This is part 2 of a series of posts about the new Companies Act. You can read the first two parts and other posts about South African corporate law right here.

It is fairly common knowledge that the manner in which we do business is largely a question of personal choice and practicality. There is no absolute requirement that an entrepreneur select an incorporated entity as the vehicle through which to run his business: a sole proprietorship may well meet a person’s particular needs or in the case of a family business, a partnership may be well suited. What is important however, is that careful consideration is given to the structure of the business entity chosen, and in particular the potential consequences (including the tax implications) of having selected any particular entity, whether it is incorporated or otherwise.

Companies (and close corporations) are in law considered to be juristic persons. This means that from the date on which it receives its Registration Certificate (under the 1973 Act the Certificate of Incorporation and the Certificate to Commence Business) the company is considered to be a separate legal entity, with rights and obligations which is capable of pursuing those rights and enforcing those obligations by means of its officers. Simply put, the Registration Certificate is the company’s birth certificate, from the moment the Registration Certificate is issued the company stands in law as though it were a person in its own right. Section 19(1)(b) of the New Companies Act sets out that a company has legal capacity and the powers of an individual except to the extent that a juristic person is incapable of exercising such power. In essence this means that:

• subject to what is set out below, the members of the company and the company itself are separated, with the members in general not being personally liable for the company’s debts;
• the assets and liabilities belong to the company and not the members;
• the company itself must enforce any right it may have against a third party for any wrong it may have sustained;
• management (subject to what is set out in the Memorandum of Incorporation) vests in the directors and not in the shareholders;
• a share is a personal right, entitling the holder to an interest in dividends, attend and vote at meetings of the shareholders and a return of capital on the winding up of the company.

This is where the common law concept of the corporate veil comes in. The corporate veil refers to the notional line that is drawn between the company and those persons behind it. In most circumstances, one cannot “pierce” the corporate veil in order to attack the persons behind it. This is not however absolute. Where the corporate veil principal is being abused, the courts are entitled to look at the “substance” of the actions taken rather than the legal form utilised, and in so doing personal liability can once again be attracted.

Sections 75 and 76 of the New Companies Act specifically states that a director or officer of a company may be held personally liable for a breach of certain statutorily created duties. These duties include many of those duties which were commonly considered as fiduciary duties of directors, and include the failure to disclose a financial interest, using his position as a director to obtain some form of personal gain or cause harm to the company, or fails to act in the best interests of the company. In such instances, the corporate veil of the company will not protect the directors and officers from personal liability even though the common law position as regards the corporate veil has not been specifically altered or incorporated into the New Companies Act.

Whereas the 1973 Act catered for a public company, a private company and an external company, (with non-profit organisations being dealt with essentially separately) the New Companies Act has two broad categories of company: a profit company and a non- profit company.

Profit companies may be incorporated by one or more persons and fall into four classes:

• a state-owned enterprise;
• a public company;
• a personal liability company; and
• a private company

For purposes of this discussion only private companies and public companies will be considered in detail as personal liability companies are those private companies utilised by professional associations such as attorneys and accountants who were previously limited to a partnership structure and in terms of section 53 of the 1973 Act were able to incorporate such entities predominantly for the purposes of succession planning. The state-owned enterprise likewise falls outside of the scope of this discussion, we are however happy to answer any direct enquiry on the subject.

As with the 1973 Act, a private company is one in terms of which the Memorandum of Incorporation contains an express prohibition against the offering of shares to the public and restricts the transferability of its shares. The restriction on the transferability of the shares in a private company is one of the defining elements of a private company. The shareholders themselves wish to retain a degree of control over who the other shareholders will be, and if such shareholders want to dispose of their shares, then the remaining shareholders want to have a say in who ultimately holds them.

In the matter of Smuts v Booyens; Markplaas (Edms) Bpk and Another v Booysens [2001] ZASCA 57 (also 2001 (4) SA 15 (A)) the court held that the word “transfer” consisted of a number of steps within a private company setting: (a) an agreement to transfer, (b) the execution of the transfer document, and (c) registration of transfer. In terms of the 1973 Act the restriction on the transferability of the shares in a private company as contained in the articles of association had to be complied with, failing which no valid transfer could take place, even if the purchaser was unaware of the restriction. Private companies under the New Companies Act have retained these features while additional flexibility and simplicity of management has been built into the New Companies Act to cater for smaller businesses.

The primary differences between a private company and a public company are that the transmissibility of the shares are no longer limited, shares may be offered to the public (subject to certain conditions which will be discussed later in this series) and membership in the company is unlimited.

As set out in Part 1 of this series, one of the main objectives of the New Companies Act is to foster a spirit of entrepreneurialism in South Africa by rendering it simple and inexpensive to incorporate a company. In fact the incorporation of a company is now worded in terms of being a right rather than a privilege bestowed by the State.

The incorporation process begins with a “Notice of Incorporation” (in accordance with the provisions of section 13(1) and signed by all members) being filed with the Commission. The Notice of Incorporation must be accompanies by the Memorandum of Incorporation and the prescribed fee. The contents of the Memorandum of Incorporation are those matters set out in section 15 and include the rights, duties and responsibilities of the shareholders and directors within and in relation to the company. It should be noted that the Memorandum of Incorporation may be unique to the company in question (but must still comply with section 15) or the company may elect to utilise the pre-prepared form in the New Companies Act and amend it at will.

At the very least the following matters should be comprehensively dealt with in the Memorandum of Incorporation:

• the objects and powers of the company (together with any restrictions on that power);
• composition and functioning of the board of directors (including alternate directors and frequency of meetings);
• board committees;
• powers of the board and powers of the shareholders;
• shareholder meetings and shareholder rights;
• personal liability and indemnification of directors;
• amendment of the Memorandum of Incorporation;
• company secretaries and other officers;
• disposals of shares by shareholders;
• conversions of shares into different classes;
• the ability of the board of directors to create rules.

The ability of the board of directors to create rules is a specific right of the New Companies Act. In terms of section 15(3) of the New Companies Act, unless the company’s Memorandum of Incorporation dictates otherwise, the directors are entitled to make, amend, or repeal any rules relating to the company in respect of any matter not dealt with the in the New Companies Act or in the Memorandum of Incorporation, provided that a copy of such rules are published in accordance with the provisions of the Memorandum of Incorporation and filed with the Commission. Any rules so published will take effect within 20 days after publication or on the date specified in the rule, whichever is the later.

The company’s Memorandum of Incorporation and rules are binding among the shareholders, between the company and the shareholders, between the company and each director, and the company and all prescribed officers and audit committee member.

Companies may still enter into shareholder agreements. However whereas in the past the parties were able to agree that in the event of any inconsistency between the articles of association and the shareholders’ agreement, the shareholders’ agreement would take precedence, under the New Companies Act, all shareholders’ agreements must comply with the New Companies Act and the Memorandum of Incorporation and to the extent that the shareholders’ agreement is inconsistent with either document, the shareholders’ agreement will be void to the extent of the inconsistency.

In terms of item 4(2)(a) of the Fifth Schedule to the New Companies Act, all pre-existing companies may at any time within 2 years following the general effective date, file without charge any amendment to its Memorandum of Incorporation to bring it in harmony with the new Companies Act.

I was recently asked to advise a client in relation to unsolicited, bulk email marketing campaigns and the brief got me thinking about these sort of marketing campaigns and how the law could well put an end to them as we currently know them.

Virtually anyone with an email account is familiar with unsolicited email, usually by the term spam. So what is spam? ISPA defines spam as follows:

Spam, or unsolicited bulk email, is the posting of emails to large volumes of addresses advertising a service or product which the recipient seldom wants. Unlike conventional junk mail where the sender pays the cost of postage, recipients of spam pay the transmission costs, either in the form of Internet access fees and/or telephone call charges.

An example of spam is an unsolicited email message from someone you dont know (or a forged address) inviting you to view pornography, purchase Viagra or enlarge your penis amongst other things.

So why is spam a problem (aside for the annoyance factor)? Well, as ISPA points out:

Spam is one of the most significant threats to the Internet, accounting for around 60% of all email traffic. Spam costs consumers and ISPs lots of money in bandwidth charges. Despite the growing number of technological means for combating spam, the spammers somehow manage to stay one step ahead and the deluge shows little sign of abating.

There isn't a lot of law dealing with spam at the moment. The Electronic Communications and Transactions Act deals with spam in section 45:

Unsolicited goods, services or communications

45.(1) Any person who sends unsolicited commercial communications to consumers, must provide the consumer

(a) with the option to cancel his or her subscription to the mailing list of that person; and

(b) with the identifying particulars of the source from which that person obtained the consumer’spersonal information, on request of the consumer.

(2) No agreement is concluded where a consumer has failed to respond to an unsolicited communication.

(3) Any person who fails to comply with or contravenes subsection (1) is guilty of an offence and liable, on conviction, to the penalties prescribed in section 89(1).

(4) Any person who sends unsolicited commercial communications to a person who has advised the sender that such communications are unwelcome, is guilty of an offence and liable, on conviction, to the penalties prescribed in section 89(1).

(If you are interested in exploring section 45 in more detail, Lance Michalson published an article in 2003 on the topic which makes for very interesting reading)

It sets a set of minimum requirements for unsolicited email to be regarded as lawful but not all service providers are satisfied with this. Internet Solutions specifically prohibits unsolicited email in its Acceptable Use Policy:

E-MAIL USE

1. It is explicitly prohibited to send unsolicited bulk mail messages ("junk mail" or "spam") of any kind (commercial advertising, political tracts, announcements, etc). This is strongly objected to by most Internet users and the repercussions against the offending party and IS can often result in disruption of service to other users connected to IS. In addition, spam is unlawful in terms of the Electronic Communications and Transaction Act 2002, and IS is entitled to take appropriate steps against the User in contravention of these provisions of the Act.

At this point sending spam becomes more a case of infringements of the service providers' terms or acceptable use policies and a matter of contract. It is one of the legal frameworks service providers are creating in the absence of more comprehensive (and, arguably, effective) legislation.

The central issue here is sending unsolicited email to people who may not even be aware of the sender's existence. Sometimes email databases are compiled in the course of legitimate business activities (training companies often collect attendees' personal information and add them to their databases, although not always with the attendees' consent). Marketers frequently buy databases of email addresses from 3rd parties who compile these databases independently. This is where a fair amount of attention is focused because many of these database compilers use underhand methods to create these databases. As far as the ECT Act is concerned, a properly functioning opt-out mechanism keeps the marketing campaign pretty much above board but the much anticipated Protection of Personal Information Bill could change that dramatically.

The PPI Bill has, as one of its central principles, the requirement that informed consent be given for the collection and processing of personal information. This means that a provider must ensure that the people it collects personal information from are informed as to what personal information is being collected and what that personal information is going to be used for. Furthermore they must consent to this. Section 66 of the PPI Bill applies this principle of informed consent to unsolicited electronic communications:

Unsolicited electronic communications

66. (1) The processing of personal information of a data subject for the purpose of direct marketing by means of automatic calling machines, facsimile machines, SMSs or electronic mail is prohibited unless the data subject—

(a) has given his, her or its consent to the processing; or

(b) is, subject to subsection (2), a customer of the responsible party.

(2) A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)—

(a) if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service;

(b) for the purpose of direct marketing of the responsible party’s own similar products or services; and

(c) if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details—

(i) at the time when the information was collected; and

(ii) on the occasion of each communication with the data subject for the
purpose of marketing if the data subject has not initially refused such use.

(3) Any communication for the purpose of direct marketing must contain—

(a) details of the identity of the sender or the person on whose behalf the
communication has been sent; and

(b) an address or other contact details to which the recipient may send a request that such communications cease.

The effect of the PPI Bill will be to introduce a requirement of informed consent to email marketing campaigns and effectively outlaw independently created email databases which are then sold to marketers for their email campaigns. Section 66(2) imposes a set of onerous requirements on anyone compiling an email database for marketing purposes which preclude many of the methods used to compile and trade in these databases in use today.

The only legal email marketing campaigns that will likely be left standing will these those typically facilitated by opt-in consents given by customers when they complete application, bookings and similar forms for specifically chosen products and/or services. This represents a radical departure from the requirements established by the ECT Act and we should see the ECT Act amended quite substantially when the PPI Bill is passed and comes into effect.

While these developments may well mark the end of unsolicited bulk email marketing campaigns as we know them today, they could well mark the beginning of a new surge of social media-based marketing initiatives.

Social media campaigns usually involve fewer numbers of people directly contacted when compared to spam mailing lists comprising hundreds of thousands or even millions of direct recipients but I suspect marketers will see better returns as people responding to those new campaigns may well be more engaged and passionate about the products and services they choose. Many businesses won't make the transition from bulk email campaigns to social media-based campaigns but those that do may find the results surprising. Of course this also represents a tremendous opportunity for social media agencies that can deliver smart, relevant and effective results.

This transition will also mean that marketers must carefully consider the legal challenges that apply to the social Web and social media, generally speaking. Just as companies may encounter charlatans posing as social media consultants (this hilarious video illustrates what I mean by this), they will also encounter lawyers who claim to have a handle on this space but lack the insight into the social Web to be truly effective.

Of course none of these legal developments will have much of an impact on illegal spammers who will continue to inundate you with Viagra, cheap watches and penis enlargement emails. This is probably a good time to get your spam filters set up and running effectively.

Google announced its Dashboard yesterday as part of its effort to address users' privacy concerns. The Dashboard gives you an overview of what personal information Google has collected about you through your use of its various services. The Dashboard is not public and you can only access it by signing in to view it. Viewing your Dashboard for the first time can be both disturbing and revealing. The Dashboard shows you details about your email accounts, your YouTube viewing habits and a lot more. Mine even told me what my last recorded location on Latitude was.

Dashboard isn't about privacy as secrecy but rather about privacy in the sense of being able to discover how much personal information has been collected and how much of that is publicly visible. The Dashboard also contains a variety of links to settings pages where you can modify your privacy settings for the various services you use as well as some guidance how to improve your privacy (as in secrecy).

Google's privacy policy is the enabling mechanism in terms of which you agree to all of this information being collected. That's not new and Google isn't the only company collecting your personal information. Facebook does it and so does virtually every website you visit or have an account with. Not all of them have privacy policies either.

What I find interesting about Dashboard is that it represents a serious effort to be transparent about what Google knows about you. Coupled with Google's Data Liberation initiative to show you how to get your data out of Google's services, Google is demonstrating an apparently sincere desire to keep you informed about the privacy implications of using its services.

There is an analogy in South African law. The Promotion of Access to Information Act creates a mechanism whereby you can require a company to disclose the personal information it has about you. Companies above a threshhold are required to publish a manual describing how you go about requesting this information. Google has gone a few steps further and is making this information available to you in alarming detail.

The Register makes a couple good points about Dashboard that adds an important perspective:

Although the Dashboard service goes some way towards answering the question of what Google knows about our lives online, it doesn't really provide many clues about how Google uses this information. In addition, one thing not included in the run-down is cookie-based data Google collects via its huge online ad-serving business.

Even so, Google Dashboard holds a lot of potentially sensitive data, providing yet another good reason for users to use hard to guess (strong) passwords on their Gmail or other Google accounts.

It isn't entirely accurate that Google doesn't tell you what it does with your personal information. Its privacy policy gives a number of insights into what it does with your personal information, although not in much detail:

We offer a number of services that do not require you to register for an account or provide any personal information to us, such as Google Search. In order to provide our full range of services, we may collect the following types of information:

• Information you provide – When you sign up for a Google Account or other Google service or promotion that requires registration, we ask you for personal information (such as your name, email address and an account password). For certain services, such as our advertising programs, we also request credit card or other payment account information which we maintain in encrypted form on secure servers. We may combine the information you submit under your account with information from other Google services or third parties in order to provide you with a better experience and to improve the quality of our services. For certain services, we may give you the opportunity to opt out of combining such information.
• Cookies – When you visit Google, we send one or more cookies – a small file containing a string of characters – to your computer or other device that uniquely identifies your browser. We use cookies to improve the quality of our service, including for storing user preferences, improving search results and ad selection, and tracking user trends, such as how people search. Google also uses cookies in its advertising services to help advertisers and publishers serve and manage ads across the web. We may set one or more cookies in your browser when you visit a website, including Google sites that use our advertising cookies, and view or click on an ad supported by Google’s advertising services.
• Log information – When you access Google services, our servers automatically record information that your browser sends whenever you visit a website. These server logs may include information such as your web request, Internet Protocol address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser.
• User communications – When you send email or other communications to Google, we may retain those communications in order to process your inquiries, respond to your requests and improve our services.
• Affiliated Google Services on other sites – We offer some of our services on or through other web sites. Personal information that you provide to those sites may be sent to Google in order to deliver the service. We process such information under this Privacy Policy. The affiliated sites through which our services are offered may have different privacy practices and we encourage you to read their privacy policies.
• Gadgets – Google may make available third party applications through its services. The information collected by Google when you enable a gadget or other application is processed under this Privacy Policy. Information collected by the application or gadget provider is governed by their privacy policies.
• Location data – Google offers location-enabled services, such as Google Maps for mobile. If you use those services, Google may receive information about your actual location (such as GPS signals sent by a mobile device) or information that can be used to approximate a location (such as a cell ID).
• Links – Google may present links in a format that enables us to keep track of whether these links have been followed. We use this information to improve the quality of our search technology, customized content and advertising. Read more information about links and redirected URLs.
• Other sites – This Privacy Policy applies to Google services only. We do not exercise control over the sites displayed as search results, sites that include Google applications, products or services, or links from within our various services. These other sites may place their own cookies or other files on your computer, collect data or solicit personal information from you.

Google only processes personal information for the purposes described in this Privacy Policy and/or the supplementary privacy notices for specific services. In addition to the above, such purposes include:

• Providing our services, including the display of customized content and advertising;
• Auditing, research and analysis in order to maintain, protect and improve our services;
• Ensuring the technical functioning of our network;
• Protecting the rights or property of Google or our users; and
• Developing new services.

You can find more information about how we process personal information by referring to the supplementary privacy notices for particular services.

Google processes personal information on our servers in the United States of America and in other countries. In some cases, we process personal information on a server outside your own country. We may process personal information to provide our own services. In some cases, we may process personal information on behalf of and according to the instructions of a third party, such as our advertising partners.

In related news ... Facebook

Facebook published an updated privacy policy that is even clearer about what personal information Facebook collects and what it does with that personal information. The draft policy was published for comment just over a week ago in accordance with Facebook's new comment and voting process it implemented with its revamped legal framework a while ago. The new process requires that a certain number of votes be received before users can influence the adoption of a new policy framework in a meaningful way. Short of that it is up to Facebook to collate comments and incorporate them at will.

The draft policy is very clear. It was drafted in plain language and it explains to users what happens to the personal information Facebook collects. One of the concerns is more about 3rd parties and what they do with users' personal information. As the draft policy points out:

We take steps to ensure that others use information that you share on Facebook in a manner consistent with your privacy settings, but we cannot guarantee that they will follow our rules. Read the following section to learn more about how you can protect yourself when you share information with third parties.

The American Civil Liberties Union published a quiz on Facebook that reveals what 3rd parties learn about you when you use 3rd parties applications. It is alarming how the massive amount of personal information users make available on Facebook can be collated and what it can be used for. This doesn't just affect users who use these applications but extends to their contacts, often without their contacts' express consent.

It is essential that users pay careful attention to their privacy settings on Facebook because these settings apparently dictate what personal information can be disclosed. Simply creating a complete profile involves disclosing a lot of detailed personal information and the privacy settings are often the only thing standing in the way of total and unwanted disclosure. There has also been talk that even these privacy settings can be disregarded in certain circumstances so even that protection is somewhat limited.

Of course there is also the persistent risk that the safeguards that are in place could be overcome:

Risks inherent in sharing information. Although we allow you to set privacy options that limit access to your information, please be aware that no security measures are perfect or impenetrable. We cannot control the actions of other users with whom you share your information. We cannot guarantee that only authorized persons will view your information. We cannot ensure that information you share on Facebook will not become publicly available. We are not responsible for third party circumvention of any privacy settings or security measures on Facebook. You can reduce these risks by using common sense security practices such as choosing a strong password, using different passwords for different services, and using up to date antivirus software.

The only safe assumption that anyone can make when active on the social Web is to assume that anything you publish online can be made public and then decide from there whether to publish the information in the first place.

The point

There are clear advances in how privacy policies are prepared and communicated to users. Facebook is a pioneer in developing plain language and interactive legal frameworks even though there are real concerns about the sanctity of personal information disclosed to Facebook and its partners.

On the other hand, Google has taken some significant steps in improving not just how transparent it is about what personal information it collects from its users but also how users can take their data out of the Google ecosystem and migrate to other services. This latter area is one in which Facebook is lagging behind considerably, despite its efforts to date to enable data portability.

Of course Google's transparency doesn't change the fact that Google does collect a considerable amount of personal information about you and that body of personal information grows as your use of Google's services increases over time. The same can be said for Facebook and what this means is that privacy on the Web is really less about secrecy and more about the degree of control you have over the personal information that is collected and what is done with it.

This post in the first in a series of posts about the various ways you can protect your content. I am going to focus on content that is made available online (shared photos, videos, music as well as content on web sites like blogs) although I will probably deal with offline content to a degree. This topic is quite a broad topic and a proper treatment would require a far more detailed publication than this series so my intention behind this series is to introduce you to a couple concepts and content protection mechanisms and to highlight some of the issues that we, as online publishers, may face in the coming weeks, months and years.

The content protection mechanisms I'll take a look at will include copyright, creative commons, digital rights management and some alternatives.

The starting point for this post is the Copyright Act of 1978 (as amended). The Copyright Act protects copyright owners from unauthorised use of their content under copyright. It sets out categories of content or media that qualify for copyright and determines what can and can't be done without permission from the copyright owner. Copyright may exist in the following types of works:

• Literary works (for example, novels, stories and poetical works; dramatic works, stage directions, cinematographic film, scenarios and broadcasting scripts; text books, treatises, histories, biographies, essays and articles; letters, reports and memoranda; instruction manuals and advertising literature; lectures, addresses and sermons; and written tables and compilations);
• Computer programs and software (broadly defined as "a set of instructions fixed or stored in any manner and which, when used directly or indirectly in a computer, directs its operation to bring about a result");
• Artistic works (including paintings, sculptures, drawings, engravings and photographs; works of architecture, being either buildings or models of buildings; technical and engineering drawings; or works of artistic craftsmanship);
• Musical works (consisting of of music, exclusive of any words or action intended to be sung, spoken or performed with the music);
• Cinematographic films (this means "any fixation or storage by any means whatsoever on film or any other material of data, signals or a sequence of images capable, when used in conjunction with any other mechanical, electronic or other device, of being seen as a moving picture and of reproduction, and includes the sounds embodied in a sound-track associated with the film, but shall not include a computer program")
• Sound recordings (these are defined as "any fixation or storage of sounds, or data or signals representing sounds, capable of being reproduced, but does not include a sound-track associated with a cinematograph film");
• Radio and television broadcasts (whether they are transmitted by radio or cable, as are programme-carrying signals).

The Copyright Act does not protect ideas so copyright only comes into being when the ideas are recorded, written down or transmitted. Given the provisions of the Electronic Communications and Transactions Act ("ECT Act"), digital versions or representations of these "works" would also qualify for copyright protection. To qualify for copyright protection under the Copyright Act a person (human or a legal person such as a company or close corporation) must be the author of the work or otherwise the owner of copyright in that work and must be either resident or domiciled in South Africa.

The way the Copyright Act works is that it sets out which forms of distribution and reproduction are reserved for the copyright owner and then takes a look at what is permissable without the owner's permission. These provisions are pretty detailed so it is worth taking a few minutes to review sections 6 to 9 of the Copyright Act. Essentially (and except where the Copyright Act allows for it), users are not permitted to reproduce or distribute content protected by copyright without the permission of the copyright owner and without paying a royalty (although the payment of a royalty can be waived by the owner).

There are a number of exceptions to this rule in the Copyright Act and can be found in sections 12 to 19 of the Act. These exceptions include making copies of some forms of content solely for personal use, for study purposes or for review purposes.

When you take into account the ECT Act, you begin to appreciate how the Copyright Act impacts on content stored and distributed online. Actually, there is no real magic when it comes to online content. The principles are pretty much the same. If you operate a web site like a blog then it is a good idea to familiarise yourself with copyright law as it applies to you. This includes provisions of the ECT Act which bridge the gap between traditional media and the new media revolution that has been taking place on the Web the last few years.

The ECT Act introduces a new dimension of copyright protection designed to cater for the nature of the Web and services like search engines and content sharing sites. Questions have arisen about the liability of service providers for copyright infringement committed directly by users of their services and even indirectly where the service provider can be said to have facilitated copyright infringement. Examples of this include the almost defunct Napster and services like YouTube.

So one question is whether a service provider like YouTube should be held liable for copyright infringement that occurs on the site by users who upload video that is subject to copyright. The Digital Millennium Copyright Act applies to copyright infringements in the United States and will probably govern copyright infringements on YouTube. In South African law we look to the ECT Act which would apply to a similar service in South Africa. In terms of the ECT Act, a service provider is defined as a party that provides information system services which are, in turn, defined as follows:

"information system services" includes the provision of connections, the operation of facilities for information systems, the provision of access to information systems, the transmission or routing of data messages between or among points specified by a user and the processing and storage of data, at the individual request of the recipient of the service

For starters, a service provider is not liable for copyright infringement where the service provider is a neutral conduit of data over its network. The conditions for this limitation of liability include qualifying for this protection under the Act, not initiating the data transmission in question, selecting the recipient of the data transmission, facilitating the transmission using automated systems and not modifying the data as it flows across the network. A service provider will furthermore not be liable for copyright protection where the service provider is not aware that there is infringing content on its network (either by virtue of "actual" knowledge or facts or circumstances which clearly point to the presence of infringing content) and if it acts expeditiously to remove infringing content from its network on receipt of a so-called "take down notice" requiring it to take that content down. There are similar provisions in the DMCA and are often referred to as "safe harbour" provisions.

There are additional provisions which are also pretty important when it comes to services that cache content or which provide tools to link to potentially infringing content. The caching provisions protect a service provider from liability where the service provider temporarily and automatically stores data for onward transmission to its users under certain circumstances which basically amount to a neutral handling of that content. Another important provision in the ECT Act dealing with service provider liability is the provision dealing with "information local tools". Section 76 provides that:

A service provider is not liable for damages incurred by a person if the service provider refers or links users to a web page containing an infringing data message or infringing activity, by using information location tools, including a directory, index, reference, pointer, or hyperlink, where the service provider-

1. does not have actual knowledge that the data message or an activity relating to the data message is infringing the rights of that person;
2. is not aware of facts or circumstances from which the infringing activity or the infringing nature of the data message is apparent;
3. does not receive a financial benefit directly attributable to the infringing activity; and
4. removes, or disables access to, the reference or link to the data message or activity within a reasonable time after being informed that the data message or the activity relating to such data message, infringes the rights of a person.

This clause is particularly relevant to search engines. You may recall instances where Google was taken to court over the fact that it provided links to and cached infringing content. For the most part, the courts hearing those cases found that Google was not liable for copyright infringement and were such a case to go before a South African court, the result may well be the same under section 76 of the ECT Act.

If you take into account the definition of a service provider mentioned above, you will realise that a service provider includes not just services like YouTube and Google but also employers who provide an information system to its employees and companies that provide hosting services to their customers. It is a very good idea to implement terms of use that govern the use of your information systems and which protect you, at least vis a vis your users, from copyright infringement claims and any action you may be required to take to remove offending content from your networks and/or services.

As you can imagine, it would take quite a bit more than this post to give you a more comprehensive overview of copyright law in South Africa. I hope that this post has given you a good starting point and a few ideas about the issues you may be facing.