publiés, avant même que l’on ait pu juger si leurs billets portent atteinte à un droit est dangereux pour les libertés publiques. La loi française réprime la diffamation, qui st un délit en droit français. Puisque la diffamation est une infraction pénale, ‘on peut obtenir de l’hébergeur l’identité de l’auteur des propos jugés diffamants. Pont n’est besoin de demander à tous les internautes de se dévoiler.

Update on California Postmortem Right of Publicity

2010-05-17T15:00:00.001-04:00

I just published a guest blog entry at the NYSBA Entertainment, Arts and Sports Law Section blog on a recent California bill which would extend postmortem right of publicity to persons who became famous because of their deaths.

A Few Comments About the Privacy Bill Draft

2010-05-07T11:56:00.017-04:00

A draft of a privacy bill which will be presented later this year by Representative Rick Boucher (D-Virginia) and co-sponsored by Representative Cliff Stearns (R-Florida) has been released this week.

Companies and nonprofit organizations, and generally “any person” collecting personal information from at least 5,000 people, would have to follow new privacy rules. If the information collected is “sensitive”, that is, medical records, financial records, or precise geolocation information, even an entity collecting information from fewer than 5,000 people would have to follow these rules. They would not apply, however, to governments agencies. (p.2)

Geolocation information

“Precise geolocation information” would be considered sensitive information, just as your bank records, or your patient’s file. What makes it sensitive is not the nature of the information (after all, everybody around me knows my geolocation when I stand on line for my morning coffee and bagel), but the fact that the information is collected, kept, and linked with a name, at least with an avatar.

Companies are more and more interested in knowing their (future) customer’s locations. Facebook will soon propose a check-In’ app in partnership with McDonald’s. Customers will be able to “check in” at McDonald, and their location will then appear on their Facebook page, complete with an ad featuring a McDonald product. Such application is likely to allow McDonald to know precisely when and where any customer using the app has visited one of their restaurants.

Render anonymous

The bill defines “render anonymous” as “remov[ing] or obscure[ing] covered information such that the remaining information does not identity and there is no reasonable basis to believe that the information can be used to identify [an individual or a computer/device used by a particular user.]" (p.6)

If “reasonable basis” is the benchmark used to assess whether an information is indeed anonymous, one can safely contend that it should be "reasonable” to take into account the paper written by Arvind Narayanan and Vitaly Shmatikov which proves that even anonymous data can be “re-identified” by using a specific algorithm.

Covered entities privacy policies must include how they render information anonymous after the expiration of the retention period. (p. 10). As we know, merely deleting name and addresses is not enough to make data anonymous. Remember in 2006 when New York Times journalists were able to identify an AOL user just by analyzing her different queries, even though the data had been rendered "anonymous” by AOL.

Covered entities would now have to delete or render anonymous any covered information, no later than 18 months after the date the covered information is first collected. (p.17)

Privacy notice

If the information is collected on the Internet, a privacy policy must be posted on the entity's website “clearly and conspicuously” and must be accessible through a direct link from the Internet home page of the covered entity.”

However, if the information is collected manually, the privacy notice must be made available to the individual, in writing, before the information is collected
The privacy notice must include how the information is collected the specific purpose for which the information is collected, and how the information is stored.

It also must inform the individual on how the entity may merge, link or combined his information with other information about him that the entity could obtain from third parties. This is very important as merging information from different sources allows for the building of digital files about one individual.

The policy must inform the individual on how to contact the entity, but also must contain either a hyperlink or a toll-free number for contacting the Federal Trade Commission. (p.11) This is a good point, as many consumers still do not know the role the FTC plays in defending their rights.

Opt-in?

The individual would have the option to opt-out. The entity must inform him of this option. The individual then either consents or decline consent. (p.12)

“Either”… Who has the power to choose between either opting-in or opting-out? If it is the entity, it is likely that it will always prefer to only allow the individual to opt-out. Opting-is much more protective for consumers. So, why use “either”? I am not sure why, and this point deserves clarification.

Opt-out

If the entity chooses the opt-out option, it must be done through a “readily accessible opt-out mechanism.”(p. 17)

Fabebook and "Droit à l'Image"

2010-05-03T08:22:00.003-04:00

I wrote this article (in French) on parents using and posting their children's photographies on Facebook.

Violent Video Games and First Amendment

2010-04-29T14:08:00.002-04:00

The Supreme Court will review next term whether a California law banning the sale of violent video games to minors is constitutional.

I just published a guest blog entry on the subject at the NYSBA Entertainment, Arts and Sports Law Section blog.

Everybody Sez Breaching Privacy Should Be a Crime

2010-04-26T11:14:00.014-04:00

It is now commonly believed that young people do not care about privacy. They post pictures online, share details of their daily life for (almost) all to see.

A recently published report: “How Different are Young Adults from Older Adults When it Comes to Information Privacy Attitudes and Policies” by Chris Hoofnagle, Jennifer King, Su Li and Joseph Turow, does not agree.

The authors found that young American adults (aged 18-24) do not seem to have fundamentally different views regarding privacy than older adults.

The report presents a set of tables showing poll results by age categories. People had been asked to answer several privacy-related questions. Indeed, the results do not show huge discrepancies between the views of young adults and of older people regarding privacy.

Incidentally, I found some results very intriguing, regardless of the age category. When asked which one of the most important ways, beyond a fine, a company that use a person’s information illegally might be punished, 35% of the sample answered that “executives who are responsible should face jail time.” 40% of the 18-24 category agree with that statement…

This is following the much - commented Google case in Italy, where executives were tried in a criminal court for having violated the privacy of an Italian teen. Google had hosted (on YouTube) a video of the teen being bullied, and Google executives were sentenced to six-months in jail. The sentence was suspended.

This was an Italian case. France’s criminal law also protects privacy. Pursuant to article 226-1 of the Fench criminal Code, one year's imprisonment and a fine of €45,000 is incurred for any willful privacy violation, either by intercepting private conversations or recording or transmitting a person’s image while she is a in private place.

So even younger Americans seem to favor the criminalization of privacy breaches. If this trend endures, one could see more and more bills, either state bills or federal bills, aiming at making privacy breaches a crime.

No Three-Strikes in ACTA

2010-04-23T14:15:00.004-04:00

A consolidated text of the Anti-Counterfeiting Trade Agreement (ACTA) has been made public at last this week. Parts of the text in brackets indicate what has not been adopted yet by all Parties.

Article 1.4 about “Privacy and disclosure of information” merely indicates between brackets that a suitable provision ensuring that nothing in the Agreement detracts from national legislation regarding protection of personal privacy needs to be drafted.

Let’s move on to section 4 dedicated to “Special measures related to technological enforcement of Intellectual Property in the digital environment.” That was the part of ACTA I was the most anxious to read, to find out whether ACTA promotes a three-strikes law similar to the French HADOPI law, or the Digital Economy Bill, which was recently passed by the U.K. Parliament.

Article 2.18 deals with “Enforcement Procedures in the Digital Environment.” There are two Options of this article, Option 1 and Option 2 (this is still a draft after all.) For both Options, these measures, procedures and remedies should be “fair and proportionate.” (p.18)

Indeed, “some persons use the services of thirds parties, including online service providers” to engage in IP rights infringement. What are, if any, the responsibilities of the ISPs according to the ACTA?

In Option 1, there would be a Safe Harbor for ISPs (although only “in certain situations”, see note 52 page 19), provided that the ISP had not selected the infringing material nor had initiated the user’s infringing actions, article 2.18. 3. (a)(ii), and did not have actual knowledge of the infringement.

An ISP would also need to have a policy addressing the unauthorized storage or transmission of copyrighted materials. However, no Party may condition offering a Safe Harbor to an ISP by having the ISP monitor its services or “affirmatively seeking facts indicating that an infringing activity is occurring,” article 2.18. 3. (b) (i) (Page 21). Does that mean that the ISP would have no monitoring duties at all?

In Option 2, there would be also a Safe Harbor provided that the ISP had not selected the infringing material nor had initiated the user’s infringing actions, article 2.18. 3. (a) (ii), and only if the ISP would remove or disable access to the infringing material “expeditiously” upon learning about the infringement. This is very similar to the DMCA takedown notices.

Article 2.18. § 3 ter, Option 2, would enable intellectual property rights holders, who have given notice to an ISP that they have valid reasons to claim that some material posted by one of its subscriber infringes their rights, to obtain “expeditiously” from the ISP the identity of this subscriber.

No three-strikes in ACTA so far, but to be followed with care…

What responsibilities should those who collect personal data have?

2010-03-20T12:28:00.011-04:00

The FCC pointed out in its Broadband Plan that “the fiduciary and legal responsibilities of those who collect and use that data are (…) unclear," and that “once consumers have shared their data, they often have limited ability to see and influence what data about them has been aggregated or is being used.” (p. 53).

There are a few federal laws which allow an individual to access and correct his personal data:

Right of access provided by U.S. Federal Laws
Some federal laws require that the consumer has access to his information after it has been collected. For instance, §609 of the FCRA gives consumers the right to ask a consumer reporting agency to disclose (almost all of) the information in their file, along with the source of this information. The disclosure must be made in writing (§610 of the FCRA).

As for medical information, 45 C.F.R. § 164.524 provides an individual with a right to access, inspect and obtain a copy of his protected health information contained in a designated record set.

The Cable Communications Policy Act of 1989 (CCPA) provides cable subscribers access to all their personally identifiable information which is collected and maintained by a cable operator. This information must be made available to them at reasonable times and at a convenient place designated by the cable operator.

Right to correct data provided by U.S. Federal Laws
Federal laws also sometimes give the data subject the right to correct his personal information. A consumer may correct information in his credit file if it is inaccurate, and §611 of the FCRA provides with a procedure in case of disputed accuracy. The consumer may notify the consumer reporting agency directly, which must then reinvestigate free of charge, correct the file or delete the item from the file if inaccurate. The Family Educational Rights and Privacy Act of 1974 gave students the right to inspect their records and correct their information, and under the CCPA, a cable operator must provide its subscribers with a reasonable opportunity to correct any error in their information.

European Law
In contrast, the European Directive 95/46/EC clearly states that “any person must be able to exercise the right of access to data relating to him which are being processed, in order to verify in particular the accuracy of the data and the lawfulness of the processing.” This right of access is provided by article 12 of the Directive, and it is the data controller who is in charge of insuring that data subjects can exercise their rights. A data controller is defined by article 2(d) as “the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.”

The data controller responsibilities start when the data is collected, until the data is destroyed. Pursuant to the article 6 of the Directive, “every reasonable step must be taken” to ensure that inaccurate data are either deleted or corrected.

Recommendation 4.15 of the Broadband plan proposes that Congress should consider helping the development of trusted ”identity providers” to assist consumers in managing their data. But wouldn’t it be more efficient to provide American data subjects with a general right to access and correct all of their personal data?

FCC Broadband Plan and Privacy

2010-03-18T10:32:00.008-04:00

The FCC presented this week its much-awaited National Broadband Plan.

Parts of the plan deal with online privacy, as broadband makes collection of personal data easier.

The FCC notes (Chapter 4, p.53) that “the emergence of broadband and the growing use of the Internet make aggregation of detailed personal data much easier and more valuable.” Since it is now easy to collect data from Internet site visitors, even single companies have the power to collect, aggregate and analyze massive amounts of personal data, allowing them to create a “digital identity,” that is, a very detailed picture of an individual, from his geographic location, his health, his eating and entertainment tastes, and so on.

This data is of great value to marketers, allowing them to target specific ads based on these digital identities, making it six times more likely, according to the FCC, that a consumer thus targeted will click on an ad.

The FCC is concerned about the impact that the ability of gathering these digital identities will have on competition. On one hand, companies already in the market have collected this massive amount of data over the years, allowing them to fine tune their marketing strategy. Indeed, according to the plan, this data is so valuable that these companies “increasingly offer their products and services free of any monetary charges. Consumers gain access to a valuable service, and businesses gain valuable information.”

In exchange for giving companies access to our personal data, consumers gain free products and services: I have a lot of problem with that statement. Let’s consider that personal data has a market value, allowing us to trade it for free products. Well, personal data does not have a sustainable value. The scenario "trade it once, lose it for ever" is a real possibility, as it is very easy to copy digital data. Like copyright pirates, we could see the emergence of data pirates. So, increasingly, as I trade more and more of my personal information, I will have less and less info to trade for these free products, and that may prevent me from dealing effectively in the market.

True, we evolve constantly as human beings, and new data is added to our digital identify every day. However, not every new data has the same value: the fact that Jane discovered that indeed Strawberry Swirl is her favorite ice cream flavor is not as important for her, nor as important for a marketer, as the fact that she will give birth to triplets in the Fall.

New firms without access to these detailed “digital identities” face competive challenges: The report goes on by noting that since new firms have not yet gathered these digital identities, they cannot monetize their audience through advertising and thus are facing competitive challenges.

The solution, according to the plan, is giving individuals control of their digital profiles: “Giving consumers control of their digital profiles and personal data, including
the ability to transfer some or all of it to a third party of their choice, may enable the development of new applications and services, and reduce barriers to entry for new firms.”

But is it really possible to transfer data to a third party without that data loosing some of its value? Our data has already been traded by Firm number 1 to an advertiser. If Firm number 2 comes later and proposes the same product, our digital identity, to the same advertisers, isn’t the value of our data then lower? Just as a digital photograph, digital personal information can be copied and stored instantly. True, Firm number 2 may have gathered more information on us, but if individuals keep “reselling” their digital profiles to every company in the open market, these profiles will lose their value, as every advertiser will be able to gain access to them, and thus none of them will have any longer the competitive advantage of knowing its target audience with such precision. Every firm will have that power, and the value of our digital identity will be diluted, thus impairing our own ability to trade it.

Microsoft Europe ad for Data Protection Day 2010

2010-01-26T08:59:00.001-05:00

Privacy Day is January 28!

We stand for a single Internet...

2010-01-22T15:23:00.009-05:00

Reading the transcript of Secretary of State Hillary Clinton's talk on Internet Freedom is rather uplifting: "We stand for a single internet where all of humanity has equal access to knowledge and ideas".

"This freedom is no longer defined solely by whether citizens can go into the town square and criticize their government without fear of retribution. Blogs, emails, social networks, and text messages have opened up new forums for exchanging ideas, and created new targets for censorship."

"The freedom to connect is like the freedom of assembly, only in cyberspace. It allows individuals to get online, come together, and hopefully cooperate. Once you’re on the internet, you don’t need to be a tycoon or a rock star to have a huge impact on society." In short, you can get whuffie-rich online.

These words echo (and amplify) the strong words of Justice Stevens in Reno v. ACLU: "Any person with a phone line can become a town crier with a voice that resonates farther than it could from any soapbox." Web 2.0 have since become the new forums of choice. This information is able to travel quickly, and viral posts and videos make their way quickly around the globe. Or so they should.

But freedom of speech is endangered, because free communication is sometimes stopped when traveling through borders: "Some countries have erected electronic barriers that prevent their people from accessing portions of the world’s networks. They’ve expunged words, names, and phrases from search engine results. They have violated the privacy of citizens who engage in non-violent political speech."

However, "all societies recognize that free expression has its limits."

"Those who use the internet to recruit terrorists or distribute stolen intellectual property cannot divorce their online actions from their real world identities. But these challenges must not become an excuse for governments to systematically violate the rights and privacy of those who use the internet for peaceful political purposes."

Does the last phrase refer to current debate over three-strikes laws such as the French Hadopi law and the UK Digital Economy Bill? Probably not, as the phrase would then have stopped after "internet." The Secretary of State is referring to people using the Internet to share their ideas which are not necessarily the ones of their government.

So governements should not have the power to cut the pipelines to censure peaceful political speech. We are still not sure whether they may use that power to cast a broad net in order to catch users downloading protected works.

Stanford Expert Considers Robots and the Law

2010-01-03T09:42:00.001-05:00

Who Owns Our Personal Data?

2009-12-19T12:02:00.005-05:00

A class action suit was filed on Thursday against Netflix in the US District Court for the Northern District of California. The class is “All Netflix subscribers that rented a Netflix movie and also rated a movie on the Netflix website during the period of October 1998 through December 2005, residing in the United States.”

According to the class action complaint, “On October 2, 2006, Netflix perpetrated the largest voluntary privacy breach to date, disclosing sensitive and personal indentifying consumer information. The information was not compromised by malicious intruders. Rather, it was given away to the world freely, and with fanfare, as part of a contest intended to benefit its trusted custodian, Netflix.” The lawsuit is brought as a class action by and on behalf of similarly situated Netflix subscribers whose privacy was violated by Netflix as organizer of the “Netflix Prize” contest.

Nettflix launched a contest in the Fall of 2006 offering cash prizes to contestants who could provide collaborative filtering algorithms that would predict viewers' movie ratings with a greater accuracy than Cinematch, which is Netflix’s proprietary recommendation software.

According to the complaint "Netflix subscribers’ movie rental choices constitute personal information that subscribers reasonably expect will be treated as presumptively confidential and that their relationships with Netflix are relationships of confidentiality. Netflix has been entrusted with the confidential, sensitive, and personal information of millions of consumers.”

What is personal information? According to Netflix privacy policy: “Personal information means information that can be used to identify and contact you . . . as well as other information when such information is combined with your personal information.”

This point is interesting, as many pieces of information can become personal information, if there is a way to combine them with information that can be used to identify a person, most of the time a name or an address, but also in some cases a title (CEO of Microsoft, Secretary of the PTA of PS 2349 Pleasantville, IL). It is so easy nowadays to link databases that virtually every information may become, at any given time, a personal information.

One of the argument of the complaint is that “ Netflix was attempting to play a semantics game—“personal” information meaning pertaining to or concerning a particular person; however personal information is not limited to a Netflix subscriber’s name. Netflix subscribers reasonably believe that no record would be released showing that they watched a dogmatic, controversial, or sexually explicit show, regardless of whether their actual name is known.”

The notion of personal information goes way beyond the mere name of an individual. Netflix indeed disclosed the personal information of its subscribers “to over 51,000 individuals.”

A very interesting point in the complaint is the claim that Netflix has been unjustly enriched by this scheme, firstly because it has “benefited from its unlawful acts through the receipt of payments for Internet service from Plaintiffs" and secondly because it “continues to benefit from [its] unlawful acts through the receipt of payments in connection with its proprietary search engine, which continues to index websites associated with the subscriber data. (…) Plaintiffs are entitled to the establishment of a constructive trust consisting of the benefit to Netflix of such payments from which Plaintiffs and members of the Classes may make claims on a pro-rata basis for restitution."

The first part of the unjust enrichment argument, the receipt of payments for Internet service from Plaintiffs is not as strong as the second part of the argument, the receipt of payments in connection with the search engine. The way I understand both arguments is that Netflix benefited from the users' fees, and rightfully so, until the moment it disclosed unlawfully their personal information. After that, these fees were somehow the product of its unlawful acts. But Netflix continued to provide their rental services, and was entitled to collect fees for that service.
The second argument is much stronger. Netflix benefited unjustly from the value represented by its users' data. Most consumers still fail to realize that their personal data are very valuable, so much that it has a market value. Their shopping habits are sold by retailers to marketers.

In Dwyer v. American Express Co., 273 Ill. App. 3d 742, (Ill. App. Ct. 1st Dist. 1995), the court held that Amex did not commercially appropriate its cardholder’s personal spending habits. In that case, the plaintiffs also claimed that these actions constituted a deceptive practice claim under the Illinois Consumer Fraud Act. The plaintiff had to prove that these practices constituted a misrepresentation or a concealment of material fact, that it was the defendant’s intent that the plaintiff relies on this misrepresentation or concealment, and that the deception had occurred in the course of trade or commerce. Amex had not informed the cardholders that their spending habits would be analyzed and their names sold to merchants, and this is a deceptive practice under the Illinois Consumer Fraud Statute. However, the court held that the plaintiffs had failed to allege that they suffered any damages, except maybe for “a surfeit of unwanted mail.”

In the Netflix case, it could be easier to prove damages, because Jane Doe, one of the plaintiffs, "believes that, were her sexual orientation public knowledge, it would negatively affect her ability to pursue her livelihood and support her family and would hinder her and her children’s’ ability to live peaceful lives within Plaintiff Doe’s community.”

Les Simples Initiales ne Suffisent pas à Rendre un Dossier Personnel

2009-12-01T09:52:00.004-05:00

Selon la jurisprudence de la Cour de Cassation, les fichiers créés par le salarié à l’aide de l’outil informatique mis à sa disposition par l’employeur pour les besoins de son travail sont présumés avoir un caractère professionnel, sauf si le salarié les identifie comme étant personnels, en sorte que l’employeur est en droit de les ouvrir hors la présence de l’intéressé.

La Cour de cassation vient toutefois de préciser que le simple fait d’utiliser ses initiales afin de nommer un dossier contenu dans le disque dur de l’ordinateur d’un salarié ne suffit pas à faire de ce dossier un dossier personnel.

The Right to Have our Information Forgotten is a Fundamental Right

2009-12-01T07:22:00.006-05:00

Here is an article (in French) written by Mr. Yann Padova, General Secretary of CNIL, the French Data Protection Agency. The title of the article, "Pas de liberté sans droit à l’oubli dans la société numérique," argues strongly that there cannot be any freedom in a digital society without the right to be forgotten.

Mr. Padova argues that all the information about us broadcasted on the web should have an expiration date. That would prevent HR directors, colleagues, your aunt, and just any other party curious about you to be able to see pictures of that wild weekend in Florida 10 years ago, when you and your friends played Monopoly all night long drinking non-diet cokes.

Madeleine Vionnet Exhibition

2009-11-20T06:16:00.001-05:00

The French fashion designer Madeleine Vionnet was a pioneer in protecting her designs. She photographed her models by collection each season, then sent the compilations of the photos to a court in order to establish copyright ownership.

Her vision led to the development of the French anti-counterfeiting laws covering fashion.

Scary Pizza

2009-11-17T06:11:00.001-05:00

Sign the Madrid Declaration

2009-11-14T11:45:00.002-05:00

Sign the Madrid Declaration here...

Une Proposition de Loi Visant à Mieux Garantir le Droit à la Vie Privée à l'Heure du Numérique

2009-11-14T06:17:00.003-05:00

Une proposition de loi visant à mieux garantir le droit à la vie privée à l'heure du numérique a été présentée au Sénat par M. Yves DÉTRAIGNE et Mme Anne-Marie ESCOFFIER.

L’exposé des motifs souhaite la transformation de l' « Homo Sapiens » en un « Homo Numericus » libre et éclairé, protecteur de ses propres données. Pour ce, il convient de renforcer la place accordée à la sensibilisation aux questions de protection de la vie privée et des données personnelles dans les programmes scolaires. L'article premier de la proposition de loi complète l'article L. 312-9 du code de l'éducation afin que l'initiation des élèves à l'usage d'Internet couvre les questions de la protection des données personnelles et de la vie privée.

L’article 2 de la proposition de loi est particulierement bienvenu, car il souhaite clarifier le statut de l'adresse IP, un moyen indiscutable d'identification, fût-elle indirecte, d'un internaute, au même titre qu'une adresse postale ou un numéro de téléphone, [bien que] certaines juridictions ont récemment contesté le caractère de donnée personnelle de l'adresse IP. La clarification opérée par l'article 2 permet ainsi d'apporter aux données de connexion des internautes la protection de la loi « informatique et libertés ».

L'article 7 précise l'obligation de sécurisation des données incombant au responsable du traitement et crée une obligation de notification à la CNIL des failles de sécurité, transposant par anticipation la directive modifiant la directive 2002/58/CE concernant la vie privée dans le secteur des communications électroniques. La France se doterait ainsi d'une data breach law . Mais qu’en est-il de l’information des personnes dont les données ont été compromises ? Elles ont droit elles aussi à être informées de ces data security breaches...

Genetic Tests, Immigration, Nationality and Grammar

2009-11-06T02:03:00.008-05:00

Boston Globe Article: the United Kingdom Border Agency is using genetic tests since last September on some African asylum seekers in order to find out whether they are lying about their nationality. An agency spokesman said Britain was the only country using genetic tests that way.

The Boston Globe article quotes Sir Alec Jeffreys, geneticist at the University of Leicester who developed techniques for DNA fingerprinting: "Genes are not aware of national borders, Nationality is a legal concept, and it's got nothing to do with genetics at all."

Hopefully, a lot of French citizens are aware of that, as France launched on November 2 a national debate on National Identity. The government lauched a site allowing visitors to answer this question: Pour vous, qu’est-ce qu’être Français aujourd’hui ? - According to you, what does it mean to be French today?

A list of questions helps shape one's opinion.

Quelles sont les éléments de l’identité nationale? Well, reading this question, it is already obvious that the government will not list "knowing how to write a simple phrase in French without making a huge gramatical mistake" as a component of being French, as this particular question is flawed with a major grammatical mistake... Or is this a component of being French? At least, no genetic tests are necessary...

Saint-Tin est une Parodie de Tintin

2009-11-04T02:36:00.003-05:00

Excellent article d'Axel Payet qui commente le jugement du TGI d'Evry du 9 juillet 2009 reconnaissant que les aventures de Saint-Tin parodient bien Tintin.

Open Internet 101

2009-10-25T04:05:00.001-04:00

Rama Yade Contre la Suppression du Droit à l'Image Collectif (DIC)

2009-10-25T03:58:00.002-04:00

La secrétaire d'Etat aux sports, Rama Yade, contre la suppression du droit à l'image collectif (DIC).

Grandma, Poppies, HADOPI

2009-10-24T08:09:00.012-04:00

When Frédéric Mitterrand, French minister of culture, defended the HADOPI bill in front of the French National Assembly in July 2009, he said: We all know the story of the grandmother who waters her grandson’s poppies, finding them very beautiful, not knowing that this plant is in fact hashish. We will not harm the grandmother!

Problem with that statement is that the HADOPI law creates a presumption of guilt if someone illegally downloads using an Internet connection. If the grandson downloads "I’m a thug", it’s Grandma who will be prosecuted. But there is no French law (so far) which creates a presumption that all hashish plant waterers are guilty, so in Mr. Mitterand's example, Grandma is indeed fine. But under HADOPI she will be prosecuted if the proverbial grandson illegally downloads using her Internet connection, one the the many reasons the HADOPI law should not have been passed.

HADOPI 2 is (Mostly) Constitutional Decided Conseil Constitutionel

2009-10-23T04:53:00.004-04:00

France’Conseil Constitutionnel validated most of the HADOPI 2 bill yesterday, and the law should be promulgated very soon. We will have to see now how it will be implemented. Who will be the first judge to use an ordonnance pénale in order to prosecute an Internet user who has allegedly illegally downloaded protected materials?

Using an ordonnance pénale is constitutional: Article 6 establishes a procedure applicable to specific criminal offenses of infringement committed over the Internet (single judge trial and simplified procedure of the penal order). The Constitutional Council had already had a chance to decide this procedure complies with the Constitution .

It may be constitutional, but is it wise? Will it be efficient in preventing illegal downloading? The question of efficiency is essential, as we know that trade-off is a key concept to evaluate how the general public will welcome laws which are taking away some of their privacy.

Corporations Have Personal Privacy

2009-10-22T03:07:00.007-04:00

In AT&T Inc. v. FCC & USA, No 08-4024, the Third Circuit ruled that corporations have “personal privacy.”

Here are the facts of the case:

AT&T participated in a federal program administered by the FCC, designed to increase schools’ access to advanced telecommunications technology by providing equipment and services to elementary and secondary schools. AT&T billed the Government for the cost.

In August 2004, AT&T voluntarily reported to the FCC that it might have overcharged the Government for some work done. The FCC conducted an investigation, and ordered AT&T to produce some documents, such as invoices, internal e-mails providing pricing and billing information, names of employees…

In April 2005, CompTel, a trade association representing some of AT&T’s competitors, submitted a FOIA request for “[a]llpleadings and correspondence contained in” the Bureau’s AT&TE-Rate investigation file. AT&T submitted a letter to the Bureau opposing the request, arguing that the FCC collected the documents for law enforcement purposes, and therefore that the FCC regulations implementing FOIA’s exemptions prohibited disclosure.

Indeed, exemption 7(C) of the FOIA shields from mandatory disclosure “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information . . . could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(7)(C).

The FCC rejected AT&T’s argument, and held that the exemption does not apply to corporations because corporations lack “personal privacy” within the meaning of Exemption 7(C). According to the FCC, this interpretation accords with the Exemption’s purpose to protect key investigation players from the “literal embarrassment and danger” that an individual might suffer, rather than from the “more abstract impact” that a corporation might suffer.

AT&T filed a petition for review of the FCC’s order, arguing that the FCC incorrectly interpreted Exemption 7(C).

The Third Circuit interpreted Exemption 7(C)as defining a “person” to include a corporation:

FOIA’s exemptions indicate that Congress knew how to refer solely to human beings (to the exclusion of corporations and other legal entities) when it wanted to. Exemption 7(F), for example, protects information gathered pursuant to a law enforcementinvestigation that, if released, “could reasonably be expected toendanger the life or physical safety of any individual.” 5 U.S.C. §552(b)(7)(F) (emphasis added). Yet, Congress, in Exemption 7(C), did not refer to “the privacy of any individual” or some variant thereof; it used the phrase “personal privacy.”

Prison for Misuse of Personal Data in UK?

2009-10-20T04:43:00.004-04:00

The British government has launched a public consultation on whether to introduce prison sentences for those found guilty of offences related to obtaining, disclosing, or selling personal data.

PNR Deserves More Privacy Safeguards Say French Representatives

2009-10-19T06:56:00.010-04:00

France’s Assemblée Nationale believes that some issues still need to be resolved regarding the Proposal for a Council Framework Decision of November 6, 2007 on the use of Passenger Name Record (PNR) for law enforcement purposes, COM(2007) 654.

Among the issues that still need to be debated and resolved, according to the French representatives, are:

- Full respect for fundamental rights, including the right to privacy and the right to data protection, which must be respected at every step of the collection and processing of data;

- Data conservation must be reduced to a reasonable period, that is, between three and six years;

- Sensitive data must be subject to specific safeguards, regardless of whether it will be ultimately decided whether or not they can be used, partially or totally, in pending investigations or prosecutions;

- Stricter rules should be obtained regarding data transfers to third countries, so that a Member State cannot be a source of leakage of masses of raw data to a third State.

Barbie Girl No Longer A Parody...

2009-10-18T02:44:00.001-04:00

The parties advised to chill are now grooving to the tune...

Failing to Make an Internet Connection Secure Could Become a COA in France

2009-10-16T09:43:00.006-04:00

The French government has been sending its observations regarding the referral for review of the HADOPI 2 bill to the Conseil Constitutionnel.

Here is an interesting quote from the document: It may happen that the Internet account holder does not acknowledge to have [illegally] downloaded, and does not secure his Internet access despite the authority [HADOPI] requesting him to do so. In this case, it is likely that no further investigation will be necessary, and criminal misdemeanor prosecution for gross negligence (négligence caractérisée) will be carried out.

Consequently, failing to make an Internet connection secure could become a cause of action for negligence in France.

October 21, 2009 update: It is so easy to surf on un-secured networks that many people could be falsely accused of illegal downloading…

Tracking Abortions in Oklahoma

2009-10-14T15:12:00.005-04:00

H.B. 1595 was signed into law by the governor of Oklahoma on May 21, 2009, and will become effective on November 1, 2009. It prohibits abortions based only on the sex of the child, and it also creates the Statistical Reporting of Abortion Act, which will be codified as Section 1-738a of Title 63 of the Oklahoma Statutes.

The Oklahoma State Department of Health must make available on its ‘stable’ Internet website, by March 1, 2011, an Individual Abortion Form, that physicians will have to use in order to submit electronically the reports required by the Statistical Reporting of Abortion Act.

The ‘Stable Internet website’ is defined by the law as a website that, to the extent reasonably practicable, is safeguarded from having its content altered other than by the State Department of Health.

To the extent reasonably practicable? I could not find a definition of that rather vague notion in the Act. But no need to worry, because The Department shall take all necessary precautions to ensure the security of the electronically submitted reports so that the data they include is able to be accessed only by specially authorized departmental personnel during and following the process of transmission.

So necessary precautions must be taken, but only to an extent that is reasonably practicable? Who will represent this standard of reason? Patients concerned about their privacy, or the government concerned about keeping costs down, or with a particular political agenda?

Pursuant to a subsection of the law that shall become operative no later of April 1, 2011, or thirty calendar days following the date on which the State Department of Health will post the Individual Abortion Form on its web site:

Any physician performing abortions shall fully complete and submit, electronically, an Individual Abortion Form to the State Department of Health by the last business day of the calendar month following the month in which the physician performs an abortion, for
each abortion the physician performs.

The Department shall post the required Individual Abortion Form on its stable Internet website. Nothing in the Individual Abortion Form shall contain the name, address, or information specifically identifying any patient.

This is interesting. The Oklahoma Legislature seems to believe that not providing the name or the address of the women who received an abortion in the state is sufficient in ensuring that their anonymity is protected. Identity is, however, a much more complex concept, and one’s name and address are only two of its multiple components. The government understands this, since the American passport also contains our DOB and photograph. The French passport adds to this information the fingerprints of the bearer.

What defines our identity? I like what Stan Karas wrote in an article : “… modernity has transformed individuals from complete subjects to a collection of subjectivities. [Stan Karas: Privacy, Identity, Databases, 52 Am. U.L. Rev. 393 428 (2002)]

Yet a collection of subjectivities is what the law requires the physicians to provide on the web form, even though the law states that nothing in the form shall contain any information specifically identifying any patient.

What is the information that the physician will have to provide on the Individual Abortion Form? Here are the first eight items:

1. Date of abortion

2. County in which abortion performed

3. Age of mother

4. Marital status of mother
(married, divorced, separated, widowed, or never married)

5. Race of mother

6. Years of education of mother
(specify highest year completed)

7. State or foreign country of residence of mother

8. Total number of previous pregnancies of the mother

This information may not be enough to identify a woman living in New York county (Manhattan), but could be enough to identify a woman living in a sparsely populated county, especially if the woman’s race (I would rather use the term ethnic background though), or educational level, are not common in the area. In other words, if you are, say, a Native-American with a PhD, obtained at the age of 22, an achievement featured in the local paper, your name and address can be deducted easily from these facts, so the form may indeed contain information specifically identifying the patient.

Misc.

2009-10-12T02:39:00.006-04:00

3 Geeks and a Law Blog about social network policies for law firms.

I often wondered if farmers building corn mazes complied with copyright laws: well, they do.

Fashion law attorneys will need to brush up on their patent law skills if the trend of creating suits protecting its wearer against the flu takes off...

Google's Book Settlement and Privacy

2009-10-07T05:55:00.006-04:00

Very interesting article by David Bender in the New York Law Journal about the fact that the Google book settlement lacks user data protection.

Mr. Bender notes that the settlement contains nothing explicit regarding such matters as what personal data Google may collect, how it may be used, how it must be secured and to whom and under what conditions it may be disclosed for what purposes.

The article notes that the EFF, the ACLU, and the Berkeley Law Public Policy Clinic have urged Google to include privacy protections in the book settlement.

Law Laughs on Legal Tube

2009-10-07T05:42:00.004-04:00

I love corny jokes. Corny lawyers jokes are even better. Corny lawyers jokes on Legal Tube? Bring them on!

Public Access to Legal Documents

2009-10-06T04:09:00.006-04:00

The NY Times reported yesterday that the SCOTUS rejected the Roman Catholic Diocese of Bridgeport’s request to delay the court-ordered release of thousands of legal documents from lawsuits filed against priests accused of sexually abusing children.

The diocese had argued in its petition that public release of the records would violate the constitutional privacy of defendants named in the suits and would also establish a dangerous precedent regarding the type of court records to which the public should have access.

In Rosado v. Bridgeport Roman Catholic Diocesan Corp. et al. the Supreme Court of Connecticut had discussed at length the issue of public access to court documents:

This [British] tradition of open trials made its way to colonialAmerica and evolved into a presumption of public access to court proceedings and records that remains a fundamental part of our judicial system today. The rationale underlying the presumption is straightforward: Public monitoring of the judicial process through open court proceedings and records enhances confidence in the judicial system by ensuring that justice is administered equitably and in accordance with established procedures.

…

This presumption of public access, however, is not absolute. When the public’s interest in judicial monitoring is outweighed by countervailing considerations, such as certain privacy
concerns, or if access is sought for ‘‘improper purposes’’ court documents or proceedings may be shielded from public view.

With respect to documents, the presumption of public access never has extended to every document generated in the course of litigation.

…

Parties are obligated to disclose a wide range of information in the course of discovery to support the disposition of their underlying claims.

But not all documents in the court’s possession are presumptively open. The presumption of public access applies only to ‘‘judicial’’ documents and records. … Therefore, when determining whether a document should be open to the public, the threshold
question under the common law is whether the document constitutes a ‘‘ ‘judicial document.’ ’’.

…

Courts have employed three general approaches to determine what constitutes a judicial document. The first approach construes judicial documents narrowly,limited to those documents relied upon to determine a litigant’s ‘‘substantive rights.’’

…

A second approach construes judicial documents more broadly. Under this approach, documents that are filed with the court that reasonably may be relied uponin support of any part of the court’s adjudicatory functionare judicial documents.

…

In what arguably could be deemed a third approach, courts have provided the definition of judicial documents in the broadest possible language, stating that the act of filing a document with the court in connection with a pending matter renders it a judicial document.

…

Regardless of approach, however, it is clear that the common-law presumption of public access to documents in the court’s possession is grounded in the public’s interest in monitoring the judicial process. Such access enhances public confidence that the judicial system is operating fairly, impartially and in accordance with established norms. This presumption is not absolute and applies only to ‘‘judicial documents’’ because
such documents serve as a proxy for public monitoring of court proceedings when the public cannot be present.

As to the issue of what documents are judicial documents, we agree generally that the mere filing of a paper or document with the court is insufficient to render that paper a
judicial document subject to the right of public access. . . . [T]he item filed must be relevant to the performance of the judicial function and useful in the judicial process in order for it to be designated a judicial document.

…

The question remains what constitutes a judicial document. For the reasons that follow, we conclude that Connecticut follows the broader approach under which any document filed that a court reasonably may rely on in support of its adjudicatory function is a judicial document.

….

We recognize that this broad definition of judicial documents creates the potential for parties to harass others by attaching private material with little to no relevance to the issues to underlying motions, thus rendering that material public. But we do not presume bad faith on the part of litigants or their attorneys.

New F.T.C. Guidelines May Mean Less Freebies

2009-10-06T02:51:00.005-04:00

The F.T.C. has released new guidelines concerning the use of endorsements and testimonials in advertising to adapt to a world where bloggers and social media sites may have as much influence, or more, on a consumer’s decision to buy a specific product than a television advertisement.

Starting December 1, 2009, bloggers reviewing products on their blogs will have to disclose their connections with advertisers, if any.

From the FTC press release: The revised Guides also add new examples to illustrate the long standing principle that “material connections” (sometimes payments or free products) between advertisers and endorsers – connections that consumers would not expect – must be disclosed. These examples address what constitutes an endorsement when the message is conveyed by bloggers or other “word-of-mouth” marketers. The revised Guides specify that while decisions will be reached on a case-by-case basis, the post of a blogger who receives cash or in-kind payment to review a product is considered an endorsement. Thus, bloggers who make an endorsement must disclose the material connections they share with the seller of the product or service.

Privacy Law and Criminal Law

2009-10-05T04:15:00.007-04:00

Whoever still believes that privacy laws are touchy-feely should read about this case.

Four Google executives are on trial in Italy: they are accused of having allowed a video of a teenager being bullied by students in front of others students to be shown on Google Video.

The video, taken using a cell phone, was later posted on Google video. It was taken down less than 24 hours after the family of the victim made the request, two months after the video was put online.

It is probably the first case where a privacy executive is tried in a criminal court for his company’s actions. The charges are defamation and failure to exercice control over personal data. The accused are facing up to three years in jail…

Once again, the question of the responsability of content-hosting sites arises. A Google spokeswoman wrote earlier this year that "Seeking to hold neutral platforms liable for content posted on them is a direct attack on a free, open Internet."

Last week, Jeremy Doig, an American engineer, testified that Google video is controlled from the United States, raising thus the question of court jurisdiction. Which state should have jurisdiction over the case? The U.S. because Google Video servers are in the United States? Italy because, following the « effects test » set by the SCOTUS in Calder v. Jones, 465 U.S. 783 (1984): when a party causes result to occur in another state, may that party be subject to the laws and jurisdiction of that state? The Calder test has been applied by an American court in a defamation case.

Do we need an Internet ius gentium ?

A Lovely Girl at her Window, Anne Frank

2009-10-02T06:59:00.001-04:00

FTC's Invitation to Comment on Privacy Challenges

2009-10-01T03:18:00.001-04:00

From the FTC's site:

The Federal Trade Commission will host a series of day-long public roundtable discussions to explore the privacy challenges posed by the vast array of 21st century technology and business practices that collect and use consumer data. Such practices include social networking, cloud computing, online behavioral advertising, mobile marketing, and the collection and use of information by retailers, data brokers, third-party applications, and other diverse businesses. The Commission invites interested parties to submit written comments or original research. A list of specific questions to inform the first roundtable discussions may be found at: http://www.ftc.gov/bcp/workshops/privacyroundtables. The goal of the roundtables is to determine how best to protect consumer privacy while supporting beneficial uses of the information and technological innovation. The Commission will post additional questions to inform the subsequent roundtable discussions at a later date.

A Very Experienced Attorney

2009-10-01T02:33:00.006-04:00

How long will I work as an attorney? A very, very, long time (hopefully). Congratulations (I think) to Jack Borden, Esq., still doing his job at the age of 101.

Placing a GPS Tracking Device on a Car is a Seizure in Massachusetts

2009-09-30T12:17:00.018-04:00

The Supreme Court of Massachusetts ruled this month in Commonwealth v. Connolly that a police officer must first obtain a warrant before placing a GPS tracking device on a car, because doing so constitutes a seizure under the Massachusetts Constitution.

When an electronic surveillance device is installed in a motor vehicle, be it a beeper, radio transmitter, or GPS device, the government's control and use of the defendant's vehicle to track its movements interferes with the defendant's interest in the vehicle notwithstanding that he maintains possession of it.

Right now, the government needs probable cause and a warrant to search a home or to seize personal property, but no search warrant is needed if the police have lawful access to the property or vehicle...

Found on the EPIC site: the New York Court of Appeals ruled that the police must first obtain a warrant before installing a GPS tracking device on an individual vehicle, but the Wisconsin Appeals Court authorized warrantless GPS surveillance by police.

According to the Wisconsin Court, The State aptly relies on United States v. Garcia, 474 F.3d 994 (7th Cir. 2007). The Garcia court concluded that attaching a GPS device to a car while the car was in a public place did not convert the subsequent tracking into a Fourth Amendment search.

The court reasoned:

[I]f police follow a car around, or observe its route by means of cameras mounted on lampposts or of satellite imaging as in Google Earth, there is no search. Well, but the tracking in this case was by satellite. Instead of transmitting images, the satellite transmitted geophysical coordinates. The only difference is that in the imaging case nothing touches the vehicle, while in the case at hand the tracking device does. But it is a distinction without any practical difference.

Like the Seventh Circuit, we discern no privacy interest protected by the Fourth Amendment that is invaded when police attach a GPS device to the outside of a vehicle, as long as the information obtained is the same as could be gained by the use of other techniques that do not require a warrant.

Sveum [defendant] might respond that, unlike Garcia, the police here did not attach the GPS device while his car was parked in a public place. However, the circuit court concluded that Sveum’s driveway was not constitutionally protected “curtilage,” and Sveum does not challenge this ruling or otherwise present a developed argument as to why the police engaged in a search or seizure by entering his driveway.

So the issue is still about the location of the vehicule at the time the beeper is attached: curtilage, or not curtilage? Do we have an expectation of privacy?

In the United States v. Knotts case, government agents had planted a “beeper” inside a five-gallon drum, which then allowed the agents to track the vehicle transporting that drum and determine that it had entered the defendant’s premises. The Court held that this did not invade any legitimate expectation of privacy and thus did not constitute a search or seizure under the Fourth Amendment: A person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another. According to SCOTUS, our expectation of privacy is 'diminished' while being in a car: a car travels in plain view, on public roads.

It is only if the police enters a private dwelling such as a garage that a warrant is required. However, there is no need for warrant if the police already determined that the container contains contraband, because one has no expectation of privacy in contraband. Or if the device is placed into the container before the suspect buys it, no warrant is required because one has no expectation of privacy in a container before it is bought.

In United States v. Karo, 468 U.S. 1250 (1984), the facts were different than in the Knotts case. The container of ether, bought by the defendant to produce illegal drugs, had entered the home of the defendant at one point, and did not stay in the car all the time as in Knotts. The beeper had given the agents information about the suspect’s home, the beeper was monitored while it was inside a home, and therefore it is a search, and one needs a warrant, because the government had used the beeper to obtain 'information that it could not have obtained by observation from outside the curtilage of the house."

These cases should be monitored by everybody concerned about their locational privacy, and not only drug dealers. As the 7th Circuit pointed out in the Garcia case:

Technological progress poses a threat to privacy by enabling an extent of surveillance that in earlier times would have been prohibitively expensive. Whether and what kind of restrictions should, in the name of the Constitution, be placed on such surveillance when used in routine criminal enforcement are momentous issues that fortunately we need not try to resolve in this case.

Either using the notion of curtilage to define our expectation of privacy needs to be updated, or its definition must be expanded. We no longer live enclosed in the privacy of our homes, leaving our living room at 7.00 am only to go the the adjacent garage, go to our car, and leave for our enclosed office. My laptop, my cell phone, are part of my "curtilage" as I travel carrying them. Yet, they can now be so easily used as tracking devices.

French Representatives Request the Conseil Constitutionnel to review HADOPI 2

2009-09-29T06:59:00.008-04:00

French representatives have requested the Conseil Constitutionnel to review the so-called HADOPI 2 bill, adopted by the French Assembly on September 22.

I have translated below some parts of the request, which can be found in French here.

The representatives are mainly concerned by the fact that the law punishes Internet users found guilty of gross negligence (négligence caractérisée), but this concept is too vague and thus violates the principle of legality.

Also it can be technically difficult to cut off only Internet service. It is possible in some parts of the French territory, and cutting off Internet service wouldn’t affect, say, telephone or television services, whereas in others parts of France, having one's Internet access cut off may leave you without phone nor television services.

The representatives wrote:

"In addition, it is equally obvious that the legislature did not consider your June 10, 2009 decision by which you took care to remind that 'attacks on freedom of expression must be necessary, appropriate and proportionate to the objective pursued.' But by punishing the offense of "gross negligence" by cutting off access to the Internet, it is nothing to say that the legislature has established a penalty obviously and manifestly disproportionate. It is indeed manifestly disproportionnate to sanction "gross negligence" - a concept whose vagueness is moreover incompatible with the principle of legality of crimes and punishments – by a measure that is a serious violation of a fundamental freedom -- cutting off access to the Internet. By creating this offense the legislature adds to the confusion and is losing sight of all proportion on the scale of penalties.

It is equally strange, constitutionally speaking, to establish by law a penalty which everybody knows that the implementation or not will depend on technical realities. In other words, as has been stressed by the ARCEP, that bundled or unbundled services do not have the same consequences in cases of suspension of Internet access. Indeed, in non-unbundled areas, it will be technically difficult to maintain IP telephony if internet access is cut. Therefore, it is manifestly contrary to the principle of equality before the law to establish a criminal penalty to which the implementation will not be the same across the country and depends on contingency techniques. If by some miracle you validate the procedural devices submitted for your consideration, it is nevertheless assumed that this law could come into force before the day the penalty may be applied uniformly throughout."

« Texto » N’est Pas Une Marque

2009-09-28T03:59:00.009-04:00

SFR avait déposé la marque « Texto » le 23 janvier 2001 dans la classe 38, Messagerie écrite pour radio-téléphone. SFR avait également déposé d’autres marques utilisant le mot Texto telles les marques « Jouez vous Texto » et « Parlez-vous Texto » le 4 avril 2001, « Un numéro, un texto, Bingo » le 21 décembre 2001, "Mega Texto" en 2003…

Une société marseillaise, One Texto, avait déposé la marque One Texto le 23 septembre 2003. SFR avait alors tenté de faire prononcer la nullité de cette marque par le TGI de Paris, qui avait déclaré nulle le 29 janvier 2008 la marque TEXTO déposée par SFR pour défaut de caractère distinctif (décision ici via Juriscom). One Texto avait produit des articles du Monde et de l'Express utilisant le terme texto our expliquer ce qu'est un sms.

Rappelons que selon l’article L. 711-2 du CPI :

« Le caractère distinctif d'un signe de nature à constituer une marque s'apprécie à l'égard des produits ou services désignés. Sont dépourvus de caractère distinctif : a) Les signes ou dénominations qui, dans le langage courant ou professionnel, sont exclusivement la désignation nécessaire, générique ou usuelle du produit ou du service".

La Cour d’Appel de Paris a confirmé ce jugement le 23 septembre dernier.

Post Mortem Moral Rights Needed in the US?

2009-09-27T05:34:00.023-04:00

The WSJ has an article about posthumous novels. New books by Vladimir Nabokov, William Styron, Graham Greene, Carl Jung and Kurt Vonnegut will be sold this fall.

Two Michael Crichton novels will be published in 2010. Mr. Crichton had finished one before he died in 2008, but he had only written “about one third” of another novel, according to the NY Times (assuming that it was measured by comparing the length of the other Crichton novels). One of these novels was discovered by Mr. Crichton’s assistant, on the writer’s computer. But did Mr. Crichton intend to distribute this work as is to the public? Who has the right to decide? Should this novel be published?

Does the law give us an answer? According to § 106 (3) of the Copyright Act, the owner of copyright has the exclusive rights to distribute copies… of the copyrighted work to the public by sale or other transfer of ownership, or by rental, lease, or lending.

§ 106A gives only to authors of works of visual art rights to attribution and integrity (so Nabokov has no droit moral under US law:

(a) Rights of Attribution and Integrity. — Subject to section 107 and independent of the exclusive rights provided in section 106, the author of a work of visual art

(1) shall have the right (A) to claim authorship of that work, and (B) to prevent the use of his or her name as the author of any work of visual art which he or she did not create;

(2) shall have the right to prevent the use of his or her name as the author of the work of visual art in the event of a distortion, mutilation, or other modification of the work which would be prejudicial to his or her honor or reputation.

Vladimir Nabokov had instructed his family to burn his final novel, "The Original of Laura" after his death. The WSJ article explains that Mr. Nabokov “had sketched out the novel on 138 index cards, a process he used to write "Lolita" and other works. Nobody, not even Mr. Nabokov's son and literary executor, Dmitri Nabokov, knows the exact order the author intended for the cards.” Yet, this novel will be published soon, after Dmitri Nabokov finally decided to authorize it. Could it be considered “prejudicial to his honor or reputation"? In France, the droit moral of the author is perpetual, and survives the author.

In the U.S., the Second Circuit had seemed in 1976 to grant a moral right to a writer. In Gilliam v. American Broadcasting Co., the appellant had claimed that ABC had mutilated their original work and consequently had violated the Lanham Act § 43(a), and that ABC misrepresentation had injured the plaintiff's business or personal reputation.

The Second Circuit followed this argument and held that when “a television network broadcasts a program properly designated as having been written and performed by a group, but which has been edited, without the writer's consent, into a form that departs substantially from”, "to deform his work is to present him to the public as the creator of a work not his own, and thus makes him subject to criticism for work he has not done." “In such a case, it is the writer or performer, rather than the network, who suffers the consequences of the mutilation, for the public will have only the final product by which to evaluate the work.”Thus, an allegation that a defendant has presented to the public a "garbled," distorted version of plaintiff's work seeks to redress the very rights sought to be protected by the Lanham Act, 15 U.S.C. § 1125(a), and should be recognized as stating a cause of action under that statute.”

The Second Circuit explained that "American copyright law, as presently written, does not recognize moral rights or provide a cause of action for their violation, since the law seeks to vindicate the economic, rather than the personal, rights of authors. Nevertheless, the economic incentive for artistic and intellectual creation that serves as the foundation for American copyright law (…) cannot be reconciled with the inability of artists to obtain relief for mutilation or misrepresentation of their work to the public on which the artists are financially dependent. Thus courts have long granted relief for misrepresentation of an artist's work by relying on theories outside the statutory law of copyright, such as contract law, (…)or the tort of unfair competition (…) Although such decisions are clothed in terms of proprietary right in one's creation, they also properly vindicate the author's personal right to prevent the presentation of his work to the public in a distorted form."

Is presenting an unfinished novel to the public a misrepresentation? What about having another writer finish the novel of a deceased author?

Should the U.S. grant perpetual moral rights to all authors? Or would it be prejudicial to creativity? Great article by Amy M. Adler arguing against moral rights available on SSRN here.

Government Use of Private Databases

2009-09-24T03:39:00.006-04:00

Via Wired.com, an article on the FBI's National Security Branch Analysis Center (NSAC) database, which, according to declassified documents obtained by Wired, contains than 1.5 billion government and private-sector records about citizens and foreigners, ans is thus becoming the “Total Information Awareness” the government wanted to put in place after 9/11.

The government thought then of data mining private databases for national security reasons. The New York Times had reported in February 2002 that the Pentagon, under the leadership of Vice Admiral John Poindexter, was building a computer able to collect and data mine personal data, such as credit card records, school, travel and medical records, in order to track terrorists. The name of the program, Total Information Awareness, was later changed to Terrorism Information Awareness. Congress eliminated funding for the program in 2003.

TIA was followed by “The Matrix,” a data mining program linking government and commercial databases. Government agencies have also required in the past the assistance of telecommunication carriers to eavesdrop on suspect’s emails. The FBI’s CARNIVORE program plugs, (or plugged,) a computer (the DCS-1000) directly to an ISPs’ network to monitor suspect incoming and outgoing emails. ECHELON was a program eavesdropping on international private telephone calls, e-mails and faxes, using both ground and satellites.

Data mining, or Knowledge Discovery in Databases (KDD) is the process that allows experts to extract trends and patterns from data, using algorithms to identify relationships and patterns in data. There are two main data mining methods. The top-down method looks for a well-defined profile by asking questions and testing hypotheses. The bottom-up method analyzes raw data to find trends and groups.

Is data mining such an extensive amount of information an efficient method to increase security? This is an important question as citizens are asked to trade off some of their liberties for security, or at least for a renewed sense of security, and would be more reluctant to do so for a program efective in preventing terrorist attacks. Former Homeland Security Secretary Michael Chertoff believed in the ability of data mining to prevent terrorism. While an assistant attorney general, he testified in 2002 that he found data mining a promising way to fight terrorism. He further testified that the Department of Justice was “using computers to analyze information obtained in the course of criminal investigations, to uncover patterns of behavior.(…) Through what has come to be called ‘data mining’ and predictive technology, we seek to identify other potential terrorists and terrorism financing networks.”

Even some privacy advocates believe that the use of commercial databases can “help improve the amount and quality of identifying information in watch lists.” However, most of them do not believe that such massive data mining would protect us against terrorist attacks, and is not fail-proof. The Wired article quotes Kurt Opsahl, an EFF senior attorney: “We have a situation where the government is spending fairly large sums of money to use an unproven technology that has a possibility of false positives that would subject innocent Americans to unnecessary scrutiny and impinge on their freedom.”

The efficiency of a method should not be the ultimate test used to establish an opinion about government surveillance. But if we may have a high surveillance tolerance, we certainly have a zero tolerance for being arrested by mistake, or prevented to board an airplane.

PhotoShop and Droit Moral

2009-09-22T03:30:00.005-04:00

A French bill aims at adding an article (Art. L. 2133-2) to the Code of Public Health which would read as follow: “The photographs of people in advertising whose physical appearance had been altered by an image processing software program must be accompanied by the words: "Photography retouched to alter the physical appearance of a person."” Most of us know that the wonderful creatures living in the pages of Vogue and Vanity Fair are helped by the Photoshop fairy.

The representative sponsoring this bill, Valérie Boyer, believes that letting people know this image is an illusion would prevent the representation of super thin models and thus fight anorexia.

But the bill would not only cover “advertising posters or photographs on the packaging of a product,” but also “photographs of political campaign posters or artistic photographs.”

No more airbrushed pictures of candidates? Fine with me. But what about artistic photographs? First of all, what is an artistic photograph? I see great pictures on Flickr that, even if not presented as artistic by their authors, are indeed artistic. If a little Photoshop is involved, would the authors have to tag their pictures? Also, what about moral rights? Could an artist be forced to reveal publicly how his final work has been produced?

The French droit moral involves the right of respect of the artwork. The work of art cannot be distorted. But the cases so far dealt with a work of art distorted by a third party after having been represented to the public. For instance, the Paris Court of Appeals (May 30, 1962) had forbidden a work of Buffet to be sold separately. The artist had painted on different parts of a refrigerator, and the owner wanted to dismantle the work and make several separate sales. If the bill would be voted into law (unlikely though), would the artist be able to argue that this law violates his droit moral, by forcing him to distort his work of art if he wishes to represent it to the public?

ADN & Présomption d'Innocence

2009-09-21T02:30:00.009-04:00

Le Monde parlait samedi de la multiplication des procès pour refus de prélèvement d’ADN. Selon le Monde, il a eu 245 condamnations en 2004, et 519 en 2005. Le nombre de personnes fichées étonne : 40 000 personnes ont été fichées en 2004, 806 356 personnes au 1er octobre 2008.

Rappelons la loi. Le Fichier National Automatisé des Empreintes Génétiques (FNAEG) a été créé par la loi du 17 juin 1998 relative à la prévention et à la répression des infractions sexuelles. Ce fichier, commun à la police et à la gendarmerie, contient les traces génétiques de suspects, qu’ils soient identifiés ou non, et les couplent, si ces informations sont connues, à différentes informations telles que le nom, prénoms, date et lieu de naissance, filiation et sexe de la personne. Selon l'article 706-54 du Code pénal, "Les empreintes génétiques des personnes à l'encontre desquelles il existe des indices graves ou concordants rendant vraisemblable qu'elles aient commis l'une des infractions mentionnées à l'article 706-55 sont également conservées dans ce fichier sur décision d'un officier de police judiciaire agissant soit d'office, soit à la demande du procureur de la République ou du juge d'instruction". L'article 706-55 du Code pénal précise les infractions pouvant donner lieu à inscription au fichier.

Selon le commissaire principal Bernard Manzoni, cité dans l’article du Monde, le fichier est « un outil efficace » pour la police. N’en doutons pas.

De même, le fichier que le gouvernement britannique se propose de créer afin de lutter contre la pédophilie serait, n’en doutons pas, un moyen de prévention efficace contre la pédophilie et les mauvais traitements. Est-ce une raison suffisante pour le mettre en place ? Désormais, les personnes souhaitant encadrer ou s’occuper d’enfants, ou d’adultes vulnérables, même si c’est seulement une fois par mois, devront s’inscrire sur le fichier de l’Independant Safeguarding Authority (ISA). Cette inscription leur coûtera 64 livres sterlings, et leur permettra de prouver qu’ils ne sont pas des pédophiles.

Si seules les empreintes génétiques "des personnes à l'encontre desquelles il existe des indices graves ou concordants rendant vraisemblable qu'elles aient commis l'une des infractions mentionnées à l'article 706-55" et celles des personnes condamnées pour l'une des infractions mentionnées à l'article 706-55 sont inscrites sur le fichier de la FNAEG, même des personnes innocentes de tout crime, qui ne sont nullement soupçonnées, dont le seul dessein est de s’occuper et d’encadrer des enfants, par exemple, en les cherchant de temps en temps à l'école, afin d’aider une voisine surmenée par exemple, devront s’y inscrire.

Le risque que ces fichiers soient utilisés en dehors de leur but premier est réel. L’ADN est une donnée biométrique dont l’analyse permet de dévoiler toutes sortes de renseignements sur la personne, beaucoup plus que ne le peuvent les empreintes digitales. Ainsi, selon l’AFP (29 mai 2008), des magistrats français auraient ordonné en 2008 des tests ADN à un laboratoire privé, afin de déterminer l’origine ethnique de suspects.

De plus, si des bases de données telles que celle de l’ISA devaient se multiplier, la présomption d’innocence dont nous bénéficions serait mise en danger. Les parents qui ne s’enregistreront pas sur la base de donnés de l’ISA seront poursuivis en justice. Cela veut dire qu’une personne complètement innocente, dont l’unique dessein était de participer à la vie communautaire et d’aider un voisin, une amie ou une école en encadrant sporadiquement des enfants, et qui aurait omis de prouver son innocence, alors qu’elle n’est accusée d’aucun crime, pourrait se voir sanctionnée par la justice pour défaut de preuve d’innocence…

LOPPSI 2, Partie Remise

2009-09-18T03:52:00.004-04:00

LOPSSI 2 ne sera finalement pas présenté au Parlement avant le premier semestre 2010.

Le projet de loi « Sécurité intérieure : loi d'orientation et de programmation pour la performance » ajouterait un nouvel article 222-16-1 au Code pénal visant à réprimer l’usurpation d’identité, qui serait définie comme suit :- « Le fait d’utiliser, de manière réitérée, sur un réseau de communication électronique l’identité d’un tiers ou des données qui lui sont personnelles, en vue de troubler la tranquillité de cette personne ou d’autrui ».- « Le fait d’utiliser, sur un réseau de communication électronique, l’identité d’un tiers ou des données qui lui sont personnelles, en vue de porter atteinte à son honneur ou à sa considération. » Ces comportements sont sanctionnés, selon le projet de loi, sur le modèle des appels téléphoniques malveillants (un an d’emprisonnement et 15 000 € d’amende).

Ce projet de loi est à suivre de près. Si le droit français peut sans doute s’accommoder de l’incrimination spéciale de l’usurpation d’identité numérique, le projet de loi comporte des éléments plus inquiétants pour les libertés publiques.

L’article 23 du projet de loi insérerait dans le chapitre II du titre XXV du livre IV du code de procédure pénale une section 6 bis , « De la captation des données informatiques » , permettant l’installation d’un « keylogging » sur un ordinateur, si autorisé par un juge d’instruction.:

« Art. 706-102-1. – Lorsque les nécessités de l’information concernant un crime ou un délit entrant dans le champ d’application de l’article 706-73 l’exigent, le juge d’instruction peut, après avis du procureur de la République, autoriser par ordonnance motivée les officiers et agents de police judiciaire commis sur commission rogatoire à mettre en place un dispositif technique ayant pour objet, sans le consentement des intéressés, d’accéder, en tous lieux, à des données informatiques, de les enregistrer, les conserver et les transmettre, telles qu’elles s’affichent sur un écran pour l’utilisateur d’un système de traitement automatisé de données ou telles qu’il les y introduit par saisie de caractères. Ces opérations sont effectuées sous l’autorité et le contrôle du juge d’instruction."

Le droit à l’image français pourrait également être remis en cause : le projet de loi modifierait le régime juridique de la vidéo protection et autoriserait les particuliers à installer des systèmes de vidéo protection afin de filmer les abords de leurs bâtiments pour des raisons sécuritaires, dans des lieux particulièrement exposés à des risques d’agression ou de vol. Les images pourraient être conservées un mois.

Public Domain Books on Paperback

2009-09-18T03:11:00.006-04:00

Google authorized yesterday that 2 million books of its digital library, which are now in the public domain, to be printed as paperbacks on the “Espresso Book Machine,” with a recommended sale price of 8 dollars per copy. Whether more titles could be printed on the Espresso machine depends of the outcome of Google Book Settlement. If authorized, it will be interesting to follow how authors's royalties will be calculated and paid.

Pas de tests ADN, merci Monsieur Besson

2009-09-17T02:45:00.005-04:00

Merci Monsieur Besson de n’avoir pas signé le décret d’application de la loi relative au regroupement familial.

Le Monde de mardi citait ainsi le Ministre : Peut-être que vingt ans, notre signature génétique sera aussi banale qu'une signature électronique ! Aujourd'hui ce n'est pas le cas" .

En effet, nous n’en sommes pas encore là. L’analyse de l’ADN est reconnue comme étant une technique biométrique par la CNIL ou la commission d'accès à l'information du Québec, mais pas par le General Accounting Office des États-Unis.

Sera-t-il un jour possible de bloquer l’accès à nos données personnelles ou à nos comptes bancaires, à moins que le doigt qui tape le code soit analysé comme appartenant à l’utilisateur légitime, non par l’analyse des empreintes digitales, mais par une analyse ultra-rapide de l’ADN ?

French Assembly Voted HADOPI 2

2009-09-16T03:27:00.004-04:00

The French Assemblée Nationale passed yesterday the HADOPI 2 bill by 285 votes to 225. Opponents to the bill already announced that they will ask the Conseil Constitutionnel to review it.

Article 2 of the adopted text would insert an article 495-6-1 in the French IP Code and authorize the use of an ordonnance pénale (criminal order) procedure, in order to prosecute Internet users using their connection to download protected material.

Pursuant to article 525 of the French criminal procedure Code, no preliminary hearing is necessary in this case: “The judge rules without a prior hearing by making a criminal order; this either provides for a discharge, or imposes a fine together with, where necessary, one or more of supplementary penalties applicable. If he considers that an adversarial hearing would be useful, the judge returns the case file to the public prosecutor for it to be prosecuted with the ordinary procedural formalities.”

Article 3 ter A (nouveau) of the HADOPI 2 text also adds an article L. 335-7-2 to the French IP Code: “In order to impose the suspension penalty provided for in Articles L. 335-7 and L. 335-7-1 and to determine its duration, the court takes into account the circumstances and severity of the offence and the personality of its author, and in particular his occupation or social position, and his socio-economic situation. The length of the sentence must balance the protection of rights of intellectual property and respect the right to express himself and communicate freely, especially from his home. "

Will it really be possible to find out who is the perpetrator of the illegal downloading? I am not my IP address! I do not block access to my computer with a lock! Whoever used my computer and/or my Internet access is not necessarily me… Digital Identity and Real World Identity are not always the same... Using the criminal order procedure, in cases where one is not even sure who the criminal is? The French legislators may be a trifle too optimistic.

Recipes and Copyright

2009-09-15T04:02:00.010-04:00

I wrote a while ago about this case... Thanks to the Trademark Blog, I found the link to the decision.

The SDNY found no copyright infringement.

The plaintiff acknowledged that "individual recipes do not necessarily qualify for copyright protection" (page 13). Pursuant to 17 USC § 102 (b), "In no case does copyright protection for an original work of authorship extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work." The Defendant's book does not incorporate the text of specific plaintiff's recipes. For instance, defendant recommended using avocado puree as an ingredient for chocolate pudding, as advocated by the plaintiff. This is a process. So is using sauerkraut in a chocolate cake.

Plaintiff also aknowledged that camouflaging vegetables in children's favorite foods is an idea, and thus not protectible by copyright. Plaintiff tried to claim protection for making the purees in advance, and storing them for future use, but the SDNY found this too abstract, and is merely an idea, hiding veggies in food liked by children. Not a new idea... According to the Court, "Plaintiff's inclusion of process details, primarily focused on time-saving techniques, is insufficient to transform an unprotectible idea into a copyrightable expression of that idea."

About a New French Crime...

2009-09-15T03:55:00.001-04:00

Professor Cédric Manara wrote an entry on the Dalloz blog about a new crime, created by the June 12, 2009 law (the so-called HADOPI 1 law). Pursuant to the article L.335-3, 3 of the French IP Code, capturing, partially or completely, a cinematographic or audiovisual work in a movie theatre constitutes counterfeiting.

According to Mr. Manara, only recording made in a closed movie theatre are illegal, as the French « salle de spectacle cinématographique » only designates a closed area. That will not help a drive-in movie theater revival…

Also, Mr. Manara notes that even a partial recording is a crime, and wonders if it will be necessary to check at the end of each show if the viewers had not recorded a brief excerpt of the movie on their smartphones… Mr. Manara adds, the movie theatre owners themselves could be implicated, if they use a surveillance camera inside the theatre for security reasons…

HADOPI 2 could be voted today in France...

2009-09-15T03:22:00.002-04:00

The so-called HADOPI 2 bill may be voted today by France’s representatives, at the Assemblée Nationale.

HADOPI 1 had been censored in June 2009 by France ‘s Constitutional Court, because the HADOPI, “Haute Autorité pour la Diffusion des Œuvres et la Protection des droits sur Internet,” the “High Authority for the diffusion of works and protection of copyright on the Internet" had been given the right to shut down Internet access, if after two warning, the Internet user persisted in using his Internet access to download protected materials.

Undaunted, the French government presented almost immediately a new bill, which would give only to a judge the power to order Internet access be shut down.

But there are many more flaws in the HADOPI 2 bill… Some representatives have pointed out that it is difficult, if not impossible to secure one’s Internet connection. Should a cyber-pirate use an innocent user’s Internet connection to download protected works, the user would be punished, as the bill targets the holder of the Internet account, who may or may not be the one downloading. And we are not even talking about the chaos the implementation of this law could create on happy families…

- Who downloaded last night “How to cut down a cherry tree”?
- It’s me Daddy…

Hadopi and Privacy

2009-05-25T08:28:00.002-04:00

In France, it is the Conseil Constitutionnel which has the power to rule on the conformity of the law with the Constitution. It examines the law after its vote by the Parliament, but before its promulgation. Pursuant to article 61 of the Constitution, only the President of the Republic, the Prime Minister, the President of the National Assembly or of the Senate, or 60 deputies or 60 senators have the power to take to initiative to ask the Conseil Constitutionnel to rule on constitutionality.

60 deputies have started this procedure on May 19, asking the Conseil Constitutionnel to rule that the Internet and Creation law is unconstitutional.

In point 3, the deputies points out the dangers for the privacy of the users that this law would entail. They point out that the way the law conciliates the protection of copyright and the protection of privacy is unbalanced. Indeed, in order to be able to strike users downloading illegally material protected by copyright, their activity on the web has to be monitored, including, according to the deputies, their email messages, considered private correspondence under French law. The law does not fix “clear and precise limits of the surveillance of the Internet that the law would imply.” The legislator has “to set limits on the technical used for monitoring the network in application of the law.”

The deputies are particularly concerned that the law does not explain clearly how the IP addresses of the users will be collected, even thought they will be collected by privates persons (article L.331-24 of the law.)

My Favorite Director and My Favorite Law Combined!!

2009-05-19T08:05:00.003-04:00

Wel, American Apparel and Woody Allen have settled, depriving us of very interesting legal reading material, oh well...

In a statement read yesterday in front of the Court House, Mr. Allen said "I sued American Apparel because they calculatingly took my name, my likeness, and image and used them publicly to promote their business" and this settlement is "the largest ever paid under the New York Right to Privacy Law."

New EU recommendations on RFID -Internet of Things

2009-05-19T06:57:00.005-04:00

The European Commission adopted on May 12 a recommendation on the implementation of privacy and data protection principles in applications supported by radio-frequency identification. As the use of RFID tags will become the norm for retailers, they will be "in the privacy hot seat". Indeed, as the European Commission writes, "in the retail trade sector, an assessment of the privacy and data protection impacts of products containing tags which are sold to consumers should provide the necessary information to determine where there is a likely threat to privacy or the protection of personal data."

The European Union protects privacy of the individuals (article 7) and data privacy (article 8) in its Charter of Fundamental Rights.

Also of interest, the European Union has a web site dedicated to the Internet of Things (IoT). See also here, and see also the European Commission staff working paper on the Internet of Things.

Blog du CNB sur le Rapport Darrois

2009-05-19T03:20:00.002-04:00

Le CNB a créé un blog sur le rapport Darrois, qui permet de réagir aux conclusions du rapport.

Eh you, Parody Face!

2009-05-15T09:48:00.005-04:00

Let’s have a little French lesson today. In French, the word “bouc” means “Billy Goat”, a wonderful animal known for its fondness for old shoes. “Bouc” is pronounced as the English word “Book.” Also, if you want to insult somebody in French, you may opt to shout “Eh! Face de ..."(insert name of an animal.) Eh! Face de rat (rat face), Eh! Face de singe, monkey face, you get it... And yes, "face de bouc" means Billy Goat face.

The facedebouc site is a site created by Julien Berthomieu, a young French man. He likes billy goats! He writes on his site: “Being a sheep, lost in the herd, or worse, being the black sheep in the flock, it’s over! Now, we're billy goats, proud, with high horns, we're here! Facedebouc loves billy goats, these so brave animals, persecuted in history. Facedebouc is not a social network, and does not require any members’ registration , does not produce profiles, or allows its members to contact one another (because there are no members). Only the administrator can actually send messages and approve or not the comments. Facedebouc.com is a blog, and has nothing to do with the facebook site (translation face / face book) here, we like billy goats first, and books next, so, sorry thus apologies to bad English speakers and literature lovers . If you have any doubts, please visit the page that defines http://www.facebook.com/press/info.php?factsheet activity facebook.”

Well, Facebook does not agree. Mr. Berthomieu received a cease and desist letter from Facebook, enjoining him to stop using the trademarks and domain names facedebouc.com and facedebouc.fr. Indeed, researching the French TM office database, one can read that Mr. Berthomieu has registered the trademark facedebouc.com.

Pursuant to Article L713-3 b) of the French IP Code, it is prohibited, unless authorized by the owner, to imitate or use an imitated mark if there is a likelihood of confusion in the mind of the public, if the imitated mark is used for goods or services that are identical or similar.

Would the public be confused? Are the services similar? Facebook is a web site, Facedebook is a web site. Facebook is a networking site, Facedebouc is well, a goofy site. But according to the French Supreme Court, where there is imitation, there is necessarily confusion (Cass Com, June 29, 1999). Translating is imitating, but this is not a translation. The judge must assess whether the average consumer, with his average degree of attention would be confused.

As for parody, French judges had considered that there wasstill infringment if the parody was used in connection with the branded products, but the Paris Court of Appeals made freedom of expression, protected by the French Constitution, prevail over the interests of the TM owner. I this right is not absolute, "it can not suffer the restrictions necessitated by the rights of others."

Take me to the European Parliament: Is French Three Strikes Law Out?

2009-05-07T03:35:00.003-04:00

The European Parliament reinstated yesterday Amendment 138 of the “Telecom Package” that had been rejected by the Council, which would prevent government to restrict user’s access to the Internet without prior ruling by the judicial authorities. According to the initial wording of the amendment “no restrictions may be imposed on the fundamental rights and freedoms of end users, without a prior ruling of the judicial authorities, notably in accordance with Article 11 of the Charter of Fundamental Rights", but it was replaced by "and the right to a judgement by an independent and impartial tribunal established by law and acting in respect of due process in accordance with Article 6 of the ECHR."

France had fought hard against Amendment 138 which would protect users’ rights against the three-strikes sanctions that is at the core of the hotly debated French Internet and Creation bill. The government did not succeed of having it voted on April 9, and a new version of the bill is currently debated by the French Parliament. If voted, article L. 331-25 of the French IP Code would allow that the Internet access of a customer having infringed his obligations can be suspended “for a period of two months to one year with the impossibility for the subscriber, to subscribe for the same period another contract for access to a communication service to the public online at any operator.”

The law created the HADOPI, the « Haute Autorité pour la Diffusion des Œuvres et la Protection des Droits sur Internet » (High Authority for the Diffusion of works and protection of rights on the Internet), an independent Administrative Authority. The HADOPI is in charge of enforcing the « three strikes and you’re out” law. It would fist send an email to the user downloading protected materials, then a registered letter, before finally made the decision to cut access for two months. But the HADOPI is not an “independent and impartial tribunal established by law and acting in respect of due process in accordance with Article 6 of the ECHR" so, according to amendment 138, has no right to cut Internet access.

So, as of today, the future of the HADOPi bill is bleak. Did I hear a sight of relief?

We need a new Katz!

2009-05-06T07:58:00.005-04:00

Bruce Schneir writes: « Our protections against police abuse have been severely watered down. The courts have ruled that the police can search your data without a warrant, as long as others hold that data. If the police want to read the e-mail on your computer, they need a warrant; but they don't need one to read it from the backup tapes at your ISP” and that “just as the Supreme Court eventually ruled that tapping a telephone was a Fourth Amendment search, requiring a warrant -- even though it occurred at the phone company switching office and not in the target's home or office -- the Supreme Court must recognize that reading personal e-mail at an ISP is no different.”

The Supreme Court would then reconciliate somehow these two famous statements: the Fourth amendment protects people, not place” (Katz v. United States), but “ the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.” (US v. Miller).

In US v. Miller, the respondent, relying on Katz, claimed that he had a Fourth Amendment interest in the records kept by his banks because they were merely copies of personal records that were made available to the banks for a limited purpose and in which he has a reasonable expectation of privacy. The Supreme Court argued that the Katz Court had stressed that "[w]hat a person knowingly exposes to the public . . . is not a subject of Fourth Amendment protection."

So we have these concepts, "copies", "limited purposes", "exposing knowingly to the public"…
In Miller, the Court noted that “checks are not confidential communications but negotiable instruments to be used in commercial transactions.” But our data, even though they are becoming a commercial commodity more and more every day, may be still confidential, if we treat them that way.

Our email could be considered copies of a confidential message sent to us, made available to our ISP for the limited purpose of storing it so we can access it later and read it on our private computer. We would then be in charge of storing that private message, in our own hard drive., protected by the Fourth Amendment. Well, what if we use web mail, what if our company is cloud computing? Should users of Outlook be more protected than the ones using, say Gmail?

Cette Pipe, Elle ne Fume Pas

2009-05-05T04:51:00.005-04:00

The French are getting a trifle too PC for my taste. There is a great exhibition on Jacques Tati in Paris right now. The Monsieur Hulot character created by Jacques Tati smokes the pipe, or, at least, has a pipe in his month, although he does not appear to be smoking it (or at least, I do not remember him puffing away.) Posters announcing exhibitions are traditionally featured in Paris on the sides of the buses, and inside the metro. Well, both companies refused to feature the Tati poster as is, because Mr. Hulot smokes the pipe, and that would be the 1991 "Evin law" prohibits any propaganda or publicity, direct or indirect, of tobacco or tobacco products.

But both the SRF, Société des Réalisateurs de Films, (filmmakers society), and the Syndicat de la Critique de Cinéma (cinema critic syndicate), issued a common press release asking bith the bus and the metro companies to finance a reprinting of new posters featuring Monsieur Hulot and his pipe, claiming that "This censoring in the name of health leads to an unbearable revisionism which affects art and culture" ("Cette censure sanitaire conduit à un révisionnisme insupportable touchant l’art et la culture.) They also claim that, by presenting a distorted picture of Jacques Tati, it diverted and undermined the integrity and spirit of his work, and that constitutes an offense under the Code of intellectual property.

Indeed, the French IP Code protects the integrity of the works through the droit moral. Pursuant to Article L121-1 of the Intellectual Property Code, " An author shall enjoy the right to respect for his name, his authorship and his work. This right shall attach to his person. It shall be perpetual, inalienable and imprescriptible."

You may sign a petition against erasing Mr. Hulot's pipe here.

The Elements of Style, by SCOTUS

2009-05-05T03:47:00.003-04:00

I will knowingly eat a sandwich with cheese today, to honor the SCOTUS, who ruled unanimously on Monday that workers using a mean of identification of another person must know that the means of identification they used belongs to another person.

Pursuant to 18 USC 1028 A(a)(1),which prohibits aggravated identity theft crimes, "Whoever, during and in relation to any felony violation enumerated in subsection (c), knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years." The question the Supreme Court had to answer was whether the statute required the government to show that the defendant knew that the "means of identification " he had unlawfully transferred, possessed, or used, belonged to "another person". The Supreme Court held that he does.

I found this case particularly interesting for two reasons. First, I have been studying identity theft in the US, and in Europe, for many years, and found it a fascinating topic, because it opened my mind to the more vast topic, of "What exactly is identity"?

Also, the SCOTUS reminded all lawyers, and law students alike, that "It's the law, stupid!". Sometimes, when we are looking for the answer of the legal issue that the senior partner just asked us, we sometimes tends to rush to find a well written article on the subject, which will provide us with all kind of neat little references, and handy quotes to be peppered throughout the memo. However, nothing beats a thorough examination of the law, and its analysis. In order to decipher the meaning, one has sometimes to refer to Congressional debates. But most of the time, printed the text, and read it carefully will allow us to find our arguments.

The Supreme Court offered us in Flores-Figueroa v. United States a lesson in both grammar and lawyering skills. Part II of the Supreme Court opinion analyzes and explain why the word "knowingly" in 18 USC 1028 A(a)(1), must be interpreted as applying to all the subsequent listed elements of the crime. The government was arguing that the word "knowingly" applies to all but the statute's last three words, i.e., "of another person". The Supreme Court reminded us that " in ordinary English, where a transitive verb has an object, listeners in most contexts assume that an adverb (such as knowingly) that modifies the transitive verb tells the listener how the subject performed the entire action, including the object as set forth in the sentence, " and adds further that "if we say that someone knowingly ate a sandwich with cheese, we normally assume that the person knew both that he was eating a sandwich and that it contained cheese."

The government tried to scorn using grammar instead of law in order to analyze a case : "The Government correctly points out that in these cases more was at issue than proper use of the English language. But if more is at issue here, what is it? " I will reflect on that today munching on my cheese sandwich.

Writing from 48° 51’ 44’’ North 2° 21’ 3’’ East

2009-04-05T10:28:00.005-04:00

Twitter is the latest piece in one's digital identity. Where I am, what am I doing, at this micro moment, is for me to advertise, to make public. What's public is no longer private (duh), and thus, is up for grabs for everybody.

As Justice Harlan wrote more than forty years ago, "(...) a man's home, is, for most purposes, a place where he expects privacy, but objects, activities, or staements that he exposes to the "plain view" of outsiders are not 'protected" because no intention to keep them to himself has been exhibited. On the other hand, conversations in the open would not be protected agaisnt being overheard, for the expectation of privacy under the circumstances would be unreasonable."

Twitter users may save lives, but more often than not, Twitter does not serve as as back up 911 number. It is a way to keep in touch it is a way to be tracked down. The line is, indeed, fine. As always in digital privacy issues, it is the aggregation of data that is the threat. Now that Google may buy Twitter, there is a real possibilities that our sweets little tweets may be exactly located on Earth, courtesy of Google's Latitude.

Endangered Logos...

2009-03-25T10:47:00.002-04:00

The international operation "Save your logo" encourages famous companies to save the animal featured in their logo. According to its site, " The Save Your Logo Fund will provide the private sector, and other donors, with a mechanism to contribute to, and support, efficient and coordinated conservation action. Many companies and organizations are already using animals in their logos and marketing strategies. These animals are a signature part of these companies logos or brands, be it the crocodile for Lacoste and hundreds more. According to the IUCN “Red List” of threatened species, many of these species are either threatened or endangered and will need serious and comprehensive conservation actions to survive."

"Companies that have benefited from the positive image of these animals have the opportunity to express their appreciation" said Jean-Louis Borloo, France's Minister of Sustainable Development.

Lacoste has accepted to sponsor the crocodile. MAAF, a French insurance company, will sponsor the dolphin. Mobil's Pegasus is extinct for a long time, unfortunately.

French Version of the the DMCA Takedown Notices

2009-02-22T08:39:00.004-05:00

The French “Internet and Creation” bill proposes to add an article L. 336-3 to the French IP Code. This article would oblige the client of an ISP “to ensure that [his] access is not being used for purposes of reproduction, representation, or making available to the public works or objects protected by copyright or a neighboring right without the permission of the holders of these rights”.

This system is similar to the DMCA takedown notices, and the purpose of the bill is, of course, to try to discourage illegal music and films downloading. Yet, the scope of the article is very broad. Imagine accessing a blog that would illegally reproduce pictures of the latest family trip to Grandma, stored on the family computer hard drive, but used by little Billy without Big Sis permission.

The bill also creates a new independent administrative authority, the High Authority for the dissemination of works and protection of rights on the Internet (Haute autorité pour la diffusion des œuvres et la protection des droits sur internet), that would be in charge of making sure that the dispositions of the article L.336-3 are respected.

What gives? According to the riposte graduée the bill proposes to put in place, the ISP client would risk, after several warning of the High Authority, to have his Internet access shut down, three months to a year, while still having to pay the ISP invoice (Art. L. 331-28), a more enviable fate than the one he faces under the current of article 335-2, §§1 and 2 of the Intellectual Property code: “Any edition of writings, musical compositions, drawings, paintings or other printed or engraved production made in whole or in part regardless of the laws and regulations governing the ownership of authors shall constitute an infringement. Any infringement shall constitute an offence.

Infringement in France of works published in France or abroad shall be liable to a three-year imprisonment and a fine of € 300.000.”

The High Authority would also be in charge of creating a database of all the persons that have been found to infringe copyrights, and thus had their Internet access cut off.

The bill, already voted by the Senate, will be discussed at the Assemblée Nationale early next month.

Amanda Wakeley Buys Back Her Brand

2009-02-01T13:49:00.002-05:00

The Times reports (scroll down) that Amanda Wakeley bought back her label from Jason Granite's Arvoco. It was sold only last year. The Times writes: "Now the intellectual property relating to the label has returned to Wakeley or, specifically, her new venture, AW Atelier. She has also haggled her bridal business Sposa into the deal.

Here’s where it gets trickier. As part of the deal, AW Atelier has granted Arvoco a licence to use the Amanda Wakeley brand.

So, all perfectly straightforward."

The 12 Days of EFF Video

2008-12-19T10:08:00.001-05:00

La rue (zone) interdite

2008-12-13T09:17:00.000-05:00

Dont' Be Such an Icon!

2008-12-12T08:19:00.005-05:00

Sur le site du Village de la Justice, un article par Frédéric Glaize à propos d’une décision de la CA de Paris du 28 novembre 2008.

Le photographe Korda, auteur de la célèbre photographie, avait accordé en 1995 une licence d’exploitation de celle-ci à Patrick Magaud. Celui-ci avait déposé la photographie comme marque communautaire en 2002.

La CA de Paris annule la marque communautaire déposée par Mr. Magaud représentant la célèbre photographie de Che Guevara, au motif que celle-ci ne saurait être une marque:

“Considérant que les parties ont abondamment souligné que la diffusion mondiale qu’a connue et que connait encore cette œuvre de Korda ; que l’écho qu’elle reçut en fait presque une sorte d’icône emblématique d’un personnage historique et à travers le destin tragique de celui-ci, d’une époque de l’histoire contemporaine ;

Que la puissance d’évocation que revêt cette œuvre aux yeux de tous n’est d’ailleurs pas contestée ;

Considérant qu’il suit que le consommateur concerné par les produits visés à l’enregistrement notamment les vêtements, les produits de l’édition, les activités culturelles, percevra la marque communautaire litigieuse non pas comme un signe lui désignant l’origine des produits ou services auxquels il s’intéresse mais comme une référence faite, à des fins politiques ou artistiques à l’œuvre de Korda qui magnifie Che Guevara ;

Qu’en d’autres termes la perception de cette photo par le consommateur est exclusive de son utilisation pour désigner à ses yeux l’origine des produits et services pour lesquels elle a été enregistrée”.

Il est intéressant de noter que la CA insiste sur le fait que la marque doit servir à indiquer l’origine des produits. Est-ce à dire que l’on ne peut utiliser l’image d’une personnalité devenue une icône? Cela voudrait dire que le marché lucratif de l’exploitation de l’image d’une personnalité décédée (ou plutôt, d’une icône décédée), n’a pas de beaux jours en perspective en Europe…

Le TGI de Paris avait dèjà eu à se prononcer sur la légalité de l’utilisation d’une photographie comme marque communautaire en 2006. Le groupe de rock Trust avait utilisé la photographie comme bannière d’arrière scène lors de l’un de leurs concerts. Mr. Magaud, et l’héritière de Korda les poursuivirent pour contrefaçon. Les défendeurs arguaient que les demandeurs ne sauraient sans violer l'article 11 de la Déclaration des Droits de l'Homme et du Citoyen et l'article 10 de la Convention Européenne des Droits de l'Homme interdire rétrospectivement au groupe Trust d'exprimer leurs opinions politiques au moyen de cette image devenue un symbole de liberté et de contestation.

En outre, la marque ferait partie du patrimoine commun et ne pourrait être appropriée par le droit des marques sans détourner celui-ci de sa finalité. Elle serait également générique et usuelle.

Le TGI de Paris avait jugé l’utilisation de l’image du Che trop fugitive pour constituer une contrefaçon. La contrefaçon de marque n’était pas avérée, car l’utilisation de la photographie par le groupe Trust avait été antérieure au dépôt de la marque communautaire par Mr. Magaud.

Le TGI de Paris précisa néanmoins qu’une photographie peut être utilisée comme marque communautaire : l'enregistrement d'une marque dont le signe est protégé par le droit d'auteur n'est pas exclu par le règlement communautaire dès lors que cette hypothèse est prévue par l'article 52 de ce texte. De plus, la photographie en cause est parfaitement arbitraire pour désigner les produits et services visés à l'enregistrement de la marque dès lors qu'elle est bien utilisée dans la vie des affaires pour désigner l'origine de ces produits et services et non comme élément décoratif ; dans cette dernière hypothèse, seul le droit d'auteur est susceptible de la protéger.

Cette jurisprudence est bien plus favorable aux ayants droit de personnalités décédées, mais la CA de Paris ne semble pas y être favorable. A suivre.

ADN et Droits de l’Homme

2008-12-10T08:46:00.004-05:00

La Cour Européenne des Droits de l’Homme vient de décider que la conservation systématique par le Royaume-Uni de l’ADN, d’échantillons cellulaires et des empreintes digitales de suspects, est contraire à l’article 8 de la Déclaration des Droits de l’Homme.

La Cour a conclu à l’unanimité à la violation de l ‘article 8 protégeant le droit au respect à la vie privée et familiale. Les échantillons cellulaires contiennent des informations sensibles, notamment sur la santé d’un individu. En outre, il est possible, grâce à l’ADN d’un individu, d’ obtenir des informations sur le code génétique de sa famille. C'est pourquoi la conservation de telles données constitue une atteinte au droit au respect de la vie privée des individus. Voir aussi ici.

Do I Belong?

2008-12-10T07:57:00.011-05:00

As a teenager, I developed some interests (AC DC) in order to belong, and some others, (Desmond Morris works) in order to look original, and, therefore, to increase even more my chances to belong. Thanks to Google Zeitgeist, I can now always check my ability to gain friends, and have a fun dinner party.

As of today, December 10, I am indeed concerned, like my fellow Americans, about the chances of the Yankees to gain CC Sabathia in the next season (# 28 on the list as of now.) I happen to know by chance the meaning of the # 1 on the list right now, eclampsia, because some characters of novels I read over the years, which titles are long forgotten, have suffered from that medical issue, and I send my warmest wishes to the women concerned about it. The Universal Declaration of Human Rights (which 60th birthday we are celebrating), is two places above the NJ lottery, # 81 and # 83 respectively. May winning the lottery become a right, and may some of the money won in lotteries this year be directed to organisations fighting for the preservation of these precious rights (first in mind, the Southern Poverty Law Center)

It is probably for the best that I am moving out of New York City this month. According to this New York Times article, Google queries reflect my fellow New Yorkers' interest in the Proton Collider and Walter Gropius. While I admire the Bauhaus greatly, I confess that I have never looked up information about it. Even more embarrassing, I was not concerned at all this year about the possibility of being engulfed for eternity in a black hole created by the hubris of proton scientists, somewhere in Switzerland. Switzerland still calls to my mind images of the Berne bears, and of the Milka cow.

But my concerns about not belonging are not important. I am more concerned about the possible chilling effect on Google queries that this monitoring could have. Would I feel 100% free to query Milka cow + Proton Collider+ how to make a bomb? Probably not.

Lego Blocks Too Functional To Be A TM in the EU

2008-11-17T09:27:00.002-05:00

The Court of First Instance of the European Communities cancelled the Lego trademark for the shape of its famous bricks. This European Community trademark was registered since 1999. Mega Brands, Lego’s rival, had then immediately applied for a declaration that the registration is invalid. The OHIM declared in 2004 that indeed this mark could not be registered because it was functional. The Court of First Instance just confirmed that decision.

Lego had argued that only signs consisting « exclusively » of the shape of goods « necessary » to obtain a technical result are barred from registration as a TM, but functional shapes per se are not. Lego offered two test to distinguish the fine line between these two types of functional shapes :

The shape must have no non-functional features

Its external appearance must not be capable of being altered in its distinctive characteristics in such a way that it would lose its functionality.

Lego also argued that according to Philips, where the European Court of Justice had decided that a TM could not be registered if key aspects of its design were purely functional, functional shapes per se are not excluded, only functional shapes whose protection would create a monopoly on technical solutions or functional characteristics of said shape.These arguments did not convince the court.

Trademarks & Second Life

2008-11-12T12:01:00.002-05:00

In this article, Ross Dannenberg offers answers to the question « Do trademark laws apply in the virtual world ? » Well, yes. The answer to this question is not only a satisfying intellectual exercise for trademark practitioners, but is a crucial question for all the companies marketing their wares on Second Life and in other virtual worlds. As Mr. Dannenberg clearly states, «a trademark may have originated in either the real world or the virtual world, but each trademark serves the same ultimate purpose -- it acts as a source identifier, an indication of goodwill associated with the provider of the goods or services. » Some real life companies are expanding their marketing into virtual worlds, sometimes finding it ain’t that easy, whereas some businesses are exclusively present on Second Life, and making a killing at it to boot.

As Mr Dannenberg points out, the arrival of bona fide real world companies in Second Life expands the risk of likelihood of confusion, as both trademarked virtual goods, and fake virtual goods are presented to the public.

Once a trademark is registered, its owner can protect it on Second Life by filling a John Doe lawsuit , then subpoena Linden Lab in order to learn the real world name of the avatar that infringed the trademark. The EULA may also provide tools to protect real life trademarks.

How To Do Business On Second Life Video

2008-11-12T11:26:00.005-05:00

My, Your Tea Pot Looks Just Like You!

2008-10-15T08:50:00.006-04:00

Is this the ultimate form of narcissism? A group of French designers, 5.5 Designers, launched their cloning design project (click on enter, then on projects, then on 2008 cloning).

From their site: "Inspired from the medical techniques of cloning, “Cloning” is an authentic service of creating objects at your own image. The aesthetic of this collection is defined by the physical data taken on your body. The object shapes are the results of a process consisting in taking data from your physical characterisics, the color of your eyes, of your hair, your pilosity, your weight, your mensurations, and then these data are treated in order to become coefficiants of the object shapes."

See some projects here.

Flash Cookies

2008-10-15T08:40:00.003-04:00

Via Slashdot, a post about flash cookies, warning us that they are silent privacy killers. The author found out that the Adobe Flash Player maintains proprietary cookies called Local Shared Objects, and that they have the capacity of storing 100KB of data. Further, these cookies are quite cumbersome to remove, although I'm a Super gives some instructions as how to do it. Adobe also provides us with a way to remove them on the Adobe site.

Microsoft's Explorer 8 will include Privacy Features

2008-08-27T09:32:00.007-04:00

Microsoft will soon make available its new Explorer 8 browser. The browser will include some privacy features, and will allow its user to browse the web anonymously... The privacy features are:

InPrivate™ Browsing: it allows the user to decide whether or not he wishes to save his surfing history, or his cookies . The user will be able to open a private browsing session, and the sites visited during the private browsing session will not be tracked. It is a particularly interesting feature if one does not use a personal computer.
Delete Browsing History allows the user to control his browsing history after he has visited websites.
InPrivate™ Blocking informs the user about web content that may observe her browsing history, and allows her to block it . This feature should be able to prevent marketing company from gathering information about browsing habits in order to build consumer profiles.
InPrivate Subscriptions gives the user to subscribe to a list of websites to block or to allow.

Sign against Edvige

2008-08-27T08:58:00.006-04:00

Edvige is the lovely name of the not-so-lovely new French police database. The June 27 2008 law, was published in the French"Journal Officiel" on July 1st, thanks to the CNIL, even though the government had not wished it to be published. Instead, it was published at a very quiet time of the year, during the vacances...

The French police is not entitled to gather personal data on individuals who have reached their 13th birthday, and who are likely to upset public order (susceptibles de porter atteinte à l'ordre public). Data thus gathered can be, of course, their names, addresses, and photographs, but also their tax reports, the names of the persons they associated with. Data regarding their health and sexuality can be gathered "exceptionally", but the law does not say how the police is supposed to evaluate the exceptional that measure must be.

Thanks to the CNIL, the database will not be connected with others. Imagine a banker trying to figure out whether to extend a credit denying it because he has access to his health data, or discover that his client was arrested ten years ago for smoking a Gauloise inside a bar?

The press had informed the French citizens about that new law, but it has not succeeded creating the uproar necessary to withdraw it. The petition is here.

Cinéma d'été et vie privée

2008-08-15T23:30:00.003-04:00

Medical Privacy of Celebrities

2008-08-07T11:37:00.002-04:00

The Los Angeles Times reports that the privacy of (yet more) several famous patients has been breached at the UCLA Medical Center. The West Coast newspaper had reported last April that the medical records of Farah Fawcett, Maria Schriver, and other celebrities had been accessed without authorization. The Los Angeles Times posted a copy of the report filed by the California Department of Health Services.

A famous patient, D., checked into the UCLA Medical Center in October 2004, under a pseudonym. In spite of taking the care of using a false name, information about his medical condition somehow leaked, and was reported by a national newspaper. An inquiry led to the dismissal of an employee last month, because he accessed the D’s records for job-related reason, and thus violated the protected health information of the patient.

In Michigan, some employees of the Sparrow Hospital in Lansing were fired or disciplined for having attempted to access the medical records of Governor Granholm.

Even the mundane act of buying medication is published for all fans to know.

Google Health and Workplace Privacy

2008-06-29T11:51:00.006-04:00

The New York reported on Friday about a recent privacy at work case. Mr. Sidell was fired by his employer. He left the company premises without signing out from his personal Yahoo email account, and the company allegedly read his personal emails.

This is an interesting case to follow, because the judges will have to answer to the question: do employers have the right to read their employee’s personal emails, when employees are accessing their email accounts using the company’s computer system?

Mr. Sidell used a Yahoo account. What if he had used a Gmail account, and was still signed up on the company’s computer? Would the employer have the right to peruse through his documents (Google documents), his blog (Blogger!) , and even his medical data (Google Health)?

Summer Reading

2008-06-29T11:08:00.003-04:00

I will document my summer reading on Library Thing. I usually do not keep books, but donate them to library sales and thrift stores, so it will be nice to keep a memento of Summer Reading, vintage 2008.

I never read books written in English translated in French, except for this book, translated by Marcel Duhamel, who founded the Série Noire. Charles Williams is sadly a little forgotten in his native country, whereas his books are still in print in France.

ADN et Eugénisme

2008-06-29T10:32:00.005-04:00

Un article très intéressant du Monde Diplomatique, écrit par Jacques Testart, qui parle des dangers des tests ADN pour les libertés individuelles. Monsieur Testart mentionne que la Grande Bretagne vient d’ autoriser le tri des embryons pour risque de strabisme. Le développement du DPI (diagnostic génétique préimplantatoire) peut ouvrir la porte à l’eugénisme, car il a le potentiel de devenir un outil précis de sélection d’un embryon en fonction de critères visant à ne donner l’autorisation de vivre qu’à des embryons porteurs des gènes adéquats.

DNA as evidence

2008-06-20T09:38:00.004-04:00

The Wall Street Journal had an article yesterday about the use of DNA in lesser felonies. The Department of Justice advocates this use in the name of enhanced public safety.

DNA databases could also enrich themself soon with the DNA of arrestees. Upon arrest, a DNA sample would be taken from the arrestee, even though the arrest may be wrongful... The ACLU argues that the collection, retention, and use of innocent persons' DNA violates the 4th Amendment. See also here.

In France, the use of DNA tests by police officers to help solve the mystery of the stolen scooter of one of President Sarkozy's son (who was at the time, Ministre de l'intérieur, and thus head of the French police), was not well received by the public. At least some thought that such exceptional tool should not be used for a mere felony. Others probably thought that every tax payer should be entitled to have DNA solve crimes.

Goodwill (store) and Trademark (bis)

2008-05-28T09:25:00.006-04:00

Some people have a jade plant, or a cat, to bring prosperity to their home. Well, I brought home a Federal Reserve Tee-Shirt from the Goodwill Store.

I unfortunately have to respond negatively to the question printed on the back of the shirt. However, my collection of fair use garments is growing every week. I feel so rich looking at it, sigh.