Irish ISP Admits To Sending Out Hundreds Of 'First Strike' Notices To Innocent Account Holders

(Mis)Uses of Technology

from the yup,-this-system-works-so-well dept

With the UN report condemning three strikes, we’ve seen a few governments suggest a bit more caution about such laws, but over in Ireland things are getting strange. You may recall a few years back the Irish ISP Eircom got sued for not implementing a three strikes plan. While it first fought back, it eventually caved and agreed to implement a three strikes plan. There was apparently some back room dealing as well, in which Eircom wanted the recording industry to go after other ISPs as well, which has happened. In a trial testing the legitimacy of Eircom’s three strikes laws, a judge ruled entirely the flip side of the UN report, claiming that kicking people off the internet was fine because it was actually copyright that was a human right, not internet access.

Of course, one of the problems with a three strikes provision is the fact that it’s based purely on accusations, rather than convictions. And that’s pretty ridiculous when the data used for the accusations is notoriously inaccurate. But, it gets even worse when an ISP like Eircom apparently sent hundreds of “first strike” notices to people who were entirely innocent, blaming it on a glitch (found via Torrentfreak). It’s now leading to an investigation by the Irish Data Protection Commissioner. Eircom has tried to brush it off due to a technical error having to do with daylight savings time (seriously?!?), but it highlights the larger problems with these kinds of schemes. And those problems mean that the Data Protection Commissioner is looking at the entire three strikes plan to see if it’s legit:

The significance of this case goes well beyond simple technical failings however, as the complaint to the Data Protection Commissioner has triggered a wider investigation of the legality of the entire three strikes system. According to the Sunday Times, “the DPC said it was investigating the complaint ‘including whether the subject matter gives rise to any questions as to the proportionality of the graduated response system operated by Eircom and the music industry’.”

This is unsurprising. When the Eircom / music industry three strikes settlement was being agreed, the Data Protection Commissioner identified significant data protection problems with it. These problems remain, notwithstanding the deeply flawed High Court judgement which permitted the parties to operate the system – a judgement which, for example, decided on the question of whether or not IP addresses are personal data without once considering the views of the Article 29 Working Party. The Data Protection Commissioner was not convinced by that judgement (it was problematic at least in part because the Commissioner was not represented – the only parties before the court had a vested interest in the system being implemented). However, until a concrete complaint arose no further action could be taken.

The complaint in this case has now triggered that action, and it seems likely that the Commissioner will reach a decision reflecting his previous views that using IP addresses to cut off customers’ internet connections is disproportionate and does not constitute “fair use” of personal information. If so, the Commissioner has the power and indeed the duty to issue an enforcement notice which would prevent Eircom from using personal data for this purpose – an outcome which would derail the three strikes system unless Eircom successfully challenges that notice before the courts, or unless the music industry were to succeed in its campaign to secure legislation introducing three strikes into Irish law.

Filed Under: innocent, ireland, three strikes