Digital Economy Act: Ofcom consults on blacklisting infringers

Out-Law News | 01 Jun 2010 | 3:23 pm | 7 min. read

Small ISPs, mobile operators and Wi-Fi providers like hotels and coffee shops will be exempt from a notification and blacklisting process under the Digital Economy Act, at least initially, according to a draft Code published by Ofcom.

The communications regulator has proposed that its draft 'Initial Obligations Code' should only apply to internet service providers (ISPs) with more than 400,000 subscribers. However, if copyright infringers migrate to smaller ISPs or mobile services, the Code will be reviewed.

The draft Code was published on Friday as part of a 73-page consultation paper. The disconnection of alleged copyright infringers, the most controversial power in the Act, is not addressed.

The Code explains the procedure for copyright owners or their representatives to notify internet service providers (ISPs) of alleged copyright infringements, the three-stage notification process for ISPs to inform their subscribers of the allegations, and lays down the rules for 'Copyright Infringement Lists' to be maintained by ISPs, which copyright owners can use if they wish to bring lawsuits. It also provides information on an appeals process.

The Act imposes obligations on ISPs where their networks may have been used for copyright infringements. It provides that ISPs must notify their subscribers if the Internet Protocol (IP) addresses associated with them are reported by copyright owners as being used to infringe copyright. It also provides that ISPs must keep track of the number of reports about each subscriber. The draft Code details how these processes will operate.

Large ISPs only

Explanatory notes to the Act say that the obligations should fall on all ISPs except those that have a very low level of online infringement. Ofcom said that it has chosen to limit its Code by size of operator.

"The seven ISPs with more than 400,000 subscribers together account for 96.5% of the residential and SME business broadband market," notes Ofcom in its consultation paper. It adds that "there is a broad correlation between the number of subscribers an ISP has and the level of alleged copyright infringement activity on their service".

The ISPs to which the Code will apply initially are: BT, Post Office, Sky, Talk Talk Group, Virgin Media and the fixed internet access subscribers of O2 and Orange.

Mobile ISPs will not be covered, partly because they "are less conducive to online copyright infringement due to speed and capacity constraints (e.g. caps on uploading and downloading) and pricing relative to fixed"; and partly because they assign IP addresses differently to most fixed ISPs.

"An IP address identified as related to copyright infringement may be in use by multiple individual subscribers at the time of the alleged infringement," said Ofcom. "The capital expenditure required to modify their systems to allow them to identify subscribers from the IP address provided in [Copyright Infringement Reports] will be significantly higher than for fixed ISPs."

Ofcom also noted that more than 95% of alleged copyright infringement incidents occur on fixed networks. "However, we propose to continue to review the level of copyright infringement on mobile networks and if necessary will require mobile ISPs to participate in the Code."

If Ofcom detects "widespread evasion of the effects of the code, resulting from migration of online copyright infringers to ISPs not covered by the Code" it said it will alter the qualification criteria for ISPs.

Wireless networks

The consultation paper explains that its definition of an ISP may include internet access providers like community Wi-Fi operators and coffee chains like Starbucks. "It is important to ensure that it is clear to these different types of provider and to Copyright Owners whether they are ISPs under the 2003 Act, and therefore potentially Qualifying ISPs if they pass the relevant threshold."

Ofcom said that a Wi-Fi operator will be caught if it has an agreement with users, even if that agreement is not in writing.

"In principle, operators of Wi-Fi networks would fall within the definition of internet service provider where the service is provided by means of an agreement with the subscriber, even where this is oral or implicit," said Ofcom in its consultation paper.

"It may not, however, apply to open access Wi-Fi networks where there is no payment from, and no agreement with, those making use of them," it said. "In those circumstances, the person making open access Wi-Fi available would themselves be a subscriber".

"Where a Wi-Fi network is provided in conjunction with other goods or services to a customer, such as a coffee shop or a hotel, our presumption is that the provider is within the definition of internet service provider," said Ofcom.

"We recognise, however, that there may be circumstances where there is an issue as to whether the agreement for goods or services extends to the use of the internet access service," it said. "Nevertheless, Ofcom’s proposal for the threshold for determining a Qualifying ISP would initially exclude those operators since the number of subscribers would not meet the required threshold."

Consequently, hotels and coffee shops are likely to be ISPs for the purposes of the Code, though initially they will not be Qualifying ISPs and therefore will not be subject to the infringement notification regime. Ofcom noted that if such businesses become Qualifying ISPs, they will need to obtain users' postal or email addresses.

An individual or small business that receives internet access for its own purposes is a subscriber, not an ISP, under the Code, even if they also make access available to others, according to the Ofcom paper. This would include people who run unprotected Wi-Fi networks.

"Those who wish to continue to enable others to access their service will need to consider whether take [sic] steps to protect their networks against use for infringement, to avoid the consequences that may follow," notes Ofcom.

Infringement reports

The Code sets out who can file a Copyright Infringement Report, or CIR, with an ISP. It also sets out the information that must be contained in a CIR, such as identification of a work and the IP address associated with an apparent infringement. The CIR must be sent to the ISP within 10 working days of the required evidence having been gathered by the copyright owner or its representative body.

The first CIR will trigger the first notification by an ISP to its 'subscriber'. The second notification would be triggered by the first CIR received on or after one month from the date of the first notification. The third notification would be triggered by the first CIR received on or after one month from the date of the second notification. At this point the ISP's subscriber would be added to the Copyright Infringement List.

No CIR more than 12 months old can be taken into account for the purposes of a notification. Therefore, someone subject only to two CIRs in any 12-month period will not be added to the list. Also, ISPs will be required "as far as is reasonably practicable" to destroy information they hold in the relation to a notification 12 months after receipt. The Code sets out the required content of the notifications and provides template first, second and third notification letters and a template information sheet to accompany the letters.

Infringement lists

The consultation paper explains how the Copyright Infringement Lists will operate.

"ISPs will have to keep a record of the CIRs linked to each subscriber along with a record of which Copyright Owner sent the report. A Copyright Owner can request an ISP to provide them with relevant parts of those records on request, but in an anonymised form to comply with data protection legislation. This is called a Copyright Infringement List," it says.

"The information in the Copyright Infringement List is intended to help Copyright Owners to target any litigation against those subscribers that appear to have infringed against them to the greatest degree."

ISPs have the choice of issuing the first and second notifications by email or post. The consultation paper does not address the risk of these notifications not being received by the subscriber. This risk has been raised previously by critics of the legislation, who point out that many ISPs have assigned email addresses to their subscribers that subscribers may ignore.

Consequently, the draft Code leaves open the possibility that a subscriber only becomes aware of allegations against him when the third notification is issued, which must be sent by recorded delivery to the subscriber's postal address and to the subscriber's email address. By then, the subscriber will feature on the copyright infringement list.

A copyright owner will need a court order to identify a person appearing on a copyright infringement list, unless the subscriber gives written consent to such disclosure. Copyright owners may not make more than one request for a copyright infringement list to each ISP within any period of three months.


The proposed notification regime does not provide for new remedies against alleged file-sharers. Instead, it creates a mechanism by which copyright owners or representative bodies like the BPI can add alleged persistent infringers to a blacklist that could be used to assist court proceedings. Such proceedings would be based on established remedies.

The Act's explanatory notes state that the Government hopes the "initial obligations" will "significantly reduce online infringement of copyright." The Act tasks Ofcom with producing an annual report on the level of online copyright infringement. If it does not fall significantly, the Secretary of State can by Order direct Ofcom to require ISPs to impose 'technical measures' on subscribers.

The Act provides that these measures include limiting a subscriber's broadband speed or suspending service. Such an Order will need the approval of Parliament and cannot be made within a period of 12 months from the date on which the Initial Obligations Code comes into force.

Ofcom's consultation asks 16 specific questions. It is inviting comments until 30th July 2010. Enforcement of the Code and the handling of industry disputes will be the subject of a second consultation in July. A third consultation, on sharing the costs of implementing and fulfilling the Code's requirement, is scheduled for September.