Mills & Reeve: Technology Law Update

Amazon’s Ts and Cs fall foul of consumer protection law

Online retailer Amazon’s European operations are based in Luxembourg. Like most online retailers, it uses a standard set of terms and conditions, and in Amazon’s case, these are stated to be subject to Luxembourg law. A minor point, you might think, as consumer protection law is fairly standard across Europe. But there are differences from country to country, and the EU court has decided that the Ts and Cs fall short in failing to properly explain the situation.

Verein für Konsumenteninformation, or VKI, is an Austrian consumer protection body. It took Amazon EU to court over several of its standard Ts and Cs, including the governing law term.

Fairness for consumers

There is a network of legal instruments that say which law applies in different situations. Normally, parties entering into a contract are free to select the law that will govern it. But there are specific rules for consumer contracts and particular care is needed to stay within the fairness rules applicable to consumer contracts. (More on those here.)   

There is no automatic rule on the fairness of a term – a court has to analyse the whole situation to decide, looking at whether the consumer is put at a disadvantage by the contract. But the court concluded that a standard term used in e-commerce specifying the law of the member state where the supplier is established could be unfair if it leads a consumer to believe that only the governing law applies. The consumer might think that he does not have the mandatory protection of his home state.

Check your standard terms

Consumer-facing online businesses should check their standard terms. Are there choice of law clauses that may not tie in with where consumers are based? If so, explanatory wording might be needed to explain to a consumer that the mandatory protection available under the law of his home state applies. And as with all consumer contracts, this will need to be in plain and intelligible language that ordinary consumers can understand.

Hannah Shaw

Do you need to review your use of images after repeal of s.52?

The UK has recently repealed a fairly obscure bit of copyright law – should you be worried?

Since the repeal of s.52 of the CDPA (Copyright, Designs and Patents Act 1988), on 28 July 2016, the main impact will be felt my manufacturers and distributors of furniture and interior design products. But there may also be an impact on use of 2D images of the affected objects. 

As we explained in our previous blog on this subject, s.52 of the CDPA meant that if certain types of artistic work had been exploited industrially (51 or more articles produced) copyright would expire 25 years after first marketing. Artistic works are a broad category, including graphic works, photographs, sculptures, collages, architecture and works of artistic craftsmanship. But several classes were carved out, leaving the main class of works affected as industrially produced works of artistic craftsmanship.

There is some debate about what qualifies as a work of artistic craftsmanship. Broadly speaking:

• it should be “artistic”:
  • some aesthetic quality is required, although it need not be a work of fine art; and
  • evidence of the creator’s intention to create a work of art is relevant.
• it should involve “craftsmanship” evidenced by:
• the exercise of skill on the part of the creator; and
• the creator taking pride in his workmanship.

Typical examples are hand-painted tiles, stained glass, cutlery, needlework, cabinet making and original jewellery.

As a result of the repeal, images, photos or other 2D copies of works of artistic craftsmanship that have been industrially produced will now have protection in the UK for the creator's life plus 70 years. It may now be necessary to review your images library, and any applicable licence agreements, to avoid infringing the revived rights.

You can read more here.

Laura Canham

Fines for cartel using automatic repricing software

UK competition regulator the CMA has said that online and digital markets are a priority area. Online markets can help retailers to compete more effectively, keeping costs low and providing greater choice, as well as enabling consumers to find the best prices But they can also be manipulated to undermine these benefits to the consumer.

We have previously reported on cases where the CMA clamped down on attempts by suppliers to keep online retail prices at or above minimum levels to protect margins for bricks and mortar distributors. Now the CMA has fined an online licensed merchandise seller £163k for use of automated repricing software to keep prices high.

Competing online sellers Trod and GB Posters agreed not to undercut each other’s prices for sport and entertainment posters. Both companies used automated repricing software configured to keep the prices high, rather than to reduce them. (Amazon itself was not involved in the arrangements.)

GB Posters blew the whistle to the CMA and Trod was subjected to searches by both the CMA, and the police acting on behalf of the US Department of Justice in a separate criminal investigation.

Trod’s admission of its part in the arrangement, and cooperation with the investigation, means that the fine was reduced by 20%. And as whistleblower, GB Posters will benefit from the CMA’s leniency policy and so escape a fine.

This case highlights the attention the CMA is giving to e-commerce. Retailers need to be aware of the rules against market manipulation, and should be ready to report suspicious activity when they come across it.

Simon Elsegood

Relief in the cloud community as Microsoft wins appeal in Irish email server case

Microsoft has successfully resisted an attempt by federal agents to gain access to email data stored on servers in Dublin in the latest round in a controversial legal battle. US courts are not always shy about extra-territorial application of their laws. But a recent ruling of a federal appeals court reverses an earlier decision to allow access to email servers in Ireland under a 30-year old statute.

The search warrant

US law enforcers had applied for a search warrant in 2013 under the Stored Communications Act of 1986 to collect evidence relating to a narcotics case. The nationality and location of the owner of the email account are not revealed, but Microsoft’s cloud storage system generally stores communications at a datacentre physically close to the customer to reduce network latency.

The 2014 rulings – warrant upheld

Microsoft produced some US-held data, but it argued that legislators had never intended the SCA to be applied to data stored outside US borders.

In 2014, the ruling of a district court magistrate upholding the warrant  was greeted with widespread concern. Microsoft’s appeal to the district court failed, the judge concluding that so long as no federal agents set foot on Irish soil there was no unlawful extraterritorial action. Microsoft in the US was able to access the Irish-stored data and so could be compelled to provide it.

The 2016 ruling – warrant quashed

Now three appeal court judges have agreed in overturning the 2014 decision. Although the SCA was passed at a time when the world was very different, the judges concluded that emails stored in the cloud still have a physical location. The US authorities could make use of international channels to access data held in other countries.

A long list of technology companies, the Irish state and civil liberties organisations, fearful of the implications if the warrant were upheld, had supported Microsoft’s position. The ruling has been met with relief. It sits rather better with the recently agreed EU-US Privacy Shield than the earlier decision to require disclosure.

The US Department of Justice is said to be considering its options, and so a further appeal is possible.

EU-US Privacy Shield for transatlantic data transfers finalised

Transfers of personal data from most European countries to the US have been exposed to legal attack since October 2015, when privacy campaigner Max Schrems successfully sued the Irish authorities over data transfers made by Facebook Ireland.

That David-and-Goliath litigation saw the end of the “Safe Harbor” decision protecting transatlantic data flows when the European courts declared it invalid. While other legal methods of data transfer are available, the Safe Harbor was widely relied on especially by technology businesses.

A new Privacy Shield

Since then, the EU and US authorities have been working on a replacement – the EU-US “Privacy Shield” After a first attempt was rejected by national and EU regulators, a tightened-up version has now passed the test. The Commission’s press release and FAQs document provide a helpful summary.

The revised version, consisting of:

• an adequacy decision describing the system of self-certification through which US organisations commit themselves to a set of privacy principles; and
• a set of seven Annexes dealing with the arrangements that the US authorities will implement to safeguard EY citizens’ data.

US companies will be able to certify themselves with the US Department of Commerce from 1 August. There will be an annual joint review process to check that the system is working.

While the certainty offered by agreement of the Privacy Shield  has been widely welcomed, this may not be the end of the story. Max Schrems, the activist responsible for the demise of its predecessor,  has told journalists that the deal is full of holes and likely to fail a legal challenge – although he does not want to be the one to bring it.

What does this mean for the UK?

UK privacy regulator, the ICO, has indicated that it will press for UK laws to track those of the EU.

It may be that the UK will adopt most of the changes due to take effect in 2018 under the  GDPR, but leave out some of the more onerous obligations that could impede the activity of SMEs for example. If the UK ends up with a relatively distant relationship with the EU compared to an EEA member like Norway, privacy laws could diverge. In that case, the UK will have to demonstrate adequacy of protection for European citizens’ privacy, like the US has done, if it is to do business freely across Europe.

Peter Wainman

The impact on investment in growing businesses after a vote for Brexit

The UK’s vote to leave the European Union has led to political chaos, with a change of Prime Minister certain and a general election a distinct possibility. We have already seen turbulence in the financial markets both within Britain and around the world, and a number of transactions put on hold or postponed. What does this mean for investment in small and growing businesses, especially those in the technology and life sciences sectors?

EIS likely to remain stable

The good news is that the Enterprise Investment Scheme, or EIS, seems likely to remain stable while the negotiations proceed. This scheme offers substantial income, capital gains and inheritance tax benefits to investors in small unquoted companies.

But the EIS has been subjected to criticism by the EU Commission under the EU’s state aid rules. Approval of the latest arrangements in October 2015 was hard won. Although further improvements have been under discussion, changes to the scheme now seem unlikely given the range of other pressing issues to contend with, on both sides. So we expect the current regime to remain in place for the next two years and more.

Question marks over Investor appetite

The greater question may be investor appetite. With the current uncertainty expected to last for years rather than weeks, will investors prefer to hold off for the time being while the dust settles? This could put a dampener on a generation of new businesses that need investment now. This presents a pessimistic picture for entrepreneurs.

However, the prospect of increasing tax rates to protect government revenues in a falling economy, alongside continuing low interest rates as the Bank of England acts to maintain liquidity may mean that investors turn to opportunities like EIS investments to maximise their returns and minimise an increasing tax burden.

In the longer term, some are optimistic that moving away from Europe’s tough stance on regulation of investment activity may improve the situation both for investors and growing businesses.

Zickie Lim

The UK is leaving – what will it mean for technology and life science businesses?

After yesterday’s leave vote, the UK government will need to start the process of disentangling the country from the EU. Formal steps to trigger withdrawal under Article 50 of the EU Treaty are currently expected to await Prime Minister David Cameron's replacement in the coming months, although informal negotiations may begin sooner. What will be the legal impact for innovative businesses?

Patent protection

A major casualty for Britain will be its membership of the planned Unitary Patent.

The UK’s membership of the European Patent Convention would not be directly affected by Brexit as membership goes beyond EU countries. Some governance matters are for EU members only, and so the UK will lose influence.

The same is not true of the Unitary Patent system as this requires EU membership. Ratification of the Unified Patent Court Agreement could still go ahead without the UK. Under the rules, another member state could take the UK’s place as one of the three member states having the highest number of European patents in the year before the UPC Agreement was signed.

This would leave the UK outside of the Unitary Patent and businesses would have to decide whether it was worthwhile to pursue separate UK national protection in each case.  For businesses with principal interest in trading in the UK, the choice of the Intellectual Property Enterprise Court or the Patent Court will remain highly attractive.  For those with an international perspective, there is a risk that the UK’s influence on the enforcement of patent owners’ rights will diminish, particularly in key areas such as pharmaceuticals.

In theory, the London-based seat of the central court for cases involving chemistry, pharmaceuticals and the life sciences could remain, although it seems likely that other participating countries would want this relocated to within a member state.

EPO president Benoît Battistelli has indicated that a British departure could delay the introduction of the Unitary Patent for the other participating nations.

Trade marks and designs

The central EU trade mark has been a mainstay for business since 1996, relied on to provide pan-EU trade mark cover with a single registration, with a considerable saving of administrative burden and cost for businesses operating in several jurisdictions. While UK businesses will still be able to seek protection for their brands under this system, the EUTM will no longer extend to the UK. The situation is similar for the Community Registered Design, which protects the appearance of products or product features.

Owners of EUTMs and CRDs may be offered an opportunity to acquire UK registered rights on payment of a fee, as was the case on Ireland’s separation from the UK in 1921. This could leave those with large portfolios facing substantial administrative and fees burdens in re-registering all of their rights, and then maintaining those separate registrations.

Alternative approaches include

• allowing existing EUTMs and CRDs to continue to apply to the UK until they are up for renewal; or
• automatically converting existing EUTMs and CRDs into UK registered trade marks and designs.

But dealing with separate registrations is relatively straightforward compared with some of the difficult issues around the exhaustion of rights and Europe-wide licences. We discussed these points in more detail here.

Businesses with trade in the EU will certainly have to consider registration both nationally and in the EU; those with limited trade across the EU may face challenges as to the validity of their EU trade mark, for non-use in the EU.

Across all of the IP rights there are likely to be additional costs and administrative activity, both as the systems are separated and going forwards. Enforcement may become more costly and complex as the UK separates itself from pan-EU systems and starts to diverge from European law.

Data protection

The recently reformed EU data protection rules are due to take effect in May 2018. By that time, the UK is likely to have developed a direction of travel for separation, even if it is some way off completing the process. Does that mean the tougher new regime for personal data would not be effective in Britain?

It seems not. The Information Commissioner’s Office has already indicated that the UK’s history of protecting personal data, and the importance of clear laws and safeguards in the growing digital economy, will mean that protection will not fall away with a departure from the EU. And as the recent negotiations with the US over data transfers has shown, any kind of data-rich organisation is likely to face difficulties in trading with EU consumers and businesses if it operates under laws that are not regarded as offering sufficient privacy safeguards to individuals. The UK is likely to track the EU system, at least in the short term.

Consumer laws

Consumer law is closely harmonised with regulations such as the consumer contracts regulations based on EU law. These regulations will not disappear overnight, but we can expect that they will be altered or removed over the next few years. This leaves businesses with some difficulties in the short term, as they must currently comply with complex obligations that often require changes to the ordering and payment processes. However, in the longer term the regulatory burden for UK transactions may become less onerous. Businesses with sales across the continent, however, will need to comply with EU law.

Of course, many consumer laws are home grown. The Consumer Rights Act 2015, for example, which recently introduced major reforms to consumer transactions, is a mixture of home made and EU law, and so may be largely unaffected.

Pharmaceuticals and medical devices regulation

The effect on life sciences business will be substantial. The centralised pharmaceuticals approval process is compulsory for more advanced medicines and the decentralised process is closely harmonised between member states. Given the need for drugs companies to sell their products around the world, and the trend around the world to harmonise standards and processes, it seems unlikely that substantial change to medicines laws will be a priority. However, some divergence is to be expected over time, and costs are likely to increase for businesses as they deal with a separate UK regulator and obtain separate product authorisations. Arrangements will be needed to ensure continuity of existing product authorisations and to deal with issues such as variations.

The central EU regulatory body, the EMA, is currently based in London. We can expect a new location to be found elsewhere on the continent.

Medical devices law does not provide a centralised approval process but sale of medical devices across the EU generally depends on validation by a relevant EU body. These rules are currently being tightened up – the UK will have to take a position on whether it tracks these developments or adopts a new direction.

Horizon 2020

The impact on participation in EU funded research under the Horizon 2020 programme will depend on what arrangements the UK negotiates. Although non-EU researchers can participate in Horizon 2020 projects, they are not necessarily eligible for funding. Certain associated countries such as Norway are permitted to participate on the same conditions as EU members, but this requires a separate agreement to be reached.

Forthcoming changes

A range of important EU initiatives are in progress affecting the digital economy, medical devices, trade secrets law to name but a few. The UK will have to determine how far it takes up any of these changes, and if it does not, how to enable trade between the UK and the remainder of the EU.

There will be many conflicting priorities for the UK government going forwards. Not all of the areas of uncertainty will be addressed promptly, and there is likely to be confusion and lack of clarity for business in many areas. We must hope that a sensible approach to compliance and enforcement is taken as these issues are sorted out.

UK competition watchdog warns suppliers and retailers over online pricing

Online retailing is growing fast. The Centre for Retail Research highlights year on year expansion of retail spending across Europe and North America at around 15% or more.

As e-commerce grows traditional bricks-and-mortar distributors retailers feel the pinch. They cannot easily reduce costs on showroom or shop rent, sales staff etc. to the levels that online sellers enjoy, so the pressure is on to keep prices to the final customer up in order to protect margins. Manufacturers of consumer goods can find themselves under pressure from their bricks-and-mortar retailers to control the prices that online sellers charge. What many consumers, small businesses and salespeople do not realise is that agreeing prices in this way is illegal.

Earlier this week the UK competition regulator, the Competition and Markets Authority, issued an open letter to suppliers and retailers making it clear that these practices are prohibited by competition law.

The letter flags two recent situations where enforcement action has been taken. In one case, supplier of commercial catering equipment ITW was fined over £2m for resale price maintenance. ITW operated a “minimum advertised price” policy and threatened dealers with sanctions such as increased cost prices or even stopping supply if they failed to comply.

This substantial fine could have been even higher if ITW had not admitted its involvement and fully cooperated with the CMA investigation and subsequent requirements for staff training. Commenting on that case, CMA Senior Director Ann Pope said

“Price competition from online sales is usually intense, given the ease of searching on the internet. ITW’s practice of setting minimum advertised prices restricted dealers from offering discounted prices online, reducing competition across online and ‘bricks and mortar’ sales, and denying buyers the benefit of lower prices for Foster’s commercial fridges. The ultimate losers are customers of restaurants or caterers, for whom the cost of their meal could have risen.”

The CMA’s open letter strengthens the case for both manufacturers and online retailers coming under pressure to control undercutting. The potential penalties are substantial – with fines of up to 10% of global turnover for both suppliers and retailers possible, not to mention the cost in management time, reputation and legal support required to deal with an investigation. Full or partial protection from penalties is often extended to whistle-blowers and those who cooperate fully.

The competition authorities are alive to the issues. As the letter says:

“The message from these recent cases is clear: the CMA takes resale price maintenance seriously and is focused on tackling anti-competitive practices that diminish the many benefits of e-commerce.”

Simon Elsegood

Threatening IP infringers - what you can (and can't) say

The UK’s unjustified threats legislation is intended to prevent IP rights-holders from abusive behaviour – threatening to sue a competitor’s customers, for example, to persuade them to take their business elsewhere. While there is still a place for these rules, they have become outdated and inconsistent between the various forms of IP. The Intellectual Property (Unjustified Threats) Bill aims to tidy up and modernise the threats rules.

Key changes include the following:

• Currently, someone accused of infringing can only sue for threats to bring proceedings in a UK court. This will be changed to so that it relates to threats to bring court proceedings for an act done or intended to be done in the UK. This will bring into scope threats relating to the infringement of European Unitary Patents, once that system comes into effect.
• A consistent approach will be applied across the different types of IP. In each case threats actions will be excluded in relation to
• primary acts – importing or manufacturing a patent product for example
• primary actors – those who carry out primary acts, such as manufacturers or importers, rather than retailers.
• A safe harbour for “permitted communications” will be provided so that IP owners can exchange information and enter into settlement discussions with potential infringers without risking triggering a threats action. The legislation sets out in detail what communications fall within this category and will need to be followed carefully. Note that this does not cover situations where someone is being asked to stop doing something, to hand over or destroy something or to promise not to do something in relation to the disputed IP right.
• The existing defence to a patent threats action, where the right-holder can show that they have taken all reasonable steps to identify the primary actor and have given this information to the secondary actor, will be extended to trade marks and designs.
• Professional advisers will not be at risk of a threats action where they are acting on instructions and have notified the infringer who their client is. This is to avoid situations where an infringer uses the threats rules tactically to drive a wedge between a right-holder and their advisers.

Intellectual Property Office guidance explaining the changes can be found here.

Because this Bill has come through the Law Commission process it is likely to pass fairly swiftly into law. Although there is bound to be a bedding-down period while the new provisions are tested, the reform is expected to provide a clearer and more coherent system for IP owners and those threatened with litigation.

Consumer law failings in the cloud storage market

Competition watchdog the Competition and Markets Authority (CMA) has raised concerns about the fairness of consumer-facing terms in the cloud storage market. In an open letter, the CMA has invited businesses to review their T&Cs to ensure legal compliance. Reports suggest  that Dixons Carphone plc, JustCloud and Livedrive have already committed to fairer terms.

Market research

The CMA’s full report on its consumer law compliance review highlights the rapid growth of the cloud sector:

“It is estimated that the European cloud computing market alone could be worth €44.8 billion by 2020 (up from €9.5 billion in 2013).”

The report brings together provider, industry and customer views of the market, and points to areas of concern.

Compliance with consumer law

Along with general problems around transparency, the CMA has particular concerns about terms allowing a cloud provider to:

• unilaterally vary the price, service or contract without giving consumers adequate notice or an opportunity to cancel the contract without penalty;
• terminate or suspend services, particularly without notice;
• automatically renew at the end of a fixed term without giving consumers reasonable notice or the opportunity to cancel (including preventing consumers from exercising their statutory cancellation rights after renewal);
• limit its liability; or
• prevent consumers from bringing legal proceedings in their local courts and under local law.

A handy checklist identifies terms that may cause problems.

Consumer confidence in cloud storage

In its report, the CMA invites providers to increase consumer confidence and trust in cloud storage services. Although the CMA found little evidence of security or privacy problems, it detected concerns by consumers about data security and indicated that a lack of understanding about product features or confidentiality may lead customers to choose unsuitable services.

Competition issues in the sector?

The CMA’s review focused on compliance with consumer protection law but were prepared to take action against any competition issues their findings exposed. Businesses will be glad to learn that no such issues were identified.

Penalties for consumer law failings

Consumers can challenge unfair terms in court and, if a court considers a term to be unfair, it is not legally binding on the consumer. The CMA and Trading Standards may also take enforcement action against businesses to ensure compliance. In a separate consultation in March-April 2016 BIS identified a possible need to boost enforcement, and asked for views on proposals to introduce civil fining powers perhaps imposed by an enforcer or by civil courts at an enforcer’s request. The results of that consultation are under analysis.

And, of course, businesses cannot ignore the potential impact of bad publicity.

Hannah Shaw

.