Data and data analytics? Big business.

We generate a massive amount of information every day, sourced via the Internet of (Every)Thing(s), GPS trackers, fitness wearables, software-as-a-service, web content and social media.

This information can be analysed computationally to yield outputs with a multitude of uses. For example, we can use large amounts of information to predict trends and patterns, find the most lucrative opportunities, and manage our time and resources more effectively.

RELATED: South Africa’s Escalating Counterfeit Crisis 

However, as we explore the potential of data analytics, it’s crucial to acknowledge that this data may be protected by intellectual property (IP) law and by legislation pertaining to the protection of personal information. Understanding and respecting IP and privacy laws are essential when leveraging data for business advantage.

Intellectual Property Law and Data

In South Africa, data is protected under copyright and the common law preventing unlawful competition.

When it comes to copyright, there is a distinction between an individual data item and a compilation of data (the latter, resulting from sourcing data items and organising them so as to make them useful). An individual data item is eligible for copyright protection only if it meets the requirements for “originality”; that is, where it is not copied from an existing source and its production requires a not-trivial degree of skilled judgement or labour. So, for example, copyright may subsist in individual data items emerging from a complex analysis, but not in raw data.

In contrast, where information has been (lawfully) gathered from publicly available sources and arranged into a compilation that can be searched and analysed, the compilation (but not the individual data items) is eligible for copyright protection.

How much reproduction constitutes an infringement of copyright?

In South Africa, the threshold for infringement is reached when a ‘substantial part’ of the original work is copied – a standard that takes into account:

  • the extent to which the value of the original work is sensibly diminished
  • the degree to which the use may prejudice the sale, or diminish the profits or supersede the objects of the original work;
  • the importance of the copied content (i.e. the quality of the copied content rather than the quantity that is copied)
  • the defendant’s intent to steal, for the purpose of saving himself labour.

This issue is especially pertinent in practices like ‘data scraping’, where data is commonly and often automatically harvested from public domains such as websites. While this practice is widespread, its legitimacy hinges on the nuanced concept of ‘fair dealings’, a clause in copyright law that varies across jurisdictions. Fair dealing generally constitutes an exception from copyright infringement, in certain circumstances, such as where a work is copied for personal or private use or for non-profit educational purposes; for reporting of current events; or for review or criticism – provided in each case, that the extent of the copying does not exceed the extent justified by the purpose.

South African Courts have held that information or knowledge of whatever value and however confidential is not property and there is no real right of ownership comparable to ownership of corporeal property. But a person having a quasi-proprietary or legal interest in data or in a compilation of data may seek relief for misappropriation of data, on the grounds of unlawful competition.  This interest could stem from, having created the data/compilation; mandating another person to do this; or being granted an exclusive right to the data by the person who created, or mandated the creation of, the data/compilation.

Unlawful competition is based on the principle that no business should benefit at the expense of its rivals through the use of improper methods. But there is a fine (and sometimes blurred) line between competition that is deemed to be lawful and that which is not.

Unlawful competition is sometimes characterized by ‘springboarding’: starting not at the beginning with one’s own development but “using, as the starting point, the fruits of someone else’s labour”.

Ultimately though, the unlawfulness of a business practice will be determined by our Courts in each case, with regard to several subjective factors like the honesty and fairness of the conduct involved, the morals of the trade sector, and the importance of competition in a particular market.

Database Rights in Europe

Unlike in South Africa, European countries afford specific protection to persons who invest resources in the compilation of a database. These resources refer to those used to seek out existing independent materials and collect them together to construct a database and not the investment involved in actually creating the information which make up the contents of the database.

The European Directive 96/9/EC on Copyright and Rights in Databases grants rights holders recourse if all or a substantial part of the contents are extracted or re-utilised, without the consent of the owner.   In this context, “extacted” means to transfer the contents of the database to another medium by any means or form; and “re-utilse” means to make the contents of the database available to the public (not necessarily for the first time) by any means.

POPIA and Data Privacy

The Constitution of South Africa provides that everyone has the right to privacy, including the right to protection against unlawful collection, retention, dissemination and use of personal information.

The Protection of Personal Information Act 4 of 2013 (POPIA) regulates the processing of personal information, in harmony with international standards, balancing the right to privacy of a data subject with other interests. POPIA influences the collection, receipt, recording, organisation, collation, storage, retrieval, alteration, dissemination, transmission, use and destruction (collectively, “processing”) of personal data in the digital era, where data analytics has become a significant business capability.

POPIA intersects with IP law by defining different legal boundaries for processing of this information. For example, the consent of data subjects themselves is required for a database of personal information to be compiled for a particular purpose and even where one owns the copyright in such a compilation of personal information, one may not be entitled to process the personal information, if such processing is noncompliant with POPIA.  Businesses may therefore face challenges in using personal information that they have invested in collecting, while remaining respectful of the rights of data subjects.

Conclusion

As a trend, all businesses are likely to become increasingly dependent on data. It is imperative to navigate the legal minefield of data rights and interests, to use data lawfully and to optimise the value to be gained by exploiting it.