CJEU rules on geo-blocking and VPN use in Anne Frank copyright case

On 9 July, the Court of Justice of the European Union (CJEU) provided clarity on various questions posed by the Dutch Supreme Court in a copyright infringement dispute between Anne Frank Fonds and our clients, Anne Frank Stichting, KNAW and Belgian association VOOHT (AFS et al.). For more background on the case before the Dutch Supreme Court, see our earlier article here. 

The case

The case centred on the publication of a scholarly edition of Anne Frank's diary on a website owned by VOOHT in Belgium, where the diary had fallen into the public domain. In the Netherlands, however, the diary still enjoys copyright protection until 2037 – the rightholder being Anne Frank Fonds. Access to VOOHT's site was restricted by a state-of-the-art geo-blocking system. This system prevents access to the website if the user tries to connect to it from an EU member state where the manuscripts are still protected by copyright. If such an attempt is made from a member state where the works are in the public domain, the website displays an access check asking the user to confirm: "YES I am accessing the website from one of the public domain countries listed above", or "NO I am accessing the website from another country". 

Although the website discourages access to users in member states where the works are copyright-protected, users could access the website from a non-public domain country by using a virtual private network (VPN) or similar service and giving a false statement about their location. For this reason, Anne Frank Fonds brought an action before the Dutch courts, including an application for interim relief, claiming that AFS et al. were infringing its copyright. Anne Frank Fonds claims were dismissed at first instance and on appeal on the grounds that VOOHT had made reasonable efforts to prevent or discourage access to the website from the Netherlands. Anne Frank Fonds then turned to the Dutch Supreme Court, which in turn requested a preliminary ruling from the CJEU. 

In short, the Supreme Court wanted clarification on how Article 3(1) of the Copyright Directive − the rightsholder's exclusive right of communication to the public of his or her works – should be interpreted:

• What is the scope of the concept of "'communication to the public" within this context? 
• Can there be a communication to the public in a certain country if (state-of-the-art) geo-blocking has been used to ensure that the website on which the work is published can only be reached by the public in that country by bypassing the blocking measure, using a VPN or similar service? 
• If the former is answered affirmatively, to whom is the relevant communication to the public attributable? 
• Is this the party who published the work on the internet, even though knowledge of that communication requires the intervention of the provider of the VPN or similar service in question? 

CJEU ruling - the legal framework 

A communication to the public 

The CJEU started by highlighting that the concept of a "communication to the public" within the meaning of Article 3(1) of the Copyright Directive is defined broadly. The rationale for this broad definition is in line with the EU legislature's objective to establish a high level of protection for authors, allowing them to obtain an appropriate reward for the use of their work. Nevertheless, copyright protection of authors is not absolute. The CJEU stressed the necessity of a fair balance between two conflicting interests protected by the Charter of Fundamental Rights of the European Union: on the one hand, the interests of copyright holders and on the other hand the protection of the freedom of expression and information. Online communication is of particular importance when the freedom of information is at stake. 

The communication of a work to the "public" refers to a public consisting of an indeterminate number of potential recipients and implies a fairly large number of persons. Furthermore, to constitute a "communication to the public", a protected work must either be communicated by specific technical means different from those previously used or be directed at a "new public" — one that was not considered by the copyright holder when authorising the initial communication. 

In the present case, the publication on VOOHT's website constituted communication via new technical means to an indeterminate number of internet users. The critical question, then, is whether Dutch internet users, who circumvent the state-of-the-art geo-block using a VPN, could be considered part of the public reached by VOOHT's publication.

Pivotal role of "effective" technological measures

The CJEU held that the existence of effective technological measures adopted in connection with an act of communication on the internet, reflects the intention of the person making that communication to give access to the protected work only to a particular circle of internet users, not to all internet users. Where a work is protected in one member state, but is in the public domain in others, any person who publishes the work on a website must ensure that the work is made accessible only to users accessing from public domain countries − so as not to infringe the exclusive rights of the copyright holder in the member state where the work is still protected.

According to the CJEU, the effectiveness of a technological measure does not have to be absolute but must be assessed in accordance with the principle of proportionality, taking into account (a) whether the measure is suitable for achieving its objective, (b) whether less restrictive alternatives would achieve comparable protection, and (c) the costs and practical feasibility of different types of measures.

Critically, effectiveness must also be assessed in light of technological developments and the possibilities of circumventing the measure, as well as the territorial nature of copyright. A geo-blocking measure will be considered effective if it is "state-of-the-art" and suitable for preventing unauthorised access in the blocked member state. The mere possibility of circumvention by VPN or a similar service cannot, in itself and in all circumstances, be a decisive factor in finding a state-of-the-art geo-blocking measure to be inadequate and thus ineffective. 

By contrast, the additional access check (requiring users to declare their location) was found not to constitute an effective technological measure, since it depended entirely on the user's willingness to complete the declaration honestly.

CJEU's answers

First and second question

Applying the above framework to the present case, the CJEU answered the first and second questions as follows: "a work which is in the public domain in certain Member States, but still protected in another, and which is published free of charge on a website with a geo-blocking measure designed to block access from that other Member State, is not the subject of a 'communication to the public' in that Member State where the geo-blocking measure is 'effective' within the meaning of Article 6(3) of the Copyright Directive — that is, where it is 'state of the art' — even if internet users can circumvent it using a VPN or similar service." 

Attributability of the communication to the public

The CJEU had already established that the classification of a publication of a work − done in the manner at issue in this case − as a 'communication to the public' largely depended on whether the technological measure put in place on the website concerned, was effective. Furthermore, this classification is for the national judge to determine. How, then, will the party responsible for the communication to the public be established?  

Regarding this, the CJEU explains, "where the person who published the work did not put in place effective technological measures, within the meaning of Article 6(3) of [the Copyright Directive], the relevant communication to the public, and the resulting lack of protection, is attributable to that person."

Furthermore, the CJEU explains that a VPN or proxy service provider cannot be held responsible for the communication to the public, if its services are used to circumvent an ineffective geo-blocking. After all, such a provider does not give end users access to a protected work. Moreover, in the words of the CJEU, "even if the provider is aware of the consequence that its service may be used to access protected works without the consent of their authors, the provider is not itself intervening for the purposes of such access, so that it does not play an ‘indispensable role’", which is a necessary factor for speaking of an intervention constituting an act of communication. 

What the ruling means in practice

The CJEU's decision confirms that a state-of-the-art geo-blocking system is a legally sufficient tool for online copyright management: it does not need to be absolute, and a publisher who implements one in good faith is not liable for users who circumvent it via a VPN or a similar service. The CJEU also confirmed that VPN providers themselves cannot be held responsible for copyright infringement on that basis alone. 

Underlying the ruling is a carefully struck balance between copyright protection and the freedom of expression and information. In this case, the freedom to gather information online outweighed the interests of the copyright holder. Publishers should note, however, that the standard of "state of the art" keeps pace with technological development − and that a user self-declaration, by itself, will never be enough.