FAST Legal Update Member Bulletin – June 2023

Case Law Updates

PQ Systems Europe Ltd v Aughton

In March 2023, the High Court held that a former employee (Mr Aughton) had infringed the copyright in software owned by one of the claimants. Mr Aughton had also misused confidential information.

Background

Productivity-Quality Systems Inc (PQS) a US company, develops software to assist with quality assurance in manufacturing. Before 2015, PQS carried on business alongside PQ Systems Europe Ltd (PQE) (together PQ). Mr Aughton was a former employee and former director of PQE and had worked on statistical process control (SPC) software for improving industrial processes. Mr Aughton had developed an SPC program called “ProSPC”, which he alleged was created as a hobby project in his spare time and over which he later claimed ownership. 

PQ alleged that Mr Aughton copied or otherwise made use of ProSPC when he wrote two further programs, “InSPC v1” and “InSPC v2”, after he left PQE. PQ issued proceedings against Mr Aughton for copyright infringement and breach of confidence in relation to both versions of InSPC.

Findings of the High Court 

The issues for Justice Zacaroli were:

1. Whether PQ owned the copyright in ProSPC; and 
2. Whether Mr Aughton copied from it when writing InSPC v1 and InSPC v2 (whether directly or indirectly) after his departure from PQE.

PQ’s case on copying was complicated by the fact that no original source code was available for ProSPC and InSPCv1, having been deleted by Mr Aughton. This made PQ’s case that copying occurred challenging. PQ relied on de-compiled object code for ProSPC and InSPC v1 to obtain a version of source code to compare against the decompiled code of InSPC v2, however it was common ground that a de-compiled code is very different to the original source code. InSPC v2 was also written in C# programming language by Mr Aughton whereas ProSPC and InSPC v1 had been written in VB.NET. As such, PQ’s case relied on circumstantial evidence.

Justice Zacaroli held on the evidence before him, including Mr Aughton’s admissions in an earlier disciplinary hearing and his inconsistent explanations at the trial, that “ProSPC was indeed written in the course of Mr Aughton’s employment such that the copyright and confidential information in it belonged to PQ”^[1]. ProSPC was exactly the kind of software that Mr Aughton was engaged to write and his work in writing ProSPC was also integral to PQ’s business. It was also relevant that he had written ProSPC using resources licensed by PQ.

Key takeaways

• Employers should clarify any ambiguities around what is considered to be work carried out within the scope of employment. For example, producing work with help from the company’s materials or on any company resources – as seen in this case – despite being used in a ‘non-working’ environment or during ‘non-working’ hours will be considered to be created in the course of employment.

• Employers should ensure that contracts, policies, and job descriptions are kept up to date, avoiding situations where the type of IP being created or the role or extent of IP creation in the role risks not falling within what could reasonably be expected to be in the course of an employee’s employment.

Wright & Ors v BTC Core & Ors

Background

This case is one of a number of actions bought by Craig Wright in the English High Court regarding his status as the purported inventor of Bitcoin. The Australian computer scientist and self-proclaimed Satoshi Nakamoto (the pseudonymous creator of Bitcoin) has had a copyright claim for Bitcoin rejected by a UK Court.  Mr Wright claimed that he should be able to block the operation of Bitcoin and the system that forked from it, Bitcoin Cash, because they breach his intellectual property rights.^[2]

Judge James Mellor commented that “there is no evidence that the Bitcoin File Format is set out in any part of the software or early blocks written to the Bitcoin Blockchain, as opposed to the Bitcoin Software simply reading and writing files in that format”^[3]. 

Mr Wright has indicated his intention to appeal. 

Key takeaways 

Bitcoin can’t be treated as literary work and protected by copyright because of its file format with digital transactions that combine to form blocks in a blockchain. The Bitcoin format itself was inherently not fixed but a component part of a wider structure and therefore could not attract copyright in and of itself.

Mr Wright’s claim whether he is really the author of the Bitcoin white paper (the foundational document of Bitcoin which was published in October 2008 by Satoshi Nakamoto) will be the subject of later rulings, which will have a greater impact on the legal status of bitcoin.

Meta fined €1.2bn for mishandling data

Facebook’s owner, Meta, has been fined €1.2bn (£1bn) for mishandling people’s data when transferring it between Europe and the United States. It is the largest fine imposed under the EU’s General Data Protection Regulation privacy law. The decision revolves around the use of standard contractual clauses (SCCs) to move European Union data to the US. These legal contracts, prepared by the European Commission, contain safeguards to ensure personal data continues to be protected when transferred outside Europe. But there are concerns these data flows still expose Europeans to the US’s weaker privacy laws – and US intelligence could access the data.

Andrea Jelinek, Chair of the European Data Protection Board, said: “The EDPB found that Meta IE’s infringement is very serious since it concerns transfers that are systematic, repetitive and continuous. Facebook has millions of users in Europe, so the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organisations that serious infringements have far-reaching consequences.”^[4]

Facebook president Nick Clegg said, “this decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US.”^[5] Meta says it will appeal against the “unjustified and unnecessary” ruling.

Key takeaways

If they have not already done so, organisations should:

• Ensure they have a clear map of their data transfers and have thoroughly risk-assessed them, focussing particularly on transfers to the US;
• Review all transfer risk assessments conducted (and finalise any that are outstanding), especially for US transfers, to make sure they are complete, thorough and up-to-date;
• Consider whether further supplementary measures can be put in place for any US transfers to mitigate the risks as far as possible; and
• Keep a close eye on further developments in this case, which is far from over.^[6]

Chat GPT

Italy issued a temporary ban of Chat GPT

On 1 April 2023, Italy issued a temporary ban of the chatbot over concerns about data transparency and whether it is protecting the data of minors. The Italian Garante launched an investigation into OpenAI on a data breach and lack of age verification to protect younger users from inappropriate generative AI content during registration. However, later that month, the ban was reversed and access to ChatGPT was restored. 

Timeline of movement on Chat GPT

Below you will find a timeline of key updates concerning Chat GPT, in which you will see that there has been some considerable movement over the last 6 months.

In the space of six months Chat GPT has moved a long way from being an intriguing new technology that could have many potential applications for use across industry. It is now the subject of much fearful public speculation as to its potential risks, and the risks posed by AI more generally. The leading experts in the field including executives who manage Open AI, the company that invented Chat GPT, have put their names to a statement released by the Centre for AI Safety on May 30^th 2023  which reads: “Mitigating the risk of extinction from AI should be a global priority alongside other societal-scale risks such as pandemics and nuclear war”. It is very difficult today to know what risks AI might pose in the future and how they might be managed, given the relative newness of the underlying technology. 

The challenge will surely be for our political class to work out the best way to regulate AI in such a manner so as to safeguard fundamental human rights while also allowing for innovation. The EU have set out their stall very clearly with their proposal for a Regulation on AI currently going through the EU legislative process. Their proposal involves a risk-based approach to AI and a requirement that all “high-risk” AI applications go through a pre-conformity check before being allowed to be placed on the market. The difficulty posed is that Microsoft has already made it possible to embed Chat GPT in the office applications used by office workers every day. In such a scenario AI in the form of Chat GPT will be used by office workers globally across all industries on a routine basis. How then would the suggested EU approach work in practice? The UK Government has yet to decide on a legislative approach to adopt and should maybe review the success or otherwise of the EU approach, and reflect upon what that might mean for the best approach to adopt in a UK context. 

^[1] PQ Systems Europe Ltd & Anor v Aughton & Anor [2023] EWHC 581 (Pat) (22 March 2023) (bailii.org)

^[2] Craig Wright Loses Bitcoin Copyright Claim in UK Court (coindesk.com)

^[3] Wright & Ors v BTC Core & Ors [2023] EWHC 222 (Ch) (07 February 2023) (bailii.org)

^[4] 1.2 billion euro fine for Facebook as a result of EDPB binding decision | European Data Protection Board (europa.eu)

^[5] Meta: Facebook owner fined €1.2bn for mishandling data – BBC News

^[6] Record-breaking decision puts US personal data transfers at risk – TLT LLP

^[7] The malware threat landscape: NodeStealer, DuckTail, and more (fb.com)