The High Court has ruled that Eircom and four major record companies could lawfully implement a graduated system for dealing with customers detected repeatedly sharing copyright-protected material online.
EMI Records, Sony BMG Music Entertainment, Universal Music Ireland and Warner Music Ireland had sued Eircom over online copyright infringement by some of its customers. The court expressly noted that Eircom itself was not accused of willingly infringing copyright or participating in copyright theft.
After eight days of evidence, the parties settled the case in January 2009. Their agreement provided for a three-stage response when monitoring technology identified an Eircom IP address involved in unauthorised peer-to-peer sharing of the plaintiffs’ material.
A first detection would generate a warning. A second would trigger a stronger written warning. Following a third detection, Eircom would review the material and, subject to representations and specified exceptions, terminate general internet access. Telephone and television services delivered through the connection would remain unaffected.
The Data Protection Commissioner subsequently raised three questions about whether the system complied with data protection legislation.
Mr Justice Charleton held first that the IP addresses in the hands of the record companies were not personal data in the circumstances because the companies neither knew nor sought the subscribers’ identities through the protocol.
Second, he held that Eircom had legitimate grounds to process subscriber information in enforcing contractual conditions prohibiting copyright infringement. The termination system was not disproportionate, particularly because the protocol allowed representations and exceptions for matters including medical needs, livelihood and legitimate business use.
Third, the judge held that the process did not amount to processing allegations of criminal offences. It was directed at civil copyright infringement and did not require proof of the mental element necessary for a criminal conviction.
The court therefore concluded that the settlement could lawfully be implemented. The ruling settled the data-protection compatibility of this particular protocol, not criminal liability of individual subscribers.