Coping with Database Protection Laws

harryhoch writes "Activist and Web commentator Andy Oram has written an article on the consequences of database protection Laws. The Sap and the Syrup of the Information Age: Coping with Database Protection Laws addresses legal and social implications of database protection legislation. For folks interested in deCSS, patents, and other "intellectual property" issues on the Net, this article provides another interesting perspective." Congress is considering legislation that would make collections of facts protectable by law. Andy Oram takes a look at what that would mean to the Internet and public in general.

A benefit?

One benefit of the new legislation, anyway, will be that we no longer will need to listen to people quoting benchmarks at the next company meeting: they'd be violating the law to do so.

Ah, well.. there's a silver lining on every cloud but lightning kills thousands of people searching for it every year...

Direct Mail

In the direct mail industry, everyone is kept honest by seeding the lists. Seeding works for that purpose, but after a while the lists would end up being padded with 1-2% seed material due to all the hands they went through.

Unfortunately, there's no decent way to go about protecting everyone's interests. Mailers have to pay the cost of mailing the seeds, which are basically useless, and aren't informed of even how many names aren't valid. But generally the names are purchased (licensed, in software speak) for a specific amount of uses.

So far as other compilations go, it would get much more difficult. I'm all in favor of making sure the people that put forth the time and money to compile these databases are the first ones in line to profit from their efforts, because they're not doing it as a public service. But some organizations, like network solutions (imo) are downright abusive in the way they withhold, or at least make unneccessarily difficult in accessing, their data.

I know. Information wants to be free. But this is a capitalistic society. If information does infact become free, then no one will gather information anymore.

Royalties for eveything?

So if the collection/compilation of facts can be protected with copyrights, or something similiar, then the only thing that can be written without using fair use (which may also go away under many proposals) will be fiction, opinion, and legal briefs. Will children have to pay a royalty to do a report when they have to look up an atomic weight in the CRC handbook? The border of compliation versus creative work has worked well for many decades, along with practices of fair use. Crossing or eliminating these will make the things they need to protect less valuable in the end as not being able to use them reduces their need and demand.

How would this relate to common facts (history, statistics, etc.), universal constants (the value of e, pi, avogadro's number, etc.) and there use once they are included in a protected work? We never remember them, we always look them up. I know this legislation is being pushed by people like stock exchanges and sports organizations to protect numbers that they spend money on, but the effects of protecting them become chilling on everything else.

Databases and facts

I haven't read the proposed legislation, so I don't know how much of this comment is relevant...

No one can copyright a fact, such an address, birthdate, etc. However, someone can collect all that information into a database, and then copyright that specific information. But this copyrighting in no ways puts a copyright on any of the facts contained within it. If this proposed legislation changes this, then it is a very, very Bad Thing.

Unlike a patent, similar copyrighted works have the possibility of being created independently. And the law currently recognizes this. As of today, it is possible for more than one person to compile the same database independent of each other, and copyright each one separately. Take a look at a map of San Fransisco. Everything on it is public information. But take a look at the lower left (or right) corner. You'll see a copyright notice. There are more than one mapmaker who publishes maps of San Fransisco. Now take a look at your phone book. It's also copyrighted. But there are competing copyrighted phone books containing identical information. A phone book *IS* a database containing public domain facts. Now look at a dictionary...

Before everyone gets lathered up over copyrighting databases, please be aware that this has been going on for at least a few centuries. Sure the USPS has a copyrighted database of everyone's address. But nothing is stopping you from creating your own.

Re:Well really how much privacy do you need?

Yes - I think that sometimes collecting together information which is "freely" available can lead to an invasion of privacy. This is because it can become possible to link together facts which build up a picture which is very much bigger than the sum of its parts.

One of the things which I felt the argument didn't cover as well as it could is the very different attitude to collections of personal data in the EU as compared with the US. This is certainly relevant to the issue of copyright in databases. One may limit the other.

Just in case people aren't aware - there are some very specific and detailed requirements for holding personal information the UK (and the rest of Europe).

Personal information is basically anything about identifiable individuals.

The Law is too complex to fully describe here - but I will give the main points

Databases must be licenced (although the licences are relatively cheap)

Data can only be collected from people if the people are told that Data is being collected and why.

Only the data relevant to the purpose can be stored in the Database ( an example of this was that everyone in the country was required to fill in a form wrt to new local taxes. these forms apparently required people to give their phone number. This was ruled to be wrong - because people didn't have a choice and the local government do not need people's phone numbers to collect tax)

People have a right to see what records are held on them and they have the right (enforced in various ways) to have errors abuot them corrected.

The Data must be held securely

And finally - and importantly - companies are not allowed to transfer data to other countries unless the safeguards above are effectively enforced.

The Copyright issue is tightly bound to at least some of those principles. If people can copy personal information and use it for their won purposes without reference it directly breaks some of the principles explained above.

There is an officer of Government in the UK called "The Data Protection Registrar" (DPR for short). The regsitrar and his staff have real teeth, are not afraid to use them and, on the whole, they are very popular with people - most people in the UK think the DPR does an important job.

I might be wrong, but I believe the situation in the USA is very different with "self regulation" being the norm for Data protection. Until the situation in the two regimes can be reconciled there are going to be fundamental problems with copyright on databases between the two systems.

More information abut the DPR in the UK can be found at http://www.dataprotection.gov.uk/

And the "principles" are described at
http://www.dataprotection.gov.uk/principl.htm

I hate to upset God, but...

... I want to get really rich, so:

I propose we should patent something along the following lines:

"A system consisting of small entities with precisely defined properties, including properties such as charge, top, bottom, spin, 'colour', and mass, that, within a framework of rules can interact to construct arbitrarily complex other entities."

I'm sure you could get it past the US (or UK) patent office. Now that would be funny.

The plaintiff requires that the universe ceases to exist forthwith unless royalties are paid.

Anyone got a spare $50,000 to have a go? No-one can claim it's 'obvious', but it could get really nasty if a certain supernatural entity appeared in court to claim 'prior art'. Armageddon, anyone?

Re:Direct Mail

Map makers have been doing this for years, adding a bogus street to their indices or exaggerating the curve of a road in a way that wouldn't affect driving but would pinpoint a data thief. Cliff notes do this, too--making a couple of key errors which will positively glare to an informed reader. (They also insert a few very concise passages intended to lure a hapless student into copying them verbatim.)

Of course, some information can't be seeded this way. A medical diagnostics database, for example, could kill someone by having a bogus disease or treatment in it, and you can imagine what could happen if a metallurgy reference misrepresented the tensile strength vs. temperature curve of a material which found its way into turbine blades.

I do admit we've entered a very sticky set of issues here. I firmly believe that Lexus/Nexus and other such databases have a right to prevent a customer from creating an account, typing

select * from people p
where sex='F' and
marital_status in ('S','D','W')
and age between 55 and 70
and net_worth>10000000
and not exists (select * from felony_trials
where SSN=p.SSN and
crime in ('MURDER', 'CONVICTED MURDER', 'BOBBITIZATION')
and victim='HUSBAND');

at the prompt, and creating BeARichOldLadysCabanaBoy.com [mindspring.com] out of essentially stolen data. OTOH there have been some frighteningly successful unjustified cases of Restaurant Guide A suing Restaurant Guide B.

Here's another question: If I use the Yellow Pages to make a list of local restaurants, and write reviews of everything Asian-sounding, and put an index in the back which includes addresses and phone numbers, is Ma Bell entitled to a cut for my derivative, value-added work? If she is, I see an enormous future in making long lists of things and then copyrighting them. This certainly seems to be working in the patent community.

On the whole, this was a very good article, if only for the questions that it left raised and left unanswered. And I'll be sure to follow eBay's lawsuit against AuctionWatch and Bidder'sEdge. To quote--uh oh--Ashleigh Brilliant, I don't have any solution but I certainly admire the problem.

One final note--if the copyrighting of a collection of data becomes a valid future enterprise, can I go ahead and copyright my name, address, school transcripts, credit history, and the list of every web page I've viewed in the past year? I think this last would be pretty goddamned useful in smacking DoubleClick [doubleclick.net] upside the head violating my privacy.

--

Getting completely screwed that's what it means!

I have to say it but if all data is copyright of someone or something else and is intellectual property then all data will have to be redone with various research having to be reexamined. This is compeltely unacceptable. Is there a good enough database tool that would allow an individual to get a large quantity of data say now before any potential laws are actually passed and then have it become open sourced?

How far do you take this...

Hold on a second... where does one draw the line. If the collection/compilation of facts can be protected with copyrights, or something similiar, then the only thing that can be written without using fair use (which may also go away under many proposals) will be fiction, opinion, and legal briefs. Will children have to pay a royalty to do a report when they have to look up an atomic weight in the CRC handbook?

The border of compliation versus creative work has worked well for many decades, along with practices of fair use. Crossing or eliminating these will make the things they need to protect less valuable in the end as not being able to use them reduces their need and demand.

How would this relate to common facts (history, statistics, etc.), universal constants (the value of e, pi, avogadro's number, etc.) and there use once they are included in a protected work? We never remember them, we always look them up. I know this legislation is being pushed by people like stock exchanges and sports organizations to protect numbers that they spend money on, but the effects of protecting them become chilling on everything else and eventually reach the level of absurd!


Nathaniel P. Wilkerson
NPS Internet Solutions, LLC
www.npsis.com [npsis.com]

Its nice to....

Its nice to see more works like this one making their way into the spotlight., However I think after witnessing the lawyers quoting Anonymous Cowards from slashdot that it won't be the overpaid analysts/experts that may sway judges treding the dark gloomy waters of the legalities of data collection and reverse engineering so much as it will be the people who post without thought in public forums who's pointed and often heated words will be used to attack the very community they hope to represent. Its an age old pratice of tactics of speech, we as a community need to be carefull how we present ourselves, and try to take notes on what the mainstream is thinking so we can know what they need to be educated on, if anything.

Re:Well really how much privacy do you need?

Yes, it does. Fundamentally, there is a difference between an organization that has a couple bits of data about me and an organization that has reams and reams of information about me-- the ability of the latter to extrapolate private information.

As an example, virtually everyone agrees that medical records should be private. Let's say that I go to my local pharmacy every month and spend $50 on some prescription drug. Given my HMO's publically available list of drug co-pays, you can determine a list of drugs I might be taking. Using information from the drug companies, you can determine a list of diseases I might have. Now, take a look at the articles I read on WebMD or one of the other health web sites. Correlate this with the probabilities with which these diseases occur among people of my age, race, gender, weight, locale, etc. Pretty soon, a lot of individually innocuous information will allow you to extrapolate private data, whether it's that I have AIDS, arthritis, or baldness. Do this for every member of my immediate family, and you can narrow the possibilities further.

In the past, we've been able to rely on the fact that the individual bits of data were spread among many organizations, each with their own proprietary format. The effort required in this regime to assemble the data above for any person was much higher than the expected reward. Today, more and more data is being consolidated under fewer and fewer roofs (i.e. DoubleClick). At the same time, technology is making it easier and easier to store and correlate this huge amount of data from various sources. Security through obscurity has begun to fail and people are recognizing that there isn't another line of defense.

While the above scenario may be unlikely, it's only for the reason that there's little use for the derived information today. The moment some organization (or individual) finds a way to profit from it, there's nothing to stop them from doing so.

humor

Overheard:

"You suck!"
"Yes, but that fact is noted in my database, please pay me $30 for citing that fact."
"..."

Calling for a new right...

Quoting from the article: Database manufacturers base their call for a new right on purely economic grounds, unlike existing forms of intellectual property that are grounded philosophically on the promotion of creativity, or "moral rights" in the European tradition.

Hmmm. Rights based on economics. If this ever made it into law, I can't see how it would be constitutional. [I have serious issues with the Digital Millenium copyright act here as well.]

Off the top of my head, it's like saying "my economic interest in protecting my database(d) information is more important than your right to

• freedom of the press,
• the Freedom of Information act which keeps most governmental documents accessible to the general public,
• free flow of medical research information

to name a few.

I don't see how any more laws are needed. It's already against the law to pirate software (which is what virtually all databases are anyway). So for the database manufacturers to refer to the "data collections" as copyrightable seems disingenious to me.

Of course, there is the obligatory "we'll protect the public interest" clauses... "regulators and courts should balance database protection with an insistence on fair licensing and other promotion for competition." Except for one set of problems, I would say, "okee dokee fine." Regulators are noted for protecting the public interest, fair licences, or promoting competition.

The major points I think we should rally behind are that

• "...no one convincingly demonstrates that it is harmed by the lack of special laws." ,
• We may be entering an age when, as law professor Lawrence Lessig claims, "copyright is more effectively protected than at any time since Gutenberg...In such an age--in a time when the [technical] protections are being perfected--the real question for law is not, how can law aid in that protection? but rather, is the protection too great?"... and finally,
• "Privatizing information through contract, encryption, and similar devices may carry greater individual and social costs than would a copyright system."

BTW, in case anyone thinks I didn't read the whole article, I do understand the idea that a lot of work goes into the collection of "facts" that goes into a database, and that the work can be "freeloaded" via the web. There are other protections: I can put copyright notices on my web pages, disallow queries that do not originate from within a given site structure, etc. that do not require any new legislation to be effective.

So IMHO the databases of facts do not require protection. The right to copyright "database facts" would seem to imply that if I create and a database of scientific facts, for example, I am somehow entitled to enforce my right to be the whole source of publishing that information -- just because I collected it first and got a copyright.

Let's hope (and contact your congressperson!!) that we can head this off before it starts another fight that the Internet community cannot afford to lose.

Faulty logic

If information does infact become free, then no one will gather information anymore.

That's the same as saying "If software becomes free, nobody will write software anymore." And just as untrue; if information is free, people will still gather it for the use-value. Maybe it will stop people from gathering information only for the sale value, but this is probably a good thing.
--

Speaking of patents...

I was re-reading Terry Pratchett's "Small Gods" today, and here is a little quote I would like to contribute to this discussion:

"Probably the last man who knew how it worked had been tortured to death years before. Or as soon as it was installed. Killing the creator was a traditional method of patent protection."

:-) I'm sorry, I just couldn't resist...

Regards,

January

p.s. Slashdotters who think there are too much patent and legal issues on /. lately, wave your hands!

Well really how much privacy do you need?

If someone on the streets asks you when your birthday is you'll tell them. If you go to buy something with a check you willingly give your drivers license number, phone number, and address away. If you order something off of a catalog you give your credit card number to the operator. If you pay by credit card at a resteraunt you let the waiter or waitress take your credit card away from you at the table. You put your ATM card into an ATM machine that is not one of your banks. And you even fill out those stupid chain mail survey's.

But someone puts that information into a database and it becomes a violation of privacy?

Granted you should be able to decide if you want it readable, but how much do you really care? My birthday is important to me and I tell everyone ... call me egocentric, but I like presents :-)