Dealing With Breach of Patent

When you discover that a business has breached your patent, what should you do?

The answer to this question has two elements. The first is based on what you can do in law and the second is based on business strategy.

Firstly, before picking a fight with anyone over such a matter, it is important to make sure that you are on firm ground, so do your research carefully. Make sure there is a real infringement and that the infringement is in a market in which your patent applies.

In law, if a business infringes a patent, it is liable to pay damages to the patent owner, which will be based on the loss suffered by the owner. In theory, losses suffered will be compensated for but, in practice, allowing an infringement to continue while you negotiate with (or sue) the infringing business is a high-risk strategy. In most cases, especially where the effect of the patent infringement is severe (for example, where its use directly affects your sales), it is likely that you should send a legal notice to the offending business requiring it to cease the infringement immediately.

This will normally produce one of the following responses:

1. The infringer will agree, cease the infringement and (hopefully) enter into discussions with you about the appropriate payment to make to you by way of compensation. Regrettably, this is not the most common response.

2. The notice will be ignored. In this case, the infringer either hopes that your letter is a bluff and you will not take legal proceedings or believes that it has not infringed your patent and would win that argument were the matter to come to court. Under these circumstances, it is doubly important to do your homework and make sure of your position as legal proceedings are likely to be necessary.

3. Your notice will be met with a denial from the infringer (and occasionally a counter-claim that one of your products infringes its patent). In this case, there is a fight there if you want it (or sometimes even if you don’t).

No matter what the response, in the majority of cases the most satisfactory outcome will usually result from negotiation with the benefit of expert advice, rather than court proceedings. Commercial considerations must be kept at the forefront and it is normally advisable to leave the door open to a negotiated settlement. This is especially so as one of the common outcomes of such disputes is the creation of a licensing agreement, which will require specialist legal advice.

See guidance from the UKIPO.

Intellectual Property: Who Owns It?

One of the biggest sources of disputes in industries based on innovation is a difference of opinion about who owns the intellectual property (IP) created in terms of designs, software, processes and systems.

This is a general guide for businesses to the ‘who owns it?’ problem, but remember that it is a complex area over which many cases have been fought. The best way to make sure who owns what is understood is to have a clear and binding agreement. We will be happy to advise on these issues and prepare any necessary documentation.

One simple way to deal with IP protection and employees is to have the ‘who owns what’ bit set out in the terms of employment. It is also normally sensible for firms which create intellectual property assets to ensure that a non-disclosure agreement is also agreed by their employees.

• If an employee creates something at work as part of their job, the IP probably belongs to their employer, unless there is a specific agreement to the contrary;
• If an employee creates something at work, but not as part of their job (i.e. something which is not work related or which is done in their own time using their employer’s equipment), this is more complex. Strictly, the IP probably is the employee’s, although the employer may have a claim against them for using the firm’s equipment, breach of their employment contract (working on their own projects in the firm’s time) or if they have incorporated any of the employer’s IP in their own creation;
• If your business produces something for someone else under contract – for example, you create a computer program for a specific application for a client who pays you for it - the contract is critical. If you want to reuse the computer code for other projects, make sure the contract specifies that any source remains with you, otherwise it could be held that the right to the program belongs to the client;
• If you create a website or write an article for someone, again, the contract will determine the position. In the absence of an assignment of the copyright, any IP rights you create would normally remain your property. However, any elements provided by the organisation commissioning the work will remain their property.

The UK Intellectual Property Office offers much useful information for owners or prospective developers of designs, patents, trade marks or copyright.

Protecting Your Design Rights

Protecting intellectual property has always been a complex area of law, but in one specific area things may be getting clearer. The Registered Designs Regulations 2001 include several protections for inventors of designs.

If you have a new design which is significantly different (‘novel’) from any previous design that has been made available to the public then you may be able to register the design, provided it has an ‘individual character’. What this means is that the item(s) made from it appear different to an ‘informed user’ of that sort of product.

Having ascertained that the design is sufficiently novel to be registered, the next hurdle is to ensure that the design relates to a product. Under the new regulations this can be almost anything that is an industrial or handicraft item, but it cannot be software. These definitions are less restrictive than the old ones, because they allow protection for the designs of 'one-off' as well as mass-produced products and they allow the registration of the representations of items (icons) as well as industrial designs.

To register a design, you must apply within twelve months of the first public display or use of the design. Under the old rules, the application to register had to be carried out first, before public disclosure of the design.

It is possible to register designs throughout the EC for a period of 25 years by being granted a Registered Community Design.

There are some types of design that cannot be registered. For example, you cannot register an item if it would prevent the use of other parts designed to be attached to it or to match it physically. The main application of this rule will be with regard to spare parts.

Once your design is registered you will have an initial 5 year period during which you have the exclusive right to exploit the design. After that you can have a further twenty-five years provided you renew the rights. For more information, see the UK Intellectual Property Office website.

Patents - The Basics

Some people may think that once you have obtained patent protection for your product, you need do nothing further to protect your rights against infringement or to claim damages from an infringer.

However, in many jurisdictions, merely being the owner of a patent is not sufficient to justify a claim for damages, because an ‘innocent infringer’ (someone who violates a patent because they are unaware that the patent exists) can rely on their lack of knowledge of the patent as a defence.

Making the existence of your patent common knowledge is therefore important. Indeed, in some countries, it is obligatory to identify patented products as such and to show the patent number. Failure to do so can mean that damages from infringers cannot be claimed.

It is also unlawful in some jurisdictions to mark a product as patented if, in fact, it is not.

Patent law varies throughout the world, and the steps that have to be taken to safeguard patent rights vary also.

Enforcing Copyright - The Basics

Copyright is a right that exists as soon as you create the copyright material. You do not have to apply for it. There are some exceptions to copyright, but unless one of these applies, anyone else using your material without your permission is infringing your copyright. The damages receivable for breach of copyright depend on the commercial loss to the copyright owner resulting from the infringement.

Normally, an informal settlement is to be preferred. If you do have to go to court, however, being seen to have tried to achieve a mediated settlement will do you no harm at all.

If you cannot resolve the matter informally, you may need to issue court proceedings. You will need legal advice for this and, in particular, putting together the evidence necessary to prove ownership of the copyright and the commercial impact of the infringement can be an onerous task.

There is a range of legal remedies for breach of copyright:

• You can ask for an injunction which requires the infringer to stop making further infringing use of your material;
• The court can award you damages for infringement of your copyright, based on your commercial loss; and/or
• The infringer can be ordered to deliver up infringing items to you.

Where the infringement is deliberate, intentional or wilful, the court may provide additional remedies, such as increased damages.
Any material you come across will usually be someone’s copyright, so do not be tempted to ‘borrow’ material for your own purposes. It is important to find the copyright owner and obtain their permission to use it.

The exceptions to copyright are limited and can be found on the Intellectual Property Office website.

Material published on the Internet is NOT 'free to use'. In a recent case, a firm which copied more than 100 articles belonging to another company (and which had appeared on various websites which were authorised to have it) was sued by the owner of the copyright. It agreed to an out of court settlement of  £5,000 plus legal cost which were several times the damages.

In December 2012 the Government announced proposals to change of the law of copyright to bring it up to date in a digital age. These have now been enacted in the Enterprise and Regulatory Reform Act 2013.

Bring Your Own Device - Data Contollers' Obligations

The Data Protection Act 1998 (DPA) requires data controllers to take appropriate technical and organisational measures to prevent unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Where an employer allows workers to use their own personal devices, such as laptops, smartphones and tablet computers, this raises a number of data protection concerns. The trend, commonly known as ‘bring your own device’ or BYOD, can mean that workers’ own devices are used to access and store corporate information, including personal data. It is therefore important for data controllers to remember that they have a duty to remain in control of the personal data for which they are responsible, regardless of who owns the device used to carry out the processing.

The Information Commissioner’s Office has produced comprehensive guidance, entitled ‘Bring your own device (BYOD)’, to help data controllers comply with their duties in this respect. This recommends having a BYOD policy covering the types of personal data you are processing and the devices, including ownership, on which these will be held. The policy should be clearly understood by users connecting their own devices to your IT systems and regular checks should be carried out to ensure compliance. When drawing up the policy, the data controller will need to assess:

• what type of data is held;
• where data may be stored;
• how data is transferred;
• the potential for data leakage;
• blurring of personal and business use;
• the device’s security capacities;
• what to do if the person who owns the device leaves your employment; and
• how to deal with the loss, theft, failure and support of a device.

The guidance gives tips on each of these areas, including the use of passwords, data encryption and other security measures that may be introduced, such as ensuring that access to the device is locked or data automatically deleted if an incorrect password is repeatedly input and the facility to locate devices remotely and to delete data on demand.

There is also a section on making sure the BYOD policy facilitates compliance with other aspects of the DPA.

The guidance can be found here.

Data Protection Policies and Personal Devices

Earlier this year, a YouGov survey showed that 47 per cent of all UK employees now use their smartphone, tablet PC or other portable device for work purposes and the Information Commissioner’s Office (ICO) has now issued a warning that organisations are failing to update their data protection policies to account for this growing trend.

The warning comes after the Royal Veterinary College was found to have breached the Data Protection Act 1998 when a member of staff lost a camera that held a memory card containing the passport images of six job applicants. It emerged that the College had no guidance in place explaining how to safeguard personal information stored on personal devices for work purposes.

ICO Head of Enforcement Stephen Eckersley said, “Organisations must be aware of how people are now storing and using personal information for work and the Royal Veterinary College failed to do this. It is clear that more and more people are now using a personal device, particularly their mobile phones and tablets, for work purposes so it is crucial employers are providing guidance and training to staff which covers this use.”

The ICO has made available guidance on this subject, entitled ‘Bring Your Own Device (BYOD)’. This highlights some of the key issues organisations need to be aware of when allowing staff to use personal devices for work. Recommendations include the following:

• Be clear with staff about which types of personal data may be processed on personal devices and which may not;
• Use a strong password to secure all devices;
• Enable encryption to store data on the device securely;
• Ensure that access to the device is locked or data automatically deleted if an incorrect password is input too many times;
• Use public cloud-based sharing and public backup services, which you have not fully assessed, with extreme caution, if at all; and 
• Register devices with a remote ‘locate and wipe’ facility to maintain confidentiality of the data in the event of a loss or theft.

Cookie Law

The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 require consent to be obtained for the use of cookies and similar technologies for storing information, and accessing information stored, on a user’s equipment, such as their computer or mobile phone. The Regulations came into force on 25 May 2011. However, the Information Commissioner’s Office (ICO) announced that organisations would be allowed a year-long period to work towards compliance with the changes. That grace period has now expired.

Previously, privacy rules only required websites to tell users about cookies they used and provide information on how to ‘opt out’. Most organisations did this by putting information in their privacy policy. The new rules require that in most cases websites wanting to use cookies must gain consent, which must involve some form of communication whereby the individual knowingly indicates their acceptance. The ICO made last-minute changes to its guidance on how to comply with the new cookie law in order to clarify the following points with regard to implied consent:

• Implied consent is a valid form of consent and can be used in the context of compliance with the revised rules on cookies;
• If you are relying on implied consent you need to be satisfied that your users understand that their actions will result in cookies being set. Without this understanding you do not have their informed consent;
• You should not rely on the fact that users might have read a privacy policy that is perhaps hard to find or difficult to understand; and
• In some circumstances, for example where you are collecting sensitive personal data such as information about an identifiable individual’s health, data protection law might require you to obtain explicit consent.

The Information Commissioners Office has also produced a short video answering FAQs.

Freedom of Information - What it Means in Practice

The Freedom of Information Act (FOIA) 2000 came fully into force on 1 January 2005 and it has serious implications for businesses doing business with the public sector. The reason for this is that because one of the aims of the Act is to engender greater transparency, the FOIA gives the public the right to obtain a huge amount of information from public bodies. This in turn will affect companies which supply public bodies, as such items as tender documents, contracts and even invoices may be required to be disclosed.

A request under the FOIA creates a requirement to provide the information requested (unless it is covered by an exemption) within 20 days. However, if the public body does not choose to exercise the exemption, then the requested information will have to be disclosed. This could cause particular problems where the information is actually held by the supplier. Furthermore, there is no requirement for the public body to consult with the supplier before complying with a disclosure request under the FOIA.

There is an exemption for companies where disclosure may damage their commercial interests or where the information is confidential. However, such exemptions can be overridden where it is in the public interest to do so.

Patents Made Simple

In response to representations regarding the cost of obtaining intellectual property protection in the UK, the Intellectual Property Office has introduced a new online patent system called Ipsum.

Ipsum will allow businesses to:

• view patent status;
• view up-to-date information on patents;
• access some documents from published patent applications; and
• see which classifications and fields of search have been used.

It will enable patent searches to be carried out more easily and will allow information to be gathered about why patents have or have not been granted. It is free of charge. Previously, each document request cost £5.

In addition, the system is updated in real time, so reliance on out-of-date information will no longer be an issue.

Dealing With Subject Access Requests

Many businesses regard the Data Protection Act 1998 as something that merely requires a lot of form filling and the payment of fees, but there is a lot more to it than that.

The purpose of the Act is to protect a person's right to privacy with regard to the processing of their personal information. Individuals (‘data subjects’ in the terminology) have the right of access to information held about them. For example, a customer of your business has the right to contact you to request a copy of any data you hold on them so that they can check it. This is called a 'subject access request' (SAR). You are required by law to supply the information requested (once you have checked that they are who they say they are, of course). The individual making the request has the right to see data held in any form, not just that held on computer, so storing information in paper form does not avoid the responsibility.

If you receive a SAR, you are required to supply not only all the information you hold on the data subject but also a description of why the information is processed, details of anyone it may be passed to or seen by, and the logic involved in any automated decisions. If you unjustifiably fail to comply with a SAR, the courts may impose a fine of up to £5,000. Any person who believes they have suffered damage and/or distress as a result of a contravention of the Act may seek compensation by applying to the High Court.

In the case of a failure to comply with a subject access request the Court may award compensation for distress alone.

The interpretation of the Court of Appeal is that ‘personal data’ has been defined in such a way that employees are only entitled to see information which is biographical ‘in a significant sense’ and which has the data subject as its focus. The mere mention of a person’s name does not entitle them to see the documents concerned.

What to do When Your IT Doesn't Work

These days it is increasingly the case that when your IT doesn't work, neither does your business. Clearly, the best way to deal with IT problems is prevention, which means doing regular backups, proper systems maintenance, keeping anti-virus protection up to date, having good security procedures and ensuring that you have the right contracts in hand to start with but what should you do if you have a serious IT failure?

The first priority is to get your business functioning properly again as soon as possible. The very first step is to identify the actual cause of the problem. Is it a software fault, a conflict problem, a hardware fault or something else? Until you know why the breakdown has occurred, it may be inadvisable to restore from your most recent backup.

If you do not know the cause of the breakdown (and the chances are that each supplier will blame someone else), you'll need to call in an expert firm to rescue the system fast, so make sure you know who the firms in this field are and which of those can help you. It is essential to have a carefully thought-out disaster recovery plan, as breakdowns are almost inevitable. Being prepared for them is just common sense.

Once the system is restored, your thoughts will turn to apportioning the blame and getting compensated. One little-known problem is that the actions you take in the "rescue" phase may impair your ability to get compensation later. You must also keep the cooperation of your suppliers on a day-to-day basis! We can assist you in negotiating a satisfactory resolution with your suppliers and make sure your rights are fully protected.

What rights you do have will depend on what you have agreed in your contract. One of the big problems with IT contracts is that the suppliers are usually experienced in negotiating these contracts whereas the purchasers are not. The time to get it right is at the beginning; so, making us part of that negotiation process may well mean you avoid head aches later!

A byte of IT prevention is worth many megabytes of cure!

The Eight Data Protection Principles

Anyone processing personal data must comply with the eight enforceable principles of good practice. Here is a checklist.

Data must be:

• fairly and lawfully processed;
• processed for limited purposes;
• adequate, relevant and not excessive;
• accurate;
• not kept longer than necessary;
• processed in accordance with the data subject's rights;
• secure; and
• not transferred to countries without adequate protection.

Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the ‘data controller’ towards the individual, although in some limited circumstances exemptions will apply. Where personal data is concerned, the definition of ‘processing’ becomes very wide. For example, it incorporates the concepts of ‘obtaining, holding and disclosing’ data.

The Office of the Information Commissioner has now published a consolidated version of the guidance on data protection issues in employment. This brings together the four existing guides on recruitment and selection, employee records, monitoring at work and medical information and is intended to provide employers with a complete manual on data protection in the workplace.

E-Commerce Law - Compliance Guide

The Electronic Commerce (EC Directive) Regulations introduced specific legislation to underpin e-commerce. If your business has an Internet presence then you need to make sure that you are not falling foul of these new rules.

The Regulations do not just apply to businesses that allow for online transactions, such as interactive shopping. They also apply to businesses which supply a service that is provided free of charge. The definition of service, within the context of this legislation, is wide.

Basically, the rules apply to most commercial enterprises that have a web site, even if it is just a basic brochure site.


All Websites

Detailed information must now be published on all websites. The information required is:

• Your name
• Your address
• Your e-mail address
• Your telephone number
• Your VAT registration number
• Any registered trade number or similar

Details of:

• any authorisation scheme and the relevant supervisory body which granted the authorisation;
• any professional body or institution with which you are registered;
• any professional titles you hold;
• the Member State where the professional title has been granted;
• reference to the professional rules applicable in the Member State and how your customers can access them.

All references to prices must be clear and must indicate whether or not any tax and delivery costs are included.


Electronic Contracting

In addition, if your business is one where contracts are entered into by electronic means (excluding those carried out exclusively by exchange of e-mails) the following information must also be provided, in a way that it is read and clearly understood by the customer before they place an order for your goods and services:

• The technical steps required to conclude the contract and at what point the person using your service is legally committed;
• whether the contract will be filed by you and whether it will be accessible to the user;
• The technical means for identifying and correcting input errors prior to placing the order;
• The languages offered for conclusion of the contract;
• Any relevant codes of conduct to which you subscribe and information on how these can be consulted electronically.

Your customers must be able to view, print and store the terms and conditions applicable to the online contract. Once an order has been received electronically, you must acknowledge its receipt.


Commercial Communications

The following regulations apply to ‘commercial communications’, which covers a wide range of electronic communications including websites, e-mails and text messages sent for advertising purposes:

• They must be clearly identifiable as a commercial communication and state clearly who is the sender;
• Any unsolicited commercial communications must be clearly identifiable as such, as soon as they are received;
• Any promotional offers must be identified, e.g. any discounts, gifts, competitions, games;
• Any conditions that must be met to qualify for a promotional offer must be clear and easy to understand.

Company E-mails

Don’t forget that legislation such as the Companies Act 2006 and the Business Names Act 1985 applies to electronic letters as well as to the hard copy variety.

For example, registered companies must include the same information in e-mail correspondence as they are obliged to give on business documents. This means that your emails should show the full name of the company, the registered number and the registered address.

Under UK case law, an e-mail delivered to a no longer used e-mail account which was previously used by a business was deemed to have been validly delivered, even though the management of the recipient business had not seen it. Be careful when changing e-mail addresses.


Websites and E-mail disclosure rules

In addition, new regulations were introduced in January 2007 which apply to all limited companies and limited liability partnerships (LLPs) and are designed to ensure compliance with EU regulations relating to company law. Failure to display the required information can result in a fine.

The information required includes:

• The registered name of the company or LLP and any trading name;
• The registered number of the company or LLP and it’s place of registration; and
• The address of the registered office.

For further information see the Companies (Registrar, Languages and Trading Disclosures) Regulations 2006. More recently, the law regarding the collection, use and retention of web cookies has been amended and has started being enforced in the UK from May 2012.  See the EU directive.

Registering a Trade Mark

Your business has its own unique brand and reputation and it is vital in a competitive marketplace to ensure that these are protected from unscrupulous third parties.

Some business owners do not believe there is any point in registering their trading or brand name because they consider their business not large enough to warrant such protection, despite the risk of losing business while others profit from their goodwill. This can be a dangerous view.

Although there is limited redress available to owners of unregistered trade marks in the common law action of ‘passing off’, this can be difficult and extremely costly to prove. If a dispute arises in relation to a registered trade mark, this will be less expensive to resolve. Both the Police and Trading Standards can prosecute those who misuse registered trade marks and infringement can result in a considerable fine or imprisonment.

There are other benefits, too. Although registered trade marks do not entitle the owner to register a domain name as of right, in the event of a dispute it will be the trade mark owner who is more likely to be granted rightful ownership of the domain name. Also, the owner of a registered trade mark can protect it from being used (for example) as a Facebook ‘named profile’ (i.e. www.facebook.com/yourtrademark). Failing to protect your trade mark on social networking sites might allow someone unconnected with your business to use your trading name as part of their profile: the risks are obvious.

For more information see the Intellectual Property Office website.

Direct Marketing Via E-mail - Regulations

UK law relating to the sending of unsolicited direct marketing material by electronic means are based on the EC Directive on Privacy and Electronic Communications.

A major aim of the Directive was to cut down on the amount of ‘spam’ that e-mail users receive from companies with whom they have never had dealings. The Department of Trade and Industry defines spam as ‘unsolicited commercial bulk e-mail sent without the consent of the addressee and without any attempt at targeting recipients who are likely to be interested in its contents’.

Whilst the intention behind the law is clear, the regulations only apply to UK businesses and will do nothing to prevent spam originating in countries where the relevant laws are less strict or, indeed, non-existent. For genuine UK businesses seeking to increase sales of their products to a targeted market, the effect will be more red tape in order to ensure they do not fall foul of the regulations.

The regulations apply to unsolicited commercial e-mails and text messages (SMS) sent to individual subscribers, rather than to company addresses, so much business-to-business e-marketing is not affected. However, under the regulations the term ‘individual subscriber’ includes sole traders, non-limited liability partnerships and their employees.

All direct marketing e-mails, regardless of whom they are sent to, must include clear sender and contact details. In addition:

• businesses must gain prior consent in that an individual must have actively opted in before they are sent unsolicited marketing e-mail;
• if your website uses cookies, or other tracking devices, to recognise previous visitors or to capture information about a user’s preferences, you must tell them this and inform them as to how any collected information will be used. Consumers must be given the right to refuse cookies;
• individuals are given greater rights to decide whether they wish to be listed in subscriber directories. Directory providers will have to give them full information and a reinforced chance to be ex-directory.

If the recipient of the e-mail was a customer prior to 11 December 2003, you may continue to market to them providing:

• their e-mail or SMS details were obtained through the sale, or negotiations for the sale, of a product or service;
• the product or service you are marketing is a similar one;
• the individual had the opportunity to opt out of receiving direct marketing material at the time they gave their contact details and is given the chance to unsubscribe or opt out on each new message that is sent; and
• the identity of the sender is not concealed.

However, where a customer has previously registered an interest in a company’s products or services, but has neither bought anything nor entered into negotiations to purchase which then fell through, then that individual’s consent must be sought before you can contact them again for direct marketing purposes.

The Office of the Information Commissioner is responsible for enforcing the regulations by issuing enforcement orders to those who do not comply. Breach of an enforcement order is a criminal offence liable to a fine of up to £5,000 in a Magistrate’s Court or an unlimited fine if the trial is before a jury. Any individual who has suffered damages as a result of a breach of the regulations has the right to sue the person responsible for compensation.

View regulations.

Patent Searches Improved

Checking for existing patents in force is easy (and free) if you use the UK Intellectual Property Office's (UKIPO) patent databases which are accessible online. The new databases replace the Patents Journal and are designed to make obtaining information sought a quicker process.

The first of the databases contains current UK patents that are open to licensing agreements.

The second database contains patents that are no longer in force.

Using the databases will allow businesses to look for commercial opportunities, such as patents which they may be able to exploit for themselves if they can reach an agreement with the owner of the patent, or patents which have effectively come into ‘free use’ by expiring.

In addition, patent applications that are filed but not yet published will be able to be examined online within a few weeks of filing.

The UKIPO has also launched an anti-counterfeiting and piracy toolkit for businesses.