Black Box

As artificial intelligence (AI) becomes ever more popular, people enjoy the convenience of technology and worry about potential risks at the same time. Facial recognition is a good example. It helps to smooth the payment, improve public security and facilitate identity verification. However, it causes leak of sensitive personal information, discrimination and feeling of monitoring. Will you be a supporter or an opponent for facial recognition?

On 21 April 2021, European Commission published the EU draft regulation for Artificial Intelligence, adopting a risk-based approach to regulate AI design and deployment. Does this approach work? The following article will provide insights to you.

The link of shared blog is attached below:

In the beginning, I want to lead you into the interface of intellectual property rights (IPRs) and the internet (IT). Many legal and practical questions arise, IP protection for software is one of these. Invention implemented by computer programs could be protected with patent as long as it fulfill the patentability test whether it makes a technical contribution. Lantana Ltd v The Comptroller-General of Patents, Design And Trade Marks is one of the significant cases.

The link of shared blog is attached below:

( * Picture is searched from Bing.com. If there is any infringement, please contact me immediately. )

This week we still pay attention to the hot bottom issue - online privacy, particularly in smart tech context. "Smart cities" have been a buzzword in recent years.  After the excitement in the beginning, people are now more worried about the issues of privacy and security. How can we protect personal information data? How can we regulate it? What’s the future going to look like? Hope this blog could provide you with inspiration.

The link of shared blog is attached below:

The tech giant Google LLC (“Google”) has been fined twice for violations of the EU General Data Protection Regulation (“GDPR”) and the French Data Protection Act by the French Data Protection Authority (the “CNIL”). The financial penalty was up to €50m and €100m in 2019 and 2020, respectively. The facts and reasoning will be briefly introduced below.

The financial penalty in 2019 was the result of collective actions filed by two non-profit associations - None Of Your Business (“NOYB”) and La Quadrature du Net (“LQDN”). After its inspections, the CNIL asserted that Google had failed to (1) meet GDPR’s obligations of transparency and information, and (2) obtain valid consent from users for personalized ads.

The tougher penalty in 2020 was justified by the seriousness of three breaches of Article 82 of the French Data Protection Act. The CNIL found Google’s failure to (1) obtain prior cookie consent from users; (2) provide adequate information regarding the cookies; and (3) opt out the ad personalization.

It is not hard to see the cookies become the bone of contention in the disputes between Google and CNIL. So, what is the cookie? A cookie is a small identifying text file, which is added to user computer by a browser on behalf of a website. A first-party cookie is created and placed by the website you’re browsing. This cookie is often used for user experience as it is responsible for remembering passwords, basic data about the visitor, and other preferences. While a third-party cookie is more problematic, it is created and placed by other companies and vendors mainly in the ad tech industry. Numerous brands use third-party cookies to collect data that helps them target ads to the right audiences.

Fueled by the development of third-party cookies, digital advertising has become a big business. However, it is noteworthy that online tracking and behavioural targeting do raise serious privacy concerns. Resale and sharing of personal data pose security threats to individuals and public. That is why advertising cookies generally requires the prior consent from internet user to be lawful. In Europe, Article 4(11) of the GDPR defines consent as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’. Then Article 7 provides the conditions for consent. Besides, on 4 May 2020 EDPB (European Data Protection Board) issued fresh guidelines titled ‘Guidelines 05/2020 on consent under Regulation 2016/679’. The Guidelines this time specifically further clarified the issue of “cookie walls” and scrolling and consent. In short, the GDPR has quite stricter requirements for valid consent, compared to other data protection laws.

Now, let’s turn to Google’s response. In January 2020, Google announced its sensational plan to block third-party cookies from Chrome internet browser within two years. According to latest announcement, Google delays its plan to phase out third-party cookies until 2023. Financial Times described the ban as “the cookie apocalypse” and underpinned digital advertising for 25 years.

In my opinion, the end of third-party cookies does not really mean the end of behavioral tracking on the Internet, neither means the happy ending of privacy protection. It is predictable that first-party cookies will rapidly increase and new technology will be developed to exploit more out of first-party data. To sum up, the future is still full of risks, and the law always needs to be ready to catch up with the technology.

This week we will focus on Blockchain, which is a decentralized, shared, encrypted database. Someone indicates that Blockchain to information technology is what Internet to the world. Blockchain does arise a number of legal challenges and risks, but Professor Kevin Werbach’s opinion deeply impresses me. Kevin Werbach’s put forward that “The central question is not how to regulate blockchains but how blockchains regulate. They may supplement, complement, or substitute for legal enforcement. ”

The link of shared blog is attached below:

With the rapid development of technology, linking poses great challenges on courts to determine whether it constitutes the infringement of the right of communication to the public. As Andrew McWhirter  stated that “courts are required to balance the rights of the copyright owner against the right to freedom of expression and access to information on the Internet”.

  WIPO Copyright Treaty Article 8 provides the right of communication to the public, which is an exclusive right of authors of literary and artistic works to authorize communication to the public of their works including the making available to the public. Referring to WIPO Copyright Treaty, Copyright Law of People's Republic of China defines the right of communication through information network as ‘the right to make a work available to the public by wire or by wireless means, so that the public may have access to the work at time and place chosen by them’. Also, the right contained in Article 3(1) of the “InfoSoc Directive”  is identical to WIPO’s. That’s why I compare decisions of Chinese Courts and CJEU.

In China’s practice, making available to the public sticks to uploading works to the server, in other words, the infringement requires that the copied works must be found on the server despite technical means. However, deep linking does not actually store the copied work on its own website and could be invalidated by the removal of initially communicated site. Deep linking does not constitute an act of the communication to the public; therefore, it does not involve the infringement of the exclusive right in China.

As opposed to China’s approach, CJEU adopts a right-oriented approach and summaries three elements to the test: (i) the work must be communicated; (ii) the communication must be to the public; and (iii) the allegedly infringing communication is unauthorized. It is noteworthy that these different elements are interactive and should not be treated as distinct tests. Two leading cases here are Svensson v Retriever Sverige AB  and GS Media .

In Svensson, RS is sued for copyright infringement on the basis that RS was communicating works to the public without authorization by operating a website containing hyperlinks. The crucial issue is whether the hyperlink was making the protected work available to a new public when both communications took place by the same technical means. CJEU observed that the published work was freely accessible, then the communication was not to a new public, there was no copyright infringement. On the other hand, linking which appears to circumvent restrictions put in place by the site constitutes an intervention since it involves new public who are not subscribers.

In GS Media, CJEU held that a linker would only be infringing copyright if they knew or ought to have known that the work was available without the rights holder’s authorization. Besides, CJEU differentiated between linking for commercial and non-commercial purposes in relation to who bears the burden of proof.

In conclusion, deep linking could be regarded as an act of communication in China. While deep link could constitute the infringement of the exclusive rights under EU law when it makes published works to the new public or links to unauthorized works for profit. China could draw EU’s experience and improve its approach to protect copyright owner better.

On April 5, 2021, the decade-long legal battle between Oracle and Google, two of the world’s technology giants, finally ends with Google’s victory. In a 6-2 decision, the U.S. Supreme Court found in favour of Google, holding that its use of 37 Sun Java Application Programming Interface (API) packages in Android phones constituted a fair use.

Undoubtedly, this case has a profound impact both on Intellectual property law and software development. The crucial issues of this case are whether Java’s API is copyrightable and, whether Google’s copying amounts to a fair use. However, the Supreme Court actually leaves a void on the first issue of copyrightability.

The relevant knowledge of technology and factual background will be briefly introduced, then the two legal issues will be analyzed through the comparison of Courts’ views.

Knowledge of technology

Java SE computer platform allows programs written in Java language to run on any computer. It contains implementing code and declaring code. Developers use and become familiar with specific “method calls,” which interact with the declaring code to invoke the implementing code for the task they want their program to perform.[1] Google copied roughly 11,500 lines of declaring code and the underlying organizational system from the Java SE platform.

Factual background

The lengthy case has two rounds. This lawsuit was first brought by Oracle in the United States District Court for the Northern District of California in 2010. After buying Sun, Oracle claimed that Google’s copying infringed its copyright. In 2012, the Trial Court ruled for Google. However, in 2014 the Federal Circuit reversed and remanded the case for examination of Google’s fair use defense. In the second round, the trial court held in Google’s favor again in 2016, while the Appellate Court reversed again and remanded for a trial on damages in 2018. Google then petitioned the Supreme Court for certiorari, asking to review the determinations as to both copyrightability and fair use.

legal issue 1: whether Java’s API is copyrightable

The Supreme Court evaded this issue, but the opposite views from the District Court and the Federal Circuit could be compared.

The District Court held that API’s declaring code was a “system or method of operation”, which fell out of the copyright law protection. The Federal Circuit held that declaring code fell within the scope of “creation”, thus was copyrightable.

legal issue 2: whether Google’s copying amounts to a fair use

As regards determination of fair use, Section 107 of the Copyright Act calls for consideration of the following four factors.

If you are interested, you can read the full Opinion of the Court by clicking it.

[1] https://www.copyright.gov/fair-use/summaries/google-llc-oracle-am-inc-2021.pdf