Database disputes

Database right

Database right is a proprietary right governed by the Copyright and Rights in Databases Regulations 1997 (CRD 1997), SI 1997/3032, which implemented Directive 96/9/EC (EU Database Directive). Database right arises automatically when there has been a substantial investment in obtaining, verifying or presenting the database contents. A database is defined as a ‘collection of independent works, data or other materials which are arranged in a systematic or methodical way and are individually accessible by electronic or other means’ (CRD 1997, SI 1997/3032, reg 12, and section 3A(1) of the Copyright, Designs and Patents Act 1988 (CDPA 1988)). For example, the definition of database would include an electronic or hard copy encyclopedia or a telephone directory.

Database right can subsist whether or not the database or its contents are a copyright work. There is no requirement for an 'author’s own intellectual creation' (as there is for copyright); the test is whether there has been a 'substantial investment' and this will turn on the facts as not all databases qualify for protection. Database right only protects the arrangement of the database as a means of storing

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Powered by Lexis+®
Latest Information Law News

Data by any other name—Court of Appeal reverses Upper Tribunal’s ruling on the protection of ‘personal data’ (DSG v ICO)

Information Law analysis: In this case, the Court of Appeal unanimously allowed the appeal brought by the Information Commissioner’s Office (ICO), holding that it is sufficient that data which has been subjected to unauthorised or unlawful processing by a third party still constitutes personal data from the perspective of the data controller, even if it is pseudonymised ‘in the hands of’ the data controller and therefore anonymised ‘in the hands of’ the attacker. Accordingly, the court held, the data controller is required to take ‘appropriate technical and organisational measures’ (ATOMs) to protect that personal data against such hackers, even where those third parties cannot themselves identify the individuals to whom the data relates. Even though this judgment is under the Data Protection Act 1998 (DPA 1998), this decision is significant as it confirms, in terms equally applicable to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), that the scope of the security obligation is not diminished merely because stolen or exfiltrated data would be anonymised in the hands of the third party with unlawful access. This development expands and makes more pressing the obligation on controllers to assess and guard against a broader range of threats—including ransomware, data destruction, and bulk exfiltration, regardless of the attacker's capacity to re-identify data subjects. Written by Adelaide Lopez, senior associate at Wiggin LLP.

View Information Law by content type :

Popular documents