Profiling Web Users – Some Intellectual Property Problems Nicholas Bohm and Joel Harrison* “Half the money I spend on advertising is wasted. The trouble is, I don’t know which half.”1 Can targeted online advertising reduce the waste identified in this pithy and much-quoted observation? Phorm, Inc’s Webwise system aims to do so by profiling web users on the basis of their online browsing, and by then selecting the advertisements they see on the basis of their individual profiles. Three of Britain’s largest Internet Service Providers (ISPs), BT, Talk Talk and Virgin Media, are reported to be considering whether to deploy the Webwise system, with BT known already to have conducted technical trials of the system on a number of its customers. Dr Richard Clayton, of the Cambridge University Computer Laboratory, has published a detailed description of the Webwise system on the basis of information supplied by Phorm.2 That description repays careful reading, but for present purposes the following summary is sufficient. When an ISP runs the Webwise system, it makes a copy of certain of the web pages visited by those of its customers who it considers have consented to being included in the system. The ISP then carries out an analysis of each page. The fruit of that analysis is a list of up to ten of the most frequently used significant words, after disregarding words consisting only of digits, or containing an “@” symbol, or following a title such as “Mr” or “Mrs” – a sort of digest of the page. That digest is passed by the ISP to Phorm coupled with a pseudonym for the user (a UID), so that Phorm can build a profile for the user by matching the digest against a database of key words. Based on this analysis, the user (represented by the UID) is allocated to certain “channels” (travel, music, sports and so on). When the user later visits a website that is a member of Phorm’s Open Internet Exchange (OIX), the profile is used to select advertisements that match the channels to which the user is allocated. This process raises a number of interesting legal issues. The Foundation for Information Policy Research has published an analysis of the criminal law and regulatory issues affecting ISPs who run the Webwise system.3 This article is directed instead to the legal position of the owners of intellectual property rights (IPR) in websites whose pages are used by ISPs in the course of profiling users. (The person who owns the IPR in a web page may or may not be the person who manages the website of which it forms part, but the distinction is immaterial for present purposes. In what follows the IPR owner is referred to for convenience as the site- owner; and references to ISPs are to those ISPs who run the Webwise system.) From the description given above it is clear that when an ISP’s customer fetches a web page which falls within the scope of the Webwise profiling activity, the ISP makes a copy of that page for the purpose of deriving from it a digest of the page and sending the digest to Phorm. The process is a rapid one, and the copy is quickly discarded (as, too, is the digest). But does this process infringe the site-owner’s IPR? In this article, we will discuss whether the operation of the Webwise system infringes the site-owner’s database right and copyright. But first, we will consider the economic impact of the Webwise system on the site-owner. Page 1 Where’s the harm? The economics of the Webwise system are fairly straightforward. Advertisers pay to advertise on websites that are members of OIX. Exactly how this revenue is divided up is not a matter of public record, but it may safely be assumed that the operator of the website on which the advertisement is displayed receives a share, Phorm receives a share and the ISP receives a share. The site-owner whose content feeds Phorm’s system with the data used to compile its user profiles receives nothing. But does the site-owner suffer any real harm? It is important to ask this question for two reasons. First, the question of whether the site-owner suffers harm may be relevant in determining whether his IPR are infringed. We discuss this further below. Secondly, Phorm has on several occasions asserted that the Webwise system causes no harm to anyone, and that any contravention of the law or any person’s rights (which Phorm naturally denies) would therefore be of a purely technical nature. In the authors’ view, a site-owner does in fact suffer harm, in the same way that any owner of IPR suffers harm whenever a person uses his IPR without payment. In some cases the IPR owner can do nothing about this, as the use made of his IPR may fall short of infringement. Where it is an infringement, however, the IPR owner may be expected to take action to prevent it, or at least to ensure that he is compensated for the use of his IPR through some sort of licence agreement. Further, many site-owners generate revenue by making space on their websites available to third party advertisers. Advertisers have limited budgets, and must choose carefully where to place their advertisements. Faced with Phorm’s sales pitch, advertisers may well choose to move their business from independent websites to those who are members of OIX. Phorm and its partner ISPs are, therefore, using the content of websites that are not members of OIX to create a system that may make it more difficult for those websites to earn revenue from advertisers (or, at the very least, a system that will compete with those websites for advertising revenue). Worse, when a user visits a website that is not a member of OIX, the Webwise system will identify the user as being interested in the subject matter of that website. When that user later visits a website that is a member of OIX, he will be shown advertisements that match his interests, from advertisers who are members of OIX – in other words, from competitors of the original website. The content of the original website is therefore used to assist the site-owner’s competitors in targeting their advertisements. (1) Infringement of database right A website will in almost every case be, or interoperate with, a database as defined in section 3A of the Copyright, Designs and Patents Act 1988 (CDPA), being “a collection of independent works, data or other materials which (a) are arranged in a systematic or methodical way, and (b) are individually accessible by electronic or other means”. Page 2 A straightforward website consisting of a number of web pages, each accessible via a hyperlink on a home page (and possibly also via hyperlinks on other web pages on the website), is a database within the meaning of section 3A. Further, many modern e- commerce websites are organised in a manner that is more readily recognisable as a traditional database, with the content stored in a relational database management system such as MySQL, separate from the code used to present the content to the user. In addition, a very large number of websites allow users to interact with databases of various kinds, such that each web page (which will usually be dynamically generated in response to the user’s input) represents the content of one or more records within the database. Almost every e-commerce website operates in this way, as do search engines, the knowledge base sections of vendors’ websites and websites operated by institutions such as libraries, galleries and museums. It is clear that, when an ISP running the Webwise system makes a temporary copy of a web page fetched by a user, it will in many cases be making a temporary copy of part of a database. This raises the question of whether the copying infringes the site- owner’s database right. The relevant legislative provisions are to be found in the Copyright and Rights in Databases Regulations 1997 (the Database Regulations)4, which implemented Directive 96/9/EC on the legal protection of databases (the Database Directive) in the UK. Regulation 13 of the Database Regulations provides that there is a property right (database right) in a database5 if there has been a substantial investment in obtaining, verifying or presenting the contents of the database. Database right exists entirely independently of any copyright in the database (there may be no such copyright; or it may be owned by a different person). However, in order for database right to subsist, at least one of the makers of the database must qualify for database right.6 Regulation 14(1) of the Database Regulations provides that the person who takes the initiative in obtaining, verifying or presenting the contents of a database and assumes the risk of investing in that obtaining, verification or presentation is regarded as the maker of the database, while regulation 14(2) provides that where a database is made in the course of employment, the employer is treated as the maker of the database (subject to contrary agreement). Accordingly, in the commercial context the maker of the database will tend to be the company in the course of whose business the database was made. Regulation 18 provides that a company will qualify for database right if it is incorporated in an EEA state and either has its central administration or principal place of business in the EEA or has its registered office in the EEA (but only, in the latter case, if its operations are linked on an ongoing business with the economy of an EEA state).