Intellectual property at Work

When a creator crafts intellectual property right (IPR) material, such as a new idea for a widget X, then the rights of such normally devolve onto her. This also includes matters of trade secrets. However there are a number of exceptions. One of these is if this inventive process occurs whilst in the employ of others. This is to stop a worker who having been paid, used resources and spent time denies the company the benefit of their work, A case such as the US SC's CCNV v. Reid can viewed as an aid to determine the test for if the work was made in the course of employment.


An example of such a term in a contract explicitly waiver any authorship rights would be:
"
An invention or discovery made by you will normally belong to you.  However, an invention or discovery made by you will become our property if it was made:-

a. in the course of your normal duties under such circumstances that an invention might reasonably be expected to result from those duties;

b. outside the course of your normal duties, but during duties specifically assigned to you, when an invention might reasonably be expected to result from these;
"


Note that IPR are ideas from people and not the people themselves. For instance there have been attempts to prevent people from working in related other companies in the same industries, so as to clamp down on potential IPR breaches. However this has been curtailed severely - in the EU by right to work provisions and in the US by perceived restrictions on Free trade. Thus if the worker brings her own talent, then that is acceptable : not worked on code which would be considered a theft of IPR. Likewise, customer lists and contact details would be items which cannot be used by the employee in a new job.


Another check on a broad application of this would be how related the IPR is to the work. So while what an employee develops while working in a company belongs to the company, if it outside the remand of her day to day working milieu then a case could be argued it belongs to the employee. For instance the work Einstein crafted on relativity at the Berne Patent office, if he had wished to apply IPR to it, would fall certainly within this.

How to protect Medical Data

Medical information and Database Systems

How does one model a data system, this was a question posed in recent discussion. Normally this should be implemented based on best practice of Database analysis and Requirements engineering.

This therefore involves a number of stages.

1- Talk to the clients

2- Create various use cases

3- Model the data using Entity-Relationship Diagrams

4- Normalise the Data from above.

5- Create the database

None of these directly impinges on legal matters, beyond the normal contractual obligations a designer owes the employer and the standard data protection rules that are present in now nearly all jurisdictions.

However, there is one aspect of data modeling where there is special emphasis, is that of sensitive data :specifically that which has its origins from medical patients. Sensitive data is of the kind mentioned as per the EU's Data Privacy Directive Article 8 as "racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health". Given the confidenital nature of the Doctor/Patient relationship, there must be a reasonable expectation of privacy.

Therefore the best practices which can be designed to secure this are:

- Ensure that there is adequate physical security. For instance where the data is being processed on site that simple steps such as having secure ids to enter a lockable room should be standard.

- Ensure that there is adequate electronic security. That access to computers must depend on at least one stage security methods; such as fingerprints or passwords unique to each user.

- That the Sysadmin ensures that the virus protections are functional and has a process for updating & patching the underlying operating system to combat Zero-Day exploits.

- Use the Database system itself as a tool to provide security. Instead of allowing a normal access user to view the underlying table, create views which filter out only data which the user can access to fulfill their role, but no more than that. In additional engaging auditing of who viewed, updated or deleted records, This provides an excellent tool to investigators overseeing any potential issues.

- Finally, if the data were encrypted this would potentially foil any large scale data breach.

Medical data is valuable. The UK's NHS has advanced plans in place to sell such to companies - link. This data will undergo anonymization so as to purge the personal details of patients: thus removing the data from the remit of the EU Data Directive. That this process can sometimes be undone is known from such well documented cases as Netflix. 

Thus this implies a need to design security considerations within the DNA of any database system which processes medical records. This should be done both to protect a valued economic resource and to remain within a statutory duty.

Data Privacy at Work and Anton Piller Orders

Data Privacy at Work and Anton Piller Orders

Privacy is a right. But like a majority of such is not absolute. There are usually a slew of other rights (several hundred according to Eric Posner's "Twilight of human rights") which need be balanced. Thus at work the employer has a measured right as well to monitor employees, within a reasonable limit.

The cases of Halford v UK (1997) 24 EHRR 523 and Copland v UK (2007) 45 EHRR 37  suggest there also has to be reasonable expectation of privacy at work to balance this. So if there was a credible threat of larceny involved it would seem to be correct to monitor, provided the employees were informed clearly and in good time. This type of data is also a resource so has a measure of value: for instance if companies are being merged, then up to a certain point it would be sensible not to swap employee personal data or at least make real efforts to anonymise the records in a commercial context.

Thus from an IT perspective, how does this relate to company supplied mobile devices such as smart phones? The data found within these, both in internal or external storage thanks to Moore's law, is always expanding. Even if no personal data or apps were permitted, the fact that geo-location data is captured during non-core office hours means not only is personal data being stored, but the protected class known as sensitive data could be viewed by employers. For instance, that an employee is going to a specialist doctor or at a rival's place of business would not be facts that the employee would wish to share.

These are not the only non-state actor that could view the personal data. There is the civil search warrant present in Common law countries known as the Anton Piller order. This is basically a search and seize order. This has been called the "Stealthbomber" of litigation. However, given that Data Protection is of EU Directive origin, would suggest that such orders need to modified to respect the personal information of the employee.

If there were to be shown the existence of procedural problems with the safety of this data, this would call into question the proportionality of any such order and would likely result in the designated Data Protection office becoming involved. The adverse publicity and possible fines could then apply as core individual EU rights are not lightly breached.

Embedded Videos and copyright

Embedded Videos

The Court of Justice of the European Union (CJEU) has recently ruled on a matter of copyright within Youtube videos. BestWater International Case (C-348/13). A German court relying on the EU power to seek the CJEU guidance on EU legal matters referred it. The material facts were that the applicant objected that two rival contractors had linked embedded youtube material from the applicant without permission on the rival's website

The legal question was

“

Does the embedding, within one’s own website, of another person’s work made available to the public on a third-party website, in circumstances such as those in the main proceedings, constitute communication to the public within the meaning of Article 3(1) of Directive 2001/29/EC, 1 even where that other person’s work is not thereby communicated to a new public and the communication of the work does not use a specific technical means which differs from that of the original communication?”

- Link to CJEU.

Result: Embedding a Youtube video on a 3^rd party site is not an infringement of copyright.

Context:

Taking a definition of copyright as “ that is is an identifier placed on works to inform the world of ownership”- “Fashion Law” by Ursula Furi-Perry.

My own understanding of embedding would be to hyperlink to another web-location and allow content, in this case a video, to be played.

Of interest: EU Copyright directive can be found here: http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32001L0029

Currently the judgement is only in German.

Ich kann nicht sprechen gut Deutsch : http://www.scribd.com/doc/244360017/EuGH-C-348-13-Framing (auf Deutesh) So my understanding is sparse, to say the least.

Comment:

So to peek beneath the surface of this ruling there are always a number of factors which influence the outcome: both the explicit ones of both public policy reasons for the “social good” and as part of the foundation impetus of the EU to boost trade as well as factors, borrowed from Posner's law and economics, on how well the embedded stakeholders have managed to lobbied so as to have their world view taken as the normative scenario. However, based on the outcome it seems common sense has prevailed.

Long term, what will be the fallout? i.e. does the rather overused term landmark belong to this.

Overall a cautious welcome. While it is rather trite at this stage to state that “Information wants to be free”, it can hardly be said that material on Youtube is out of the way. The material was in no way illegal uploaded onto the site or illegally kept their by the site's owners.

In fact, the ability to disable embedding was present.

“

If you've uploaded a video and do not want to allow others to embed your video on external sites, here's how to disable the option:

Visit your Video Manager.

Find the video you'd like to change and click Edit.

Click Advanced Settings under the video.

Uncheck the Allow Embedding checkbox under the "Distribution Options" section.

Click Save changes at the bottom of the page.

” https://support.google.com/youtube/answer/171780?hl=en, accessed 02/11/2014

Hence overkill. De minimus non curat lex, and this is rather an excellent reason for this to be followed. Thus the speed which the court dealt with this can be commended.

Interesting other view on this:

“The CJEU Continues to be the Court of Common Sense: The BestWater Case Ruling or Another Good Day for the Internet” -link.

Has Data Protection gone a step too far in Europe?

Data protection is very much part and parcel of the human rights driven approach that the EU has taken for personal data. Leaving aside the rather broad exceptions that are present for the state when it comes to gathering information on people when it comes to revenue and taxes (under section 8 of the Data Directive 1995) this is broadly a positive step. However as the saying goes, too much of a good intention can lead inter alia to a poor outcome. In this case, the use of data to better serve customer needs being waylaid.

This has in part been prompted by the reading of the book, What Stays in Vegas: The World of Personal Data by Adam Tanner. Here there are numerous negative examples of how Big Data and how the prevalence of digitization has lead to personal data being used for morally questionable outcomes. For instance the use of criminal mugshots in websites for the titillation of the general populace would likely give a typical Data Protection commissioner fits. This is very much in keeping with the commercial driven agenda where the worth of the data is key to understanding how the US crafts their rather minimalist data protection laws.

On the other hand, where commercial interests are present so too are the technological innovation that goes hand in hand with such. Key to this was the paper, written in part by CEO of a Vegas Corp. Gary Loveman, "Putting the Service-Profit Chain to Work" which traces the importance of the regular customer. Whilst he/she in an average transaction might not spend much, a satisfied customer in their lifetime would be the sum total of their entire spending and as such would be equivalent to the occasional bigger spender. This insight lead to more emphasis on data gathering on these heretofore unremarked segments of the market place and the use of Big data to better craft personalised products to keep them as regular spenders. As Tanner in his book mentions in the context of gathering this data, there is a market imperative to keep much of this open and voluntary as even the suggestion of "creepiness" would lose the client and perhaps draw the ire of the legislators. As well in parallel, this drives the technological innovation of Big data.

Thus while not saying their should be a whole scale rollback of the EU data protection, given that the current directive is being overhauled to make it fit for the Cloud/Big Data purpose, it would be relevant to note that the societal good can as well be serviced by for-profit motivations.

Case of Cartier, Montblanc and Richemont v BSkyB, BT, TalkTalk, EE and Virgin

The case of Cartier, Montblanc and Richemont v BSkyB, BT, TalkTalk, EE and Virgin (Open Rights Group intervening) [2014] EWHC 3354  deals with the Claimants Intellectual rights holder seeking to force the Defendants ISPs to block various websites that the Claimants indicate are hosting and selling counterfeit goods. An excellent summary of the background of this is found in the IPKat site [http://ipkitten.blogspot.ie/2014/10/online-enforcement-has-colour-and-name.html] as well the judgement on Bailli [http://www.bailii.org/cgi-bin/markup.cgi?doc=/ew/cases/EWHC/Ch/2003/3354.html&query=Cartier&method=boolean].

The summary is that with some caveats the rights holder is allowed under various legal provisions (domestic and EU) to apply for a blocking injunction. The upshot is that the offending sites can be blocked.

The Ancient Greeks had a phrase, men/de translated roughly as on the one hand and on the other.

Thus stealing has been perceived as a wrong doing since Biblical times. There are numerous and many laws on the subject of in both common and criminal law both on the direct action of stealing and the surrounding activities: from supply of house breaking tools to that of selling counterfeit goods on a newspaper (a paper based media of information exchange). So the latter example seems to be analogous close to a website allegedly selling similar goods and viewable via the ISPs network. However to differential, that while the Cartier judgment thankfully provides a sunset clause (with two years being suggested) it ignores the social,economic and IT framework that websites in general operate in. A vast majority of sites are both legitimate and their underlying software can be changed so as to restrict content on site. This coupled with the fact that sites have a value, with site names being auctioned depending on their worth means than any injunction, even if justified, can impact the sites owners. Furthermore there is an economic disparity between the power dynamic between corporate rights holder and site owners. From examples of how other take-down notices by rights agencies have been automated [https://www.techdirt.com/articles/20120308/03505018034/eff-argues-that-automated-bogus-dmca-takedowns-violate-law-are-subject-to-sanctions.shtml] so as to be overlying broad and having a censorious effect, then over eager use of injunction could have the same effect on the EU freedom of selling goods.

Therefore while counterfeiting is a problem that deserves solution, it should be a nuanced one that those not effect the rights and open innovative flow of data that rights holders themselves have used to sell their products.