England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
ADMINISTRATIVE COURT
Mr Justice Kenneth Parker
[2011] EWHC 1021 (Admin)

		Royal Courts of Justice Strand, London, WC2A 2LL
		06/03/2012

Lord Justice Richards :

1. This is an appeal against an order made by Kenneth Parker J in judicial review proceedings relating to the compatibility of the online infringement of copyright provisions ("the contested provisions") of the Digital Economy Act 2010 ("the DEA 2010") and the draft Copyright (Initial Obligations) (Sharing of Costs) Order 2011 ("the draft Costs Order") with a number of EU directives.
2. The DEA 2010 inserted new sections 125A to 125N into the Communications Act 2003 as a response to the growing problem of subscribers to internet services uploading and accessing material online in breach of copyright. In broad outline, the contested provisions impose "initial obligations" on internet service providers ("ISPs") to notify subscribers of copyright infringement reports (or "CIRs") received from copyright owners, and to provide copyright infringement lists (or "CILs") to copyright owners, if an "initial obligations code" is in force. They make provision for the approval or making of an initial obligations code and as to the content of such a code, and empower the Secretary of State to specify provisions that must be included in the code about payment of contributions towards costs incurred: the draft Costs Order is to be made in the exercise of that power. They also provide for the possible future introduction of additional "technical obligations" on ISPs, together with a "technical obligations code". This case is concerned, however, only with the initial obligations, the initial obligations code and the related provisions as to costs.
3. The appellants, British Telecommunications Plc and TalkTalk Telecom Group Plc, are ISPs. They were the claimants in the court below, where they advanced a multi-faceted but largely unsuccessful challenge to the contested provisions and the draft Costs Order.
4. The defendant was formerly the Secretary of State for Business, Innovation and Skills, but owing to a transfer of functions the correct respondent to the appeal is now the Secretary of State for Culture, Olympics, Media and Sport.
5. The interested parties are organisations, employers, unions and associations concerned with the protection of copyright in works belonging to their members.
6. Kenneth Parker J's judgment below is extremely thorough, clear and cogent. I will cross-refer to it for many points of detail, whilst aiming to include sufficient in my own judgment for a proper understanding and resolution of the issues in the appeal. A number of the issues decided by the judge have fallen away. Permission to appeal has been granted on grounds that cover four areas:

(1) Ground 1: whether the contested provisions should have been notified to the EU Commission in draft pursuant to Directive 98/34/EC of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations, as amended by Directive 98/48/EC, ("the Technical Standards Directive"), with the result that they are unenforceable for want of notification.

(2) Ground 2: whether the contested provisions are incompatible with provisions of Directive 2000/31/EC of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market ("the Electronic Commerce Directive" or "the ECD").

(3) Ground 3: whether the contested provisions are incompatible with provisions of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("the Data Protection Directive" or "the DPD") and/or of Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ("the Privacy and Electronic Communications Directive" or "the PECD").

(4) Ground 4: whether the contested provisions are incompatible with provisions of Directive 2002/20/EC of 7 March 2002 on the authorisation of electronic communications networks and services, as amended by Directive 2009/140/EC, ("the Authorisation Directive" or "the AD").

7. Ground 1 does not apply to the draft Costs Order, which was notified to the Commission in draft. Whilst grounds 2 to 4 do apply to the draft Costs Order, it is only under ground 4 that it requires specific consideration.
8. The background to the DEA 2010 is described in some detail by the judge at [7]-[38]. I do not need to repeat it here.
9. The contested provisions are examined by the judge at [39]-[51]. Since they are central to the issues in the appeal, I will explain the main provisions before turning to consider the various grounds of appeal.

The contested provisions

10. The references below are to provisions of the Communications Act 2003 as inserted by sections 3 to 16 of the DEA 2010. The provisions fall under the heading "Online infringement of copyright obligations of internet service providers".
11. Section 124A imposes an obligation on ISPs to notify subscribers of copyright infringement reports (as defined in the section). It provides:

"124A.(1) This section applies if it appears to a copyright owner that –

(a) a subscriber to an internet access service has infringed the owner's copyright by means of the service; or

(b) a subscriber to an internet access service has allowed another person to use the service, and that other person has infringed the owner's copyright by means of the service.

(2) The owner may make a copyright infringement report to the internet service provider who provided the internet access service if a code in force under section 124C or 124D (an 'initial obligations code') allows the owner to do so.

(3) A 'copyright infringement report' is a report that –

(a) states that there appears to have been an infringement of the owner's copyright;

(b) includes a description of the apparent infringement;

(c) includes evidence of the apparent infringement that shows the subscriber's IP address and the time at which the evidence was gathered;

(d) is sent to the internet service provider within the period of 1 month beginning with the day on which the evidence was gathered; and

(e) complies with any other requirement of the initial obligations code.

(4) An internet service provider who receives a copyright infringement report must notify the subscriber of the report if the initial obligations code requires the provider to do so.

(5) A notification under subsection (4) must be sent to the subscriber within the period of 1 month beginning with the day on which the provider receives the report.

(6) A notification under subsection (4) must include … [a detailed list of matters, including, at (6)(i), 'anything else that the initial obligations code requires the notification to include'].

…."

12. Section 124B imposes an obligation on ISPs to provide copyright infringement lists (as defined in the section) to copyright owners. It provides:

"124B.(1) An internet service provider must provide a copyright owner with a copyright infringement list for a period if –

(a) the owner requests the list for that period; and

(b) an initial obligations code requires the internet service provider to provide it.

(2) A 'copyright infringement list' is a list that –

(a) sets out, in relation to each relevant subscriber, which of the copyright infringement reports made by the owner to the provider relate to the subscriber, but

(b) does not enable any subscriber to be identified.

(3) A subscriber is a 'relevant subscriber' in relation to a copyright owner and an internet service provider if copyright infringement reports made by the owner to the provider in relation to the subscriber have reached the threshold set in the initial obligations code."

13. Sections 124C to 124E all concern the initial obligations code. Section 124C provides for the approval of a code made by persons other than Ofcom; section 124D provides for the making of a code by Ofcom in the absence of a code approved under section 124C; and section 124E relates to the contents of a code. An order approving or making a code must be laid before Parliament and is subject to annulment in pursuance of a resolution of either House.
14. Section 124C provides:

"124C.(1) The obligations of internet service providers under sections 124A and 124B are the 'initial obligations'.

(2) If it appears to OFCOM –

(a) that a code has been made by any person for the purpose of regulating the initial obligations; and

(b) that it would be appropriate for them to approve the code for that purpose,

they may by order approve it, with effect from the date given in the order.

(3) The provision that may be contained in a code and approved under this section includes provision that -

(a) specifies conditions that must be met for rights and obligations under the copyright infringement provisions [i.e. sections 124A to 124N] or the code to apply in a particular case;

(b) requires copyright owners or internet service providers to provide any information or assistance that is reasonably required to determine whether a condition under paragraph (a) is met.

(4) The provision mentioned in subsection (3)(a) may, in particular, specify that a right or obligation does not apply in relation to a copyright owner unless the owner has made arrangements with an internet service provider regarding –

(a) the number of copyright infringement reports that the owner may make to the provider within a particular period; and

(b) payment in advance of a contribution towards meeting costs incurred by the provider.

(5) The provision mentioned in subsection (3)(a) may also, in particular, provide that –

(a) except as provided by the code, rights and obligations do not apply in relation to an internet service provider unless the number of copyright infringement reports the provider receives within a particular period reaches a threshold set in the code; and

(b) if the threshold is reached, rights or obligations apply with effect from the date when it is reached or from a later time.

(6) OFCOM must not approve a code under this section unless satisfied that it meets the criteria set out in section 124E.

…."

15. Section 124D provides:

"124D.(1) For any period when sections 124A and 124B are in force but for which there is no approved initial obligations code under section 124C, OFCOM must by order make a code for the purpose of regulating the initial obligations.

(2) OFCOM may but need not make a code under subsection (1) for a time before the end of -

(a) the period of six months beginning with the day on which sections 124A and 124B come into force, or

(b) such longer period as the Secretary of State may specify by notice to OFCOM.

…

(4) A code under this section may do any of the things mentioned in section 124C(3) to (5).

…

(6) OFCOM must not make a code under this section unless they are satisfied that it meets the criteria set out in section 124E.

…."

16. Section 124E sets out the criteria to be met by an initial obligations code. Subsection (1), which is then amplified in the later subsections, provides:

"124E.(1) The criteria referred to in sections 124C(6) and 124D(6) are –

(a) that the code makes the required provision about copyright infringement reports …;

(b) that it makes the required provision about the notification of subscribers …;

(c) that it sets the threshold applying for the purpose of determining who is a relevant subscriber within the meaning of section 124B(3) …

(d) that it makes provision about how internet service providers are to keep information about subscribers;

(e) that it limits the time for which they may keep that information;

(f) that it makes any provision about contributions towards meeting costs that is required to be included by an order under section 124M;

(g) that the requirements concerning administration and enforcement are met in relation to the code …;

(h) that the requirements concerning subscriber appeals are met in relation to the code …;

(i) that the provisions of the code are objectively justifiable in relation to the matters to which it relates;

(j) that those provisions are not such as to discriminate unduly against particular persons or against a particular description of persons;

(k) that those provisions are proportionate to what they are intended to achieve; and

(l) that, in relation to what those provisions are intended to achieve, they are transparent."

17. The requirements that an initial obligations code must contain in relation to subscriber appeals are set out in section 124K(2) to (8). They include, in subsection (7), a requirement that the powers of the person determining subscriber appeals are to include power (a) to secure so far as practicable that a subscriber is not prejudiced for the purposes of the copyright infringement provisions by an act or omission in respect of which an appeal is determined in favour of the subscriber, (b) to make an award of compensation to be paid by a copyright owner or ISP to a subscriber affected by such an act or omission, and (c) where the appeal is determined in favour of the subscriber, to direct the copyright owner or ISP to reimburse the reasonable costs of the subscriber.
18. Section 124L makes provision for enforcement of the initial obligations, including a power for Ofcom to impose financial penalties for contraventions.
19. Section 124M provides that the Secretary of State may by order specify provisions that must be included in an initial obligations code about payment of contributions towards costs incurred under the copyright infringement provisions. As already mentioned, the draft Costs Order has been made in the exercise of that power.
20. Section 124N is an interpretation section for the purposes of sections 124A to 124M.
21. The DEA 2010 received Royal Assent on 8 April 2010. Some of the contested provisions came into force on that date, the others (so far as relevant) on 8 June 2010.

Ground 1: the Technical Standards Directive

22. The appellants' case on this ground is that the contested provisions should have been notified in draft to the EU Commission pursuant to the Technical Standards Directive. It is common ground that they were not in fact notified and that, if there was a requirement to notify them, the failure to notify renders them unenforceable. The Secretary of State's position, upheld by the judge, is that there was no requirement to notify the provisions by themselves; it is the code to be approved or made under section 124C or 124D ("the Code") that will need to be notified in draft, accompanied by the text of the statute as part of the explanatory package.
23. The notification requirement is in Article 8(1) of the directive, which provides:

"Subject to Article 10, Member States shall immediately communicate to the Commission any draft technical regulation, except where it merely transposes the full text of an international or European standard …; they shall also let the Commission have a statement of the grounds which make the enactment of such technical regulation necessary, where these have not already been made clear in the draft.

Where appropriate, and unless it has already been sent with a prior communication, Member States shall simultaneously communicate the text of the basic legislative or regulatory provisions principally and directly concerned, should knowledge of such text be necessary to assess the implications of the draft technical regulation …."

24. "Draft technical regulation" is defined in Article 1(12) as "the text of a technical specification or other requirement or of a rule on services, including administrative provisions, formulated with the aim of enacting it or of ultimately having it enacted as a technical regulation, the text being at a stage of preparation at which substantial amendments can still be made". "Technical regulation" is defined in Article 1(11) as "technical specifications and other requirements or rules on services, including the relevant administrative provisions, the observance of which is compulsory, de jure or de facto, in the case of marketing, provision of a service, establishment of a service operator or use in a Member State or a major part thereof …". The focus in this case is on a "rule on services", defined in Article 1(5) as a "requirement of a general nature relating to the taking-up and pursuit of service activities" within the meaning of Article 1(2). Article 1(2) defines "service" as "any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services". These various definitions are covered more fully by the judge at [52]-[55].
25. The broad aim of the notification requirement is to enable the Commission and other Member States to comment on the draft (the comments from Member States being informed by input from trade organisations and undertakings) and for those comments to be taken into account, as Article 8(2) requires them to be, in the subsequent preparation of the technical regulation itself. Article 9 therefore lays down various standstill periods during which the notifying Member State must postpone adoption of the measure. At [60]-[62] the judge dealt more fully with the purposes of notification, drawing from Article 9, the recitals to the directive and the case-law. As he said at [60], the main purpose "is to allow the Commission and other Member States to propose any amendments which might remove or reduce any restrictions which a rule on services might create on the free movement of services or the freedom of establishment, and to serve the interests of transparency and legal certainty by ensuring that there is an opportunity for Member States to take into account the potential introduction of forthcoming EU legislation which covers some or all of the same ground that the national measure is designed to address".
26. There are three Court of Justice authorities relevant to the question whether the contested provisions amount to a technical regulation which should have been notified in draft or whether it is only the Code that will need to be notified in due course as a draft technical regulation.
27. The circumstances in Case C-317/92, Commission v Germany [1994] ECR I-2039 were that primary legislation imposed a labelling requirement on medicinal products and conferred a power to extend the requirement to other products; and the power was subsequently exercised to adopt a regulation extending the requirement to non-sterile medical instruments. The primary legislation had been notified in draft but the regulation extending the requirement had not. The court held that the regulation "constitutes a new technical specification within the meaning of Article 1 … since non-reusable sterile medical instruments may henceforth be marketed or used in Germany only if certain obligations are fulfilled the application of which was formerly confined to the labelling of medicinal products" (paragraph 25) and that the regulation should therefore have been notified. It continued:

"26. That finding is not called in question by the fact that … the extension of the scope of the rule is based on an enabling provision which was previously communicated to the Commission. That enabling measure, taken as such, does not require to be notified on the basis of Article 8 aforesaid since it does not constitute a new specification. The situation is different as regards the implementation of that measure, which does constitute a new specification which must be notified."

28. Case C-194/94, CIA Security SA v Signalson SA and Securitel SPRL [1996] ECR I-2201 concerned inter alia a Belgian law (Article 12 of the 1990 Law) providing that certain alarm systems and networks "may be marketed or otherwise made available to users only after prior approval has been granted under a procedure to be laid down by royal decree …". The procedure was laid down only by a later royal decree in May 1991 (the 1991 Decree). The court held:

"26. As regards the 1991 Decree, it contains detailed rules defining, in particular, the conditions concerning the quality tests and function tests which must be fulfilled in order for an alarm system or network to be approved and marketed in Belgium. Those rules therefore constitute technical regulations within the meaning of Directive 83/189.

27. As regards Article 12 of the 1990 Law, it is to be recalled that it provides that the products in question may be marketed only after having been previously approved according to a procedure to be laid down by royal decree, which was laid down by the 1991 Decree.

…

29. A rule is classified as a technical regulation for the purposes of Directive 83/189 if it has legal effects of its own. If, under domestic law, the rule merely serves as a basis for enabling administrative regulations containing rules binding on interested parties to be adopted, so that by itself it has no legal effect for individuals, the rule does not constitute a technical regulation within the meaning of the directive (see the judgment in Case C-317/92 Commission v Germany [1994] ECR I-2039, paragraph 26). It should be recalled here that, according to the first subparagraph of Article 8(1) of Directive 83/189, the Member States must communicate, at the same time as the draft technical regulation, the enabling instrument on the basis of which it was adopted, should knowledge of such text be necessary to assess the implications of the draft technical regulation.

30. However, a rule must be classified as a technical regulation within the meaning of Directive 83/189 if, as the Belgian Government submitted at the hearing, it requires the undertakings concerned to apply for prior approval of their equipment, even if the administrative rules envisaged have not been adopted.

31. The reply to be given to the third and fourth questions must therefore be that … provisions such as those contained in the 1991 Decree do constitute technical regulations and that classification of a rule such as Article 12 of the 1990 Law depends on the legal effects which it has under domestic law."

29. It is clear from paragraph 45 of the Opinion of the Advocate General that the explanation given by the Belgian Government at the hearing was that even without the 1991 Decree, Article 12 of the 1990 Law would not be without legal effect. This led the Advocate General to observe that the provision was not merely an enabling provision, as in Commission v Germany, but was on the contrary a significant substantive regulation which could stand alone and which had to be regarded as a technical regulation requiring to be notified. It appears that the court was proceeding along the same lines in paragraphs 30-31 of the judgment, whilst leaving it to the national court to determine whether the explanation given by the Belgian Government represented the true effect of Article 12 of the 1990 Law as a matter of national law.
30. Case C-159/00, Sapod Audic v Eco-Emballages SA [2002] ECR I-5031 concerned a provision of French law (Article 4 of Decree No. 92-377) which in substance required producers to apply a distinguishing mark to the packaging in which they marketed household goods but which left the details of the mark to be agreed between the producers and an approved body. The court, having noted that it was for the national court to interpret national law, continued:

"32. Consequently, the Court must also consider the possibility that, in the light of all the factual and legal evidence before the national court, that court will reach the conclusion that the second paragraph of Article 4 of Decree No 92-377 must be interpreted as imposing on producers an obligation to mark or label the packaging, although not specifying what sign must be affixed.

33. In such an event, it would have to be held that that provision is in fact a technical specification within the meaning of Directive 83/189 and, consequently, that, since the obligation is imposed by decree in the case of marketing of packaged products throughout the national territory, that provision constitutes a technical regulation.

34. In that case, even though the detailed rules regarding the marking or the labelling remained to be defined, marking or labelling would, in itself, be compulsory, also for imported products …. In addition, having regard to the aim of Directive 83/189, namely the protection of free movement of goods by means of preventive control (see, in particular, Case C-194/94 CIA Security International [1996] ECR I-2201, paragraphs 40 and 48), such a control, implemented in accordance with the procedure prescribed by that directive, would be both appropriate and possible."

31. Having considered those authorities and the case advanced by Mr White QC on behalf of the present appellants, Kenneth Parker J found against the appellants for reasons given at [84]-[94] of his judgment. His primary reasons were these:

"84. In my judgment, the fundamental difficulty with Mr White's analysis is that, on their proper interpretation (which, as the Court of Justice has stressed on at least two occasions …, is a matter for the national court), the initial obligations enacted by the DEA and brought into force are not yet legally enforceable against any individual, including ISPs such as the Claimants; and, therefore, they do not have the 'legal effect' described in the Court's case law. They are not legally enforceable for two distinct, but related, reasons. First, the incidence of the initial obligations on ISPs is made expressly contingent upon the promulgation and enactment of the Code. Without the Code, the initial obligations simply beat the air in legal terms. Secondly, the initial obligations are not yet sufficiently particularised as to be enforceable: the actual content of the obligations is to be spelled out in the Code.

85. As to the first point, I have already set out the relevant provisions at some length and need not repeat them. I put forward by way of example Section 124A(2) which permits a copyright owner to make a CIR to the ISP 'if a code in force under section 124C or 124D … allows the owner to do so'. In my view, the Parliamentary meaning could not be clearer: unless and until a code is in force the ISP is not liable to receive a copyright infringement report under the DEA and an ISP is not obliged to take any action in respect of any such report pursuant to the DEA. Copyright owners may send copyright infringement reports, but they have no consequences under the DEA unless and until a code is in force.

86. As to the second point, although section 124E sets out the criteria which the Code must fulfil, it is the code itself which will define the substantive content of the initial obligations. For example, the Code will specify the circumstances in which a copyright owner will be allowed to make a CIR, the means by which evidence must be obtained and the standard of proof which is required. The Code will also specify the circumstances in which an ISP will be required to provide a copyright infringement list to a copyright owner and determine the number of CIRs that must be made in respect of a subscriber before he becomes a 'relevant subscriber'. Importantly, although sections 124E(1)(f)-(g), 124E(7)-(8) and 124M require provision to be made about contributions towards meeting costs, they do not specify what that provision should be. That is left to the Costs Order, which will take effect when the Code itself takes effect" (original emphasis).

He went on to explain why in his view the various points made by Mr White did not undermine that conclusion.

32. The principal point advanced by Mr White before us is that the contested provisions impose two new obligations (the initial obligations) on ISPs to which they will be subject when the Code comes into force; it is inevitable that this will happen, since the statute requires the making of a Code; and the prescribed content of the Code is such as to make it inevitable that ISPs will have to do certain things and will be subject to certain liabilities, whatever the detail of the Code may be. Those features of the statute, necessarily exposing ISPs to obligations and liabilities, are said to meet the test for a technical regulation requiring notification in draft.
33. For example, Mr White pointed to section 124C(1) as making clear that the initial obligations are imposed by the statute as enacted, and to sections 124C(2) and 124D(1) as showing that the purpose of the Code is to regulate the obligations so imposed. The extent to which the content of the Code is prescribed by the statute is shown by sections 124C(6), 124D(6) and 124E. The effect of the provisions is that there will inevitably be copyright infringement reports which ISPs will be required to notify to subscribers, and there will be a requirement to provide some copyright infringement lists. ISPs will therefore need to set up databases for the operation of the system. All this is clear from the statute. It is, moreover, inevitable that ISPs will be exposed to a liability to pay compensation and costs and to a liability to financial penalties (see section 124E(f)-(h) together with sections 124K(7) and 124L). The terms of the draft Costs Order are also relied on as showing the extent to which it is possible to predict what ISPs will have to do under the system laid down by the statute.
34. Thus it is submitted that, contrary to the view taken by the judge, the contested provisions do have legal effects of their own, which will arise and be enforceable under the statute as soon as the Code comes into force. The judge lost sight of, or paid insufficient attention to, the fact that the making of the Code is inevitable. He was wrong, for example, to say in [85] that the ISP would not be liable to receive or take action on a copyright infringement report "unless" a code was in force: "unless" suggests that there might not be a code, whereas the statute requires there to be one.
35. A further criticism of the judge's reasoning relates to his finding at [93] that the combined effect of section 124D and section 135(1) of the Communications Act 2003 (which empowers Ofcom to require ISPs to provide it with all such information as it considers necessary for the purpose of carrying out its functions) was that ISPs and others had come under a new liability to provide information, if Ofcom required it, for the purposes of Ofcom's new functions, and that this new liability was itself a "rule on services" and hence a technical regulation which should have been notified in draft. The judge described this as a specific and limited liability which did not in itself make the initial obligations legally enforceable against ISPs and did not give relevant legal effect to those obligations, so it did not advance the appellants' case on notification generally. Mr White submitted that to treat this liability as severable from the rest of the package was an artificial approach to a scheme with interlocking provisions.
36. At [88] the judge observed that if, following notification, it transpired that the Code needed such fundamental amendment that the contested provisions themselves required amendment, such amendment could be effected if necessary under the provisions of the European Communities Act 1972. Mr White did not dispute that an amendment could be effected in that way, but he submitted that this approach does not pay proper respect to the requirement of notification in draft so that any necessary amendments can be made prior to enactment rather than after the event.
37. Criticism is also made of the judge's response to the argument that any interpretation other than that put forward by the appellants would create anomalies; for example, if an obligation had no legal effect simply because its effect was made contingent on some later event, then the duty to notify could be put off so long as that event was not imminent. The judge said at [89] that each situation would have to be assessed on its own particular facts and that it might well be, for example, that a measure once enacted could be a technical regulation if all that was lacking was a simple provision to bring the measure into force: in such a case, in contrast to the present case, it would be difficult to see how the commencement provision, having no substantial content, could be a technical regulation and how the measure itself, having been enacted, was still a "draft" for the purposes of Article 1(12) of the directive. Mr White submitted that it cannot be a question of degree (there must be a requirement to notify, or not) and that the judge's approach involved an erroneous gloss.
38. I am not persuaded by any of those submissions. In my judgment, the judge reached the correct conclusion on this issue for the reasons he gave, and there is no force to the appellants' criticisms of those reasons.
39. The Court of Justice's case-law cited above shows that the key question is whether the legislation in issue has "legal effects of its own" (the expression at paragraph 29 of the judgment in CIA Security SA): the fact that the legislation refers to further rules which have not yet been made will not prevent it from being a technical regulation if the legislation itself has legal effects. Unless it has actual legal effects, the legislation is not capable of impacting on those seeking to exercise the freedom of movement of services or other freedoms. This also fits with the language of "rule" or "requirement" in the relevant definitions contained in Article 1 of the directive.
40. There may be particular situations which are difficult to analyse, such as that considered by the judge at [89] where legislation may realistically have to be notified pre-enactment even though it will not have legal effects post-enactment until a further order is made to bring it into force. But the existence of potentially difficult cases does not affect the basic principle as it appears from the case-law, and I am satisfied in any event that legislation enacting a scheme of regulation that is conditional or contingent on future rules both for its detailed content and for it to have any relevant legal effect at all does not have to be notified in draft before it is enacted.
41. That view also fits with the purpose of the notification requirement. As submitted by Mr Eadie QC for the Secretary of State, there is not a lot of point in troubling the Commission and other Member States with something that is inchoate. Informed comment depends on there being a worked-through draft, especially as consideration of issues of proportionality depends on the detail.
42. The judge was right to find that the contested provisions do not have the "legal effects" described by the court's case-law. The "initial obligations" of ISPs under sections 124A and 124B are conditional on there being a code in force under section 124C or 124D. The word "if" in section 124A(2) is important, even though the provisions contemplate that there must in due course be a code: until such time as the Code comes into being, the provisions impose no obligations on ISPs. Moreover the Code is to be made for the purpose of regulating the initial obligations, and the scope of those obligations will be dependent on the detailed content of the Code. Whilst the statute prescribes various basic features of the Code, it leaves very considerable freedom for the working out of the detail. (The fact that the contested provisions have legal effects for Ofcom, in relation to matters such as the approval or making of the Code, is irrelevant. What matters is whether there are legal effects for individuals, capable of affecting the freedom of movement of services or freedom of establishment.)
43. The purpose of the notification procedure will be better served by notification of the draft Code, accompanied by the statute as part of the package. Only at that stage can the nature and effect of the scheme be properly assessed and detailed comments be made on it. Since at that stage it will still be possible to amend the contested provisions as well as the draft Code should it prove necessary to do so, and this can take place before any legal effects arise, I do not accept the argument that this approach fails to pay proper respect to the notification requirement.
44. By way of exception to the above, the judge correctly identified the one respect in which the contested provisions did have legal effects, as triggering a power in Ofcom to require ISPs to provide it with information. I see no difficulty in treating that one matter as involving a distinct technical regulation which should have been notified in draft and is unenforceable through want of notification. It does not provide a good reason for treating the entirety of the contested provisions as a technical regulation.
45. Accordingly, I would reject the appellants' case under ground 1.

Ground 2: the Electronic Commerce Directive

46. The appellants advance a twofold case of breach of the Electronic Commerce Directive: (1) that the effect of the contested provisions is to render ISPs potentially "liable for the information transmitted", contrary to Article 12, and (2) that the contested provisions amount to restrictions on the freedom to provide information society services from other Member States, "for reasons falling within the co-ordinated field", contrary to Article 3. The judge rejected the case in respect of both articles. He also rejected a case advanced under Article 15 of the directive, for which permission to appeal was refused.

Article 12 of the Electronic Commerce Directive

47. Article 12 is in a section of the directive concerning the liability of "intermediary service providers" of three types: "mere conduit" (Article 12), "caching" (Article 13) and "hosting" (Article 14). Different provisions apply to each type. In relation to "mere conduits", Article 12 provides:

"12(1) Where an information society service is provided that consists of the transmission in a communication network of information provided by a recipient of the service, or the provision of access to a communication network, Member States shall ensure that the service provider is not liable for the information transmitted, on condition that the provider:

(a) does not initiate the transmission;

(b) does not select the receiver of the transmission; and

(c) does not select or modify the information contained in the transmission.

…

(3) This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement."

48. The appellants contend that the set of responsibilities imposed on them by the contested provisions with regard to notification of copyright infringement reports and the provision of copyright infringement lists, together with the related financial burden and exposure to liability for costs, compensation and penalties, renders them "liable for the information transmitted" within the meaning of Article 12(1) and is therefore incompatible with the article.
49. The judge referred at [100] to the legislative history of Article 12, which, in the words of the Commission, "struck a careful balance between the different interests involved in order to stimulate cooperation between different parties thereby reducing the risk of illegal activity on-line". He continued:

"101. … It seems to me that if the Community legislator, as in this instance, has chosen specific language to give effect to a careful balancing of competing interests, the judge must be especially cautious before departing from the plain meaning of the text. To depart from that meaning creates the obvious risk of promoting the interest of one economic sector to the detriment of the other interested sector, and hence of seriously upsetting the balance between competing interests that the legislator has carefully struck. It was for this very reason that the Commission rejected certain amendments to its legislative proposal that the European Parliament put forward which would have affected the balance struck by the text of Article 12.

102. It seems to me, particularly in the light of that legislative history, that liability "for the information transmitted" is a carefully delineated and limited concept. As regards copyright material, this language is broadly contemplating a scenario in which a person other than the ISP has unlawfully placed the material in the public domain or has unlawfully downloaded such material, and a question then arises whether the ISP, putatively a mere conduit for the transmission of the information, also incurs a legal liability in respect of the infringement. That liability could take the form of a fine (in criminal or regulatory proceedings) or damages or other compensation payable to the copyright owner, or some form of injunctive relief. The liability could be joint and several with the other person, or it could simply be a default liability if the other person could not be found, or was not worth pursuing, or was insolvent …" (original emphasis).

50. For reasons given at [103]-[105], the judge considered that this interpretation was consistent with Article 12(3), with the jurisdiction of the High Court arising from Norwich Pharmacal v Customs and Excise Commissioners [1974] AC 133, and with the implementation of Article 12 in UK law through Regulation 17(1) of the Electronic Commerce (EC Directive) Regulations 2002.
51. He went on to give detailed reasons for rejecting the appellants' specific contention that liabilities of ISPs under the contested provisions would render them "liable for the information transmitted" within Article 12(1):

"107. However, penalties may be imposed under section 124L only as a sanction for a breach of an initial obligation, for example, by a failure to notify a subscriber of a CIR, or to provide a copyright owner with a Copyright Infringement List ('CIL'), or for a breach of a technical obligation (a failure to take a technical measure against a relevant subscriber), or for a failure to give Ofcom any assistance that they reasonably require for the purposes of complying with any direction by the Secretary of State. These liabilities arise as a result of the specific scheme established by the DEA, of which the core obligations, so far as concern ISPs, are that ISPs are obliged to receive CIRs from copyright owners and to communicate such CIRs to their subscribers, and to compile CILs for onward transmission to copyright owners. These core obligations do not constitute any liability 'for the information transmitted', that is, in respect of the underlying infringement of copyright that has given rise to CIRs and CILs, as explained earlier. Without the underlying infringement, there would be no CIR or CIL: but the legal test is not whether a liability has arisen because there was an initial infringement of copyright; the liability must arise in respect of that underlying infringement, so that the liability is for the information transmitted. The liabilities or costs referred to by Mr White are wholly dependent upon the regulatory regime under the DEA and are essentially parasitic on the core obligations of the ISPs. In that sense they are one stage removed from the core obligations and do not, any more than those obligations, constitute any liability 'for the information transmitted'. The same analysis applies to costs and/or compensation arising from subscriber appeals. The liability to pay such costs and/or compensation arises in essence from the failure of an ISP to discharge its core obligations under the DEA. Nor does any eventual requirement to take technical measures impose a liability 'for the information transmitted': such a requirement is an element in a regulatory procedure designed to put appropriate controls on those subscribers who, despite other measures, have persisted in copyright infringements.

108. Mr White frankly accepted that the foregoing obligations and costs could fall within Article 12 only if the crucial words of that Article meant 'an economic or other burden falling on an ISP that would not have so fallen if there had not been a transmission of information in breach of copyright, etc.', or other language to that effect. However, for the reasons already given, I am not able to extract such an extended meaning from the language of Article 12 without doing violence to that language and thereby upsetting the careful balance represented by the text …."

52. Mr White submitted to us that the judge was wrong to say that the appellants' construction of Article 12 would do violence to the language of the article, and that the judge's own construction was unduly narrow. It is said that as a matter of language, the words are capable of bearing the meaning for which the appellants contend, and once it is accepted that it is a possible construction there are a number of pointers in favour of it being the correct one. The main pointers relied on are sought to be derived from the purpose of the directive, as shown by its recitals; from the travaux préparatoires or legislative history; and from the terms of Article 12(3).
53. In my judgment, the judge's construction of Article 12 gives effect to the natural meaning of the language used and is the correct one. The appellants' construction places, at the very least, a severe strain on the language used and gains no material support from the "pointers" on which Mr White relied. The arguments advanced by the appellants do nothing to cast doubt on the conclusion reached by the judge.
54. Article 1(1) states that the directive "seeks to contribute to the functioning of the internal market by ensuring the free movement of information society services between the Member States". This objective is further illustrated by the recitals, including recitals (3) and (8). Consistently with the objective, the directive aims to place primary responsibility for the regulation of ISPs on the Member State of establishment (the country of origin principle) and to cut down the restrictions that may be imposed on an ISP by other Member States: see, in particular, recitals (22) and (24), the latter of which provides that in the context of the directive, notwithstanding the country of origin principle, "it is legitimate under the conditions established in this Directive for Member States to take measures to restrict the free movement of information society services". I can see nothing in the objective of the directive or in the detailed recitals that favours the appellants' interpretation of Article 12. They cast no real light on whether the contested provisions fall within the prohibition in Article 12.
55. As to the travaux préparatoires, Mr White sought to derive assistance, first, from the fact that the explanatory memorandum accompanying the Commission's proposal for the directive referred, in relation to the proposed Article 12, to the need to clarify the "responsibility" of ISPs for transmitting and storing third party information. Mr White suggested that "responsibility" was a wider concept than legal liability for unlawful conduct and that "liability" in Article 12 should be given this wider meaning. For my part, I see no force at all in that linguistic point.
56. The second point advanced by Mr White in relation to the travaux préparatoires was based on the fact that the European Parliament proposed, but the Commission rejected, the extension to "access" providers (i.e. to the "mere conduits" covered by Article 12) of a "notice and take down" procedure of the kind contained in Articles 13 and 14 in relation to caching and hosting providers respectively. The fact that such a proposal was evidently considered inappropriate is relied on as suggesting that the protection in Article 12 from liability for information transmitted is wider than mere protection from legal liability for unlawful conduct. But that is to attribute to the Commission a speculative and improbable reason for its rejection of the proposal. The inappropriateness of a "notice and take down" procedure in respect of mere conduits is readily explained, as was submitted in the skeleton argument on behalf of the Secretary of State, by the fact that, by their very nature, mere conduits could not be required to "take down" information: that is a responsibility of those who cache or host information under Article 13 or Article 14. This aspect of the legislative history cannot therefore assist the appellants.
57. The final pointer relied on by the appellants in support of their construction of Article 12(1) is the provision of Article 12(3) whereby the article "shall not affect the possibility for a court or administrative authority … of requiring the service provider to terminate or prevent an infringement". It is said that the premise of Article 12(3), read in the light of recitals (43) to (45), is that Article 12(1) would otherwise prevent a mere conduit from being required by a court or administrative authority to terminate or prevent an infringement committed by another, i.e. the subscriber; and that this supports the view that "liable for the information transmitted" in Article 12(1) is not limited to legal liability for unlawful conduct by the ISP but covers the responsibility of the ISP as a result of the transmission of unlawful information.
58. The judge dealt with Article 12(3) at [103], picking up a point he had made at the end of [102] concerning situations in which the owners of intellectual property rights have sought effective remedies against those they perceive to have facilitated the infringement of those rights. He said:

"103. … In the scenario just described it is conceivable that the copyright owner might in certain cases be able to draw the attention of the ISP to the fact of a present infringement, or to the likelihood of a specific infringement occurring in the future, and to invite the ISP to terminate or prevent such an infringement. In these circumstances, if the ISP was liable to terminate or prevent the present or future infringement, a real question could arise as to whether the ISP was being made liable 'for the information transmitted', or was rather simply coming under an obligation to use its technical facilities to terminate or prevent an infringement, in respect of the information transmitted, committed by another person. The 'careful balance' struck by the Community legislator settles that issue, and removes all uncertainty, by allowing Member States to authorise the courts or competent administrative authority to order the ISP to terminate or prevent the infringement, so long as the ISP is not made liable (by way of fine or compensation) in respect of the infringement itself" (original emphasis).

59. The judge thereby gives Article 12(3) a sensible scope of application which is entirely consistent with his interpretation of Article 12(1). I see nothing in Article 12(3) itself or in recitals (43) to (45) to sustain the appellants' contention that the judge was in error. Recital (43) provides that an ISP can benefit from the exemptions for a mere conduit "when he is in no way involved with the information transmitted"; recital (44) that an ISP who deliberately collaborates with one of the recipients of his service in order to undertake illegal acts goes beyond the activities of a mere conduit and as a result cannot benefit from the exemption from liability; and recital (45) that the limitations of the liability of an ISP established in the directive "do not affect the possibility of injunctions of different kinds; such injunctions can in particular consist of orders by courts or administrative authorities requiring the termination or prevention of any infringement". It is recital (45), in particular, that reflects Article 12(3), but there is nothing in it or in the two preceding recitals or in the wording of Article 12(3) itself to cast doubt on the correctness of the judge's analysis.
60. For those reasons I would reject the appellants' case under Article 12 of the directive.

Article 3 of the Electronic Commerce Directive

61. Article 3 of the directive provides:

"3(1) Each Member State shall ensure that the information society services provided by a service provider established on its territory comply with the national provisions applicable in the Member State in question which fall within the coordinated field.

(2) Member States may not, for reasons falling within the coordinated field, restrict the freedom to provide information society services from another Member State.

(3) Paragraphs 1 and 2 shall not apply to the fields referred to in the Annex.

(4) Member States may take measures to derogate from paragraph 2 in respect of a given information society service if the following conditions are fulfilled: … [the conditions refer inter alia to the necessity for the measures and to a prior notification procedure]."

62. It is contended by the appellants that the contested provisions are contrary to Article 3(2) in that they are taken for reasons falling within the coordinated field and they restrict the freedom to provide information services from another Member State. It is sufficient to focus for present purposes on whether they are taken for reasons falling within the coordinated field. That turns on the scope of the "coordinated field". The effect of Article 3(3) is that it excludes fields referred to in the Annex. The Annex provides inter alia that Article 3 (1) and (2) do not apply to:

"copyright, neighbouring rights, rights referred to in Directive 87/54/EEC and Directive 96/9/EC as well as industrial property rights."

63. The expression "copyright" in the Annex is not defined. The Secretary of State's contention, accepted by the judge, is that it has its normal meaning, encompassing all aspects of the law of copyright under national laws, that the contested provisions were taken for reasons falling within the field of copyright in that sense, and that Article 3(2) therefore does not apply to them. The appellants submit that "copyright" in the Annex has a more limited meaning, referring only to the substantive law of copyright under national laws and to such measures for the protection of copyright as have been introduced by Directive 2001/29/EC of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society ("the Copyright Directive"); that the contested provisions do not relate to copyright in that sense; and that they are incompatible with Article 3(2).
64. Mr Beal, who presented this part of the argument on behalf of the appellants, referred to the travaux préparatoires behind the directive as indicating that the exclusion of "copyright" from the scope of Article 3(1) and (2) was the result of an insufficient level of harmonisation to guarantee an equivalent level of protection between Member States; but he submitted that it was the intention of the Community legislature to adopt the Copyright Directive at much the same time as the Electronic Commerce Directive and that "copyright" in the Annex must be interpreted accordingly. He referred in that connection to recital (50) of the Electronic Commerce Directive, which provides:

"(50) It is important that the proposed directive on the harmonisation of certain aspects of copyright and related rights in the information society and this Directive come into force within a similar time scale with a view to establishing a clear framework of rules relevant to the issue of liability of intermediaries for copyright and relating rights infringements at Community level."

65. In the event, the Copyright Directive was adopted almost a year later than the Electronic Commerce Directive. As its title indicates, it provides for the harmonisation of certain aspects of copyright and related rights in the framework of the internal market, with particular emphasis on the information society. It does not affect the substantive law of copyright. Its focus is on the removal of significant differences in the protection of rights within the harmonised field. It provides inter alia by Article 8(1) that Member States shall provide appropriate sanctions and remedies in respect of infringements of the rights and obligations set out in the directive; by Article 8(2), that each Member State shall take the measures necessary to ensure that rightholders whose interests are affected by an infringing activity carried out on its territory can bring an action for damages and/or apply for an injunction, etc; and by Article 8(3), that Member States "shall ensure that rightholders are in a position to apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right".
66. The appellants' contention, as I have said, is that "copyright" in the Annex to the Electronic Commerce Directive refers to the substantive law of copyright (which remains unharmonised) and to the harmonised measures of copyright protection introduced by the Copyright Directive. This construction is said to gain support from the principle that derogations from directives are to be narrowly construed, and from certain observations by the Commission on French legislation which permits measures to be taken against internet users who commit copyright infringement online. It is submitted that the contested provisions do not relate to substantive copyright law and do not fall within the scope of Article 8 of the Copyright Directive, and that they do not therefore relate to "copyright" in the sense in which it is used in the Annex. The only way of obtaining a derogation from Article 3(2) would have been by way of individual derogation under Article 3(4), but that route was not pursued.
67. The appellants' case appears to have been put on a more extreme basis before Kenneth Parker J, or at least to have been so understood by him. The submission as described by the judge at [126] was that "copyright has now been harmonised (by the Copyright Directive), the rationale for the derogation in Article 3(3) ECD, in so far as it relates to copyright, has fallen away, and Member States may take measures, falling within Article 3(1), relating to copyright, only if such measures are unequivocally and specifically authorised by the Copyright Directive" (original emphasis). His reasons for rejecting the submission were given at [127]-[131] and were, in summary, as follows. First, there was no authority for its central premise that the law of copyright has been completely or sufficiently harmonised so that the rationale for the exclusion could no longer be supported. Secondly, the appellants' interpretation would create intolerable legal uncertainty: the relevant exclusion remained within the Electronic Commerce Directive and had not been removed either at the time when the Copyright Directive came into force or subsequently. If the Community legislator had wished to abrogate it, it would have done so expressly in the interests of legal certainty and would not have left the matter in the air. Thirdly, the relevant exclusion would have had a relatively short shelf-life, and if such a result had been intended an express provision would have been expected. The judge went on to state that after the date for implementing the Copyright Directive had been reached, Member States could no longer lawfully maintain provisions in national copyright law that conflicted with the provisions of the directive; but the contested provisions do not so conflict, since Article 8(3) of the Copyright Directive does no more than impose an obligation on Member States to secure the minimum protection there referred to; it does not preclude Member States from introducing additional measures that it believes are reasonably required to facilitate rightholders in exercising effective remedies against persistent copyright infringers. The judge made the further point, upon which it is unnecessary to dwell, that any concerns about Article 3 of the Electronic Commerce Directive and the scope of the exemption for copyright could be addressed following notification of the Code and that it could not be determined at this stage, before the Code had been promulgated and brought into force, and before the initial obligations had achieved legal effect, whether the contested provisions would inevitably infringe EU law.
68. Mr Beal advanced various criticisms of the judge's reasoning. He said that it was common ground that the substantive law of copyright had not been harmonised; what was intended was harmonisation in relation to measures of copyright protection, and the argument was that the exclusion of copyright from Article 3(1) and (2) related both to the substantive law of copyright and to copyright protection as harmonised by the Copyright Directive. The judge's concern about legal uncertainty was met by the point that recital (50) to the Electronic Commerce Directive signalled that the Copyright Directive would be brought into force within a similar time scale. The judge's point about a short shelf-life was said to be misplaced, because the exclusion of copyright would have continuing application, but with the meaning attributed to it by the appellants. Mr Beal also took issue with the judge's view that the Copyright Directive is a minimum harmonising measure: he submitted that it is not open to a Member States to adopt more restrictive measures than those laid down in the directive.
69. Parts of the judge's reasoning do not apply, or do not apply with the same force, to the way in which the appellants' case was advanced before us, and I think it unnecessary to decide whether various of the criticisms made of that reasoning are well founded. One part of his reasoning that does plainly apply, however, to the case as advanced before us, and a part with which I am in full agreement, concerns the principle of legal certainty. The judge looked at the matter in terms of the abrogation of the relevant exclusion, saying that if the Community legislator had wished to abrogate it when the Copyright Directive came into force or subsequently, it would have done so by an appropriate amendment to the Electronic Commerce Directive. As explained below, I would adopt a similar approach in relation to the meaning of the relevant exclusion.
70. At the time when the Electronic Commerce Directive was adopted, "copyright" in the Annex to the directive must in my view have had its normal meaning, encompassing all aspects of the law of copyright under national laws, and cannot have had the elaborate meaning attributed to it by the appellants. At that time there was no harmonising directive at the Community level in the field of copyright protection. It would be unrealistic to impute to the Community legislature, at least in the absence of clear, express language to this effect, an intention to give "copyright" a meaning related to provisions of a copyright directive that had not yet been adopted. But if "copyright" did not have the appellants' meaning at the outset, I do not see how it can have come to acquire that meaning subsequently. The later adoption of the Copyright Directive cannot of itself have had the effect of changing the meaning of the expression. It would have needed an express amendment of the Electronic Commerce Directive to achieve that result, but no such amendment has ever been made.
71. In my judgment, that is sufficient to dispose of the appellants' case under Article 3 of the Electronic Commerce Directive.

Ground 3: the Data Protection Directive and the Privacy and Electronic Communications Directive

72. Ground 3 relates to alleged breaches of the Data Protection Directive and/or of the Privacy and Electronic Communications Directive. They can be considered separately.

The Data Protection Directive

73. The judge set out relevant provisions of the Data Protection Directive and of the UK implementing legislation, the Data Protection Act 1998, at [133]-[151]. For present purposes it suffices to quote parts of Article 8 of the directive, which relates to the processing of special categories of data:

"1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

2. Paragraph 1 shall not apply where:

…

(e) the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims."

74. Although Article 8(2)(e) uses the expression "legal claims", the corresponding exemption in the UK implementing legislation, in paragraph 6(c) of Schedule 3 to the Data Protection Act 1998, refers to processing that is necessary for the purposes of establishing, exercising or defending "legal rights". No difference in meaning can have been intended. In each case the focus is on the protection of the underlying rights, but a reference to "legal rights" is perhaps a more natural way of expressing the concept than the directive's reference to "legal claims".
75. For reasons given at [152]-[157], the judge concentrated on the processing of data by the copyright owners, i.e. the processing involved in their identifying apparent infringements, together with relevant IP addresses and subscriber details, for the purpose of compiling copyright infringement reports: it was accepted that subsequent processing by the ISPs, including the sending of notifications and the completion of copyright infringement lists, would be compatible with the directive. The judge proceeded on the basis that the data processed by the copyright owners would be "personal data" and that, because of what might be revealed by the nature of the unlawfully copied digital material identified by the exercise, some of it would be special category data falling within Article 8(1). He held at [159]-[161], however, that such processing would fall within the exception in Article 8(2)(e). In particular:

"159. The Defendant and the Interested Parties rely on Article 8(2)(e) …: the processing is necessary for 'the establishment, exercise or defence of legal claims'. That would appear to be the precise purpose of the contested provisions of the DEA: the copyright owner will be able, through the procedures under the DEA, to establish not only that there has been an infringement of copyright but also who is responsible for the infringement."

76. The appellants' essential submission is that the judge lost sight of the fact that in a substantial proportion of cases the scheme established by the DEA 2010 is not intended to involve legal claims at all. In a later part of his judgment, at [254]-[256], when dealing with the issue of proportionality, the judge referred to the assumption in the Government's impact assessment for the statute that 70% of infringers would stop once and for all upon receiving a single notification from their ISP. The point made is that if that is right, those cases will not get as far as inclusion in a copyright infringement list and there will be no prospect of a legal claim. The judge also said at [260] that "a principal aim of the measures is educational (so obviating legal action)". In the light of those matters, Mr White submitted that the scheme would operate for the most part as an extra-judicial curtailment of copyright infringement, and he submitted that in those circumstances the processing could not be said to be necessary for the establishment, exercise or defence of legal claims and could not therefore fall within the exemption in Article 8(2)(e).
77. I do not accept that submission. In my view the processing is plainly necessary for the establishment, exercise or defence of legal claims even if the beneficial consequence of the sending of a notification by the ISP pursuant to a copyright information request will be that in the majority of cases the infringing activity ceases and no further action is required. As Mr Saini QC observed on behalf of the Interested Parties, the fact that the scheme seeks to educate users about the legal rights of copyright owners and to encourage them to desist without the need for legal action does not mean that the copyright owners are not establishing, exercising or defending their legal rights. It no more has that effect than does the sending of a letter before action to an infringer in the hope that he will desist. In my view, therefore, the judge was right to find that the processing in question in this case would fall within the exception in Article 8(2)(e).
78. I should mention for completeness that the appellants placed reliance in this context on an Opinion dated 22 February 2010 of the European Data Protection Supervisor ("the EDPS") on then current negotiations by the EU of an Anti-Counterfeiting Trade Agreement with third countries. We were told by Mr Saini that the Opinion was provided by the EDPS of his own motion and was based on the EDPS's own understanding of what was then proposed. At paragraph 52 of the Opinion, in relation to the possible imposition on ISPs of a "three strikes internet disconnection policy", the EDPS acknowledged that the collection of targeted, specific evidence, particularly in cases of serious infringements, might be necessary to establish and exercise a legal claim, but he cast doubt on the legitimacy of wide-scale investigations involving the processing of massive amounts of data of internet users. It is not clear that he had Article 8(2)(e) of the DPD specifically in mind, but if he did it is difficult to see why the applicability of that provision should depend on the scale of the operation. In any event the view expressed by the EDPS is not binding on us and it does not cause me to alter my own view that the processing in this case would fall within Article 8(2)(e).

The Privacy and Electronic Communications Directive

79. This part of the case proceeds on the assumption (which seems to me to be an entirely realistic assumption) that the data processed pursuant to the contested provisions would be "traffic data" as defined in Article 2 of the PECD, namely "any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof". Articles 5 and 6 of the directive impose obligations on Member States in relation to such matters as the confidentiality of traffic data, subject in each case to the derogation in Article 15(1), which provides:

"Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union …."

80. Although Article 15(1) does not refer expressly to restrictions necessary for the protection of property rights, including copyright, it has been interpreted by the Court of Justice as having that extended scope. Case C-275/06, Productores de Musica de España (Promusicae) v Telefonica de España SAU [2008] ECR I-271 arose out of an application to the court by Promusicae for the disclosure of information by an ISP about users of a file exchange program who were claimed to be engaging in unfair competition and infringing intellectual property rights. Promusicae sought disclosure of the information in order to be able to bring civil proceedings against the persons concerned. The court rephrased the question from the national court as asking essentially whether Community law must be interpreted as requiring Member States to lay down, in order to ensure effective protection of copyright, an obligation to communicate personal data in the context of civil proceedings. For the purpose of answering that question, consideration was given to whether the Privacy and Electronic Communications Directive precluded Member States from laying down, with a view to ensuring effective protection of copyright, an obligation to communicate personal data which would enable the copyright holder to bring civil proceedings based on the existence of that right. That took the court to Article 15(1). The court referred to the exceptions expressly listed in that provision, and observed that none of them appeared to relate to situations that call for the bringing of civil proceedings. It continued, at paragraph 53:

"It is clear, however, that Article 15(1) of Directive 2002/58 ends the list of the above exceptions with an express reference to Article 13(1) of Directive 95/46. That provision also authorises the Member States to adopt legislative measures to restrict the obligation of confidentiality of personal data where that restriction is necessary inter alia for the protection of the rights and freedoms of others. As they do not specify the rights and freedoms concerned, those provisions of Article 15(1) of Directive 2002/58 must be interpreted as expressing the Community legislature's intention not to exclude from their scope the protection of the right to property or situations in which authors seek to obtain that protection in civil proceedings."

81. Kenneth Parker J rejected an argument by the appellants, repeated before us, that the ruling in Promusicae related only to the protection of property in the context of civil proceedings, where there is a sufficient degree of judicial oversight, and that no wider derogation was to be read into Article 15(1) so as to apply in the present context. In my judgment, he was correct to do so. I think it clear that the court in Promusicae interpreted Article 15(1) as extending to the protection of the rights and freedoms of others, including the protection of the right to property, and that this was not intended to be limited to the context of civil proceedings.
82. A certain amount of energy was expended before us on the recent judgment of the Court of Justice in Case C-70/10, Scarlet Extended SA v SABAM (judgment of 24 November 2011, BAILII: [2011] EUECJ C-70/10 ), which concerned the compatibility with the Privacy and Electronic Communications Directive and other directives of a court injunction against an ISP requiring it to install a system for filtering electronic communications in order to identify and block the transfer of files infringing copyright. Both the Advocate General and the Court referred to Promusicae, in terms that do not in my view cast any great light on that ruling; but I see nothing in the case to support the limited scope that the appellants seek to give to the ruling in Promusicae.
83. Accordingly, I do not accept that the appellants are able to derive any assistance from the Privacy and Electronic Communications Directive.

Ground 4: the Authorisation Directive

84. Ground 4 relates to alleged breaches of the Authorisation Directive. The aim of the directive, as set out in its Article 1, is to implement an internal market in electronic communications networks and services through the harmonisation and simplification of authorisation rules and conditions in order to facilitate their provision throughout the European Union. The directive provides in part for schemes of "general authorisation" allowing any person who wishes to provide electronic communications networks and services to do so in accordance with a publicly available set of conditions. As explained by Kenneth Parker J at [172], such schemes replaced individual licensing arrangements which were commonly found in national systems of regulation and which could create significant barriers to new entrants. In the United Kingdom, Ofcom has drawn up and published "General Conditions of Entitlement" in accordance with the directive. The main issue under ground 4 is whether the contested provisions are required to form part of a general authorisation and, if so, whether they impose conditions permitted within a general authorisation. If the contested provisions are compatible with the main provisions of the directive relating to general authorisations, two alternative issues arise for consideration under other provisions of the directive.
85. The Authorisation Directive must be read together with Directive 2002/21/EC of 7 March 2002 on a common regulatory framework for electronic communications networks and services ("the Framework Directive"). Recital (5) of the Framework Directive explains that the convergence of the telecommunications, media and information technology sectors means that all transmission networks and services should be covered by a single regulatory framework. That regulatory framework consists of the Framework Directive and four specific directives, including the Authorisation Directive.

Compatibility with the main provisions relating to general authorisations

86. Article 2(2) of the Authorisation Directive defines "general authorisation" as:

"a legal framework established by the Member State ensuring rights for the provision of electronic communications networks or services and laying down sector specific obligations that may apply to all or to specific types of electronic communications networks and services, in accordance with this Directive."

87. Article 3(2) provides that the provision of electronic communications networks or services may, without prejudice to certain other provisions, only be subject to a general authorisation.
88. Article 6 and the Annex to the directive concern the conditions that may be attached to the general authorisation. Article 6 reads:

"1. The general authorisation for the provision of electronic communications networks or services … shall be subject only to the conditions listed in the Annex …..

…

3. The general authorisation shall only contain conditions which are specific for that sector and are set out in Part A of the Annex and shall not duplicate conditions which are applicable to undertakings by virtue of other national legislation."

The Annex states that the conditions listed in Part A "provide the maximum list of conditions which may be attached to general authorisations … within the limits allowed under Articles 5, 6, 7, 8 and 9 of … the Framework Directive". Part A lists nineteen conditions. The condition of particular relevance for present purposes is paragraph 9, which reads:

"9. Restrictions in relation to the transmission of illegal content, in accordance with [the Electronic Commerce Directive] …."

89. The appellants' case is, first, that the contested provisions fall within the definition of "general authorisation" in Article 2(2) and should have been included in the general authorisation rather than being the subject of separate legislation; secondly, that if they had been so included they would have had no legal force because they were not conditions of a kind permitted by Article 6(3) and the Annex.
90. The judge rejected the first of those propositions, stating:

"176. In my view, the first proposition rests upon a false premise, namely, that, as a result of Article 2(2), any "sector specific obligation" must be contained in the conditions of the general authorisation. It is correct that nothing other than a sector specific obligation may be contained in the conditions of the general authorisation. It does not follow that each and every such obligation must be so contained, and there are good reasons why that should not be the case" (original emphasis).

91. The first and principal reason he gave, at [177]-[180], was that to insist that each and every sector specific obligation had to be included in the conditions of the general authorisation would create serious tension with the Framework Directive. Article 1(3) of the Framework Directive provides that the Framework Directive itself and the specific directives (including the Authorisation Directive) "are without prejudice to measures taken at Community or national level, in compliance with Community law, to pursue general interest objectives, in particular relating to content regulation and audio-visual policy". Recital (6) of the Framework Directive states that audio-visual policy and content regulation are undertaken in pursuit of general interest objectives, and it refers to a Commission communication setting out the key actions to be taken by the Community to implement its audio-visual policy. That communication in turn, at point 4.3, recognises copyright protection and the taking of measures against piracy as a central element of the Community's audio-visual policy. The judge said that the contested provisions were one type of national measure constituting audio-visual policy and content regulation and that it would be distinctly odd that, on the one hand, Article 1(3) of the Framework Directive expressly excluded such measures from the scope of the Authorisation Directive but, on the appellants' interpretation of Article 2(2), they had to be specifically included in the conditions of general authorisation under the Authorisation Directive, solely because they were sector specific obligations. That obvious tension, if not inconsistency, told heavily against the appellants' interpretation.
92. The judge went on at [181]-[182] to give additional, policy-based reasons for his conclusion.
93. Mr White submitted that the judge was wrong to interpret "general authorisation" as he did at [176]. The words "a legal framework … laying down sector specific obligations" are apt to include in the general authorisation any sector specific obligation forming part of the legal framework within which ISPs operate; and since the contested provisions are sector specific obligations forming part of that legal framework they should be included in the general authorisation.
94. Mr White further submitted that the judge erred in his analysis of the relationship between the Authorisation Directive and the Framework Directive, and in particular that he put too much weight on Article 1(3) of the Framework Directive. He said that the relationship between the two directives is a little obscure, but the Authorisation Directive is the lex specialis and there must be limits to what can be done under the Framework Directive by way of derogation from the Authorisation Directive; and it cannot be right that the Framework Directive enables Member States to adopt sector specific obligations aimed at ISPs but to exclude them from the general authorisation simply because they pursue general interest objectives: many of the matters identified in Part A of the Annex to the Authorisation Directive might be viewed as general interest objectives, and there would be no point in setting them out in the Annex as permissible conditions if they could in any event be the subject of separate provision made outside the general authorisation. Recital (6) of the Framework Directive sheds no light on the matter, since it is concerned with action at the Community level. In relation to action at the national level, it may be that Article 1(3) is restricted to the sort of measures referred to in recital (7), which provides that the provisions of the Framework Directive and the specific directives "are without prejudice to the possibility for each Member State to take the necessary measures to ensure the protection of its essential security interests, to safeguard public policy and public security, and to permit the investigation, detection and prosecution of criminal offences". Mr White also sought to draw support from the fact that the Commission raised concerns with the United Kingdom as to the extent to which the draft Costs Order complied with the Authorisation Directive, notwithstanding the reliance placed by the United Kingdom in correspondence on Article 1(3) of the Framework Directive.
95. Notwithstanding those submissions, I find the judge's analysis convincing. Article 1(3) of the Framework Directive is apt in my view to permit the contested provisions by way of derogation from the Authorisation Directive, as measures taken at national level to pursue general interest objectives. The recitals to the Framework Directive tend to support that view and certainly contain nothing to undermine it. The Commission communication referred to in recital (6) shows the importance attached to copyright protection as an element of audio-visual policy and, given the reference in Article 1(3) to audio-visual policy, is a strong indicator that measures for copyright protection fall within the scope of that provision. Our attention was also drawn by Mr Eadie to the Commission's comments on the French legislation which permits measures to be taken against internet users who commit copyright infringement online. In those comments the Commission recognised that copyright protection is a general interest objective of a kind referred to in Article 1(3). As to the Commission's comments on the draft Costs Order, the fact is that the United Kingdom persisted in its reliance on Article 1(3) but the Commission took no further action, which is at least consistent with an acceptance by the Commission that Article 1(3) is applicable.
96. Compared with those considerations, I regard the various policy arguments as being of subsidiary importance and I have not therefore thought it necessary to set out the detail of the judge's policy-based reasons or of the counter-argument advanced by Mr White. Suffice it to say that I see nothing wrong with the judge's approach and that I have found nothing in Mr White's counter-argument to cast doubt on that approach.
97. Even if the appellants were able to show that the contested provisions should have been included in the general authorisation, they could not succeed on this part of the case unless they were able to show in addition that the provisions would not be conditions permitted by Article 6(3) and the Annex to the Authorisation Directive. The point on that is a very short one. The essential question is whether the provisions come within paragraph 9 of the Annex as restrictions in relation to the transmission of illegal content "in accordance with [the Electronic Commerce Directive]" (the French text uses the expression "conformement à" for "in accordance with"). The judge held at [183] that because the contested provisions do not limit or undermine the relevant immunities conferred by the Electronic Commerce Directive, they would not be inconsistent with paragraph 9. Thus he treated the expression "in accordance with" as equivalent to "compatible with". Mr White submitted that this was an error and that a provision is not "in accordance with" the directive unless it is positively required or mandated by the directive. In my view the judge was right to prefer the wider meaning. There is no obvious reason for adopting the restrictive meaning contended for by Mr White. In particular, it is far from obvious why the Community legislature would have wished to exclude the possibility of sector specific national measures which, as the judge found, strike a proportionate balance between the free market and the protection of copyright.
98. For those reasons I am not persuaded by the first limb of the appellants' case under ground 4.

Article 12 of the Authorisation Directive

99. The issue here is whether provisions of the draft Costs Order breach Article 12 of the Authorisation Directive, which provides:

"1. Any administrative charges imposed on undertakings providing a service or a network under the general authorisation or to whom a right of use has been granted shall:

(a) in total, cover only the administrative costs which will be incurred in the management, control and enforcement of the general authorisation scheme and of rights of use and of specific obligations as referred to in Article 6(2), which may include costs for international cooperation, harmonisation and standardisation, market analysis, monitoring compliance and other market control, as well as regulatory work involving preparation and enforcement of secondary legislation and administrative decisions, such as decisions on access and interconnection …."

100. As already explained, the judge had previously found that the contested provisions, including those relating to costs, did not have to be included in, and were not conditions of, a general authorisation. He considered, however, that there was still scope for the application of Article 12. His reasons for that view, which is not challenged before us, can be seen at [192] and, more fully, at [197] in the course of his rejection of an argument by the Secretary of State that the reference in Article 12 to "administrative charges" is to charges paid by ISPs in their capacity as authorised persons:

"197. For the reasons already given, I agree that the contested provisions do not, and could not properly, form part of the conditions of the general authorisation. However, Article 12 does not in terms say that administrative charges are charges that ISPs pay only in their capacity as authorised persons, that is, in meeting the conditions set by the general authorisation. Article 12(1) appears simply to identify a class of person, namely, 'an undertaking providing a service or a network under the general authorisation or to whom a right of use has been granted'. No charges of an administrative nature may then be imposed upon such persons, if such charges fall, and fall substantially, on persons of that description …."

101. At [186]-[189] the judge identified three kinds of costs to which the draft Costs Order refers. In summary, they are (1) "qualifying costs", namely the costs incurred by Ofcom or the appeals body in carrying out functions under the copyright infringement provisions, including costs incurred by Ofcom under those provisions in appointing the appeals body or in establishing a body corporate to be the appeals body; (2) "relevant costs", namely costs which would be reasonably and efficiently incurred by a notional qualifying ISP in carrying out its obligations under the provisions; and (3) "case fees" charged by the appeals body in respect of each subscriber appeal which it receives (in relation to each appeal, the appealing subscriber's ISP would be required to meet 25% of the fee, with the other 75% being recovered from the relevant copyright owner).
102. At [195]-[200] he said that "qualifying costs" would ordinarily be regarded as "administrative charges" and would in principle appear to be administrative charges under Article 12; he rejected contrary arguments put forward by the Secretary of State; and he said that it was common ground that if the charges in respect of "qualifying costs" did amount to "administrative charges" within Article 12, they did not relate to any of the matters specified under that provision and must therefore be unlawful. Accordingly he granted a declaration that the Costs Order would, if made and implemented, be incompatible with Article 12 by requiring ISPs to pay "qualifying costs". There is no appeal against that part of his order.
103. At [193] he held that "relevant costs" were in this context irrelevant, for these reasons:

"193. They are not 'administrative charges' at all. ISPs do not pay 'relevant costs': they will incur such costs internally in order to discharge statutory obligations under the DEA. The Costs Order is simply a means by which ISPs can recover from copyright owners a (substantial) proportion of internal costs that ISPs have had to incur. The DEA could have left ISPs to bear such costs entirely and have provided no mechanism for recovering any part of such costs. However, Parliament provided that in fairness copyright owners should reimburse ISPs for a substantial part of the costs incurred by ISPs in discharging their obligations under the DEA."

104. Mr White argued that all costs and charges under the DEA regime, including "relevant costs", are to be regarded as "administrative charges" within Article 12. What matters is substance, not form: the effect of the draft order is that ISPs will have to meet part of the expenses of the system. He cited Case C-296/06, Telecom Italia SpA v Ministero dell'Economia e delle Finanze [2008] ECR I-801, which concerned an obligation on a telecommunications undertaking, formerly the holder of an exclusive right and then the holder of a general authorisation, to pay a fee based on its turnover and corresponding to the licence fee previously payable for its exclusive right. The court had no difficulty in finding that such a fee was contrary to the predecessor of the Authorisation Directive, including the equivalent of Article 12, and was not saved by certain transitional provisions relied on by the Italian Government. Mr White submitted that the reasoning in that case applied by analogy to the "relevant costs" in issue here. In my judgment, however, the court in that case was dealing with an entirely different situation and its reasoning provides no support for the appellants' contentions. The case does not begin to undermine the judge's conclusion on "relevant costs". I am not persuaded that his conclusion was wrong.
105. At [195], immediately after his conclusion in respect of "relevant costs", the judge dealt briefly with "case fees":

"195. Similarly, it does not seem to me that 'case fees' can be regarded as 'administrative charges' under Article 12 AD. The fees arise because a subscriber has brought a specific appeal, involving a relevant ISP and a relevant copyright owner. The fees are intended to do no more than ensure that the judicial vehicle for resolving disputes under the DEA is adequately funded."

106. On this one small point I respectfully disagree with the judge. If, as the judge found and is accepted before us, "qualifying costs" are "administrative charges" within Article 12, I can see no sensible reason why "case fees" should not be treated in the same way. As Mr White submitted, they are in substance a supplement to "qualifying costs", comprising that part of the costs of the appeal body which is not covered by "qualifying costs". Mr Eadie rightly submitted that case fees arise directly as a result of a service requested by, and provided to, an ISP's own customers, and that they do not function as a tax for the raising of general revenue. Understandably, however, he had no real answer to the question why they should not be treated in the same way as "qualifying costs".
107. I would therefore allow the appeal in relation to this one point and would enlarge the declaration granted by the judge so as to cover "case fees" in addition to "qualifying costs".

Discrimination and distortion of competition

108. A final area of complaint relates to the proposed exclusion of smaller ISPs and mobile network operators ("MNOs") from the scope of the initial obligations and the associated costs. Various provisions are relied on. Article 6(1) of the Authorisation Directive provides that conditions of the general authorisation are to be non-discriminatory, proportionate and transparent; and Article 12(1)(b) that any administrative charges are to be imposed in an objective, transparent and proportionate manner. Article 8(1) of the Framework Directive provides that Member States shall take the utmost account of the desirability of making regulations technologically neutral; and Article 8(2)(b) that national regulatory authorities shall promote competition by inter alia ensuring that there is no distortion or restriction of competition in the electronic communications sector. The appellants contend that the exclusion of smaller ISPs and MNOs runs counter to the thrust of those provisions.
109. The judge's reasons for rejecting that contention refer specifically to Article 6 of the Authorisation Directive but are of more general application. He said, at [201]-[202]:

"201. The Claimants also argue that the proposed exclusion of small-scale ISPs from the scope of the initial obligations is "discriminatory" under Article 6 of the AD (assuming that the AD applies at all to the contested provisions). However, it appears from the evidence that Ofcom proposed the initial qualifying threshold of 400,000 subscribers as a starting point because it represented a proportionate response. The six ISPs who have more than 400,000 subscribers together account for 93.4 per cent of the residential and SME business broadband market. There is a natural break point below the big six, in that the smallest of the big six is still twice the size of the next in line. In my view, it is reasonable and proportionate to concentrate on the larger ISPs in the first instance, and to identify any other individual ISPs where there are high levels of copyright infringement on a case by case basis. Any alleged 'migration' of infringers to smaller ISPs is speculative at this stage and could be addressed if it began to present real problems.

202. As to the exclusion of mobile network operators ('MNOs'), the evidence shows that mobile networks are less conducive to online copyright infringement due to technical features such as speed and capacity constraints, traffic management policies, and pricing relative to fixed lines. Internet traffic carried by MNOs represents only a very small proportion (less than 5 per cent) of the overall file-sharing problem. It was therefore considered disproportionate to include MNOs at the present time and this appears to me to be a legitimate policy choice for the Defendant to make, having regard to proportionality. In any event, under the DEA Ofcom has a statutory obligation to monitor levels of online copyright infringement. Ofcom could be expected to alter the qualification criteria in the Code as necessary in future notification periods, to bring within the scope of the obligations in the Code any ISP, whether fixed or mobile, where the scale of infringement is such that inclusion in the Code was justified."

110. Mr White submitted that it is no answer to say, as the judge did, that the matter can be kept under review and other operators can be brought within the scope of the regime as necessary. The exclusion of MNOs, in particular, means that the regime is not technologically neutral in its present form, and smaller ISPs and MNOs will enjoy a competitive advantage pending any such review and amendment to the regime.
111. I do not accept those criticisms. The judge's conclusion was soundly based on detailed evidence submitted on behalf of the Secretary of State. He was plainly entitled to take the view that the exclusion of smaller ISPs and MNOs represented a proportionate response; and in the circumstances I do not think that anything material is added by recourse to the principle of non-discrimination or the desirability of technological neutrality. The judge did not rely on the possibility of review and amendment of the regime as an answer in itself to the appellants' case, but he made the valid point that if circumstances changed there existed mechanisms for ensuring that any future problem of disproportionate effect could be avoided.

CONCLUSION

112. The appellants requested that if we were in doubt about any of the issues raised in the appeal we should make a reference to the Court of Justice. Kenneth Parker J declined to make a reference, stating at [264] that "the questions of European Union law raised by this judicial review admit of clear answers, and I do not believe that any useful purpose would be served by my making a reference". I am of the same view.
113. For the reasons given, I would dismiss the appeal, save in relation to the issue of "case fees" under the Costs Order, as to which I would allow the appeal and deal with the matter as proposed in [107] above.

Lord Justice Patten :

114. I agree.

Lady Justice Arden :

115. I also agree.