Data and data analytics? Big business.

We generate a massive amount of information every day, sourced via the Internet of (Every)Thing(s), GPS trackers, fitness wearables, software-as-a-service, web content and social media.

This information can be analysed computationally to yield outputs with a multitude of uses. For example, we can use large amounts of information to predict trends and patterns, find the most lucrative opportunities, and manage our time and resources more effectively.

RELATED: South Africa’s Escalating Counterfeit Crisis 

However, as we explore the potential of data analytics, it’s crucial to acknowledge that this data may be protected by intellectual property (IP) law and by legislation pertaining to the protection of personal information. Understanding and respecting IP and privacy laws are essential when leveraging data for business advantage.

Intellectual Property Law and Data

In South Africa, data is protected under copyright and the common law preventing unlawful competition.

When it comes to copyright, there is a distinction between an individual data item and a compilation of data (the latter, resulting from sourcing data items and organising them so as to make them useful). An individual data item is eligible for copyright protection only if it meets the requirements for “originality”; that is, where it is not copied from an existing source and its production requires a not-trivial degree of skilled judgement or labour. So, for example, copyright may subsist in individual data items emerging from a complex analysis, but not in raw data.

相比之下，如果信息是（合法）从公开来源收集并整理成可供搜索和分析的汇编，则该汇编（但不是单个数据项）有资格获得版权保护。

How much reproduction constitutes an infringement of copyright?

In South Africa, the threshold for infringement is reached when a ‘substantial part’ of the original work is copied – a standard that takes into account:

  • the extent to which the value of the original work is sensibly diminished
  • the degree to which the use may prejudice the sale, or diminish the profits or supersede the objects of the original work;
  • the importance of the copied content (i.e. the quality of the copied content rather than the quantity that is copied)
  • the defendant’s intent to steal, for the purpose of saving himself labour.

This issue is especially pertinent in practices like ‘data scraping’, where data is commonly and often automatically harvested from public domains such as websites. While this practice is widespread, its legitimacy hinges on the nuanced concept of ‘fair dealings’, a clause in copyright law that varies across jurisdictions. Fair dealing generally constitutes an exception from copyright infringement, in certain circumstances, such as where a work is copied for personal or private use or for non-profit educational purposes; for reporting of current events; or for review or criticism – provided in each case, that the extent of the copying does not exceed the extent justified by the purpose.

South African Courts have held that information or knowledge of whatever value and however confidential is not property and there is no real right of ownership comparable to ownership of corporeal property. But a person having a quasi-proprietary or legal interest in data or in a compilation of data may seek relief for misappropriation of data, on the grounds of unlawful competition.  This interest could stem from, having created the data/compilation; mandating another person to do this; or being granted an exclusive right to the data by the person who created, or mandated the creation of, the data/compilation.

非法竞争的原则是，任何企业都不应通过使用不当方法而损害竞争对手的利益。但是在被认为是合法的竞争和不合法的竞争之间有一条很好的（有时是模糊的）界限。

Unlawful competition is sometimes characterized by ‘springboarding’: starting not at the beginning with one’s own development but “using, as the starting point, the fruits of someone else’s labour”.

Ultimately though, the unlawfulness of a business practice will be determined by our Courts in each case, with regard to several subjective factors like the honesty and fairness of the conduct involved, the morals of the trade sector, and the importance of competition in a particular market.

Database Rights in Europe

Unlike in South Africa, European countries afford specific protection to persons who invest resources in the compilation of a database. These resources refer to those used to seek out existing independent materials and collect them together to construct a database and not the investment involved in actually creating the information which make up the contents of the database.

The European Directive 96/9/EC on Copyright and Rights in Databases grants rights holders recourse if all or a substantial part of the contents are extracted or re-utilised, without the consent of the owner.   In this context, “extacted” means to transfer the contents of the database to another medium by any means or form; and “re-utilse” means to make the contents of the database available to the public (not necessarily for the first time) by any means.

POPIA and Data Privacy

The Constitution of South Africa provides that everyone has the right to privacy, including the right to protection against unlawful collection, retention, dissemination and use of personal information.

The Protection of Personal Information Act 4 of 2013 (POPIA) regulates the processing of personal information, in harmony with international standards, balancing the right to privacy of a data subject with other interests. POPIA influences the collection, receipt, recording, organisation, collation, storage, retrieval, alteration, dissemination, transmission, use and destruction (collectively, “processing”) of personal data in the digital era, where data analytics has become a significant business capability.

POPIA intersects with IP law by defining different legal boundaries for processing of this information. For example, the consent of data subjects themselves is required for a database of personal information to be compiled for a particular purpose and even where one owns the copyright in such a compilation of personal information, one may not be entitled to process the personal information, if such processing is noncompliant with POPIA.  Businesses may therefore face challenges in using personal information that they have invested in collecting, while remaining respectful of the rights of data subjects.

结论

As a trend, all businesses are likely to become increasingly dependent on data. It is imperative to navigate the legal minefield of data rights and interests, to use data lawfully and to optimise the value to be gained by exploiting it.