Who bears the costs of complying with Norwich orders? These orders require ISPs to disclose the identify of their subscribers to enable copyright owners to bring legal proceedings against suspected infringers. The issue was resolved earlier today by the Supreme Court in Rogers Communications Inc. v. Voltage Pictures, LLC, 2018 SCC 38.
In an 8-1 decision written by Brown J, (with whom Wagner C.J. and Abella, Moldaver, Karakatsanis, Gascon, Rowe and Martin JJ agreed) the Court held that ISPs must bear the costs of complying with their obligations under s41.26(2) of the notice and notice regime. These include the costs associated with the obligations of (1) determining, for the purposes of forwarding notice electronically, who was assigned the impugned IP address at the time of the alleged infringement; (2) taking all steps necessary to verify that the ISP has done so accurately; and (3) taking all steps necessary to verify the accuracy of records which would permit the ISP to identify the name and physical address of the person to whom notice was forwarded.
However, as the obligations under the notice and notice regime do not include a requirement to actually identify the name or physical address a person from its records – which is required to comply with a Norwich order – these latter costs are recoverable from the copyright owner seeking the Norwich order, provided they are reasonable and arise from compliance with the order.
The Court summarized its findings on this issue as follows:
In brief, the three express obligations contained in ss. 41.26(1)(a) and 41.26(1)(b) carry with them several implicit obligations that an ISP must satisfy under the notice and notice regime. Specifically, s. 41.26(1)(a) requires an ISP to determine, for the purpose of forwarding notice electronically, the person to whom the IP address belonged. It also requires an ISP to take whatever steps that are necessary to verify that it has done so accurately lest it risk statutory liability for failing to actually forward notice to that person. It does not, however, require an ISP to determine the name and physical address of that person.
Similarly, the records that an ISP must retain under s. 41.26(1)(b) must be accurate. Any steps which are necessary to verify the accuracy of those records therefore form part of an ISP’s s. 41.26(1)(b) obligations. That said, while those records must be kept in a form and manner that allows an ISP to identify the name and address of the person to whom notice is forwarded under s. 41.26(1)(a), s. 41.26(1)(b) does not require that they be kept in a form and manner which would permit a copyright owner or a court to do so. The copyright owner would, however, be entitled to receive that information from an ISP under the terms of a Norwich order — which process, as I have already said, falls outside the ISP’s obligations under the notice and notice regime.
The decision by the Court is an important one. Under the decision of the Federal Court of Appeal, which was reversed by the Supreme Court, ISPs had only a very limited right of recovery of their costs which did not extend to their reasonable costs of identifying the name and physical addresses of subscribers to whom they forwarded notices under the notice and notice regime. The Court adverted to this saying:
Moreover, to read s. 41.26(1)(a) as requiring an ISP to determine the name and physical address of the person to whom it forwards notice would not be consistent with the notice and notice regime’s purpose of balancing the interests of all stakeholders. Each month, Rogers receives approximately 200,000 to 300,000 notices of claimed copyright infringement, each of which it must forward in accordance with s. 41.26(1)(a). Only a small portion of these notices ultimately result in Norwich orders requiring Rogers to disclose the name and physical address of a person who has received notice. Recognizing an implicit requirement in s. 41.26(1)(a) for Rogers to identify the name and physical address of those hundreds of thousands of persons to whom it forwards notices each month would force Rogers to undertake identification work in all cases even though the vast majority of notices sent will never culminate in a Norwich order. In my view, this would undermine the balance struck by Parliament within the notice and notice regime between the respective interests of ISPs and of copyright owners.
The Court did not make any finding in the case as to how much an ISP can charge a copyright holder to obtain subscriber information under the Norwich process. It ruled, however, that “motion judges should carefully review an ISP’s evidence to determine whether an ISP’s proposed fee is ‘reasonable’, in light of its obligations under the notice and notice regime.”
The Court held that, in the case before it, the motion judge erred in law by failing to interpret the full scope of an ISP’s obligations under s. 41.26(1) and then by failing to consider which of the steps the ISP took to comply with the Norwich orders were recoverable. Accordingly, the Court remitted the matter back to the Federal Court to determine the issue. Because the record before the Court was not complete, the Court granted leave to Rogers to adduce new evidence to prove its reasonable costs of compliance with the Norwich order.
In the course of decision, the court made some other observations about copyright, Norwich orders, the goals of the notice and notice regime and the copyright amendments made in Copyright Modernization Act. In particular, the Court made the following findings and observations:
- The notice and notice regime was enacted as part of the Copyright Modernization Act, “to serve two complementary purposes: (1) to deter online copyright infringement; and (2) to balance the rights of interested parties.”
- The balance of the rights of interested parties includes “not only balancing the rights of copyright owners and Internet users who may infringe those rights, but also the interests of Internet intermediaries such as ISPs”. An example given by the court is that “Parliament insulated ISPs from liability for the copyright infringement of their Internet subscribers (Act, s. 31.1). Now, to attract liability under the Act, an ISP must fail to satisfy its statutory obligations under the notice and notice regime, or provide a service “primarily for the purpose of enabling acts of copyright infringement” (ss. 27(2.3), 31.1 and 41.26(3)).”
- The notice and notice regime “is intended to deter the continued infringement of copyright online”. However, “it does not require an ISP to disclose the identity of a person who has received notice to a copyright owner. For a copyright owner to obtain that person’s identity, the owner must proceed outside the regime — specifically, by obtaining a Norwich order compelling the ISP to disclose it.”
- The deterrent purpose of the notice and notice regime “affirms the ISP’s duty to correctly determine to whom the impugned IP address belonged at the time of the alleged infringement. Deterring online copyright infringement entails notifying that person, because it is only that person who is capable of stopping continued online copyright infringement.”
- The notice and notice regime “implicitly requires an ISP to maintain records which allow it to accurately determine the identity of the person to whom the impugned IP address belonged.” Given “the rapidity with which copyrighted content is shared via simultaneous downloading and uploading on peer to peer networks, inaccurate identification might hollow out those rights altogether. The purpose of s. 41.26(1)(b) is to allow for identification when an ISP is required to do so by court order. It is therefore of utmost importance that an ISP retain its records in an accurate manner and form in order to ensure prompt identification.”
- The notice and notice regime (S41.26(1)(b)) does not require an ISP to actually disclose the records to which the provision refers to copyright holders.
- An ISP may be liable for statutory damages under s. 41.26(3) “where an ISP fails to correctly forward notice to the person to whom the impugned IP address actually belonged” “for statutory damages in an amount of no less than $5,000 but no more than $10,000. This statutory liability is a clear affirmation of the ISP’s obligation, each time it receives notice from a copyright owner, to ensure that it forwards that notice to the correct person.”
- To obtain a Norwich order a copyright owner must show (a) a bona fide claim against the unknown alleged wrongdoer; (b) the person from whom discovery is sought must be in some way involved in the matter under dispute, he must be more than an innocent bystander; (c) the person from whom discovery is sought must be the only practical source of information available to the applicants; (d) the person from whom discovery is sought must be reasonably compensated for his expenses arising out of compliance with the discovery order in addition to his legal costs; and (e) the public interests in favour of disclosure must outweigh the legitimate privacy concerns.
