|
List of Tables and Figures |
|
|
xxiii | |
Late Developments |
|
xxv | |
|
|
xxvii | |
|
|
xxxi | |
|
PART I Privacy, Anonymity, and Data Protection |
|
|
|
1 The death of privacy and the growth of surveillance |
|
|
3 | (24) |
|
|
3 | (1) |
|
1.2 The development of surveillance technology |
|
|
4 | (3) |
|
|
7 | (1) |
|
|
8 | (1) |
|
1.4 Surveillance legislation |
|
|
8 | (1) |
|
1.5 Scope of the legislation |
|
|
9 | (2) |
|
1.6 Forms of surveillance |
|
|
11 | (3) |
|
1.7 Surveillance and the law |
|
|
14 | (4) |
|
1.8 The emergence of data protection |
|
|
18 | (1) |
|
1.9 Personality profiling and social media |
|
|
19 | (1) |
|
|
19 | (2) |
|
|
21 | (1) |
|
1.12 Data protection implications |
|
|
21 | (1) |
|
1.13 The (voice assistant) doctor will see you now |
|
|
22 | (1) |
|
1.14 Medicine and the Internet |
|
|
23 | (2) |
|
1.15 Do privacy policies help? |
|
|
25 | (1) |
|
|
25 | (2) |
|
2 The beginnings of data protection |
|
|
27 | (12) |
|
|
27 | (1) |
|
2.2 The development of data protection laws |
|
|
28 | (6) |
|
2.2.1 International data protection initiatives |
|
|
28 | (1) |
|
2.2.2 The Council of Europe |
|
|
29 | (2) |
|
2.2.3 The Organisation for Economic Co-operation and Development |
|
|
31 | (1) |
|
2.2.4 The Asia-Pacific Privacy Charter initiative |
|
|
32 | (1) |
|
|
33 | (1) |
|
2.3 The development of data protection legislation in the United Kingdom and the European Union |
|
|
34 | (3) |
|
2.3.1 The European Data Protection Directive and the Data Protection Act 1998 |
|
|
35 | (1) |
|
2.3.2 The General Data Protection Regulation and Data Protection Act 2018 |
|
|
36 | (1) |
|
|
37 | (2) |
|
3 The scope of data protection |
|
|
39 | (17) |
|
|
39 | (1) |
|
3.2 The concept of personal data |
|
|
39 | (2) |
|
3.3 Sensitive personal data |
|
|
41 | (1) |
|
3.4 Personal data relating to the data subject |
|
|
42 | (7) |
|
3.5 Issues of identification-anonymity and pseudonymity |
|
|
49 | (2) |
|
3.6 The concept of processing |
|
|
51 | (1) |
|
3.7 Data protection actors |
|
|
52 | (2) |
|
|
52 | (1) |
|
|
53 | (1) |
|
|
54 | (1) |
|
3.8 Jurisdictional issues |
|
|
54 | (1) |
|
|
54 | (2) |
|
|
56 | (15) |
|
|
56 | (1) |
|
4.2 National supervisory agencies and the role of the UK's Information Commissioner |
|
|
57 | (1) |
|
4.3 Structures of supervisory agencies |
|
|
58 | (2) |
|
4.4 Key functions of supervisory agencies |
|
|
60 | (1) |
|
4.5 Functions of the supervisory agency |
|
|
60 | (2) |
|
4.6 Accreditation and certification |
|
|
62 | (1) |
|
4.7 Enforcement of the legislation |
|
|
63 | (4) |
|
4.7.1 Powers of entry and inspection |
|
|
63 | (1) |
|
4.7.2 Information notices |
|
|
63 | (1) |
|
4.7.3 Enforcement notices |
|
|
64 | (1) |
|
|
65 | (1) |
|
|
65 | (1) |
|
|
66 | (1) |
|
4.8 General duties of the Information Commissioner |
|
|
67 | (2) |
|
4.8.1 Disseminating information |
|
|
67 | (1) |
|
|
67 | (1) |
|
4.8.3 International cooperation |
|
|
68 | (1) |
|
4.8.4 Professional secrecy |
|
|
68 | (1) |
|
|
69 | (1) |
|
4.10 Other supervisory agencies |
|
|
69 | (1) |
|
|
70 | (1) |
|
5 The data protection principles |
|
|
71 | (21) |
|
|
71 | (1) |
|
5.2 Fair and lawful processing |
|
|
72 | (2) |
|
5.3 Information obtained from the data subject |
|
|
74 | (1) |
|
5.3.1 Information not obtained from the data subject |
|
|
74 | (1) |
|
5.4 The nature of consent |
|
|
75 | (2) |
|
5.4.1 Duration of consent |
|
|
76 | (1) |
|
5.5 Other factors legitimising processing |
|
|
77 | (1) |
|
5.6 Factors legitimising the processing of sensitive data |
|
|
78 | (4) |
|
5.6.1 Explicit subject consent |
|
|
79 | (1) |
|
5.6.2 Other grounds legitimising processing |
|
|
79 | (1) |
|
|
80 | (1) |
|
5.6.4 Processing by specified bodies |
|
|
80 | (1) |
|
5.6.5 Information in the public domain |
|
|
81 | (1) |
|
5.6.6 Legal proceedings and the administration of Justice |
|
|
81 | (1) |
|
5.6.7 Processing for medical purposes |
|
|
81 | (1) |
|
|
81 | (1) |
|
|
82 | (1) |
|
5.7 Exceptions to the application of the data protection principles for law enforcement and revenue-gathering purposes |
|
|
82 | (1) |
|
5.8 The second data protection principle---purpose limitation |
|
|
83 | (1) |
|
5.9 The third data protect principle---relevance |
|
|
84 | (4) |
|
5.10 The fourth data protection principle---adequacy and timeousness |
|
|
88 | (1) |
|
5.11 The fifth data protection principle---duration of record-keeping |
|
|
89 | (1) |
|
5.12 The seventh data protection principle---data security |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
91 | (1) |
|
6 Individual rights and remedies |
|
|
92 | (22) |
|
|
92 | (1) |
|
6.2 Subject access and information rights |
|
|
92 | (1) |
|
6.3 Exceptions to the subject access provisions |
|
|
93 | (12) |
|
|
93 | (4) |
|
|
97 | (3) |
|
6.3.3 Data held for policing and revenue-gathering purposes |
|
|
100 | (1) |
|
|
101 | (1) |
|
|
102 | (1) |
|
6.3.6 Educational records |
|
|
103 | (1) |
|
6.3.7 Regulatory activity |
|
|
103 | (1) |
|
6.3.8 Research, history, and statistics |
|
|
104 | (1) |
|
6.3.9 Information required to be made available to the public |
|
|
104 | (1) |
|
6.3.10 Confidential references |
|
|
104 | (1) |
|
6.3.11 Judicial appointments, judicial independence, and judicial proceedings |
|
|
104 | (1) |
|
6.3.12 Crown honours, dignities, and appointments |
|
|
104 | (1) |
|
6.3.13 Management forecasts and corporate finance |
|
|
105 | (1) |
|
|
105 | (1) |
|
6.3.15 Legal professional privilege |
|
|
105 | (1) |
|
6.3.16 Self-incrimination |
|
|
105 | (1) |
|
|
105 | (1) |
|
6.4.1 Right to resist enforced subject access |
|
|
106 | (1) |
|
6.5 Right to object to data processing |
|
|
106 | (2) |
|
|
106 | (1) |
|
6.5.2 Other forms of processing |
|
|
107 | (1) |
|
6.5.3 Automated decision-making |
|
|
108 | (1) |
|
6.6 The right to be forgotten |
|
|
108 | (2) |
|
|
110 | (1) |
|
6.8 Denial of access requests |
|
|
110 | (1) |
|
6.9 Rectification of inaccurate data |
|
|
110 | (1) |
|
|
111 | (1) |
|
6.11 Criminal offences associated with access |
|
|
111 | (2) |
|
6.11.1 Unlawful obtaining of personal data |
|
|
111 | (1) |
|
6.11.2 Re-identification of de-identified personal data |
|
|
112 | (1) |
|
6.11.3 Alteration of personal data to prevent disclosure |
|
|
112 | (1) |
|
|
113 | (1) |
|
7 Sectoral aspects of data protection |
|
|
114 | (24) |
|
|
114 | (1) |
|
7.2 Data protection and the media |
|
|
114 | (1) |
|
7.3 Scope of the media provisions |
|
|
115 | (1) |
|
7.4 Key elements of the provisions |
|
|
116 | (1) |
|
7.4.1 Grant of assistance |
|
|
116 | (1) |
|
|
117 | (1) |
|
7.6 Guidance about how to seek redress against media organisations and related matters |
|
|
117 | (1) |
|
7.7 Data protection in the electronic communications sector |
|
|
118 | (2) |
|
7.8 The development of communications-specific legislation |
|
|
120 | (1) |
|
7.9 The Privacy and Electronic Communications Directive and Regulations |
|
|
121 | (1) |
|
7.10 Obligations imposed on network and service providers |
|
|
122 | (4) |
|
7.10.1 Security and confidentiality |
|
|
122 | (1) |
|
7.10.2 Breach notification |
|
|
123 | (1) |
|
|
124 | (2) |
|
7.11 Traffic and location data |
|
|
126 | (2) |
|
|
128 | (2) |
|
|
130 | (1) |
|
7.14 Directory information |
|
|
131 | (2) |
|
7.15 Calling and connected line identification |
|
|
133 | (1) |
|
7.16 Unsolicited communications |
|
|
134 | (2) |
|
|
136 | (2) |
|
|
138 | (23) |
|
|
138 | (1) |
|
8.2 Regulating transborder data flows |
|
|
139 | (1) |
|
8.3 Procedures for determining adequacy |
|
|
140 | (2) |
|
|
141 | (1) |
|
8.4 The `Safe Harbor' agreement and the Privacy Shield |
|
|
142 | (4) |
|
8.5 Consequences of a finding of adequacy |
|
|
146 | (1) |
|
|
147 | (2) |
|
|
149 | (2) |
|
8.8 Transfers when an adequate level of protection is not provided by national law |
|
|
151 | (2) |
|
8.8.1 National approvals of contractual provisions |
|
|
152 | (1) |
|
8.9 Standard contractual terms |
|
|
153 | (2) |
|
8.10 Binding corporate rules |
|
|
155 | (2) |
|
|
157 | (4) |
|
PART II Computer-Related Crime |
|
|
|
9 National and international responses to computer-related crime |
|
|
161 | (12) |
|
|
161 | (1) |
|
|
161 | (2) |
|
|
163 | (2) |
|
9.4 From cybercrime to cyberwarfare and cyberterrorism |
|
|
165 | (3) |
|
9.5 National and international responses to computer-related crime |
|
|
168 | (4) |
|
9.5.1 The Council of Europe Cybercrime Convention |
|
|
169 | (1) |
|
9.5.2 OECD Guidelines for the Security of Information Systems |
|
|
169 | (1) |
|
|
170 | (2) |
|
|
172 | (1) |
|
10 Substantive criminal law provisions |
|
|
173 | (16) |
|
|
173 | (1) |
|
10.2 Offences against the confidentiality, integrity, and availability of computer data and systems |
|
|
173 | (1) |
|
|
174 | (1) |
|
10.4 Obtaining or enabling access to computers or data |
|
|
175 | (2) |
|
10.5 When is access unauthorised? |
|
|
177 | (1) |
|
10.6 Unauthorised use by authorised users |
|
|
178 | (3) |
|
10.7 Interception of communications |
|
|
181 | (1) |
|
10.8 Data and system interference |
|
|
181 | (1) |
|
|
182 | (3) |
|
10.10 Denial-of-service attacks |
|
|
185 | (2) |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
189 | (14) |
|
|
189 | (1) |
|
11.2 Internet pornography |
|
|
190 | (3) |
|
|
192 | (1) |
|
11.3 The Internet and child pornography |
|
|
193 | (1) |
|
11.4 Photographs and pseudo-photographs |
|
|
194 | (2) |
|
|
196 | (3) |
|
11.6 Jurisdictional issues |
|
|
199 | (2) |
|
|
201 | (2) |
|
12 Detecting and prosecuting computer crime |
|
|
203 | (20) |
|
|
203 | (1) |
|
12.2 Interception of communications |
|
|
204 | (4) |
|
12.2.1 Scope of the legislation |
|
|
206 | (1) |
|
12.2.2 Interception of content |
|
|
206 | (1) |
|
12.2.3 Financing interception |
|
|
207 | (1) |
|
12.3 Bulk interception and acquisition orders |
|
|
208 | (1) |
|
12.4 Data retention issues |
|
|
208 | (4) |
|
12.5 The future of data retention |
|
|
212 | (1) |
|
12.6 Interference with communications |
|
|
213 | (1) |
|
|
213 | (2) |
|
|
215 | (1) |
|
|
216 | (1) |
|
12.10 Jurisdictional issues |
|
|
217 | (2) |
|
|
219 | (4) |
|
PART III Intellectual Property Issues |
|
|
|
13 The emergence and forms of intellectual property law |
|
|
223 | (7) |
|
|
223 | (1) |
|
|
223 | (2) |
|
|
225 | (2) |
|
13.4 Other forms of intellectual property right |
|
|
227 | (1) |
|
|
228 | (2) |
|
14 Key elements of the patent system |
|
|
230 | (16) |
|
|
230 | (1) |
|
14.2 Patents in the international arena |
|
|
231 | (1) |
|
14.3 The Patent Co-operation Treaty |
|
|
231 | (1) |
|
14.4 The European Patent Convention |
|
|
232 | (1) |
|
|
233 | (1) |
|
14.6 Intellectual property in the GATS and WTO |
|
|
234 | (1) |
|
14.7 Requirements for patentability |
|
|
235 | (4) |
|
|
235 | (1) |
|
|
236 | (1) |
|
14.7.3 Capacity for industrial application |
|
|
237 | (1) |
|
14.7.4 Matters excluded from patent protection |
|
|
238 | (1) |
|
|
239 | (1) |
|
14.9 The process of obtaining and enforcing a patent |
|
|
240 | (2) |
|
|
240 | (1) |
|
14.9.2 Specification and statement of claim |
|
|
240 | (1) |
|
14.9.3 Preliminary examination |
|
|
241 | (1) |
|
14.9.4 Substantive examination |
|
|
241 | (1) |
|
|
242 | (1) |
|
14.10 Infringement of patents |
|
|
242 | (1) |
|
14.11 Remedies for infringement of a patent |
|
|
243 | (1) |
|
14.12 Revocation of a patent |
|
|
243 | (1) |
|
|
244 | (2) |
|
|
246 | (25) |
|
|
246 | (1) |
|
15.2 The quest for a technical contribution |
|
|
246 | (8) |
|
15.3 Patents and the Internet |
|
|
254 | (1) |
|
|
255 | (1) |
|
15.5 The software patent wars |
|
|
255 | (1) |
|
|
256 | (1) |
|
15.7 Standard essential patents |
|
|
256 | (3) |
|
15.8 Standard Essential Patents (SEPs) and intellectual property |
|
|
259 | (2) |
|
|
261 | (2) |
|
15.10 SEPs before the courts |
|
|
263 | (5) |
|
15.11 Where next for Standard Essential Patents? |
|
|
268 | (2) |
|
|
270 | (1) |
|
|
271 | (50) |
|
|
271 | (1) |
|
|
271 | (2) |
|
16.3 Forms of protected work |
|
|
273 | (2) |
|
16.3.1 The requirement of originality |
|
|
274 | (1) |
|
16.4 Ownership of copyright |
|
|
275 | (1) |
|
16.4.1 Employee-created works |
|
|
275 | (1) |
|
16.4.2 Computer-generated works |
|
|
275 | (1) |
|
16.5 Duration of copyright |
|
|
276 | (1) |
|
16.6 Infringement of copyright |
|
|
277 | (4) |
|
16.6.1 The nature of reproduction |
|
|
277 | (1) |
|
16.6.2 Temporary reproduction |
|
|
278 | (3) |
|
16.7 Communication to the public |
|
|
281 | (3) |
|
16.8 The legitimacy of private copying |
|
|
284 | (2) |
|
16.9 Fair and unfair use of an earlier work |
|
|
286 | (2) |
|
16.10 Other rights belonging to the copyright owner |
|
|
288 | (2) |
|
16.10.1 Communication to the public |
|
|
288 | (1) |
|
16.10.2 To perform, show, or play the work in public |
|
|
289 | (1) |
|
16.10.3 To broadcast the work or include it in a cable programme service |
|
|
289 | (1) |
|
16.10.4 To make an adaptation of the work |
|
|
289 | (1) |
|
16.11 The development of software copyright |
|
|
290 | (1) |
|
16.12 Applying copyright principles to software |
|
|
291 | (1) |
|
|
292 | (1) |
|
16.14 User rights in respect of software |
|
|
293 | (1) |
|
|
293 | (1) |
|
16.16 A use right for software? |
|
|
294 | (2) |
|
|
296 | (1) |
|
|
296 | (1) |
|
|
297 | (1) |
|
16.20 Copy protection and digital rights management |
|
|
298 | (1) |
|
16.21 Reverse engineering and decompilation |
|
|
299 | (4) |
|
16.22 Reverse engineering and computer programs |
|
|
303 | (2) |
|
16.23 Literal and non-literal copying |
|
|
305 | (1) |
|
16.24 The rise and fall of look-and-feel protection |
|
|
306 | (1) |
|
16.25 The computerised pharmacist |
|
|
307 | (2) |
|
16.26 Agricultural software |
|
|
309 | (1) |
|
|
310 | (2) |
|
16.28 Arm's length reproduction |
|
|
312 | (3) |
|
16.29 Computer programs as visual works |
|
|
315 | (2) |
|
16.30 New directions in UK copyright law |
|
|
317 | (1) |
|
|
317 | (1) |
|
16.32 Harvesting the Internet |
|
|
318 | (1) |
|
|
319 | (2) |
|
|
321 | (16) |
|
|
321 | (1) |
|
17.2 The Directive on Copyright in the Information Society |
|
|
321 | (2) |
|
17.3 Enforcement of copyright |
|
|
323 | (1) |
|
17.4 Accounting of profits |
|
|
324 | (1) |
|
|
324 | (1) |
|
|
325 | (1) |
|
|
325 | (2) |
|
177.1 Twentieth Century Fox v Sky UK and 67 (and Ors) |
|
|
327 | (2) |
|
17.8 Blocking orders and trade marks |
|
|
329 | (2) |
|
|
331 | (1) |
|
17.9 Duration of injunctions |
|
|
331 | (1) |
|
|
332 | (1) |
|
17.11 Norwich Pharmacal orders and threats of litigation |
|
|
333 | (1) |
|
|
334 | (3) |
|
18 Protection of databases |
|
|
337 | (19) |
|
|
337 | (1) |
|
|
338 | (1) |
|
18.2.1 Examples of databases |
|
|
338 | (1) |
|
18.3 Databases and new technology |
|
|
339 | (1) |
|
18.4 Traditional forms of protection for databases |
|
|
340 | (1) |
|
18.5 The `sweat of the brow' doctrine |
|
|
341 | (3) |
|
|
344 | (2) |
|
18.6.1 Copyright and databases |
|
|
344 | (1) |
|
18.6.2 Licensing and databases |
|
|
345 | (1) |
|
18.6.3 Other copyright changes |
|
|
346 | (1) |
|
|
346 | (2) |
|
18.7.1 Duration of the right |
|
|
347 | (1) |
|
18.8 The database right in the courts |
|
|
348 | (4) |
|
18.8.1 Football fixture lists |
|
|
351 | (1) |
|
18.9 How much is too much? |
|
|
352 | (2) |
|
|
354 | (2) |
|
|
356 | (8) |
|
|
356 | (1) |
|
19.2 The development of design right and key legislative instruments |
|
|
356 | (2) |
|
19.3 Registered design right protection |
|
|
358 | (1) |
|
19.4 Unregistered design right |
|
|
359 | (1) |
|
19.5 Design rights in tablet computers |
|
|
359 | (4) |
|
|
363 | (1) |
|
|
364 | (13) |
|
|
364 | (1) |
|
20.2 Effect of trade marks |
|
|
365 | (1) |
|
|
366 | (1) |
|
20.4 Internet market places and trade marks |
|
|
366 | (3) |
|
20.5 Interflora v Marks and Spencer and Google |
|
|
369 | (4) |
|
20.6 Cartier and Others v British Sky Broadcasting and Others |
|
|
373 | (3) |
|
|
376 | (1) |
|
|
377 | (16) |
|
|
377 | (1) |
|
|
377 | (1) |
|
21.3 Internet addresses and URLs |
|
|
378 | (1) |
|
21.4 The nature of domain names |
|
|
378 | (1) |
|
21.5 Top-level (global or generic) domain names |
|
|
379 | (1) |
|
21.6 A brief history of Internet governance |
|
|
379 | (2) |
|
21.7 The future of ICANN and Internet governance |
|
|
381 | (1) |
|
21.8 Second (country) level domains |
|
|
382 | (2) |
|
21.9 The revised domain name structure |
|
|
384 | (1) |
|
21.10 The top-level domain application process |
|
|
385 | (1) |
|
21.11 The Uniform Dispute Resolution Rules |
|
|
386 | (1) |
|
21.12 Arbitration decisions |
|
|
387 | (1) |
|
|
388 | (5) |
|
|
|
22 International and European initiatives in e-commerce |
|
|
393 | (14) |
|
|
393 | (1) |
|
22.2 International initiatives |
|
|
394 | (1) |
|
22.3 Key legal instruments |
|
|
395 | (6) |
|
22.3.1 The Distance Selling Directive |
|
|
395 | (2) |
|
22.3.2 The Electronic Commerce Directive and Regulations |
|
|
397 | (2) |
|
22.3.3 Defences provided to Information Service Providers |
|
|
399 | (2) |
|
22.4 Substantive provisions in the Directive |
|
|
401 | (4) |
|
22.4.1 When and where is a contract made? |
|
|
401 | (3) |
|
22.4.2 Choice-of-law issues |
|
|
404 | (1) |
|
22.5 Alternative dispute resolution |
|
|
405 | (1) |
|
|
406 | (1) |
|
|
407 | (18) |
|
|
407 | (1) |
|
|
408 | (2) |
|
23.3 Legal tender and the cashless society |
|
|
410 | (1) |
|
23.4 The emergence of cryptocurrency |
|
|
411 | (2) |
|
23.5 Issues with cryptocurrency |
|
|
413 | (1) |
|
|
413 | (1) |
|
23.7 The future of cryptocurrency |
|
|
414 | (2) |
|
23.8 Regulation of the e-money sector |
|
|
416 | (1) |
|
23.9 The nature of e-money |
|
|
417 | (1) |
|
23.10 E-money issuers and small e-money issuers |
|
|
417 | (1) |
|
23.11 Criteria for admission to the register |
|
|
418 | (1) |
|
23.11.1 Safeguarding arrangements |
|
|
418 | (1) |
|
|
418 | (1) |
|
23.12 Peer-to-peer lending |
|
|
418 | (2) |
|
|
420 | (4) |
|
|
424 | (1) |
|
|
425 | (42) |
|
|
425 | (1) |
|
24.2 Liability and software |
|
|
425 | (1) |
|
|
426 | (1) |
|
24.4 The legal status of software and software contracts |
|
|
426 | (3) |
|
24.5 Implied terms in software contracts |
|
|
429 | (4) |
|
|
430 | (1) |
|
|
430 | (1) |
|
|
431 | (2) |
|
24.6 Remedies for breach of the implied terms |
|
|
433 | (2) |
|
24.7 Software quality and the courts |
|
|
435 | (1) |
|
|
435 | (10) |
|
24.7.2 Problems with the Community Charge |
|
|
437 | (2) |
|
24.7.3 Water privatisation |
|
|
439 | (1) |
|
24.7.4 The Monday software package |
|
|
440 | (3) |
|
24.7.5 The dog with an MBA |
|
|
443 | (2) |
|
24.8 Exclusion or limitation of liability |
|
|
445 | (2) |
|
24.8.1 Enforceability of shrink-wrap licences |
|
|
446 | (1) |
|
|
447 | (1) |
|
24.10 Non-consumer contracts |
|
|
448 | (5) |
|
24.10.1 The requirement of reasonableness |
|
|
450 | (3) |
|
24.11 Towards fair dealing obligations in contractual relationships? |
|
|
453 | (3) |
|
24.12 The Consumer Rights Act 2015 |
|
|
456 | (2) |
|
|
458 | (3) |
|
24.14 Exclusion of liability |
|
|
461 | (1) |
|
|
462 | (5) |
Index |
|
467 | |