Your name
<No.> Your street
Your town
Your county
Your Area Code
The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Dear Information Commissioner.
Release of personal details to UK solicitors by Internet Service Providers (ISPs)
   
    I am writing to you regarding a very pressing matter, which I hope you will take extremely seriously.

    As you may be aware, solicitors in the UK (namely Davenport Lyons) have obtained several court orders obliging some of the largest ISPs in the country to provide the names and addresses of their customers in connection with alleged illegal peer to peer (P2P) file sharing, pursuant to CPR 31.8. The personal data disclosed includes the name, address and telephone numbers of subscribers who were assigned a particular Internet Protocol (IP) address at a particular time point when an alleged offence of making copyrighted content available to download occurred - usually a single game or video. According to reports in the press, using numbers from Davenport Lyons themselves, a total of 26,500 people have had their personal data in this manner so far - with more potentially to follow.

    Once Davenport Lyons receives a list of names and addresses from an ISP they subsequently send out cease and desist letters, around 6-7 months after the alleged infringement has taken place. These letters include a request for sums of around £500 to £700 as compensation for the act of infringement. It is clear from the reactions of people on various internet fora, as well as several reports in the press that not everyone who receives such a letter is guilty of the offence they have been accused of. In fact, Davenport Lyons has had to withdraw their allegations in at least one well publicised case - that of Gillian and Ken McKinnon. Hundreds of others are also maintaining their innocence using various media such as internet forums and BBC's Watchdog programme.

    I am one of those who have been accused by Davenport Lyons. I am wholly innocent of the allegations they have made against me. To my knowledge, the work I have been accused of making available has never been either downloaded or purchased by myself or any member of my household and therefore could not have been made available to download using my internet connection.

    It is clear to me that an IP address in isolation is not sufficient evidence to show an act of infringement has occurred. The only possible way of proving an alleged act of infringement has taken place is to inspect the hard drive of the computer in question in a timely manner, i.e as soon as possible after the alleged offence. For Davenport Lyons (and their data gatherers such as Digiprotect and Logistep) to rely on an IP address alone as evidence is wholly disproportionate and is causing a great deal of distress for those who have been falsely accused of these offences. Furthermore, Logistep and other data gatherers have refused to allow independent auditing of their data collection tools and have already been forced by the Swiss Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)) to cease gathering data, due to concerns about the accuracy of the data gathered and the legality of the collection method.

    Recent cases have come to light where Davenport Lyons have sent letters to people accusing them of allegedly making available works of hardcore heterosexual and homosexual pornography, using data collected by Digirights on behalf of Digiprotect. I believe that this constitutes sensitive personal data as defined under section 2 (f) of the Data Protection Act 1998 and as such I understand there are extra considerations about the handling of sensitive personal data. However, I also understand that exemptions are provided under Schedule 3 Section 6 (a) of the same act.

    I am aware that under section 35 (1) of the Data Protection Act 1998 that "Personal data are exempt from the non-disclosure provisions where the disclosure is required by or under any enactment, by any rule of law or by the order of a court.". I am also aware that this is an exemption granted in accordance with the EC Directive on the protection of individuals with regard to the processing of personal data (95/46/EC) (Data Protection Directive) , specifically Article 13(1) of that directive.

    However, the EC Directive on the processing of personal data and the protection of privacy in the electronic communications sector (2002/58/EC) (E-Privacy Directive) provides that national authorities may only lift the protection of data privacy in order to safeguard national or public security or to conduct investigations into criminal offences or the unauthorised use of an electronic communications system, where this is a "necessary, appropriate and proportionate measure" (Article 15(1), E-Privacy Directive, emphasis mine). In addition to this, on the 29th of January, 2008 Advocate General Kokott of the European Court of Justice (ECJ) took the position that Community law does not require member states to oblige ISPs to disclose details of suspected file sharers in order to enable a copyright owner to bring civil proceedings. This position was arrived at due to a case involving the Spanish ISP Telefonica and Promusicae, a data collection agency, at the Juzgado de lo Mercantil No 5 de Madrid (case number C-275/06). In that case, the proceedings were stayed and the following question was put to the ECJ:
Does Community law, specifically Articles 15(2) and 18 of Directive [2000/31], Article 8(1) and (2) of Directive [2001/29], Article 8 of Directive [2004/48] and Articles 17(2) and 47 of the Charter permit Member States to limit to the context of a criminal investigation or to safeguard public security and national defence, thus excluding civil proceedings, the duty of operators of electronic communications networks and services, providers of access to telecommunications networks and providers of data storage services to retain and make available connection and traffic data generated by the communications established during the supply of an information society service?
    The ECJ responded that Directives 2000/31, 2001/29, 2004/48 and 2002/58 do not oblige Member States to communicate personal data in order to ensure effective protection of copyright in the context of civil proceedings - and that a fair balance needs to be struck between the various fundamental rights and, in particular, the principle of proportionality. Advocate General Kokott considered it compatible with community law for member states to exclude operators of electronic communications networks and services from having to make available personal data relating to connection and traffic information in the context of a civil, as distinct from criminal, action.

    Given the above, I feel that the requests for 26,500 people's details should have been interpreted as a request for information relating to a non criminal offence. The request for the personal data therefore should have been refused. I believe the release of my personal data was a breach of the Data Protection Act 1998 and urge you to carry out a review of all subsequent releases.

                                    Yours,

                                     Name, Date