The EU’s Data Protection Directive puts restrictions on transferring personal data outside the European Economic Area unless the data protection regime of the receiving country has been approved as ‘adequate’ by the EU. Transfer outside the European Economic Area can otherwise only take place if there is a specific justification for that transfer or if other safeguards are taken.

Uruguay also made an application for similar status, but this will require further approval before formal approval is given.

Israel will now join Argentina, Guernsey, Jersey, Canada, the Isle of Man and Switzerland on the approved list, which, along with further conditions for data transfer to those countries, can be found at http://ec.europa.eu/justice/policies/privacy/docs/international_transfers_faq/international_transfers_faq.pdf. Transfers to the US can be readily made if the recipient has signed up to the ‘Safe Harbor Privacy Principles’, which had been agreed between the European Commission and the US Department of Justice.

M-Tech’s objection here was that Oracle had conducted its business in a way in which it was not possible for traders to ascertain whether the goods had originated inside the EEA or outside. In particular, it had deliberately chosen not to make publicly available its database of product serial numbers – and those could have identified where the goods had been first marketed.

The High Court had awarded Oracle summary judgment but on appeal the Court of Appeal agreed that M-Tech had an arguable case. It thought that it was possible that Oracle’s actions amounted to an artificial partitioning of the European market, contrary to the Treaty on the Functioning of the European Union (previously the EC Treaty), with the aim of maintaining price differences in each country rather than any legitimate wish to protect its brand. The Court of Appeal did not award victory to one party or the other, but said that M-Tech’s arguments warranted a full trial and the case should probably end up being referred to the European Court of Justice to make a ruling.

DSS argued that, as claimant, Honda should bear the burden of proving that trade mark infringement had occurred rather than for DSS to have to show that it had done no wrong. It also said that Honda’s claim was totally speculative and lacked particularity. In this preliminary legal action, DSS applied to strike out Honda’s claim.

The High Court refused to strike out Honda’s claim. All Honda needed to do was to allege that DSS had used Honda’s trade marks and that it had not consented to DSS’s use. It was for DSS to have the burden of proving its defence – ie that the goods had been put onto the market in the EEA by Honda. It was not for Honda to prove that DSS had parallel imported the goods from outside the EEA. It was also sufficient for Honda to make generalised claims and there was no legal requirement on it to make trap purchases as evidence of wrongdoing, even if that was the preferred method in practice for brand owners to show trade mark infringement. A trade mark owner could bring proceedings if it had a reasonable suspicion of infringement even if it did not have any hard evidence. As soon as the brand owner has not consented to the specific use by the dealer, it was then for the dealer to prove its defence that the brand owner had consented to the products being supplied in the EEA. In answer to DSS’s claim that brand owners could make frivolous claims without sufficient evidence, the Court responded that there was a sufficient disincentive to that because the claimant would be penalised by costs orders if its claim failed.

Paul Gershlick, a Partner at Matthew Arnold & Baldwin LLP and editor of Upload-IT, comments: ‘This consultation sounds like a good idea in theory. But, in practice, there may be little that the Government can do as the Data Protection Act implements a European Union Data Protection Directive. Therefore, any changes need to be in line with that EU law. As it is, the European Commission has recently given the UK an ultimatum to change the Act in line with the Directive.’

The Commission has just updated the rules and data export contract terms that apply when a European data controller transfers data to a data processor that is not based in the EEA. A ‘data controller’ is someone who decides and controls what happens to personal data, and a ‘data processor’ is someone who processes personal data on behalf of a data controller but does not take decisions in relation to the personal data and is not ultimately responsible for that data. The new rules allow for the data processor to sub-contract the processing of the data to sub-processors under certain conditions, including by obtaining the prior written consent of the data controller that is exporting the data out of the EEA. The development is aimed at keeping pace with the way business is done, and in particular different levels of outsourcing in a chain.

Separate contract terms continue to exist in relation to transfers of data from data controllers within the EEA to data controllers outside of the EEA. They are unaffected by the updated contract terms in data controller to data processor situations.

In this case, Sun accused M-Tech of buying Sun’s products from China, Chile and the US and selling them in the UK without Sun’s consent. It therefore sought summary judgment against M-Tech. M-Tech raised a number of arguments.

The High Court dismissed M-Tech’s arguments and sided with Sun, awarding it summary judgment. It said M-Tech’s arguments had no real prospect of succeeding at a full trial. The judge was satisfied that the goods were first put on the market outside of the EEA and M-Tech had not produced any evidence to support its suggestion that they had been subsequently imported into the EEA with Sun’s consent.

M-Tech also raised another interesting legal argument, which was dismissed by the judge. It claimed that Sun’s distribution agreements which protected its trade mark rights infringed EU competition law and were therefore prohibited as they carved up the market. Sun was prepared to accept that its agreements may have infringed EU competition law, but argued that there was no connection between any such breach and its ability to enforce its trade mark rights. The judge was willing to accept Sun’s argument that the disappearance of any sort of secondary reseller market for Sun’s equipment was not because of its network of illegal agreements. Therefore, in the judge’s view, there was no real prospects of success between M-Tech’s argument that Sun should not be able to enforce its trade mark rights on EU competition law grounds.