legal aspects of crowdsourcing of audio visual information

Legal aspects of Crowd Sourcing of Audio Visual Information

Franziska Boehm

2Crowd Sourcing

Outline

• Data protection law and its impact on Crowd Sourcing

− Overview on sources of law

− Relevance of primary law

− Secondary law: Directive 95/46/EC

− Processing of personal data− Processing of personal data

− General Principles in data protection law

− Conformity of Crowd Sourcing with the principles

• Copyright law and its impact on Crowd Sourcing

-Sources of law

-Idea of copyright protection

-Crowd Sourcing and its conformity with copyright law

3Crowd Sourcing

Part I: Data protection law and Crowd Sourcing

4Crowd Sourcing

Data protection - Sources of law

Art.

16 TFEU

Art. 7, 8 CFR

Art. 8 ECHRArt. 8 ECHR

Directive 95/46/EC

Directive 2002/58/EC

General and sector specific data protectionlaw on the national level

Art. 16 TFEU

1. Everyone has the right to the protection of personal data concerning them.

2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down rules relating to the protection of individuals with regard to the processing of personal data

5Crowd Sourcing

protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.

The rules adopted on the basis of this Article shall be without prejudice to the specific rules laid down in Article 39 of the Treaty on European Union.

Art. 7, 8 CFR

Article 7: Right for private and family life

Everyone has the right to respect for his or her private and family life, home and communications.

Article 8: Protection of personal data

6Crowd Sourcing

Article 8: Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority.

Art. 8 ECHR

Article 8Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

7Crowd Sourcing

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

8Crowd Sourcing

Relationship of legal sources

Art. 8 ECHR

Coherentscope andapplication

of the rights

Art. 7, 8 CFR

9Crowd Sourcing

Obligations resulting from primary law

Member States must refrainfrom interfering with thefreedoms granted by the CFR

Member States must takeactions to ensure thatindividuals can live according

CJEU ECtHRand

individualfreedoms granted by the CFR

and ECHR individuals can live accordingto the granted rights

Article 7, 8 CFR; Article 8 ECHR

dual

10Crowd Sourcing

Secondary EU law

• Basic legislation is Directive 95/46/EC

� implements most of the requirements set by primary law

• Besides, there are sector-specific laws, e.g Regulation 45/2001(processing of personal data by the Community insitutions and bodies) or Directive 2002/58/EC (processing of personal data in electronic communications sector)

11Crowd Sourcing

General data protectionPrinciples

Personal datamust be:

Fairly andlawfully

processed

Processedfor limited purposes

Adequate, relevant and

not secure

Onlytransferredto states

withadequateprotection

must be: not excessive

Accurate andup-to-date

Not kept forlonger thannecessary

Processedin line with

the datasubjects‘

rights

12Crowd Sourcing

Personal data

Definition in Article 2 (a) Directive 95/46/EC:

"personal data" shall mean any information relating to an identified oridentifiable natural person ('Data Subject'); an identifiable person isone who can be identified, directly or indirectly, in particular byone who can be identified, directly or indirectly, in particular byreference to an identification number or to one or more factorsspecific to his physical, physiological, mental, economic, cultural orsocial identity.

13Crowd Sourcing

Personal data

Problem: case-by-case decision whether personal data is concerned

Typical and unquestionable examples for personal data:

14Crowd Sourcing

Personal data

Does material resulting from crowd sourcing contain personal data?

Example: Video of a concert recorded by an audience member with a mobile device that shows not only the artist but also people in the audience

Can an individual be identified?

�Recital 26 of Directive 95/46/EC: „whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person”

�Broad definition leads to the conclusion that the video may contain personal data.

15Crowd Sourcing

Processing of personal data

Second crucial criterion: processing of the data

Definition in Article 2 (b) Directive 95/46/EC:'processing of personal data' shall mean any operation or set ofoperations which is performed upon personal data, whether or not byautomatic means, such as collection, recording, organization, storage,automatic means, such as collection, recording, organization, storage,adaptation or alteration, retrieval, consultation, use, disclosure bytransmission, dissemination or otherwise making available, alignmentor combination, blocking, erasure or destruction

16Crowd Sourcing

Processing: CJEU in “Google Spain”

erase

link

Claimant

erase

Private company

17Crowd Sourcing

CJEU in “Google Spain”

Problem: Processing of personal data?

CJEU stated, that an operator of a search engine is

collecting,

retrieving, Finding can berecording,

organising,

storing,

disclosing and

making availablepersonal data.

Finding can betransferred tomost of the

projects.

18Crowd Sourcing


Problem: Is the operator of the engine the “controller“?

Operator was regarded as controller, because

- of the clear wording of Article 2(d),

- an effective protection requires extensive interpretation

- operators plays decisive role in dissemination of the data

- activity of the operator is additional to that of the third party originally acting

- users get a structured overview of the information

Concerning the projects a similar reasoning is likely.

19Crowd Sourcing



Fairly andlawfully

processed



not secure







the datasubjects‘

rights


• Principle of proportionality requires a fair balance of the opposinginterests

20Crowd Sourcing

“Balance may however depend, in specific cases, on the nature of the information in question and

its sensitivity for the data subject’s private life the interest of the public and on the interest of the public in having that

information (…)”

Claimant‘s interests outweighed Google's interests!

Lessons to be learned

1. Directive 95/46/EC is applicable, if it comes to a processing of personal data.

2. There might be more than one party processing personal data.

21Crowd Sourcing

3. The Directive contains several strict data protection principles that every party has to observe.

4. Processing of personal data is only allowed if one of the explicitly mentioned criteria in the Directive is met (next slide).

Legitimate processing

22Crowd Sourcing


Fairly andlawfully

processed



not secure







the datasubjects‘

rights


Article 7 allows the processing under certain circumstances. Most relevant for this meeting are Article 7 (a) and 7 (f) of Directive 95/46/EC:

23Crowd Sourcing

Consentby datasubject

Necessary forpurposes oflegitimateinterests


1. Consent:

Unambiguously given

Freely given

By the data subject

24Crowd Sourcing

2. Necessary for purposes of legitimate interests:

Balancing of interests is necessary; Example of aspects involved:

- Nature of information

- Affected fundamental rights

- Sensitivity of information

- Public interest

- Role of the data subject in public life

Examples: balancing opposing interests

25Crowd Sourcing

Different results are possible.

Purpose limitation

26Crowd Sourcing


Fairly andlawfully

processed



not secure







the datasubjects‘

rights

Security

27Crowd Sourcing


Fairly andlawfully

processed



not secure







the datasubjects‘

rights

Data Minimization

28Crowd Sourcing


Fairly andlawfully

processed



not secure




Accurate and up-to-date



the datasubjects‘

rights

Conclusion: data protectionCan you identifyindividuals in the

video

YES NO = not a DP

29Crowd Sourcing

YES

Do you have consent or a legitimateinterest

NO = not in accordance withdata protection

law

YES = you needto respect thedata protection

law

problem

Part II: Copyright law and Crowd Sourcing

30Crowd Sourcing

Copyright law: Sources of law

Relevant legislation stems from EU secondary law as well as from international treaties:

�Directive 2001/29/EC

�Berne Convention for the Protection of Literary and Artistic Works

31Crowd Sourcing

�Berne Convention for the Protection of Literary and Artistic Works

�WIPO Copyright Treaty

�WIPO Performances and Phonograms Treaty (WPPT)

Transposed by national law

The idea behind copyright protection

32Crowd Sourcing

Exclusive rights

33Crowd Sourcing

reproduction

Communication Author

Communication to the publicand making

available to thepublic

distribution

Authorhasexclusiverights of

Conflict of Copyright law and Crowd Sourcing

34Crowd Sourcing

Copyright law must be considered, when a protected work is affected:

Copying, connecting, editing the material � exclusive right of reproduction

Uploading the material onto a server � exclusive right of making it publicly available

Requirements to act in conformity with Copyright law

35Crowd Sourcing

1st alternative: license- single licensing- collective licensing

2nd alternative: legal exemption, e.g.- reproduction for private use (= only for the private persons… )- reproduction for private use (= only for the private persons… )- reproduction for usage in libraries, museums etc.- usage solely for teaching or research- usage for purposes such as criticism or review of published

works

It seems unlikely that a legal exemption will apply in the case of Crowd Sourcing. Therefore, licenses become necessary requirements to realize the projects.

Excursus: Project aims at facilitating just a platform

36Crowd Sourcing

Operators are obliged to check, if illegitimate material is uploaded.On request of the rightholder they might be obliged to block the content.

� Projects cannot be realized effectively

Conclusion

• Data protection needs to be decided on a case-by-case basisand if data protection law applies, data protection principles need to berespected

37Crowd Sourcing

• IP law requires permissions, if the rights of rights holders are concerned.

38Crowd Sourcing

Thanks for your attention!

Any questions?

legal aspects of crowdsourcing of audio visual information

Documents