JUDGMENTS

Business purchaser did not have ongoing implied software
licence

On 8 June 2021, the Federal Court considered the factors to be
taken into account when determining the existence of an implied
software licence: QAD Inc v Shepparton Partners Collective
Operations Pty Ltd [2021] FCA 615. The proceedings related to
an alleged infringement of copyright by the purchaser, based on its
continued use of software licensed by the plaintiff to the vendor.
The licence agreement between the plaintiff and the vendor required
the plaintiff’s consent to an assignment, and the plaintiff
subsequently stipulated a transfer fee as a condition of
assignment. The purchaser declined to pay the transfer fee but
contended it had an implied licence to continue using the software,
essentially on the basis that the plaintiff had not objected to the
ongoing use of the software during the course of negotiations.
Thawley J concluded that an implied licence existed during the
period of negotiations between the parties regarding the transfer
fee, but once those negotiations lapsed, the implied licence came
to an end. It followed that the purchaser infringed the
plaintiff’s copyright through its continued use of the
software. Compensatory damages of $662,408.80 were awarded, being
the amount of the transfer fee plus a year’s maintenance fee,
together with exemplary damages under section 115(4) of the
Copyright Act 1968 for the purchaser’s “flagrant
breach”. In the latter regard, the court noted that the
software had been essential to the ongoing functioning of the
business, but this was no excuse: “The fact that,
commercially, [the purchaser] had little choice other than to use
the software does not make the infringement less flagrant; rather
it explains the reasons why the infringement was so
flagrant”.

Information Commissioner determines that Uber breached
APPs

On 30 June 2021, the Information Commissioner made a
determination under section 52(1A) of the Privacy Act 1988
that Uber Technologies Inc. and Uber B.V. interfered with the
privacy of approximately 1.2 million individuals in Australia by
failing to adequately protect the personal data of customers and
drivers which was accessed in a cyber-attack in October and
November 2016. The attack was directed at data stored in Amazon Web
Service’s Simple Storage Service. Specifically, Uber was found
to have breached Australian Privacy Principle (APP) 11.1 by failing
to take reasonable steps to protect personal information against
unauthorised access, and APP 11.2 by failing to take reasonable
steps to delete or de-identify personal information which was no
longer needed for a permitted purpose. Related to these breaches,
the Information Commissioner further determined that Uber had
breached APP 1.2 by failing to take reasonable steps to implement
practices, procedures and systems relating to its functions and
activities that would ensure that they complied with the APPs. In
making these findings, the Information Commissioner rejected
Uber’s submission that it did not, for the purposes of section
5B of the Act, “carry on business in Australia” due to
the absence of any direct contractual or other relationship with
riders or drivers in Australia, with the Information Commissioner
observing that “the fact that an activity which occurs in
Australia might be controlled or facilitated by actions of the
entity taken remotely and without the need for employees in
Australia, does not necessarily mean that no relevant activity is
performed by the entity in Australia”.

Federal Court overrides exclusive jurisdiction clause in Apple
case

On 9 July 2021, the Full Court of the Federal Court allowed an
appeal by Epic Games against a temporary stay of proceedings
granted to Apple Inc in a dispute over an Apple Developer License
Agreement: Epic Games, Inc v Apple Inc [2021] FCAFC 122.
In November 2020, Epic had commenced the proceedings in the Federal
Court alleging that Apple’s conduct in requiring developers to
(a) distribute iOS apps to Australian users through Apple’s
Australian App Store, and (b) only use Apple’s payment
processing system for in-app purchases, contravened Pt IV of the
Competition and Consumer Act (2010). As we have previously
reported in an earlier TMT Update and analysed in a separate article on our website, Apple had
sought a stay because the agreement provided that any dispute
relating to it must be litigated in the Northern District of
California, and in April 2021 Apple was granted a temporary (3
month) stay by the trial judge: Epic Games, Inc v Apple Inc
(Stay Application) [2021] FCA 338. Epic asserted in its appeal
that the primary judge erred in failing to give effect to
“overriding” public policy considerations that militated
against the granting of a stay, and in failing to find that there
were strong reasons to permit the proceeding to continue in the
Federal Court notwithstanding the existence of the exclusive
jurisdiction clause. Relying on the principles espoused by the High
Court in Akai Pty Ltd v People’s Insurance Co Ltd
(1996) 188 CLR 418, the Full Court concluded that the primary judge
had erred in granting a stay because, amongst other things,
enforcement of the exclusive jurisdiction clause would offend the
public policy of the forum, observing that “if contraventions
of Pt IV of the CCA are determined by foreign courts they will be
determined through the prism of expert evidence about the content
of Australian law . This process is not the same as ascertaining
and applying the law directly . One of the difficulties and
uncertainties involved in proving foreign law is the risk that
important aspects of the foreign law will be lost in
translation.” The Court acknowledged that exclusive
jurisdiction clauses are a significant feature of global commerce,
but this was outweighed by public interest factors such as the
forensic disadvantage of Epic litigating the matter before a
foreign court, the fact that the conduct in question was undertaken
in an Australian sub-market, and the fact that “the focus
should not only be on the nature of competition law, but the
significance of the statutory provisions which allow the Commission
to intervene, private parties to get the benefit of factual
findings and admission, and the relevance of the Federal Court
being chosen by Epic Games as the court of its choice”.

Software developer liable for breach of copyright

On 19 July 2021, the Federal Court of Australia ruled that a
software developer infringed copyright when developing software to
replace a program which had been sold to the applicant:
Campaigntrack Pty Ltd v Real Estate Tool Box Pty Ltd
[2021] FCA 809. The Applicant had previously purchased the
intellectual property rights in a product which competed with its
own real estate online software system. The vendor then created a
new product which the applicant alleged reproduced parts of the
source code of the purchased product. Thawley J rejected the
respondent’s contention that the original assignment related
only to the then-current version of the software, stating that such
an interpretation would be “defeating the whole purpose
underlying the parties’ transaction”. A breach of
copyright was evidenced by “many lines of source code which
matched exactly”, especially after taking account of “the
functionality of the matching code”. His honour also ruled
that the developer had, for the purposes of section 36(1A) of the
Copyright Act, authorised infringement by other developers
over whom he exercised supervision and control. The court found
that, in addition to breaching copyright, the respondent had
misused confidential information derived from the source code,
noting that it “would have been clear to a reasonable
person..that he was not free to deal with the information as his
own”.

Technology manufacturer liable for breach of confidence

On 26 July 2021, the Queensland Supreme Court delivered a
judgement which focusses attention on the effectiveness of
Non-Disclosure Agreements (NDAs) in technology
development contracts: Madritsch KG & Anor v Thales
Australia Ltd [2021] QSC 170. Bradley J ruled that the
defendant, a small arms manufacturer and supplier to the
Commonwealth, had infringed an NDA with the plaintiffs, both of
which were also involved in the firearms industry, regarding
details of a technological solution to a functional problem
affecting a service rifle used by the Australian Defence Force. The
defendant had been provided with technical details relating to the
Madritsch product with a view to deciding whether to manufacture
the Madritsch solution under licence. The defendant subsequently
opted, however, to develop its own solution and the principal issue
was whether Thales had made use of confidential Madritsch
information in the process. His Honour found for the plaintiffs and
in so doing, a number of fundamental considerations regarding the
effectiveness of NDAs were confirmed. These included: if the
subject matter of an NDA is precisely defined, the risks of the
agreement being void for uncertainty are reduced; the fact that the
information could have been independently created by the recipient
is of no relevance if the recipient in fact relied upon
confidential information provided by the discloser; information is
not necessarily in the public domain by virtue of the fact that it
has previously been disclosed in confidence to a third party; and a
time limit on the duration of the confidentiality obligation will,
if it is reasonable, reduce the risk of the obligation becoming an
unenforceable restraint of trade in circumstances where the
Restraints of Trade Act 1976 (NSW) applies. For a detailed
analysis of the case, refer to the article by Gordon Hughes on our website.

Blockchain invention deemed patent eligible

On 21 July 2021, the Australian Patent Office delivered a
decision discussing the patentability of inventions directed to
solving business problems using computer technology: Advanced
New Technologies Co Ltd [2021] APO 29. The patent application,
titled ‘Method and apparatus for processing transaction
request’, relates to a method for processing transactions using
a blockchain network, a form of distributed ledger characterised by
decentralisation, openness, and transparency. The invention
proposed to solve the problems surrounding privacy security issues
due to the decentralised nature of blockchains. Prior to the
hearing, the Examiner characterised the substance of the invention
as an abstract scheme on the basis that the invention was not
technical in character and required only generic computer
implementation, but the Delegate took a more nuanced approach,
reviewing the state of the art at the priority date with respect to
blockchain technology to better understand and distinguish the
invention. Although the Delegate was not satisfied that preserving
the privacy of blockchain nodes was a technical problem, they
considered that the invention nevertheless provided a technical
solution as “the critical steps of converting the transaction
data into an indecipherable data abstract and then generating a
transaction abstract based on digitally signed approvals from the
transaction nodes involves the application of information
technology techniques”, clarifying that the “fact that
[a] technique may be well-known does not make it any less
technical”. In deciding that the invention, although a
computer implemented technology, was more than a mere abstract
scheme, the Delegate acknowledged that preventing breach of privacy
data was a practical and useful result, where there is, on balance,
no reason why “technical improvements to fundamental
mechanisms” within a blockchain should not be patentable. The
case has, however, been remitted back to examination to reconsider
potential issues of inventive step. For a more detailed discussion
of this decision, see the article by Richard Brown, Isaac Tan and
Angie Chen on our website.

Data collection notification requirements under NSW privacy
legislation

On 27 July 2021, the New South Wales Civil and Administrative
Tribunal determined that a local council failed to comply with the
Information Privacy Principles contained in the Privacy and
Personal Information Protection Act 1998 (NSW) when handling a
complaint about a draft local strategic planning statement: EMF
v Cessnock City Council [2021] NSWCATAD 219. The proceedings
arose out of the council’s internal dissemination of a
complaint made by the applicant regarding a confidential code of
conduct issue. One interesting aspect of the decision related to
the means of satisfying Information Privacy Principle 3 in section
10 of the Act (“Requirements when collecting personal
information”), specifically, the requirement to notify an
individual as to the intended recipients of their personal
information. The Tribunal concluded that in accordance with IPP 3,
the council was required to take reasonable steps to notify the
Applicant prior to, or as soon as reasonably possible after, the
information had been collected. The Tribunal was of the view that
this requirement could have been met if the council’s webpage
(where complaints were lodged) had contained a link to a privacy
collection notice. The Tribunal commented that “while not
necessarily an IPP 3 notice, this is the general public privacy
statement of (or promise by) the Respondent to individuals about
the way the Respondent will handle their personal information and
any statements in it will, in the absence of an IPP 3 statement,
prevail over any inconsistent rights or exemptions given to Council
under the LG Privacy Code”. The link would probably have
sufficed because it could have been “referred to by
individuals in deciding whether to provide their personal
information to the Respondent”. The Applicant was awarded
compensation of $30,000.

Complex technology contract interpreted by Queensland Supreme
Court

On 28 July 2021, Justice Ryan in the Supreme Court of Queensland
delivered directions regarding the interpretation of a complex
contractual relationship between a US wireless network supplier, a
wholly-owned subsidiary and a Brisbane-based microwave and
millimetre wave radio technology supplier: BSO Network Inc and
Anor v EMClarity Pty Ltd (No 2) [2021] QSC 192. Her
Honour’s ruling had previously been handed down on 9 April 2021
but a redacted version has only now been published. Her Honour
found that the defendant supplier, EMClarity, had failed to comply
with its delivery obligations under a series of contracts and had
repudiated the principal supply contract by indicating an intention
to vary the timing of delivery. The defendant had advised the
plaintiffs that there would be a “pause” in delivery
whilst a “quality review” of its processes and products
was undertaken, but the court rejected the defendant’s
contention that this delay was permissible because the timing of
supply was conditional upon the completion of development of the
products pursuant to an earlier development agreement. Justice Ryan
relied upon well-established principles of interpretation in
finding that the parties had reached agreement on the terms of the
supply contract, notwithstanding the fact that the agreement was
concluded by laypersons and was not “legally perfect”. It
was an implied term of the principal supply agreement that the
goods would be delivered within a “reasonable time”,
although the court declined to speculate as to what a
“reasonable time” in this context would actually be. With
respect to the alleged disclosure of confidential material by the
defendant to a competitor of the plaintiffs, the court considered
the juxtaposition between contractual and equitable obligations of
confidentiality, concluding that whilst an equitable obligation can
co-exist with a contractual obligation, the equitable obligation
will not convert a contractually authorised disclosure into a
breach of a broader equitable obligation.

A machine can be an “inventor”

On 30 July 2021, the Federal Court of Australia ruled in a
world-first decision that artificial intelligence (AI) can be named
as the inventor on a patent application: Thaler v Commissioner
of Patents [2021] FCA 879. The invention was described as
“DABUS”, being an acronym for a device for the autonomous
bootstrapping of unified sentience. Dr Thaler was the owner of
copyright in the DABUS source code and the owner and operator of
the computer on which DABUS operates, but he was not named as an
inventor because the substantive innovative work was autonomously
generated by DABUS using artificial neural networks. Beach J noted
that there is no definition of “inventor” in the
Patents Act 1990 (Cth), the Act does not mandate that the
named entity be an actual inventor, and the Act does not state that
the inventor must be a human. His Honour considered that to deny
grant of a patent for an otherwise patentable invention because the
inventor is not a natural person would be the antithesis of the
object of the Act to “provide a patent system in Australia
that promotes economic wellbeing through technological innovation
and the transfer and dissemination of technology.”. He further
observed that the recognition of AI as being capable of
inventorship would incentivise the development of creative machines
and lead to new scientific advantages, where they might otherwise
be protected as trade secrets. The Australian patent application at
issue was filed by Davies Collison Cave on behalf of Dr Thaler -
for a detailed analysis of the decision, refer to the article by
David Webber, Claire Gregg and Courtney White on our website.

Google Ads suggesting government affiliation were
misleading.

On 13 August 2021, the Full Court of the Federal Court upheld an
appeal by the Australian Competition and Consumer Commission (ACCC)
against a trial judge’s ruling that Google Ads for a workplace
relations consultancy were not misleading: Australian
Competition and Consumer Commission v Employsure Pty Ltd
[2021] FCAFC 142. The trial judge had rejected the ACCC’s
assertion that the Google Ads falsely represented that the company
had a government affiliation. The Full Court overturned the trial
judge’s decision, finding that the respondent had infringed
sections 18, 29(1)(b) and 29(1)(h) of the Australian Consumer
Law. Section 18 prohibits a company engaging in misleading or
deceptive conduct; section 29(1)(b) prohibits a false or misleading
representation that services are of a particular quality or
standard; and section 29(1)(h) prohibits a false or misleading
representation that a person has a sponsorship, approval or
affiliation. Whilst the finding is in some respects fact-specific,
the reasoning of the Court is instructive. The target audience in
this case comprised “business owners who are employers and who
search for employment-related advice on the internet”, and the
Court considered that the primary judge erred by attributing to
this audience “too high a level of shrewdness or wariness,
digital literacy, and/or commercial sophistication” and also
in the view he reached “as to the level of attention or
scrutiny that the ordinary or reasonable business owner was likely
to give to the advertisements”. Specifically, the Court
considered that it was incorrect for the trial judge to conclude
that “an ordinary or reasonable business owner taking
reasonable care of his or her own interests would have discerned
that each of the Google Ads was an advertisement for privately
provided employment-related advice which was not associated with
any government agency”.

Disclosure of settlement deed to insurer does not infringe the
privacy of litigant.

On 21 August 2021, the New South Wales Civil and Administrative
Tribunal ruled that the disclosure of a settlement deed by the
Police Force to its workers compensation insurer did not contravene
the Privacy and Personal Information Protection Act 1998
(NSW): BVV v Commissioner of Police [2021] NSWCATAD 250.
The settlement involved a holistic resolution of a number of
issues, some of which related to a workers compensation claim and
some of which were unrelated. The Applicant claimed he was unaware
that an insurer was represented at the mediation which led to the
settlement. The case essentially turned on section 18 of the Act
which places limits on the disclosure of personal information by
public sector agencies. Section 18(1)(a) permits disclosure if
“the disclosure is directly related to the purpose for which
the information was collected, and the agency disclosing the
information has no reason to believe that the individual concerned
would object to the disclosure”. The Tribunal concluded that
the Applicant’s personal information contained in the Deed
(including information not relating to the workers compensation
claim) was collected by the Respondent for the purpose of managing
the Applicant’s claims and complaints, and disclosure of the
Deed to the insurer in order to facilitate the payment of
settlement sums was “directly related” to the collection
of that information. The Tribunal also considered that, on the
facts, it was “difficult to understand how the Respondent
could possibly have had reason to believe that the Applicant would
object to the disclosure of the Deed”.

Federal Court grants injunction to US video game
publisher.

On 27 August 2021, the Federal Court issued declaratory and
interlocutory injunctive relief for copyright infringement in
favour of a US video game publisher against a local developer:
Take-Two Interactive Software Inc v Anderson [2021] FCA
1024. The respondent’s program “Infamous” allowed
players of the applicant’s game “Grand Theft Auto” to
gain certain advantages over other players by taking actions
in-game that players who did not have the software installed could
not. A self-executing order, with which the respondent had failed
to comply and which the respondent unsuccessfully sought to set
aside, had been issued on 16 April 2021 requiring the respondent to
file and serve evidence within 7 days or else judgement would be
entered in favour of the applicant. In rejecting the
respondent’s application to set aside the earlier judgement,
Nicholas J took into account four considerations: the
respondent’s explanation for the default; whether the
respondent had an arguable defence; whether the respondent would
suffer prejudice if the order were not made; and whether the
applicant would suffer prejudice if the order were made. The Court
ruled that the applicant was entitled to declaratory and injunctive
relief for copyright infringement and also, subject to proof, any
applicable pecuniary remedy. The Court declined, however, to grant
relief in respect of alleged contraventions of Part V Division 2A
of the Copyright Act, his honour noting that there was no
evidence at this point to indicate whether the applicant’s
anti-cheat tools which the respondent interfered with were
“technological protection measures” within the meaning of
s 116AO of the Act or “access control technological protection
measures” as defined in s 10 of the Act.

NEW LEGISLISATION & GUIDELINES

Intergovernmental data sharing scheme commences

On 9 July 2021, the Intergovernmental Agreement on Data
Sharing between Commonwealth and State and Territory
Governments came into effect when it was signed by the
National Cabinet. The Agreement commits all Australian
jurisdictions to share public sector data as a default positon,
subject to the process being completed “securely, safely,
lawfully and ethically”. The Agreement is premised on the
proposition that “access to data is critical for policy,
service delivery, and government decision making”, and that
“data held by one government can be valuable to another
government in delivering its activities”. The Agreement
encompasses, amongst other things, routine administrative data,
statistics and reference data, and de-identified and identifiable
data required for emergency situations. “Identifiable
data” is defined as “data consisting of personal
information, where an individual is identifiable or reasonably
identifiable”. A schedule to the Agreement establishes a
mechanism for determining “national priority areas” and a
prioritisation process. The operation of the Agreement will be
reviewed after two years.

POLICIES, REPORTS & ENQUIRIES

Government commences consultation on online safety
expectations.

On 8 August 2021, the Australian Government commenced public
consultation on an exposure draft of the Online Safety (Basic
Online Safety Expectations) Determination 2021. We have
previously reported that on 23 June 2021, the Australian Parliament
passed the Online Safety Act 2021. The Act will commence
on 23 January 2022. The draft Determination includes the
Government’s core expectations, which are specified in the Act,
as well as a number of additional expectations. Service providers
are expected to take reasonable steps to meet these expectations in
order to uphold the safety of Australian end-users on their
services. The eSafety Commissioner also has the power to require
service providers to report on their compliance with these
expectations. Until now, the Government’s expectations of
industry have been articulated in the soon-to-be-superseded basic
online safety requirements Enhancing Online Safety Act
2015, the safety Commissioner’s Safety-by-Design
Principles, and the Online Safety Charter, none of which have any
legal or regulatory enforceability. Part 4 of the new Act sets out
the requirements for the determination of the basic online safety
expectations for social media services, relevant electronic
services and designated internet services, and the requirements for
compliance reporting by industry. The ultimate objective is to
establish a benchmark for online service providers to take
proactive (rather than reactive) steps to protect the community
from abusive conduct and harmful content online.

Discussion paper foreshadows cyber security code under the
Privacy Act.

On 26 August 2021, the Australian Government issued a Discussion
Paper seeking public feedback on Australia’s cyber security
laws: Strengthening Australia’s cyber security regulations
and incentives. Two issues of particular interest raised for
discussion involve the prospect of a Security Code being issued
under the Privacy Act 1988, and the prospect yet again of
enacting a statutory privacy right. In relation to the Privacy
Act, the Paper drew particular attention to Australian Privacy
Principle 11 which establishes an obligation to keep personal
information secure, and Part IIIC which establishes the mandatory
data breach notification scheme with respect to “eligible data
breaches”, and expressed concern that current laws may not
provide “sufficient clarity about cyber security
expectations”, whilst the Information Commissioner’s
enforcement powers were compromised because they were based on an
“escalation model”. The Privacy Act nevertheless
had “the greatest potential to set broad cyber security
standards (albeit only in relation to personal information)”,
particularly if a privacy code could be established under Part IIIB
of the Act to provide clear expectations about how Privacy
Act entities should meet their existing cyber security
obligations under APP 11. A cyber security code could
“harmonise international standards and offer opportunities to
Australian businesses to market their security credentials
internationally”. In relation to a statutory privacy right,
the Discussion Paper postulated that “a direct right of action
could give individuals greater control over their personal
information and provide an additional incentive for entities
covered by the Privacy Act to comply with their
obligations under the Act”.

HEALTH PRIVACY ISSUES

Medical information is not always “personal
information”

On 16 August 2021, the New South Wales Civil and Administrative
Tribunal delivered a ruling on whether information regarding a
police officer’s medical fitness for work was “personal
information” within the meaning of section 4(3) of the
Privacy And Personal Information Act 1998 (NSW): DTN v
Commissioner of Police [2021] NSWCATAD 240. The applicant had
been discharged from the Police Force due to a workplace injury,
and he complained that inaccurate information about his condition
had been provided by his employer to its workplace insurer, in
breach of the “accuracy principle” in section 16 of the
Act. The respondent contended that it was exempt from compliance
with the accuracy principle by virtue of section 4(3)(j) which
excludes from the definition of “personal information”
any “information or an opinion about an individual’s
suitability for appointment or employment as a public sector
official”. The application was rejected by the Tribunal which
ruled that the “content of the information collected and
contained in the Document relates to DTN’s fitness to continue
working” and that “the context in which the information
relates has been stored by the Respondent to assess the ability of
DTN to continue in his employment specifically from a medical
perspective”, thus enlivening the section 4(3)(j)
exemption.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.