Extracts from a discussion about privacy and the Protection of Personal Information Bill

This is a partial recording from Marketing Mix's Permission Based Marketing Conference in Cape Town on 2012-06-01 where I was a panelist speaking about privacy and the Protection of Personal Information Bill. I recorded part of my contribution to the discussion and this recording covers the nature of privacy from the perspective of the Bill and the definition of consent in the 7th draft of the Bill which has the potential to radically change the Bill's impact on privacy practices and the direct marketing industry in SA.

The President, his penis and the Streisand Effect

Background

If you have missed the controversy that arose in the last few days about a depiction of President Zuma with his penis exposed called "The Spear", this is what it is all about:

The painting is part of an exhibition by Brett Murray called "Hail to the Thief II", a sequel to his 2010 series "Hail to the Thief". It is currently on display at the Goodman Gallery which describes the exhibition as follows:

Established Cape Town based artist Brett Murray returns to Goodman Gallery Johannesburg with Hail to the Thief II. This body of satirical work continues his acerbic attacks on abuses of power, corruption and political dumbness seen in his 2010 Cape Town show Hail to the Thief. In this sequel show, Murray’s bronzes, etchings, paintings and silk-screens form part of a vitriolic and succinct censure of bad governance and are his attempts to humorously expose the paucity of morals and greed within the ruling elite.

The ANC and Presidency Responds

The ANC was outraged by the depiction of the President and other works in the exhibition criticising the ANC for, among other things, its apparent corruption and emphasis on material wealth. The ANC released a statement on 17 May which reads as follows:

ANC outraged by Brett Murray`s depiction of President Jacob Zuma

17 May 2012

The African National Congress is extremely disturbed and outraged by the distasteful and indecent manner in which Brett Murray and the Goodman Gallery in Johannesburg is displaying the person of Comrade President Jacob Zuma.

This disgusting and unfortunate display of the President was brought to our attention by one of the media houses and we have physically confirmed this insulting depiction of the President. We have this morning instructed our lawyers to approach our courts to compel Brett Murray and Goodman Gallery to remove the portrait from display as well as from their website and destroy all printed promotional material. We have also detected that this distasteful and vulgar portrait of the President has been displayed on a weekend newspaper and its website, we again have instructed our lawyers to request the said newspaper to remove the portrait from their website.

It is in our view and we remain steadfast in that the image and the dignity of our President as both President of the ANC, President of the Republic and as a human being has been dented by this so-called piece of art by Brett Murray at Goodman Gallery. We are also of the view that this distasteful depiction of the President has violated his individual right to dignity as contained in the constitution of our country.

The same gallery has displayed the logo of the ANC without the permission of the ANC, with the inscription FOR SALE on it, both these portraits are a clear calculation to dismember and denigrate the symbols and the representative of the ANC, chief amongst them, the President of the ANC.

The ANC believes in both freedom of the press and artistic expression. The vulgar portrait and the dismembering of the ANC logo by Brett Murray is an abuse of freedom of artistic expression and an acute violation of our constitution, apart from being defamatory. That is why we have instructed our lawyers to approach the courts in-view of these violations and the defaming nature of the so-called President Zuma portrait titled ”The Spear”.

Issued by:
Jackson Mthembu
African National Congress

Enquiries:
Jackson Mthembu 082 370 8401
Keith Khoza 082 823 9672

The Presidency similarly published a strongly worded statement the following day:

Presidency disgusted at violation of President Zuma’s rights

The Presidency is shocked and disgusted at the grotesque painting by Brett Murray depicting President Jacob Zuma in an offensive manner.

We are amazed at the crude and offensive manner in which this artist denigrates the person and the office of the President of the Republic of South Africa.

The Presidency is concerned that Brett Murray fails to appreciate that freedom carries a deep responsibility. The President was amongst the primary architects of our Constitution and shall defend the rights enshrined in our Bill of Rights, including the freedom of artistic expression. However, in exercising these rights, people should at all times be conscious that they are not absolute.

Nobody has a right to violate the dignity and rights of others while exercising their own. Other than his position as Head of State and as President of the ruling party, President Zuma as a citizen has a right to human dignity, which is enshrined in the Constitution of the Republic. No human being deserves to be denigrated in this shocking manner.

We are also concerned that the painting perpetuates a shocking new culture by some sections of the artistic world, of using vulgar methods of communicating about leading figures in the country, in particular the President.

Intense hatred of the new democratic administration or the ruling party should not translate into distorting South Africa’s value system of emphasising respect and of ensuring that disagreements are expressed in a cultured and civilised manner, which these artists are failing to do. It is shocking as well that some media houses find this distasteful work worth displaying on their websites and are eager to publish it repeatedly.

The President reserves his rights in this matter.

Enquiries: Mac Maharaj on 079 879 3203.

Issued by: The Presidency
Pretoria

The Goodman Gallery and the City Press Resist

Both the Goodman Gallery and the City Press, which published a photograph of the image, have refused to accede to the ANC's demands that the images be removed, the art itself removed from view and all promotional materials relating to the work, stating that doing so would amount to censorship. Ferial Haffajee wrote a column which appeared in the City Press in which she explained the paper's position. Here is an extract of her column which is worth reading in its entirety:

Did we think the image of President Jacob Zuma by Brett Murray was particularly beautiful to persuade us to publish it? No.

Would it be something I would hang at home? No.

There is a copy stuck on my office window, along with two others from Murray’s explosively angry exhibition of satirical graphic art.

Murray, now facing a demand from the governing ANC that he destroy the work, designed some of the anti-apartheid movement’s most iconic resistance art.

…

Our Constitution explicitly protects artistic expression as a subset of free expression, to which its detractors will respond as they have all week: they draw the line at art that impugns presidential dignity.

But I’ve learnt that the commitment to clauses like free expression (be it in art or journalism) is never going to be tested by still lifes of bowls of flowers or by home decor magazines.

It is always going to be tested by art that pushes boundaries and journalism that upsets holy cows, which is why our clever founders enshrined the right in our Constitution.

They knew our artists and journalists would, if we stayed true to the founding South African DNA of questioning and truth-saying, need protection.

In the past week – and in the one to come – we will hear again this clash of free expression and dignity.

Not convinced, the ANC served an application on the Goodman Gallery and the City Press seeking to interdict them from "displaying and exhibiting on their website or any other platform including the online channels the offensive and distasteful so-called portrait". What the ANC doesn't seem to realise just yet is that its application, due to be heard in the Johannesburg High Court on Tuesday at 12:00, has already failed.

For one thing, the ANC is almost certainly on the wrong side of the law in this matter. As always, Constitutional law expert, Pierre De Vos, has published a somewhat sarcastic but insightful article on some of the reasons the application will fail. His post is titled "On the President, his penis, and bizarre attempts to censor a work of art" and is a must-read if you are interested in some of the legalities that will likely be considered including the following considerations:

The ANC may not be aware of the fact that section 16(1)(c) of the Constitution states that everyone has the right to freedom of expression, which includes ”freedom of artistic creativity”. It is true that no right is unlimited but even where the right to free expression is limited an exception is usually made for artistic expression. Our law often distinguishes between real depictions of individuals and art works and hardly ever allows for the censoring of the latter. For example, section 12 of the Promotion of Equality and Prevention of Unfair Discrimination Act (which prohibits hate speech) explicity makes an exception for a “bona fide engagement in artistic creativity”. Section 3 of the Film and Publications Act contains a similar exception.

The fact that the ANC seems incapable of distinguishing between a work of art and real life will probably ruin their legal case they are planning to launch. The ANC statement says that it has instructed its lawyers to approach the courts to compel Brett Murray and Goodman Gallery to remove the portrait from display as well as from their website and to destroy all printed promotional material relating to the work. But given the protection for artistic freedom in the Constitution and the many exceptions in our law made for the expression of such artistic creativity, I am am almost 100 percent certain that the ANC’s proposed legal action will not be successful. In a democracy, courts seldom order the censoring of a work of art – even if that work of art makes fun of the President and his philandering patriarchal ways. …

Leaving aside the Constitutional rights arguments which may well include a reference to the case in the same court involving the late health minister as well as the 2007 case of Midi Television v Director of Public Prosecutions (Western Cape) in the Supreme Court of Appeal (thanks to Yolandé van Aswegen for the retweet that highlighted this for me), the ANC has lost this application because of a non-legal phenomenon called the Streisand Effect which has claimed a number of victims in the past.

The Streisand Effect Strikes Back

Wikipedia describes the Streisand Effect as follows:

The Streisand effect is a primarily online phenomenon in which an attempt to censor or remove a piece of information has the unintended consequence of causing the information to be publicized widely and to a greater extent than would have occurred if no censorship had been attempted. It is named after American entertainer Barbra Streisand, following a 2003 incident in which her attempts to suppress photographs of her residence inadvertently generated further publicity.

In this particular case, the effects of this phenomenon are appearing in search results, numerous newspaper articles covering the controversy and elsewhere online. I looked at two examples of this phenomenon at work: I ran a search for "president zuma" on Google and was presented with the following:

I then ran an image search for "'the spear' zuma" and was presented with these results:

This controversy is trending in South Africa on Twitter too:

A more concrete illustration of how the Streisand Effect has thwarted the ANC's efforts to censor the work came from a follow-up article focusing on the Goodman Gallery's response to the ANC's demands and the tremendous interest in the exhibition:

Traffic to the Goodman Gallery in Johannesburg, which has also been instructed to remove the painting by the ANC’s lawyers, has been higher than usual since City Press published the portrait on Sunday.

“Actually it’s insane here this morning,” said Lisa Koseff, a staff member at the gallery.

“I would say this is the biggest response we’ve ever had to an exhibition.”

She said there was huge interest from international media.

Major international news services like Sky News and the Huffington Post have covered this story and others are sure to follow soon.

What does this all mean? It means that regardless of whether the ANC and the President have a sound legal basis to demand the work's removal from public view, their actions in pursuit of this (including very public statements expressing outrage and the application launched yesterday) have shone a very bright and public spotlight on what would otherwise have been a relatively short-lived and isolated amusement. The ANC forgets that the work would not just be distributed through the gallery's website, promotional materials and coverage in the City Press but by every person who was alerted to the controversy and who tweeted, shared or blogged about it, motivated by amusement, outrage at the ANC's censorship attempts or the simple desire to share it with their connections.

Of course the ANC and the President are entitled to express their outrage, dismay, disgust or any other opinion about the work and are free to make their views public (just as anyone else commenting on the work is entitled to express an opinion about it) but in such a connected world where media-rich news spreads across the globe in moments, they should have given more consideration to the consequences of doing so. In a very real sense, they have made a powerful contribution to their application's ultimate failure as a means to close this Pandora's box. As I pointed out in my post dealing with the challenges presented by online defamation:

In the 2007 Digg controversy [link added], Toshiba's attorney at the time, Michael Avery, summed up this challenge as follows:

If you try to stick up for what you have a legal right to do, and you're somewhat worse off because of it, that's an interesting concept.

Update (2012-05-24): The matter is being heard in court today and some interesting comments and rulings are emerging:

Dignity and privacy rights do not apply to Zuma's office as president of the country or the ANC, his counsel concedes. Very important.

— Nicholas Dawes (@NicDawes) May 24, 2012

#ZumaSpear GM: He was insulted personally & as President. But only remedy available is to him personally. SG

— Stephen Grootes (@StephenGrootes) May 24, 2012

#ZumaSpear Judge Claasen: A final interdict cannot be monitored, if the court issues it in perpetuity, what if pics downloaded by others? SG

— Stephen Grootes (@StephenGrootes) May 24, 2012

Instagram's new content license (it still doesn't own your content)

Rian van der Merwe posted a tweet asking me to comment on the changes to Instagram's Terms of Service:

@pauljacobson I thought you might be able to shed some light? b.elezea.com/post/221145426…

— Rian van der Merwe (@RianVDM) April 30, 2012

Rian posted the new license from the terms on his one blog and I took a quick look at it (I am in a lock-down here at work so I haven't had time to review the full terms for this post). The new license states the following:

Instagram does NOT claim ANY ownership rights in the text, files, images, photos, video, sounds, musical works, works of authorship, applications, or any other materials (collectively, "Content") that you post on or through the Instagram Services. By displaying or publishing ("posting") any Content on or through the Instagram Services, you hereby grant to Instagram a non-exclusive, fully paid and royalty-free, worldwide, limited license to use, modify, delete from, add to, publicly perform, publicly display, reproduce and translate such Content, including without limitation distributing part or all of the Site in any media formats through any media channels, except Content not shared publicly ("private") will not be distributed outside the Instagram Services.

Rian's (and, I'm sure many other people's) concern is nicely summed up in the rest of his post:

Here’s my non-lawyer interpretation:

We don’t own your stuff, but we can do whatever we want with it.

Which kind of sounds like it can be shortened to:

We own your stuff.

Any lawyers out there who can clarify what’s going on here?

The subtext here is that the Facebook acquisition has poisoned this popular service and Facebook is encroaching on Instagram users' rights over their content. As Web services go, this content license is typical and hardly a land grab which it may be made out to be. As I mentioned in my previous post about the Google Drive license terms –

This clause clearly states that Dropbox doesn’t claim ownership of your data but the more important set of provisions are those dealing with the license Dropbox takes from its users when it comes to accessing and making use of the data you upload to Dropbox. Bear in mind that all of these services will have a license of some sort. A license is a set of permissions you, as the user, give to the provider and that enables the provider to receive, manipulate and otherwise handle your data. It’s an essential component and nothing to be alarmed by in itself (at least not if you are comfortable with the basic idea of a provider having access to your data as part of your use of the particular service).

Instagram's license is fairly broad but it could be even worse. The license is basically designed to enable the service to operate. In the absence of a specific license Instagram could fairly convincingly argue that the permissions set out in this license would be implicit in the unspoken license users would grant to Instagram merely by using the service. In other words, when you use Instagram, the license provisions are implied by your use.

By comparison, here is the license Facebook takes from you:

For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.

What I find interesting about the Instagram license is that it is implicitly in favour of Instagram, Inc (the company behind Instagram); it isn't transferrable and it isn't even sub-licensable. This means the license is limited to Instagram and you don't give Instagram the right to license your content to Facebook or any other party. The wording is a little unclear because the license gives Instagram the ability to distribute "part or all of the Site in any media formats through any media channels" and yet it doesn't permit the content to be sub-licensed or to transfer the license to another party. This is probably a flaw in the license language because it is notionally problematic for anyone to consume other users' posts in a way that would require those consumers exercising the user's rights under copyright and which is not covered by an exception to copyright infringement like fair dealing or fair use.

Moving away from the legal geekery, the new Instagram license is not a land grab. It is a pretty reasonable license given the nature of the service and doesn't equate to "We own your stuff". Rather it's more like "We can do things with your stuff to make Instagram work".

Google Drive and the data ownership panic

Google Drive launched a couple days ago and some new publications are already writing about possible data ownership issues. It’s a common concern whenever a new service launches or website terms and conditions change. Darren Smith pointed me to an article by C|Net titled “Who owns your files on Google Drive?” which had a somewhat confused focus and an unnecessarily alarming conclusion represented by this tagline:

Dropbox and Microsoft's SkyDrive allow you to retain your copyright and IP rights to the work you upload to the service, but Google Drive takes everything you own.

I took a look at Dropbox’s, Microsoft’s and Google’s terms and conditions to test this conclusion.

Dropbox’s terms and conditions

The C|Net post focused on this clause in the Dropbox terms which are only part of the story when it comes to Dropbox’s terms:

By using our Services you provide us with information, files, and folders that you submit to Dropbox (together, “your stuff”). You retain full ownership to your stuff. We don’t claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services, as explained below.

This clause clearly states that Dropbox doesn’t claim ownership of your data but the more important set of provisions are those dealing with the license Dropbox takes from its users when it comes to accessing and making use of the data you upload to Dropbox. Bear in mind that all of these services will have a license of some sort. A license is a set of permissions you, as the user, give to the provider and that enables the provider to receive, manipulate and otherwise handle your data. It’s an essential component and nothing to be alarmed by in itself (at least not if you are comfortable with the basic idea of a provider having access to your data as part of your use of the particular service).

Dropbox’s license provisions are pretty vague. Here are the key clauses:

We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. This includes product features visible to you, for example, image thumbnails or document previews. It also includes design choices we make to technically administer our Services, for example, how we redundantly backup data to keep it safe. You give us the permissions we need to do those things solely to provide the Services. This permission also extends to trusted third parties we work with to provide the Services, for example Amazon, which provides our storage space (again, only to provide the Services).

To be clear, aside from the rare exceptions we identify in our Privacy Policy, no matter how the Services change, we won’t share your content with others, including law enforcement, for any purpose unless you direct us to. How we collect and use your information generally is also explained in our Privacy Policy.

…

Sharing Your Stuff

The Services provide features that allow you to share your stuff with others or to make it public. There are many things that users may do with that stuff (for example, copy it, modify it, re-share it). Please consider carefully what you choose to share or make public. Dropbox has no responsibility for that activity.

The basic idea is clear, though. Dropbox requires your permission to run its service and you agree to give it whatever permissions it requires to do that. The problem with this simplistic approach is that it is too simplistic and vague. As a user you don’t really know what the license’s parameters are beyond whatever is not required to operate the service.

Microsoft Services Agreement

These terms and conditions are not limited to SkyDrive but apply to a range of Microsoft services:

It's a contract that governs your use of any Windows Live, Bing, MSN, Microsoft Office Live, or Office.com services or software, or other Microsoft services or software that directly display or link to this agreement (the "service"). By using or accessing the service, you confirm that you agree to these terms. If you don't agree, don't use the service. Thanks.

This is significant because, unlike with Dropbox where your license relates to a fairly specific service, the license you grant to Microsoft encompasses a variety of services which are increasingly interconnected. This is very similar to Google’s terms (below). These terms and conditions are more specific than Dropbox’s licensing provisions and also contain a statement that Microsoft doesn’t claim ownership of users’ data:

5. Your content

Except for material that we license to you, we don't claim ownership of the content you provide on the service. Your content remains your content. We also don't control, verify, or endorse the content that you and others make available on the service.

You control who may access your content. If you share content in public areas of the service or in shared areas available to others you've chosen, then you agree that anyone you've shared content with may use that content. When you give others access to your content on the service, you grant them free, nonexclusive permission to use, reproduce, distribute, display, transmit, and communicate to the public the content solely in connection with the service and other products and services made available by Microsoft. If you don't want others to have those rights, don't use the service to share your content.

You understand that Microsoft may need, and you hereby grant Microsoft the right, to use, modify, adapt, reproduce, distribute, and display content posted on the service solely to the extent necessary to provide the service.

Please respect the rights of artists, inventors, and creators. Content may be protected by copyright. People appearing in content may have a right to control the use of their image. If you share content on the service in a way that infringes others' copyrights, other intellectual property rights, or privacy rights, you're breaching this contract. You represent and warrant that you have all the rights necessary for you to grant the rights in this section and the use of the content doesn't violate any law. We won't pay you for your content. We may refuse to publish your content for any or no reason. We may remove your content from the service at any time if you breach this contract or if we cancel or suspend the service.

You're responsible for backing up the data that you store on the service. If your service is suspended or canceled, we may permanently delete your data from our servers. We have no obligation to return data to you after the service is suspended or canceled. If data is stored with an expiration date, we may also delete the data as of that date. Data that is deleted may be irretrievable.

A couple things emerge from these terms and conditions. Firstly, when you share your data with other people, you give them a limited license to use your data “solely in connection with the service and other products and services made by Microsoft”. Similarly, the license users grant to Microsoft in respect of their data is limited to permissions required “solely to the extent necessary to provide the service”.

Google’s terms and conditions

Google Drive is governed by Google’s Terms and the license provisions are fairly similar to Dropbox’s and SkyDrive’s, at least when it comes to the basic approach. As with the other two services, Google doesn’t claim ownership of your data. Here are the license provisions:

Your Content in our Services

Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.

When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.

You can find more information about how Google uses and stores content in the privacy policy or additional terms for particular Services. If you submit feedback or suggestions about our Services, we may use your feedback or suggestions without obligation to you.

The license Google users grant to Google is notionally for the “limited purpose of operating, promoting, and improving our Services, and to develop new ones” but it is somewhat open ended in that Google could develop new services or modify existing ones that require your data to be used in ways you couldn’t have anticipated when signing up. This is fairly similar to Microsoft’s Services Agreement which also uses one license for all its services.

What does this all mean?

The C|Net article contains this rather alarming set of statements:

The last sentence makes all the difference. While these rights are limited to essentially making Google Drive better and to develop new services run by Google, the scope is not defined and could extend far further than one would expect.

Simply put: there's no definitive boundary that keeps Google from using what it likes from what you upload to its service.

The chances are Google's terms will never be an issue -- and it is likely over-zealous lawyers making sure Google doesn't somehow get screwed in the long run by a lawsuit -- but it may be enough to push away a great number of entrepreneurs and creative workers who rely on holding on to the rights to their own work.

The fact is, according to its terms, Google may own any code or product you ultimately upload to its new Google Drive service, whether you realise it or not.

These statements, particularly the last one, are factually incorrect and misleading. They are also not uncommon when journalists attempt to navigate terms and conditions without the time or inclination to read them carefully. Google doesn’t claim ownership of its users’ data. Its license is fairly broad and that is understandable given the wide range of services it offers. At the same time, there is scope for the already broad license to be applied in ways users may not have considered. The specific permissions users grant to Google are substantially the same as those users grant to Microsoft (Google is more specific and lists more individual permissions but they are not fundamentally different). 

The big difference here is between Dropbox’s terms, on one hand, and Google’s and Microsoft’s on the other hand. Dropbox offers a fairly specific set of services so users have more certainty as to what they are licensing Dropbox to do with their data. Google and Microsoft offer a range of interconnected services governed by a single legal framework and the potential scope for their licenses is far broader when you consider that their users may be using a variety of Google and Microsoft services with different functionality.

I’ve seen license provisions which are far more onerous in the past. The big culprit back in 2007 was Facebook with this gem:

When you post User Content to the Site, you authorize and direct us to make such copies thereof as we deem necessary in order to facilitate the posting and storage of the User Content on the Site. By posting User Content to any part of the Site, you automatically grant, and you represent and warrant that you have the right to grant, to the Company an irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to use, copy, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part) and distribute such User Content for any purpose on or in connection with the Site or the promotion thereof, to prepare derivative works of, or incorporate into other works, such User Content, and to grant and authorize sublicenses of the foregoing. You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.

This license was as close to an assumption of ownership as Facebook has ever come. It was so close to assuming ownership that the difference between ownership and licensing user content was a matter of semantics. The controversies over the Facebook terms did a lot to create more awareness of users’ expectations and what it means to be a better licensor. The current generation of terms and conditions reflect that, for the most part (there are still some shockers). These modern licenses are clearer, limited in varying degrees but are often necessarily broad to enable these services to function effectively. I agree with the one statement in the C|Net article, though –

It always pays to read the fine print.

Privacy in a nutshell, a guide

I started working on an overdue post this morning and, as I started to do that, I realised it would be really helpful to first publish this guide, "Privacy law in a nutshell", as an introduction to South African privacy law (some of the principles apply elsewhere too). It is a pretty brief overview but if you are not familiar with some of the basic legal principles and considerations relating to privacy, this should help.