Q: When is a fine not a fine? A: When it’s legal fees.

Although she is late off the mark with this, Matron can’t help being somewhat irked about the level of cross-cultural misinformation surrounding the German Supreme Court’s decision on open wi-fi networks. A number of commentators, including Outlaw and the SCL Editor’s blog reported that the court has "fined" the owner of a wi-fi network because he did not secure it with a password and it was used to download music without the copyright holder's permission. Even though Outlaw then makes it clear that the “fine” consisted in the payment of legal fees, this does little to divert from the sense of uproar instilled by the article’s headline. So what actually happened?

A musician had sued the owner of a (private) unsecured wi-fi connection because his connection was used to illegally download that musician’s music. The owner of the wi-fi network could prove that he had been away on holiday at the relevant time and was understandably upset at being held responsible for that unlawful activity. As far as Matron could ascertain (the full decision has not yet been published), the musician sued the owner on two counts: (1) for payment of damages in respect of the unlawful use of his music and (2) for omission of the behaviour that enabled the unlawful activity to take place (that is, leaving his wi-fi open). The claimant's lawyers, who had been instructed to enforce the claim, also requested payment of their legal fees, incurred in relation to the sending of the letter requesting payment of damages and omission.

The court held that:

1. The owner of an open wi-fi network did not have to pay damages unless the claimant could prove that the owner himself was involved in the unlawful activity (rather than just enabling it by leaving his wi-fi network unsecured).

2. The owner of an open wi-fi network was under an obligation secure his wi-fi network by taking the technical steps deemed adequate at the time of installation.

3. The owner of an unsecured wi-fi connection was liable for the legal fees of a claimant who could prove that this enabled behaviour that damaged the claimant’s rights. However, the court capped the fees that a claimant can claim in this respect at 100 Euro.

There has been a lot of huffing and puffing about this decision from all corners of the internet with many predicting that this is going to be the thin end of the wedge as far as online copyright enforcement is concerned. But before we all jump to that conclusion, lets put the judgement into its proper legal and cultural context.

To start with, the fact that the defendant in this case was not found liable to pay damages to the claimant is surely a positive and well-reasoned step in the right direction. The owner of a wi-fi network may be under an obligation to secure that network, but he will not become vicariously liable for any unlawful activity that other people use it for. Claims that the court has created a new intermediate liability for private individuals are therefore wildly exaggerated.

Of course, the decision is not without its problems. In this particular case, the defendant could prove that he was on holiday when the illegal activity took place. But what happens in cases where that isn’t possible? What level of proof will be required from the claimant? Might there even be, heaven forbid, a reversal of the burden of proof whereby the owner of an unsecured wi-fi network will have to exculpate himself? For the answer to those questions we will have to wait for the next judgement, I’m afraid. But stranger things have happened at sea and in German case law and we would do well to keep a watchful eye on developments.

Secondly, the German court has unequivocally stated that he who runs a wi-fi network must secure it. This is the point that many find disturbing, but given the existence of certain longstanding private law concepts (in particular the concept of “Störerhaftung”), it will not come as a surprise to anyone qualified in German law. “Störerhaftung” effectively means that if you create or operate something that is likely to infringe the rights of a third party, then that third party has the right to request you to stop creating or operating that something (the right to claim an omission).

Other examples for this type of claim include the right of a property owner to stop someone from building a factory next door which emits dangerous fumes or preventing the owner of a neighbouring property to set up a building that blocks all his light or television reception. In relation to online activity, this concept has long been the basis of intermediary liability of ISPs, website hosts and platform owners (whose liability is then in turn limited through the provisions implementing Articles 12 to 14 of the E-commerce Directive). We may not appreciate the end result, but like the courts in other countries German courts must enforce and interpret statute law (in this case section 1004 of the German Civil Code), and with a lot of interpretative history in this area, it is relatively easy to see why the Supreme Court decided as it did.

At the same time, one could argue that the court has also set the bar for avoiding this sort of liability fairly low. All it requires is that, at the time of installation, owners install the most recent form of security (which should normally be what the router comes with anyway) and change the factory-set password to a personal one. If they do that, owners can run the thing for as long as they want, security measures can improve vastly during that time, but they are under no obligation to upgrade or even check it. They only have to do it once.

Now, this comes as no relief to:

• people like Matron’s mother who would not know how to install security if it hit her in the face with a large stick (fortunately the nice man from Deutsche Telekom did it for her, and Matron expects that ISPs will take this judgement as an opportunity to widen their service offerings in this area),
• cafes and other outlets who run open wi-fi systems (although the question here is whether the court will accept other ways to secure those networks, like an additional requirement to sign in), or
• individuals who believe in open wi-fi.

However, maybe we should put our preconceptions aside here for a bit and ask ourselves whether, all things being equal, it is not a fairly rational demand to ask people to secure their wi-fi? Matron is all for an open network, but the fact of the matter is that that network can be used for good or ill. We are not only talking unlawful downloads here, but other things like the organisation of criminal networks, terrorist activity and the distribution of child pornography (and if readers could please take a moment here to comprehend Matron’s pain at having to play the kiddie porn card).

It is very nice that we may want to share. Sharing is good and fun and kind and we should all do it more often. But if we left our car unlocked with the keys in the ignition, knowing that any passer-by could help himself to it, would we really expect to escape liability if that passer-by turned out to be someone without a driving licence who then causes an accident? Of course we wouldn't! We accept that we are expected to take certain precautionary measures, both to protect our own property (and lets not forget that an unsecured wi-fi is also an open door to our own information) and that of others. Why should things be different online? Go on folks, move with the time!

Finally, let us turn to the small question of the “fine”. Of course, if you categorically believe that owners should be allowed to run unsecured wi-fi networks, then having to pay someone else’s legal fees just adds (financial) injury to (ideological) insult. However, those of us who see some wisdom in a requirement to secure a wi-fi network must try to evaluate this part of the judgement more reasonably. For this Matron has to dig a little deeper into the way German lawyers are paid.

Lawers’ fees are generally calculated on the basis of the “case value”. A fee table exists which sets out the amount a lawyer can charge for a particular action (for example, sending a letter before action or serving a writ) relative to the case value. The way that case value itself is calculated is relatively easy in cases like debt collection (the amount of the debt owed) but more complicated in relation to other situations. Before 2008, the way in which the case value of copyright cases was calculated had more to do with the premise of “what-can-I-get-away-with?” than any comprehensible tabulation and the courts in fact accepted case values of 10,000 Euro (proposed by the lawyers for the claimant, of course) for relatively minor infringements. This meant that potential infringers of copyright who received a lawyer’s letter requesting them to cease their infringing behaviour were, at the same time, asked to pay hundreds if not thousands of Euro in legal fees for the pleasure. This, is turn, led to something that can only be described as “fee-farming” with law firms sending hundreds of similarly phrased letters to people accused of infringement (for example, if they displayed photographs of a protected mark on eBay to sell their old household goods) just for the money it brought in. In September 2008, a new law was adopted to counteract this practice. It limited the fee that lawyers can charge for such letters to 100 Euros. The “fine” the court imposed in our wi-fi case was therefore nothing more than the application of a new law that was brought in specifically for the purpose of consumer protection.

This doesn’t change the fact that 100 Euro is still a lot of money for some people. But it beats the hell out of the threatening effect that a bill for 1,000 Euro would have had. And - Matron must come back to this fact - it can be avoided by taking a few simple security measures when you first set up your wi-fi network.

So here we are then. Was this a scary and dreadful judgement? Matron doesn’t think so. In an ideal world we could of course all leave our windows open and our front doors unlocked while we swan off for a three-week holiday in the Caribbean. But that ideal world we have yet to create. Back in the real world, we make damn sure that we have left our car in a secure car park, engaged our five-lever mortice locks and switched on the alarm. It’s common sense, really, and maybe we could do with a bit more of that online.

Drove my Chevy to the levy but the levy was dry...

It's almost laughable that it took two evenings of BBC Parliament coverage to get Matron out of her work-induced hibernation. But having watched the whole sorry spectacle of the "committee stage" of the Digital Economy Bill last night she is not sure who she despises more: the (many) MPs who did not turn up at all or the ones who allowed themselves to be herded in from the pub like cattle for the final division by a defunct, decrepit government.

For those who do not know yet, the Digital Economy Bill, a most complex piece of legislation which even highly specialised experts in the field of law and IT have difficulty to understand in its entirety, was rushed through Parliament last night in a dubious process called "Wash-up" and approved in third reading by 189 to 47 votes. During the entire debate, both last night and the night before, the number of MPs present in the Chamber never seemed to veer above 40 when suddenly, around 10.30 pm, it seemed to be kick-out time in the neighbouring, alcohol-serving establishments and hordes of people streamed into the hallowed halls, laughing, joking and generally seeming to enjoy what may very well have been the last time they all got together in this format. Then they locked the doors and the backroom deal negotiated between the front benches of the two biggest parties became enshrined in Hansard history.

The problems with this Bill have been described in mind-boggling detail by brains more engaged with the subject matter that Matron's (for some of the best coverage, see the blog of the formidable Pangloss), but now that another battle against a Parliament which acts in blatant disregard of its constituency - safe in the knowledge that the constitutional concept of parliamentary supremacy (combined with modern party discipline, money-saturated lobbyists and procedural tools such as Standing Order 14) gives the governing party the right to do almost anything for as long as they are in power - it is time for the both the electorate and the elected to learn some uncomfortable lessons.

Riddle me this, dear political representative, if the signature of 23 "business leaders" on an open letter requesting the scrapping of a national insurance increase is enough to get all parties putting out endless press releases, why do 20,000 letters written by ordinary citizens to their MP about the risks and dangers of unpopular piece of legislation not have the same effect?

A look at the division list of shame should be compulsory for every media journalist and some names deserve to be mentioned in particular:

Derek Wyatt, LAB, who should know better having chaired the All Party Parliamentary Internet Group for years and who was instrumental in setting up the Oxford Internet Institute, inexplicably voted for the bill. He has nothing to fear from his front bench since he is not standing for re-election, so why?

John Redwood, CON, who harshly criticised the government in second reading for rushing the bill through wash-up, then failed to let his vote follow his political point-scoring. He did not turn up at third reading and vote against the bill as his comments would have suggested (he was in the HC in the afternoon during the debate of the Finance Bill where he made similar comments).

The 44 LIB DEM MPs who, despite their party leaders' assurance that the party would take a stand against the passage of the bill, apparently did not hear the division bell ringing: Nick Clegg, Danny Alexander, Norman Baker, Annette Brooke, Des Browne, Malcolm Bruce, Lorely Burt, Vince Cable, Ming Campbell, Tim Farron, Andrew George, Sandra Gidley, Julia Goldsworthy, Nick Harvey, David Heath, Paul Holmes, Martin Horwood, Chris Huhne, Mark Hunter, Charles Kennedy, Susan Kramer, Norman Lamb, David Laws, Michael Moore, Greg Mulholland, Mark Oaten, John Pugh, Alan Reid, Willie Rennie, Dan Rogerson, Paul Rowen, Adrian Sanders, Robert Smith, Andrew Stunell, Jo Swinson, Matthew Taylor, Sarah Teather, Steve Webb, Roger Williams, Stephen Williams, Mark Williams, Phil Willis, Jenny Willott and Richard Younger-Ross. They may not have been able to add much to the debate, but their presence (and vote against) would have made the government's victory much less impressive.

The Tory and Labour backbenchers (of whom there are to many for Matron to list them all) who will have received full postbags and e-mail inboxes from their constituents begin them to intervene and who did not feel it necessary to do the one part of their job (for which - as we all now know - they are handsomely paid) that surely is the raison d'etre for their existence: turn up, debate and vote for or against legislation. Anyone in the private sector would be sacked for such behaviour.

On the plus side, as many others have observed before, this bill has probably done more to bring the shortcomings of the UK's parliamentary procedure to the attention of the silent majority than any other in recent history. Thousands of people will have watched the debates on television and via the internet and it is to be hoped that those people, rather than return to their normal lives in frustration and resignation, will use their pent-up anger to come together and demand constitutional change.

The next step has to be to identify all those who did not attend or who did vote in favour of this insidious bill and who stand for re-election in May and to inform them in no uncertain terms that they will not get our vote unless they give some guarantees that they will what is necessary to ensure that the Bill is revisited as soon as possible in the next Parliament. If the ballot box is really the only way in which ordinary citizens can hope to have any effect on the political decisions made in this country, make sure that you do not pass on that right.

Here's to a hung Parliament and a lively and much needed debate about proportional representation!

Gordon Brown's been "Jim Hackered"

On a topic entirely unrelated to privacy, Matron wonders if she is the only one who thinks that Gordon Brown has been completely "Jim Hackered" by Joanna Lumley on the Gurkha issue. Watch this video of the statement she gave after her meeting with the Prime Minister today and compare her strategy with that used by the famous TV Minster at the end of the "Big Brother" episode when he finally gets one over on Sir Humphrey. To quote young Bernard Woolley: "I'd say, 'Checkmate!'"

Principiis obsta et finem respice!

After a long conference and work induced absence, Matron's blogging reflexes were triggered today not by the big important developments of the day (RIPA and IMP consultations, ICO RAND report etc. - maybe more about those later, time permitting), but by a small news piece in the Guardian, which reports that a Brazilian MP has just proposed draft legislation that would force Rio de Janeiro's state government to publish an online list of all HIV carriers. The reasoning behind this proposal is, apparently, a wish to protect medical staff and other citizens from contamination.

It reminded Matron of an ongoing discussion she has with the inimitable Lilian Edwards (currently a pleased-as-punch and fully paid-up member of the "hydra-headed gang of online privacy pirates" whose purpose is to damage behavioural advertising company Phorm. But that, again, is another story.) about the merits - or not - of a general right of disclosure of other people's personal information on the internet. The discussion centred largely on such disclosures by individuals on social networking sites, so, obviously, this potentially state-sponsored Brazilian proposal would go far beyond that and raises a completely different set of issues. But Matron can't help wondering whether some of the same considerations do apply in this context as well.

If we do accept that individual privacy can be restricted to protect some other common good (like a perceived notion of public safety) or individual right (like freedom of speech, expression and opinion), what are the limits? Indeed, are there any limits or should we be able to expose everything about another person, strip them digitally naked so-to-speak, if it serves a justifiable purpose?

As she often does, Matron looks to the German Constitutional Court's for an answer. It's case law defines individual behaviour as falling into three separate "spheres": the public, the private and the intimate sphere. Interference with an individual's privacy in the interest of competing rights is permitted, subject to certain limitations like necessity and proportionality, in the public and the private sphere, but not in the intimate sphere. The Court recognises that in relation to each individual there exists a "core area" of privacy - arising from individuals' human dignity and their right to self-determination and self-development - that must not be touched or interfered with by anyone for any purpose, however well-meaning.

In this day and age, it's a controversial concept with security-conscious state protectors on the one side and freedom of speech advocates armed with "floodgate" arguments on the other, both questioning its legitimacy.

But can there really be a right to information about another individual - and a right to spreading that information - in the same way as there should be a right to information - both collecting and disclosing it - about the activities of governments and public authorities (the latter, of course, being the notions that underpin Freedom of Information legislation and the right to the freedom of the press)?

But governments supposedly work for us and the transparency and accountability that are the ultimate objective of these rights of information gathering and disclosure are necessary to even out the unequal power relationship between the state and the individual. They are part of the system of checks and balances that is meant to stabilise our democratic political system.

Can the same really be said about our relationship with other individuals and can there be a right to gather and disclose information about our friends, acquaintances, enemies as well as people we barely know or don't know at all? Again, what would be the limits of such a right? Indeed, is there, should there be, a limit at all? Where does citizen journalism end and -seemingly inconsequential but potentially damaging - gossip begin? And what new power relationships - some open, some hidden from view - are we creating or re-creating in this brave new online world?

So resist the beginnings and consider the end. Or should it be the other way around?

Of geeks and men

Matron just returned from a few days in Athens where she attended the inaugural WebSci'09 conference. For the blissfully ignorant, web science is the latest project of WWW Godfather Tim Berners-Lee and the newly made up Dame Prof. Wendy Hall (yes, this really is the correct title, there's nothing like a dame, as we all know). A few years ago, they got together to create the Web Science Research Initiative (WSRI - apparently pronounced Woozri according to Dame Wendy) with a view to bring several research areas together to form a new academic discipline.

Matron was warned before she travelled that she would meet some hardcore geeks there. Real geeks that is, not like the ones she normally meets who are actually interested in things like law and policy and society and stuff. And indeed, the place was packed to the rafters with creatures who quite clearly may not be able to survive in bright sunlight. But very interesting it was too.

Now, Matron is not sure herself if "a new new discipline was born" in Athens as Dame Wendy apparently claimed during her closing address (Matron could be wrong about the attribution of that statement as by then she was already back in her hotel room, all conferenced out). But the interdisciplinary opportunities are certainly worth pursuing.

What was almost touching, though, was the way in which the hardcore geeks were going about discovering as "new" a number of subjects (privacy for a start) that have been discussed by social scientists, Internet lawyers et al. for more than a decade. Apparently, "web science" is all about the way in which the existence of the web affects society as a whole, as individuals live more and more of their life online. Matron wants to be neither patronising nor scathing, but it seems to her that that particular wheel may already have been invented. Or at the very least been designed in some detail. Nonetheless, the more the merrier. And as the general consensus among tech lawyers and social scientists seems to be that we need computer scientist to think about the issues close to our hearts ab initio, that is when they first inventi new technologies rather than as an afterthought (see, for example, in the area of privacy-enhancing technologies), any cross-fertilisation between disciplines has to be a good thing. So here's to the success of the project - plus Athens certainly was a very nice place to wet the babies head.

Geeks of the world, rejoice!

On a much more cheerful note, Matron was very happy to see that the announcement for this year's GikII conference finally went up this week. For the uninitiated, GikII is a conference on the intersections between law, technology and popular culture. It is now in it's forth year and very rightly so, as it is - in the oft quoted words of a regular attendee - "like a normal conference, just without the boring papers".

It has become so popular in the legal geek community that it will also be transported to the Southern Hemisphere this summer: SoGikII will take place ("in a beach hut in Sydney" according to some of its organisers) on 9 June. What's not to love about that prospect? Matron, who has not been able to find the small pot of gold at the end of the rainbow that it would take to fly her to Oz and back is very, very jealous of those who will attend. But then the fact that Northern GikII will take place in trendy Amsterdam this year (17/18 September) is some compensation.

So, in the words of GikII co-founder panGloss, get your geek on and respond to the Call for Papers for either Holland or Australia. The only rule is that "you must not be boring", because, Toto, this ain't Kansas!

The hour draweth nigh...

Matron just looked at the calendar and noticed that today is the day when all EU member states must have fully implemented the Data Retention Directive into domestic law - "fully" in this context meaning transposition for internet data as well as for telephony data.

The UK has not yet made that deadline although transposition is probably imminent following the recent publication of the government's response to the relevant consultation (see Matron's previous post on the issue). The good news is that other countries are also still dragging their feet, many of them having waited for the recent ECJ decision in relation to the Ireland challenge (again, see Matron's previous rant on the decision) before deciding whether they should implement the Directive at all, given it's dubious human right credentials.

What with all the excitement, Matron isn't quite sure whether to be pleased or disappointed at a piece of news she picked up at a conference in Salzburg last month, namely that the Austrian government, so far a stern resister of data retention, has now invited the Ludwig Bolzmann Institute for Human Rights in Vienna under the leadership of Prof. Hannes Tretter to draft the Austrian law concerning the implementation of the directive. Now, Matron has had the good fortune to participate in a seminar hosted by Prof Tretter last year, and he did not seem to her to be the kind of chap who would take the human rights issues arising from these measures lightly. On the other hand, the fact that the Austrian government does now seriously consider transposition seems a bit of a drawback for civil rights campaigners.

In a press release (in German), the Institute confirms that it is itself doubtful about the compatibility of the directive with human rights and that it expects further legal actions to be brought in the future, both before the ECJ and the ECtHR. However, in view of the fact that these actions could take years to be resolved and that the member states' obligation to implement the directive continues to exist in the meantime, the Institute is restricted to pursuing a course of damage limitation while, at the same time, considering the potential consequences, both in domestic and EU law, of transposing a legal measure that may violate human rights.

So there may be a smidgen of light at the end of the tunnel, but it remains a very long tunnel!