Netherlands

[NL] Data Protection Authority on the lawfulness of processing data for online copyright enforcement

IRIS 2017-9:1/28

Robert van Schaik

Institute for Information Law (IViR), University of Amsterdam

On 6 July 2017, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, DPA), published a draft decision on the lawfulness of personal data processing proposed by Dutch FilmWorks B.V. (DFW). DFW had notified the DPA last March of its intention to collect and further process personal data for the purpose of the online enforcement of DFW’s copyright. Because DFW plans to process data without informing data subjects, Article 31(1)(b) of the Dutch Data Protection Act requires prior investigation by the DPA. With its decision, the DPA plans to declare the proposed processing lawful (for a previous decision, see IRIS 2016-5/23).

DFW is a Dutch film producer, and it intends to process data, including the capturing of Dutch IP addresses, to determine whether users of these addresses are involved in the distribution or reproduction of works protected by copyright. The DPA decision reports that DFW intends to perform three investigative stages. First, DFW will instruct a partner data processor to capture IP addresses and other data that occur in online traffic corresponding to unauthorised copies of DFW’s works, if such works are offered as torrents on indexing websites. The titles of the files offered, the IP-addresses and possible aliases used by publishers of the torrents will be indications for further investigation at the second stage, when DFW receives the data from the processor. DFW will then request Dutch internet service providers (ISPs) to submit further personal data of the customers using the relevant IP-addresses. At the third stage, DFW aims to approach data subjects to address the alleged infringement of copyright.

The decision continues by highlighting that the collection of data based on one’s own observations and without informing the data subjects creates a particular risk. The DPA also finds that the processing of data based on the subjects’ alleged infringement of copyright amounts to the processing of criminal data, but finds two grounds of exception for DFW. Thereafter, the decision critically assesses the proposed processing. Amongst other things, the DPA concludes that the processing will be necessary for the purposes of the legitimate interests pursued. DFW will use certain priority criteria in its investigation, such as exclusive focuses on DFW’s copyrighted works and Dutch IP addresses. Also, DFW will periodically delete data throughout the stages of investigation. In conclusion, the DPA believes that DFW’s proposed processing meets subsidiarity and proportionality standards, and that DFW’s legitimate interest outweighs the interests of the data subjects. Another point made is that during the first two stages of investigation, DFW will not reasonably be able to inform the data subjects involved due to a lack of contact details. The DPA, in its decision, requires that data subjects be informed in any case, as soon as DFW has obtained enough contact details, for example via the contacted ISP. The DPA opened a six-week consultation period, allowing parties to submit their opinion. Once the DPA has completed the consultation process, a final decision will be made and published.