A blog relating to Internet legal issues by Professor John Swinson, University of Queensland
The European Data Protection Board (EDPB) has recently published guidelines with examples for data breach notification under the GDPR.
The Guidelines set out common types of data breaches, such as ransomware, lost or stolen devices, social engineering attacks and the like, and set out case studies to clarify notification and remediation obligations.
The Australian Patents Office has decided that an AI machine cannot be an inventor for the purposes of granting a patent.
"Section 15(1) is inconsistent with an artificial intelligence machine being treated as an inventor, since it is not possible to identify a person who can be granted a patent."
Further, the person who operated the AI machine was also not an inventor:
"I have considered the alternative option that Dr Thaler is the inventor. It seems clear that Dr Thaler asserts that he did not devise the invention but merely acquired knowledge of the invention from the artificial intelligence machine. In the light of JMVB Dr Thaler would not be the inventor."
U.S. law firm Wilson Sonsini has a good summary of likely FTC priorities.
Potential key priorities:
Read in The Wall Street Journal: https://apple.news/AykpuzRwHQJeQWQoc3GPxyg
APRA speech by Geoff Summerhayes in late 2020 on APRA’s current focus on cybersecurity: https://www.apra.gov.au/news-and-publications/executive-board-member-geoff-summerhayes-speech-to-financial-services
Flight Centre organised a hack-a-phon in 2017, and gave those participating access to real customer data. This resulted in a breach of the Privacy Act.
Decision here: https://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/AICmr/2020/57.html
On U.S. Election Day, 3 November 2020, voters in the State of California overwhelmingly voted in favour of Proposition 24—a ballot measure that creates the California Privacy Rights Act (CPRA). The CPRA revises and expands the California Consumer Privacy Act (CCPA), creating new industry requirements, consumer privacy rights and enforcement mechanisms.
The CPRA's new obligations for businesses will come into effect on 1 January 2023. At that time, the CPRA will effectively replace the CCPA. In the meantime, the CPRA requires that a new California privacy agency be established and that it adopts implementing regulations.
Posting anonymous reviews to defame someone is risky.
Telstra has been ordered to provide documents to a doctor so that the doctor can assist identify someone who supposedly defamed him.
See this recent Federal Court decision: Colagrande v Telstra Corporation Limited [2020] FCA 1595
Telstra did not appear at this court hearing.
This is similar to this case against Google: http://www.cyberspac.com/2020/03/google-sued-again-for-identity-of-users.html and also these cases:
Kukulka v Google LLC [2020] FCA 1229
Kabbabe v Google LLC [2020] FCA 126
Titan Enterprises (Qld) Pty Ltd v Cross [2016] FCA 1241 (patent attorney ordered to hand over file)
Titan Enterprises (Qld) Pty Ltd v Cross [2016] FCA 890 (written by Justice Edelman, now on the High Court)
A wedding planner has won a 'landmark' court case against consumers who made defamatory comments about her business on social media.
Tristan Moy, 33, from Brisbane, moved to Indonesia in 2014 to run a business arranging weddings in Bali for Australian tourists.
But she suffered 'hurt and humiliation' when two Australian women began posting salacious comments about her and her business on Facebook in 2017.
They included accusations Ms Moy was unprofessional, bullied her clients and would try ruin her client's weddings.
See also this old Fordham article
See this article regarding the recent Seiko case in the High Court of Australia
https://www.kwm.com/en/au/knowledge/insights/patent-rights-on-sale-high-court-reverses-20201113
A new set of rules for .au domain names will come into effect on 12 April 2021.
auDA, the domain name regulator, states: "This new licensing framework helps maintain trust in the .au ccTLD, offers clearer guidance for registrants and registrars, and enhances auDA’s role as the guardian of a key piece of Australia’s digital infrastructure."APRA is stepping up its focus on CPS234 in 2021. This is not a surprise. The Australian government has a strong focus on cybersecurity (and Defence, and foreign influence).
The Australian Human Rights Commission released a paper today on AI, bias and fairness. It is worth reading.
A Sydney hedge fund has collapsed after a cyber attack saw its trustee and administrator mistakenly approve $8.7 million in fraudulent invoices. Scammed by a fake Zoom invite.
The scam, the latest in a series of strikes by offshore criminal gangs against Australian fund managers, has also ensnared ANZ after the bank failed to stop almost $800,000 being withdrawn from an account linked to the cyber criminals.
Trivago, a price comparison, recent lost an appeal in Australia regarding how it ordered the listings on its affiliate program website. Trivago's conduct was held to be misleading, and therefore illegal, in Australia.
See ACCC media release: https://www.accc.gov.au/media-release/trivago-loses-appeal-after-misleading-consumers-over-hotel-ads
Judgment is here: Trivago N.V. v Australian Competition and Consumer Commission [2020] FCAFC 185
Can you give your User ID to someone else to use your account? And what if that someone then uses your account for a purpose not allowed by the user agreement? Are you responsible? This is the subject of a possible lawsuit against CoreLogic in Australia.
See BCI Media Group Pty Ltd v Corelogic Australia Pty Ltd [2020] FCA 1556 https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2020/2020fca1556
In addition to the privacy review, the government is conducting an AI review.
"The Australian Government recognises that accelerating the development, adoption and adaption of artificial intelligence (AI) will have profound social and economic outcomes for all Australians. We have an opportunity and a responsibility to strive for a better future. A future where Australians develop and use AI to solve national problems, build competitive businesses and increase our collective wellbeing.
To achieve this vision, the Australian Government will need a plan. To inform this plan, the Department of Industry, Science, Energy and Resources has released a discussion paper that seeks public input to an AI Action Plan for Australia."
You can read the discussion paper and have your say at: https://consult.industry.gov.au/digital-economy/ai-action-plan
Submissions close on Friday, 27th November 2020, two days before submissions close for the privacy law consultation.
Section 230 of the Communications Decency Act is supposedly being reviewed. From the NY Times:
Chief executives from Google, Facebook and Twitter appeared before a Senate hearing on a law that protects internet companies from liability for much of what their users post, and on how they moderate content. |
Democrats focused on misinformation and extremism. They also accused Republicans of holding the hearing to benefit President Trump. |
Republicans accused the executives of selective censorship, questioning Twitter’s Jack Dorsey, above, on how the company handled specific tweets. “Mr. Dorsey, who the hell elected you and put you in charge of what the media are allowed to report and what the American people are allowed to hear?” Senator Ted Cruz said. |
The Australian Government is undertaking a complete review of The Australian Privacy Act.
Unfortunately, after a year of work, the government is only giving 4 weeks to make submissions in respect of a very detailed issues paper.
One topic for consideration is whether to legislate and create a privacy tort in Australia.
Further information available here.
How Police Can Crack Locked Phones—and Extract Information
A report finds 50,000 cases where law enforcement agencies turned to outside firms to bypass the encryption on a mobile device.Although off topic, I consider it worthwhile to fund public art. This is a great project:
https://australianculturalfund.org.au/projects/chrysalis-01
It was only a matter of time. The restaurant chain Wagamama has been reported to the UK Information Commissioner’s Office (ICO) for allegedly using contact details provided for Covid track and trace to send surveys to customers.
See The Times
An American who complained on TripAdvisor that a resort hotel in Thailand wanted to charge him a $15 corkage fee for bringing his own bottle of gin to the restaurant was arrested this month and spent a weekend in jail. If convicted of criminal defamation, he faces up to two years in prison. So don't write anything bad about the Sea View Koh Chang resort, which had the charges brought. |
After a backlash, the resort had some regrets. “We agree that using a defamation law may be viewed as excessive for this situation,” the hotel acknowledged. |
The newspapers are appealing the decision of the NSW Court of Appeal that decided that media companies can be held responsible for defamatory comments under stories they post on Facebook.
Guardian Article, and discussion of appeal here. The newspapers are appealing to the High Court.
The Court of Appeal decision is not surprising. Compare prior cases:
http://www.cyberspac.com/2012/07/smirnoff-responsible-for-comments-of.html
https://www.accc.gov.au/media-release/firm-fined-for-testimonials-by-facebook-fans-and-tweeters
A good article from Harvard looking at autonomous vehicles, ethics and the trolley problem.
A recent decision in Australia, concerning whether Facebook could be served in California, was decided by the Federal Court of Australia. This case arises out of a privacy action brought against Facebook by ACMA in relation to the Cambridge Analytics issues.
"It might be added that the means by which entities carry on business are constantly evolving. Much of the case law in which the concept has been discussed was decided long before the technological advances which underpin many modern forms of commerce. Ultimately, the question whether a particular entity carries on business, and does so in a particular place, is determined by reference to the particular facts.
The Commissioner submitted that she had established a prima facie case that Facebook Inc carried on business in Australia through a combination of two matters: first, through the agency of Facebook Ireland; and secondly, through certain activities for which Facebook Inc was directly responsible in Australia. ...
Rather, the evidence on this application suggests that, to the extent Facebook Ireland carried on business in Australia, it was carrying on its own business. The evidence adduced on this application and the inferences available to be drawn do not sufficiently allow for a possible conclusion that Facebook Ireland was also carrying on Facebook Inc’s business to warrant permitting service out of the jurisdiction.
However, for the reasons given next, the Commissioner has established a sufficient prima facie case to warrant exposing Facebook Inc to litigation in Australia on the basis that Facebook Inc directly carried on business in Australia. On its case, a part of Facebook Inc’s business was to provide services to Facebook Ireland, including the processing activities referred to earlier. I am satisfied that there is a prima facie case that Facebook Inc carried out sufficient activity in Australia in its business of providing services to Facebook Ireland for a conclusion to be available that Facebook Inc carried on business in Australia within the meaning of s 5B(3)(b) of the Privacy Act. ...
I am satisfied that the Commissioner has established a prima facie case, in the required sense, that Facebook Inc carried on business in Australia within the meaning of s 5B(3)(b). In summary, the Commissioner has established a sufficient prima facie case that Facebook Inc carried on business in Australia which included providing services to Facebook Ireland."
Australian Information Commissioner v Facebook Inc (No 2) [2020] FCA 1307
A recent dispute between two taxi companies confirms that a telephone number is not property and is not owned by the telco customer.
"Relevantly, the terms confirm that the customer does not own or have any legal interest or goodwill in any telephone number issued to the customer. The terms also permit the customer to “transfer” a telephone number to another person with the prior consent of Telstra."
Compare this domain name decision: Multi-National Concepts Pty Ltd v. 1300 Directory Pty Ltd
The Office of the National Data Commissioner has released an exposure draft of the Data Availability and Transparency Bill for public comment. - https://www.abc.net.au/news/2020-09-16/government-draft-law-share-personal-data-between-agencies/12666792)
More information and the draft bill is available here: https://www.datacommissioner.gov.au/exposure-draft/dat
The objects of this law are to:
(a) promote better availability of public sector data; and
(b) enable consistent safeguards for sharing public sector data; and
(c) enhance integrity and transparency in sharing public sector data; and
(d) build confidence in the use of public sector data; and
(e) establish institutional arrangements for sharing public sector data.
The UK Intellectual Property Office has announced a call for views on artificial intelligence and intellectual property. In particular, the UK IPO wants to hear about the implications that AI might have for IP policy, and, likewise, what impact IP might have on AI.
See the full consultation: https://www.gov.uk/government/consultations/artificial-intelligence-and-intellectual-property-call-for-views
The consultation closes on 11 November 2020.
Listen to this podcast where I discuss how damages should be assessed in privacy and cybersecurity lawsuits. The Lawyers Weekly Show host J...