Scarlet: Why Copyright Enforcement Cannot Require General Internet Surveillance

Case C-70/10 | Scarlet Extended SA v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM) | Court of Justice of the European Union | Third Chamber | 24 November 2011

Practice Takeaways: ① Copyright enforcement must respect the prohibition on general monitoring by internet intermediaries. ② An injunction requiring preventive filtering of every customer’s communications, indefinitely and at the provider’s expense, is incompatible with EU law. ③ Copyright is a fundamental right, but it must be balanced against freedom to conduct a business, data protection, and freedom of information. ④ The IP addresses involved in the proposed system were protected personal data because they allowed users to be identified. ⑤ Filtering must account for lawful uses of protected works; identifying a copyrighted file does not establish that its transmission is unlawful.

An internet service provider can be required to help stop copyright infringement. But how much of its customers’ activity may it be required to inspect to do so? In Scarlet, the Court examined an injunction that would require a provider to filter all electronic communications passing through its network, for all customers, as a preventive measure, indefinitely, and entirely at its own expense.

The Court held that EU law precluded that injunction. Implementing it would require general monitoring prohibited by Article 15(1) of Directive 2000/31/EC on electronic commerce. It would also fail to strike a fair balance between copyright protection and the rights of the provider and its customers. The judgment connected the architecture of an enforcement system with its consequences for personal data, lawful communications, and the provider’s ability to operate its business. (Judgment, paras. 29, 38–40, 43–54.)

Practice Tip: When evaluating an enforcement measure, examine what the system must observe before it can act. An order aimed at infringing files may still require indiscriminate inspection of everyone’s communications. Its legal assessment must address that monitoring as well as the files ultimately blocked.

What happened

SABAM was a Belgian collective management organization representing authors, composers, and publishers of musical works. Scarlet provided internet access without itself offering downloading or file-sharing services. In 2004, SABAM concluded that Scarlet’s customers were using peer-to-peer networks to exchange works in its repertoire without authorization or payment of royalties. (Judgment, paras. 15–17.)

On 24 June 2004, SABAM brought proceedings before the President of the Brussels Court of First Instance. It sought a declaration of infringement and an order requiring Scarlet to stop its customers from sending or receiving unauthorized musical files through peer-to-peer software. SABAM argued that Scarlet, as the access provider, was best placed to bring the infringements to an end. (Judgment, paras. 18–20.)

The court found copyright infringement on 26 November 2004, but appointed an expert before deciding what measures to order. The expert was asked to assess technical feasibility, whether filtering could distinguish unlawful sharing from lawful sharing, and the cost of possible measures. Although the report identified numerous technical obstacles, it did not entirely rule out filtering and blocking. On 29 June 2007, the court ordered Scarlet to make it impossible for customers to send or receive files containing musical works in SABAM’s repertoire through peer-to-peer software, on pain of a periodic penalty. (Judgment, paras. 21–23.)

Scarlet appealed. It disputed the effectiveness and feasibility of the proposed systems and argued that compliance would require general surveillance of its network. It also raised EU rules protecting personal data and the confidentiality of communications, because filtering would involve processing users’ IP addresses. (Judgment, paras. 24–26.)

The Brussels Court of Appeal referred the matter to the CJEU. Before investigating whether an effective filtering mechanism existed, it wanted to know whether EU law permitted an obligation of that scope. Its questions concerned preventive filtering of all incoming and outgoing electronic communications for every customer, without a time limit and at Scarlet’s expense, and the role of proportionality in assessing such an order. (Judgment, paras. 27–29.)

Why the case matters

Scarlet demonstrates that a legitimate enforcement objective does not determine whether the mechanism used to pursue it is lawful. Copyright holders were entitled to seek injunctions against intermediaries whose services facilitated infringement. That entitlement nevertheless operated within EU limits on monitoring and the Charter’s protection of other affected rights. (Judgment, paras. 30–36, 43–45.)

The judgment also made the interests of ordinary internet users part of the assessment. A system designed to detect unlawful file sharing would inspect communications involving customers who had committed no identified infringement. It would process identifying information and could block lawful exchanges because recognizing a protected work does not resolve whether a particular use is authorized, covered by an exception, or otherwise lawful. (Judgment, paras. 38–40, 50–52.)

For data protection, the case is significant both for its treatment of IP addresses and for its examination of systematic content analysis. The Court assessed the processing required by the proposed enforcement system alongside its effects on business operations and access to information. Those consequences had to be considered together when evaluating the injunction. (Judgment, paras. 47–53.)

Key holding

The Court held that Directives 2000/31, 2001/29, 2004/48, 95/46, and 2002/58, read together in light of the applicable fundamental rights, precluded an injunction requiring an internet service provider to install a filtering system with the following features:

• It examined all electronic communications passing through the provider’s services, particularly peer-to-peer traffic.
• It applied indiscriminately to all customers.
• It operated preventively.
• The provider alone bore its cost.
• It operated for an unlimited period.

The system would identify transfers of files containing musical, cinematographic, or audiovisual works in which the applicant claimed rights and block transfers that infringed copyright. Its implementation would require prohibited general monitoring and would fail to preserve a fair balance between intellectual property and the affected rights of the provider and its customers. (Judgment, paras. 29, 40, 49–54 and operative part.)

The Court’s analysis

1 Intermediaries may be ordered to prevent infringement

The Court began by recognizing the enforcement powers available under EU law. Article 8(3) of Directive 2001/29/EC on copyright in the information society and Article 11 of Directive 2004/48/EC on the enforcement of intellectual property rights allowed rightholders to seek injunctions against intermediaries whose services third parties used to infringe their rights. Such orders could address existing infringements and help prevent further ones. (Judgment, paras. 30–31.)

National law governed the conditions and procedures for those injunctions, but national discretion remained subject to EU law. In particular, copyright enforcement could not override the rules on intermediary services in Directive 2000/31. Article 15(1) prohibited national authorities from imposing a general obligation to monitor transmitted information or actively seek facts indicating unlawful activity. The Court also referred to Article 3 of Directive 2004/48, which required fair and proportionate enforcement measures that were not unnecessarily complicated or costly. (Judgment, paras. 32–36.)

Practice Tip: Authority to grant an injunction does not establish that a particular injunction is lawful. Examine how the proposed measure would operate, the scope of monitoring it would require, and its effects on the rights of the provider and its users.

2 The proposed filtering system required general monitoring

The Court identified the steps needed to implement the system. Scarlet would first have to identify peer-to-peer files within all of its customers’ electronic communications. It would then need to identify files containing works claimed by rightholders, determine which were being shared unlawfully, and block those transfers. (Judgment, para. 38.)

That process required active observation of every customer’s electronic communications and covered all information transmitted over the network. Its preventive character extended the monitoring to possible future infringements, rather than confining it to a specific identified act. The Court held that this amounted to general monitoring prohibited by Article 15(1) of Directive 2000/31. (Judgment, paras. 39–40.)

Practice Tip: A filter can be selective in what it blocks while remaining general in what it monitors. Assess the communications inspected, the people affected, and the duration of observation separately from the categories of content targeted for removal.

3 Copyright protection must be balanced against other fundamental rights

Copyright fell within the protection of intellectual property in Article 17(2) of the Charter of Fundamental Rights of the European Union. The Court nevertheless rejected the proposition that intellectual property was inviolable or entitled to absolute protection. Relying on Promusicae, it held that national authorities and courts had to strike a fair balance between copyright protection and the fundamental rights of people affected by enforcement measures. (Judgment, paras. 42–45.)

For Scarlet, the relevant competing right was freedom to conduct a business under Article 16 of the Charter. For its customers, the Court considered the protection of personal data under Article 8 and freedom to receive or impart information under Article 11. An assessment concerned only with whether filtering would reduce infringement would leave those interests unanswered. (Judgment, paras. 46, 50.)

4 The indefinite filtering obligation disproportionately burdened the provider

The proposed monitoring had no time limit. It addressed all future infringements and extended to works that did not yet exist when the system was introduced. Scarlet would have to install a complicated, costly, permanent computer system entirely at its own expense. (Judgment, paras. 47–48.)

• The Court held that this would seriously infringe Scarlet’s freedom to conduct its business. It also conflicted with Article 3(1) of Directive 2004/48, which required enforcement measures not to be unnecessarily complicated or costly. In those circumstances, the injunction failed to balance the rightholders’ interests fairly against the provider’s rights. (Judgment, paras. 48–49.)

The reasoning addressed the burden of this particular system. It did not establish that every compliance cost imposed on an intermediary infringes Article 16.

5 Systematic inspection and IP address processing affected personal data

The consequences extended beyond Scarlet. The filtering system would involve systematic analysis of all content and the collection and identification of users’ IP addresses associated with unlawful content. The Court treated those addresses as protected personal data because they allowed the users concerned to be precisely identified. (Judgment, paras. 50–51.)

This finding placed data protection within the assessment of the injunction itself. The provider’s technical ability to examine traffic did not settle whether it could lawfully be required to deploy that ability across its network. The processing needed to identify and block transfers had to be considered when balancing the rights affected by the enforcement measure. (Judgment, paras. 51–53.)

The judgment’s statement about IP addresses should be read in its factual context. It concerned addresses processed in a system operated by an internet access provider and capable of identifying its users. The Court did not undertake a comprehensive analysis of identifiability for every type of IP address in the hands of every possible recipient.

6 Filtering could block lawful communications

The Court also identified a risk to freedom of information. The system might fail to distinguish unlawful content from lawful content, leading it to block legitimate communications. Whether a transmission was lawful could depend on copyright exceptions that differed among Member States. Some works might be in the public domain in a particular Member State, while others could be made freely available online by their authors. (Judgment, para. 52.)

Recognizing a work was therefore insufficient to establish that its transmission infringed copyright. A system that overlooked the legal context of a particular exchange could restrict lawful access to information. Taken together with the business burden and personal data processing, that risk confirmed that the proposed injunction did not strike the required fair balance. (Judgment, paras. 52–54.)

The Advocate General’s Opinion

Advocate General Pedro Cruz Villalón also proposed that EU law precluded the requested order, but his decisive reasoning concerned the legal basis for restricting fundamental rights. He examined the filtering system in light of privacy and confidentiality of communications under Article 7 of the Charter, data protection under Article 8, freedom of expression and information under Article 11, and the requirements for limitations on those rights in Article 52(1). (Opinion, paras. 73–88.)

The requirement that a limitation be provided for by law demanded more than the existence of a statutory provision. Drawing on the European Court of Human Rights’ case law, he explained that the legal framework had to be accessible, sufficiently clear, and foreseeable, and had to define the scope of the power to interfere with protected rights. (Opinion, paras. 93–100.)

Belgian law allowed injunctions against intermediaries whose services were used to infringe copyright. In his view, that general authority was insufficient to support a system of systematic, universal, permanent filtering. The proposed arrangement lacked specific safeguards for personal data and communications confidentiality, as well as express procedures through which users could oppose the blocking of a file or challenge its justification. Nor had a substantial body of Belgian case law been identified that made such an order sufficiently foreseeable. (Opinion, paras. 101–109.)

He therefore concluded that the national provision did not provide an adequate legal basis for this injunction and proposed a negative answer to the first question, making a separate answer to the conditional second question unnecessary. (Opinion, paras. 112–115.)

The Court reached the same outcome through the prohibition on general monitoring and the need to balance fundamental rights. It did not adopt the Opinion’s legal-basis analysis as its stated rationale. The Opinion also did not establish that more precise legislation would necessarily make such a system lawful; other Charter requirements would still need to be assessed. (Judgment, paras. 35–54; Opinion, paras. 113–115.)

What the Court did and did not decide

The Court held that:

• The proposed preventive, indiscriminate, indefinite filtering system required prohibited general monitoring. It also held that the injunction failed to balance copyright protection fairly against the provider’s freedom to conduct a business and its customers’ rights to data protection and freedom of information.
• The IP addresses involved in that system are personal data because they enabled identification of the users concerned. It recognized that automated filtering could interfere with lawful communications when the system failed to account for authorization, exceptions, or the public-domain status of a work.

The Court did not:

• Prohibit all injunctions against internet service providers. It expressly acknowledged orders aimed at ending existing infringements and preventing further ones.
• Decide that every filtering or blocking measure constituted general monitoring. The ruling addressed a system with the particular scope described by the referring court. (Judgment, paras. 29–40.)
• Decide that data protection always prevailed over copyright, or that copyright enforcement could never involve personal data. Its conclusion required a fair balance among the applicable rights.
• Did not prescribe the design of a lawful alternative or resolve Scarlet’s technical feasibility objections. (Judgment, paras. 27, 43–54.)

Finally, the judgment interpreted the EU framework applicable in 2011, including Directive 95/46 rather than the GDPR. Applying its reasoning to a present-day service requires identifying the legislation now governing that service and the measure proposed.

Conclusion

Scarlet required courts to examine the monitoring that copyright enforcement would entail. The proposed injunction would have placed every customer’s communications under preventive observation, indefinitely, to detect possible infringement. Its reach affected the provider’s business, the processing of users’ personal data, and the exchange of lawful information.

The judgment preserved the availability of injunctions against intermediaries while rejecting this form of general surveillance. Its practical lesson is to evaluate an enforcement system by what it observes, whose activity it covers, how long it operates, and how it distinguishes unlawful transfers from lawful communications. A legitimate claim to protect copyright does not dispense with those inquiries.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court’s official case-law database. The judgment and Opinion are also available on EUR-Lex.

Search CJEU case law on InfoCuria

• Court of Justice of the European Union, Third Chamber, Case C-70/10, Scarlet Extended SA v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM), Judgment of 24 November 2011, ECLI:EU:C:2011:771. Read the Judgment.
• Opinion of Advocate General Pedro Cruz Villalón, Case C-70/10, delivered 14 April 2011, ECLI:EU:C:2011:255. Read the Opinion.

Related reading from The de la Torre Review

• “Promusicae: When an IP Address Becomes a Person.” The 2008 judgment underlying Scarlet’s analysis of competing fundamental rights. Promusicae held that EU law does not require Member States to disclose subscriber data for civil copyright claims, but permits them to do so if they preserve a fair balance between fundamental rights and respect proportionality. Read the article.
• “Tele2: When Copyright Enforcement Meets Communications Privacy.” The 2009 order applying Promusicaeto requests for subscriber information and confirming that a provider offering only internet access can qualify as a copyright intermediary. It helps explain why Scarlet could be subject to enforcement measures even though the scope of those measures remained constrained by EU law. Read the article.
• “Bonnier: When Copyright Disclosure Depends on Proportionality.” A subsequent judgment examining a Swedish framework for identifying subscribers in civil copyright proceedings. The Court considered that framework capable, in principle, of preserving a fair balance because it required evidence of infringement and judicial assessment of competing interests. It provides a useful comparison with the indiscriminate monitoring rejected in Scarlet. Read the article.
• “Breyer: When an IP Address Becomes Personal Data.” The 2016 judgment examining when a dynamic IP address constitutes personal data for a website operator relying on identifying information held by an internet service provider. It complements Scarlet’s treatment of IP addresses by explaining how identifiability depends on the legal and practical means available to connect an address to an individual. Read the article.
• “Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” The 2014 judgment invalidating the Data Retention Directive and explaining how communications metadata can reveal detailed information about an individual’s private life. It extends the discussion of broad surveillance beyond content filtering to the privacy consequences of retaining communications data. Read the article.
• “Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive.” A later CJEU decision examining government access to subscriber-identification data and distinguishing privacy interferences according to their seriousness. Read alongside Scarlet, it helps explain why the scope of processing and what the data reveal matter when assessing proportionality. Read the article.