Supreme Court Guidance on Personal Data Disclosure in Copyright Claims

Hungary’s Supreme Court – the Curia – recently held that during the enforcement of copyright claims before courts, internet service providers (ISPs) may disclose the personal data of their natural person subscribers only with the subscribers’ consent. As a result, ISPs now may want to revise their data disclosure policies and practices to implement the approach of the Curia.

The applicable law

In accordance with Directive 2004/48/EC on the Enforcement of Intellectual Property Rights, Hungarian law (Act LXXVI of 1999 on Copyright - Copyright Act) enables courts in intellectual property infringement proceedings – in response to a justified and proportionate request of the claimant – to order that information on the origin and distribution networks of the goods or services which infringe an intellectual property right be provided by the infringer. Courts may also order those persons to perform the above data provision who were found to be providing on a commercial scale services used in infringing activities.

The relevant case

In the case, where the Curia confirmed the lower court’s ruling, the claimant lodged a copyright claim against an ISP. The claimant – on the basis of the Copyright Act – requested the court to oblige the ISP to disclose the names and addresses of some of its subscribers, in order to identify the users of those IP addresses where the unauthorised use of works protected by copyright took place. The claimant stated that the people using the relevant IP addresses have unlawfully copied works by downloading movies from the internet, and also have unlawfully reproduced the works by facilitating the downloading of such movies by third parties. The final judgement dismissed the claim and held that the defendant service provider was not obliged to disclose the personal data (names and addresses) of natural person subscribers without their consent.

Possible application of other laws

Act CVIII of 2001 on Electronic Commerce and on Information Society Services (E-Commerce Act) allows ISPs to process the identification data and home address of natural person subscribers but only for the purposes listed therein. Such purposes are: concluding contracts for information society services, defining their contents, subsequent amendments, monitoring the performance of the contracts, invoicing the relevant fees, and enforcing claims arising out of or in connection with such contracts. Such data may not be linked to the identification data of the service recipient and may not be disclosed to third parties without the prior consent of the recipient. The Curia confirmed that the E-Commerce Act does not allow the disclosure of the personal data of natural person subscribers in any other cases.

Act C of 2003 on Electronic Communications requires electronic communications service providers to disclose or make available the data in their possession upon a request made by the investigating authority, the public prosecutor, the court or the national security service in accordance with the applicable law. The Curia determined that the relevant provisions of the Copyright Act are not applicable in this respect.

The Curia also found that the restrictions on the subscribers’ privacy rights are not proportionate to the legitimate interests pertaining to the enforcement of copyright claims. Consequently, the claimant cannot argue that the data are required for its legitimate interests and that therefore the subscriber’s consent is not needed for their disclosure under Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.

If you would like more information, please contact us.