Definitions

Commercial Use Reproducing a work in any manner that is primarily intended for or directed toward commercial advantage or monetary compensation.

Crown Copyright Works deposited with the organisation that have been produced for or on behalf of the Crown.

Infringement Any unauthorised use of material, which is protected by copyright and/or any other related right, for which permission to use, has not been obtained. Infringements can occur in print and/or digital form.

Intellectual Property Rights (IPR/IP) All patents, Trade Marks, trade names and domain names, service marks, rights to inventions, copyright and related rights, rights in get-up, rights in goodwill, unfair competition rights, rights in designs (whether held in physical or electronic format or otherwise howsoever), database rights, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications (and rights to apply) for, and renewal or extensions of, such rights and similar or equivalent rights or forms of protection in any part of the world.

Non-commercial Use Reproducing a work in any manner that is not primarily intended for or directed toward commercial advantage or monetary compensation.

Orphan Works Works that are in copyright, but where the owners of any third-party rights are either unknown or cannot be traced.

Third-Party Rights Intellectual property rights, not owned by the organisation.

Works Items, objects and/or collections and/or content, both accessioned and support collections. It also applies to any assets created by the organisation's staff and/or anyone else working for, or on behalf of the organisation and/or involving the organisation.

Introduction

The organisation owns, creates, commissions, loans, acquires, has deposited and uses a wide range of Works. Intellectual Property Rights (IPR) protects many of these. This document sets out the organisation's policy regarding the use, access to and management of these IPR. It includes IPR owned by the organisation, as well as any IPR vesting in the organisation's Works for which a third party might own the IPR.

This Policy outlines a framework under which the organisation, its staff and those working for or on behalf of the organisation should operate to ensure legal compliance, reduce the organisation's exposure to risks and work in accordance with robust ethical and reputational imperatives. Moreover, adherence to this Policy supports the achievement of the organisation's strategic objectives.

Introduction

This chapter explores the role of information law awareness and engagement from both an operational and strategic perspective. It will be of importance and interest to LIK workers, who may:

• ◆ require ongoing training themselves in information law compliance issues, such as copyright, data protection and freedom of information

• ◆ have responsibility for raising awareness and ensuring engagement amongst their colleagues, students and possibly volunteers

• ◆ need to make the business case to senior management for training and development as a long-term commitment on behalf of their organisation

• ◆ need to develop a long-term strategy, supported by a business case, for maintaining high levels of awareness and engagement beyond training

• ◆ need to find a budget to support ongoing training and awareness activities.

High levels of staff awareness and engagement with information law issues are essential to organisational compliance with the law, whilst the proceeding chapters have also discussed the relationship between legal compliance and proportionality regarding risk. This means that inefficiencies and/or mistakes in the management of information law issues and the lack of awareness and staff confidence in managing rights, permissions and consents can increase risk, hamper opportunities and duplicate efforts, increasing overall costs and reducing the impact of information law policies and their implementation, as well as reducing access to information. Thus, raising awareness and engagement with information law issues is both an operational and a strategic imperative. It's an operational issue because awareness of information law compliance and its application to a specific organisation enables staff to do their jobs better. It's also a strategic issue, because organisations with limited resources for training, awareness raising and engagement need to ensure that they plan how they can optimise staff understanding of the issues, who to target and also achieve the long-term embedding of such know - ledge into the corporate memory. Moreover, legal compliance issues often require the maintenance of high levels of staff awareness so that long-term investment is made in retaining good levels of awareness amongst current staff, whilst also training up new starters.

Definitions

Data Any information, which is being processed automatically or recorded as part of a relevant, filing system.

Data Controller A person or organisation who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data is, or is to be, processed.

Data Subject An individual who is the subject of personal data.

Information Asset Owner The member of staff responsible for collecting the information and/or in charge of the project and/or initiative involving personal data.

Personal Data/Information Data which relates to an identifiable living individual.

Processing Obtaining, accessing, altering, adding to, deleting, changing, disclosing or merging data and anything else, which can be done with data.

Special Category Data Information about an individual's racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health or condition, sexual life, commission or alleged commission of any offence, any proceedings for any offence committed or alleged to have been committed by him/her.

Introduction and scope

The organisation may collect and hold personal data about its staff, users, visitors, customers, supporters, business partners and other individuals who visit, work with or contact the organisation. It is committed to ensuring that this personal information is managed responsibly and in accordance with data protection legislation, other related policies and any associated legislation or Codes of Practice.

This policy covers all personal information held by the organisation including that contained in its own records and that held in its archives and deposited collections.

All the organisation's staff, volunteers and contractors are required to ensure that they comply fully with this policy and its associated procedures.

This policy is linked closely to the organisation's Acceptable Use Policy. A full list of associated policies can be found in the Appendix.

The legislation

The data protection legislation, namely the Data Protection Act 2018 and the General Data Protection Regulation (GDPR), provides a framework for the handling of Personal Data as well as Special Category Data.

The data protection legislation applies to all Personal Data and Special Category Data contained in manual files and filing systems, e-mails, computer files, computer databases, images and films, documents and all other formats and media.

Staff in LIK services are facing a challenging time. Technology is advancing apace, with exciting, yet potentially dangerous developments in artificial intelligence, and with new technologies for recording and processing personal data (such as face-recognition technologies, and the use of social media and home assistance devices such as Alexa) becoming commonplace. In the field of copyright, there have been developments both in technologies to make it easier to copy and disseminate materials to multiple audiences all over the world, and in TPM software to try to prevent easy infringement being applied. We now live in a world where everyone can be a content creator, often using multiple media, as well as a content disseminator, publisher and a content user. Sometimes we can be all of them, collectively with others. Social media platforms make it easier to share content and often blur these roles. Over the decades, the resulting role of the LIK professional has changed beyond recognition, with arguably an increased role as being an advisor on the legality of things as well as a completely changed intermediary role between the patron and the information they wish to access. But they are not the only one in that position. Increasingly sophisticated search engines, such as Google, as well as TDM and other computational analysis technologies, can quickly provide access to information, whilst the internet is becoming overwhelmed with fake news and other misleading and sometimes illegal content.

Information law is also standing rather like a piggy in the middle, again between content owners and content users. On the one hand, the law tries to encourage novel creations, freedom of expression and creativity. On the other hand, it tries to prevent abuse of the new technologies by means, for example, of data protection legislation and strong rights for content creators. However, the law faces particular challenges. The first is the tension between creators and users (in the case of copyright), or between privacy and exploitation of personal data (in the case of data protection). There is also the tension between the wish for accountable and open government so citizens are fully informed about, and can comment on, the actions of all levels of government (through freedom of information), and the wish by government agencies to maintain confidentiality for commercial or national security (or perhaps more sinister) reasons.

This set of clauses assumes a service that is being provided to a privatesector organisation. Services provided to educational establishments, public libraries or archives will require different clauses. Any readers who work in further or higher education are strongly recommended to read the text of the various Jisc model licences, as we consider them to be very fair. Readers who work in public libraries should have a look at the public library licence developed by Licensing Models.3 Readers who work in the private sector should also check these academic and public library licences for wording that might be useful when negotiating with a database service provider. The clauses below should not be regarded as a ‘model contract’, but they are presented to give readers an idea of the sorts of clauses that they are likely to encounter. As has been stressed throughout this book, any draft agreement should be negotiated, and explanations sought for the reasons for particular clauses if they are unclear or thought to be unfair.

Definitions

In this Agreement, , the following meanings shall apply:

‘Provider’: [name and address]

‘You (and Your)’: the customer identified in the Registration Form, with whom Provider enters into the Agreement, and any person who Provider reasonably believes is acting with the customer's authority

‘Account’: the facility extended under this Agreement allowing You to access and use the Service

‘Agreement’: the entire contract between Provider and You for the provision of the Service incorporating these terms and conditions, the Registration Form, and the documents referred to in them

‘Approved Use’: your private and internal business use only

‘Authorised Users’: the users notified to Provider in the Registration Form

‘Data’: the information and other materials in whatever form from time to time available through the Service

‘Fees’: the charges for the Service as set out and amended from time to time in the Provider's price list

‘Passwords’: unique user names and codes

‘Registration Form’: the Service registration form

‘Rights’: copyright, database and other intellectual property and related rights owned by the Provider and its licensors

Introduction

In this chapter, we will cover why it is important to develop policies relating to information law, what a typical policy might contain, what the key areas that should be covered by such policies are, such as risk management, dealing with complaints, consent management, ownership of rights and use of third-party content.

It is not difficult to make the case for the need for formal policies, whatever the size of the organisation or of its LIK management function. LIK workers are likely to be managing copyright and permissions associated with access to print and electronic resources on a daily basis, and are likely to be involved in issues relating to FoI requests and/or data protection issues on a regular or irregular basis. This means that proficiency and awareness of these topics is increasingly a requirement of their skills set. A lack of a basic understanding of copyright and database rights, or of FoI or data protection law, can restrict access to information and resources, could be detrimental to an organisation's ability to maximise the impact and/or exploitation of IPR that it owns, as well as putting the organisation at risk because of its failure to comply with its contractual or legal obligations. Other risks relate, for example, to users or staff copying more than they should, using materials in ways they should not or viewing, sharing or downloading inappropriate/illegal material, or the organisation giving incorrect advice or failing to respond correctly to an SAR or a FoI request.

The key risks for an organisation not getting its policies right, or having appropriate policies but staff ignoring them, are:

• ◆ breaking the law

• ◆ more stress and uncertainty than necessary

• ◆ potential financial penalties

• ◆ potential damage to reputation

• ◆ increased pressures on resources

• ◆ discontented users who no longer make use of the services, cause problems, or bad-mouth the organisation to third parties

• ◆ job losses/disciplinary procedures

• ◆ an over-cautious approach, which leads to frustration for others, or failing to grasp opportunities that present themselves. It is clear that the business case for putting relevant policies in place is extremely strong.

Introduction

Management of information should be a strategic concern in all organisations. They need information to function effectively and for decision-making. Increasingly, information has been recognised as an asset to be exploited as, for example, in intellectual property. This was first publicised in the KPMG report Information as an Asset: the board agenda (Hawley, 1995), confirmed through research (for example see Oppenheim,

Stenson and Wilson, 2002) and revived in 2019 through CILIP. Information law compliance takes place within broader information governance frameworks. Information governance refers to control of the use of information throughout its lifecycle from creation to preservation or destruction. The goal of information governance is to ensure the following:

• ◆ identification of information assets, their quality and their value to the organisation

• ◆ that the information is secure and is available and accessible however and whenever it is required and, at the same time, no unauthorised person can access it

• ◆ development, communication and implementation of policies and procedures for information management that address organisational goals, comply with all legal and regulatory frameworks and are responsive to change

• ◆ people within the organisation have the necessary knowledge, skills and authority to be aware of, and implement, appropriate policies and procedures.

Information governance frameworks

Information governance frameworks are concerned with the management of information in all its forms, information systems and information security, within the organisation. The scope of information governance frameworks also encompasses legal, regulatory and any external information that has an impact on the organisation's obligations. All staff involved in the creation, management, use and sharing of information should be covered by these frameworks, which set out policies and procedures and the rights and roles of staff, suppliers, users, customers and all other stakeholders.

Information governance frameworks should include a range of policies, recognising all aspects of information management and use. Such policies should include information, records and archives management; information systems and security; compliance with information-related laws, such as data protection, and copyright; and information sharing, including FoI in the case of public bodies. Staff training and development policies are also crucial to ensure policies are implemented correctly.

Introduction

Organisations drawing up procedures to implement information policies can make use of various sources of guidance, tools, and pro-formas. The main source of authoritative and detailed guidance on data protection and FoI is the Information Commissioner's Office (ICO). The Scottish Information Commissioner also provides FoI advice and toolkits for public authorities and other organisations subject to FoI in Scotland. The UK IPO provides some information and guidance on rights management, but little in the way of tools or templates to support this. Other sources of guidance on copyright and licensing include Jisc, which supports the higher and further education sectors in the UK in licensing and managing information resources. CopyrightUser.org provides advice on using copyright works for rights holders as well as copyright users, including libraries and archives. This chapter introduces sources of advice to help organisations comply with information laws and manage their own, and others’ intellectual property appropriately. It also introduces toolkits and templates that organisations and LIK services can use in the development and implementation of their procedures.

Copyright and licensing agreements

Contractual arrangements are the main basis of intellectual property rights (IPR) management in organisations, including libraries and archives. As far as an organisation's own IPR are concerned, standard agreements can be drawn up to ensure the organisation owns rights in accordance with its policies. They can be effected through standard employment terms and other standardised contractual arrangements with service providers and independent consultants. The organisation's legal experts will normally draw up such standard agreements, but it is important to ensure that there is some flexibility to reflect the organisation's values and the different relations hips it has with its stakeholders, so ensuring that the standardised agreements are fit for purpose and that each party gets what they need from the agreement.

LIK services are more concerned with the use of copyright works in their collections, including reprographic copying and scanning.

This book provides an overview of important information law issues for library, information and knowledge (hereinafter LIK) workers. Focusing specifically on copyright and other intellectual property rights (IPR), freedom of information (FoI), and data protection, the book is based upon UK law as of November 2019. The relevant laws in other countries sometimes differ a bit from UK law, sometimes a lot, and this fact should be borne in mind by readers. LIK workers need to know about these areas of law, both because their organisations must comply with the law and because this knowledge provides them with tools when responding to user enquiries. For example, knowledge of what can be obtained by use of freedom of information legislation can be extremely helpful to users. Thus LIK workers, often at the front line of managing and monitoring their organisation's legal compliance, have roles and responsibilities in both complying with the law and taking advantage of its provisions from time to time.

On a broader level, information law issues dovetail together, creating a sophisticated, complex and delicate balance between facilitating open and free access to information – thus supporting open and accountable government, democratic freedom and an uncensored press – sim ul taneously with the necessity for control and privacy. This balance is not always successfully achieved, which can result in tension and sometimes legal cases and court judgments. Information law tries to achieve this balance by creating clarity about what is definitely legal or illegal, whilst providing exemptions and exceptions and room for interpretation, risk management and the user's own ‘gut feeling’ by the frequent use of terms such as ‘reasonable’, ‘fair’ and ‘justifiable’. LIK workers are operating in a constantly changing digital space in which everyone is often simul taneously a content creator, publisher and user. This makes the interpretation and application of laws that are steeped in hundreds of years of historical tradition challenging. Moreover, the interplay between legal compliance and ethics is complex: often the two follow the same trajectory, but occasionally, ethical considerations, such as the specific nature of content, might preclude its use even if there are very few or no legal compliance issues.

Introduction

Freedom of information (FoI) is legislation that obliges government and other public bodies to reveal documents, data collections, etc., to any members of the public, including the media. Many countries around the world have FoI laws, including the UK. The relevant legislation in England and Wales is the Freedom of Information Act 2000, which also covers Northern Ireland at the moment. Scotland has its own Freedom of Information (Scotland) Act 2002.

The following organisations, many of which employ LIK staff, are covered by UK FoI legislation:

• ◆ government departments

• ◆ local councils

• ◆ schools, colleges and universities

• ◆ health trusts, hospitals and doctors’ surgeries

• ◆ publicly funded museums

• ◆ the police

• ◆ non-departmental public bodies, committees and advisory bodies

• ◆ BBC and Channel 4.

The House of Commons and the Independent Parliamentary Standards Authority are both subject to FoI, but individual Members of Parliament are not.

This means that LIK workers working in such organisations need to understand the circumstances in which they may be asked for, and subsequently may (or may not) need to supply, information to third parties. Furthermore, professionals working in sectors not subject to FoI also need to be aware of the possibilities offered by FoI to help answer queries posed by their patrons.

UK FoI legislation includes a particularly long list of exemptions compared with the legislation in other countries. Unlike data protection, the UK's FoI laws are not tied to any EU Directive or Regulation.1 There is separate legislation in respect of information of relevance to the environment (the Environmental Information Regulations 2004, SI2004/and similar Scots legislation), but that is not considered further in this chapter.

In the EU, many individual member states have explicit FoI laws, or FoI is written into the country's constitution. In addition, a EU Regulation provides FoI for the three main EU institutions to EU citizens and natural or legal persons residing, or with registered offices in, a member state (Regulation (EC) No 1049/2001 of the European Parliament and the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents).

Many such templates are also available online. We recommend that readers consult the ICO's website aimed at small-to-medium-size enterprises. The web page includes background information to GDPR, together with a suggested template privacy notice, which can be downloaded and then amended to suit a particular organisation's requirements.

Privacy Notices, often called Privacy Policies or Statements, must be used by every organisation and written in clear and plain language. They should be concise, and easily accessible. The purpose of a Privacy Notice is to inform a data subject of his/her rights regarding the processing of his/her data. Privacy notices may be displayed in many different places, for example, in forms, in contracts, websites, or on notice boards. It is an externally facing explanation of how you manage personal data responsibly and with respect.

If personal data is being provided by a data subject, your privacy notice or a link to it should be provided at the time that the data is collected. Here are some useful links:

• ◆ See https://ico.org.uk/for-organisations/guide-to-the-general-dataprotection- regulation-gdpr for general guidance.

• ◆ Department or Education model privacy notice: www.gov.uk/government/publications/data-protection-and-privacyprivacy- notices.

• ◆ Also see www.nationalarchives.gov.uk/informationmanagement/ legislation/data-protection for guidance on archiving personal data.

Introduction

Most developed countries have at least a minimum level of data protection legislation in place. The USA is notable in having only limited protection at a federal level, although many states have introduced such legislation. Data protection is based upon the notion that every individual has some rights over information about them and that abuse of this information should be prevented. Data protection legislation is an important com - ponent of the legal compliance framework, whose ultimate objective is trying to achieve the appropriate balance between privacy and freedom. Typically, data protection legislation requires the following:

• ◆ Data controllers (those that are responsible for managing data about individuals) must register with a supervisory body if they currently, or plan to, use so-called ‘personal data’, and if those data can be searched or manipulated using the individual's name (or equivalent identifier).

• ◆ Data subjects (living identifiable individuals who have data about them stored and manipulated by third parties) have the right to know whether data is held about them, and inspect what information is held about them.

• ◆ Data subjects can sue for damage caused by inaccurate data about them, or for other breaches, such as unauthorised release of such data.

• ◆ Data controllers must abide by certain general principles and codes of practice.

• ◆ Data processors (anyone who handles personal data under instructions from a data controller) have to follow similar rules to their controllers.

• ◆ There are exemptions for matters of national security, crime prevention, etc.

• ◆ There must be systems in place to prevent unauthorised access, deletion or amendment of records containing personal data.

However, some countries’ legislation goes much further, for example:

• ◆ Data controllers must explicitly request the permission of data subjects before handling their personal data.

• ◆ Data subjects can insist that data about them is deleted.

• ◆ Data subjects shall be entitled to know to whom data about them has been passed, and where data about them has come from.

• ◆ No decisions about the data subject may be made purely relying on information obtained from personal data files.

Introduction

Whether you are providing access and usage rights to information resources (digital, print, and/or any other media or format) in which you own the rights (licensing out) or signing licences with organisations that are offering to supply electronic information to your institution (licensing in), negotiating the right terms will be extremely important. Contract management is an essential component of copyright compliance, an area of responsibility that has grown rapidly in recent years, and arguably one cannot do one's job as a manager of an electronic information service without getting involved in these crucial information law issues. Even if you work for an institution that has in-house lawyers, few, if any of them will have any experience of contractual terms within the context of LIK services, and specifically of contracts relating to access to information resources and/or information management issues. This chapter is written largely from the point of view of someone who is thinking of buying in from a third party offering a licence. If you are proposing to license out the use of resources that your institution holds the rights to, think of this chapter as identifying the issues you will have to address to satisfy potential clients of your services.

The electronic information industry

The electronic information industry (which term includes those selling – or offering for free – information over the web as well as through other electronic media) is a particularly complex industry. This is in terms of the players who are involved, the many relationships that are possible between these players, as well as the inevitability that the players will take on multiple roles in the supply chain of resources, depending upon your relationship to the information resources themselves. This complexity is one (but by no means the only) reason why it is so difficult to measure the size or growth rate of the industry. Who, then, are the players involved in the industry?

The first player in the electronic information industry is the information provider, also known as the database producer or similar terms. This is an individual or organisation that creates information, which is offered directly to end-users or which is licensed to other organisations (often called aggregators) who allow users access to them. Information providers can be, but are not always, also publishers in media other than electronic, e.g. print.

Introduction

Copyright is the exclusive and assignable legal right, initially given to the author of an original work for a fixed number of years, to reproduce, print, publish, disseminate electronically, perform, or record their creative material. The word ‘initially’ is used, as the author can and often does assign the copyright, i.e. transfer the copyright ownership, to a third party, such as a publisher. Assignment is discussed further below. In order to use copyright materials, you have to know what it is and the difficulties and opportunities copyright can create.

In the UK, copyright law is primarily based on the Copyright, Designs and Patents Act 1988 and subsequent revisions, including the Copyright and Related Rights Regulations 2003, SI 2003/2498, various Copyright Rights in Performances Regulations 2014, some sections of previous Copyright Acts 1911 and 1956, various European Union (EU) Directives (most of which have been transposed into UK law by means of Statutory Instruments), international treaties that the UK has signed up to and case law from UK Courts and the European Court of Justice (ECJ). The key points to note about copyright are as follows:

• ◆ Copyright is an economic right granted exclusively to the creator(s) of an original work, which must be in some tangible or fixed format, to either permit or to prevent other people from copying, and doing certain other things (known as ‘restricted acts’ – see further discussion below), to it. If someone does carry out a restricted act on a copyright work without permission, they may have infringed the copyright, and the copyright owner is entitled to sue in a civil court case and seek forms of redress, such as damages for loss of income, destruction of infringing copies, etc. There are also certain circumstances where carrying out or enabling infringement becomes a criminal offence.

• ◆ In most countries of the world, including the UK, copyright is automatic. In other words, there are no formalities one has to go through, or fees to be paid, to acquire copyright.

• ◆ Copyright does not protect an idea, but it can protect the material expression of the idea.

• ◆ Works are protected regardless of their merit, although they need to be original (i.e. not copied from something else) and show some level of skill and judgement in their creation.