Below is our latest report on developments in IP, data privacy and cybersecurity law. In this issue, we discuss the EU’s Unified Patent Court, a pending copyright case regarding works created by AI, a fair use case to be heard by the U.S. Supreme Court in its next term, and the enactment of consumer data privacy laws in Utah and Connecticut. This periodic update is provided by Davis Polk’s IP & Tech Transactions group and IP Litigation group.

Notable developments

European Union’s Unified Patent Court takes major steps forward

On July 8, 2022, the Administrative Committee of the Unified Patent Court (UPC) held its second meeting in Luxembourg.  The inaugural meeting, held on February 22, 2022, followed Austria’s ratification of the Protocol on Provisional Application of the UPC Agreement, marking the entry into force of the Protocol and the birth of the UPC as an international organization.  The meeting on July 8th was intended to facilitate the last stage of preparation for the UPC before it is expected to begin operations in early 2023.

The UPC is designed to have exclusive jurisdiction over all European Patents for the European Union member states that have contracted to join the UPC (Contracting Member States), subject to exceptions for a seven-year transitional period. During the transitional period, European patent owners in the Contracting Member States will have the option to enforce their patents before national courts instead of before the UPC.  European patent owners in the Contracting Member States have the option, by notifying the UPC registry, to opt out of UPC exclusive jurisdiction for patents granted or applied for before the end of the transition period, so long as such patents have not already been brought before the UPC.  European patent owners can withdraw the decision to opt-out at any time.

The first two meetings of the Committee adopted the Rule of Procedures of the Court, presented a list of candidates for judges, and confirmed the establishment of the local and regional divisions of the Court of First Instance.  The local divisions of the Court of First Instance are currently planned to be located in Austria (Vienna), Belgium (Brussels), Denmark (Copenhagen), Finland (Helsinki), Germany (Düsseldorf, Hamburg, Mannheim, Munich), Italy (Milan), the Netherlands (The Hague), Slovenia (Ljubljana) and Portugal (Lisbon), and the regional Nordic-Baltic division of the Court of First Instance will be located in Sweden (Stockholm).  The central divisions of the Court of First Instance will sit primarily in Paris, with certain cases relating to mechanical engineering, lighting, heating, weapons and blasting being held instead in Munich.

On August 25, 2022, the UPC announced that it had made significant progress in implementing its case management system, and industry experts anticipate that the UPC may be targeting March 2023 for opening, which would coincide with the first grants by the European Patent Office of Unitary Patents.

The UPC Agreement, which outlines the structure of the UPC can be found here.

Thaler and intellectual property protection through artificial intelligence

A case currently pending before the U.S. District Court for the District of Columbia, Thaler v. Perlmutter, has brought attention to the scope of copyright protection as applied to works created by artificial intelligence (AI).  On June 2, 2022, Dr. Stephen Thaler filed a complaint seeking an order from the district court that would require the United States Copyright Office (USCO) to reinstate the copyright application for registration of a two-dimensional artwork titled, A Recent Entrance to Paradise.

In his registration application, Dr. Thaler listed the author of the work as the AI itself, which he calls the “Creativity Machine.”  Dr. Thaler also listed himself as the owner of the copyright in the work by virtue of the work-made-for-hire doctrine.  The suit seeks to resolve the question of whether copyright law requires a human author or if it may extend to other forms of authorship.

On August 12, 2019, the USCO rejected the application on the grounds that the artwork lacked the “human authorship necessary to support a copyright claim.” Notably, the terms “author” and “authorship” are not defined in the Copyright Act of 1976.  However, as the Review Board mentioned in their response to Dr. Thaler’s second request for reconsideration, in Supreme Court cases such as Burrow-Giles Lithographic Co. v. Sarony and Mazer v. Stein, the Court limits copyright protection to creations of human authors.

Dr. Thaler argues that there is no binding authority that prohibits copyright for computer-generated works, and that copyright law allows for nonhuman entities (such as corporations) to be authors under the work-made-for-hire doctrine.

Such textual intricacies in copyright law differ from patent law, a distinction which was illustrated by the U.S. Court of Appeals for the Federal Circuit (Federal Circuit) in its August 5, 2022 decision in Dr. Thaler’s parallel case, Thaler v. Vidal.  There, Dr. Thaler sought to list his “Device for the Autonomous Bootstrapping of Unified Science” (or DABUS) AI system as an inventor for certain patent applications.  The U.S. Patent and Trademark Office and the Federal Circuit rejected Dr. Thaler’s arguments, and found that the Patent Act unambiguously refers to natural persons because it expressly provides that “inventors” are “individuals.”  As such, DABUS could not properly be an inventor for a patent application.

A decision not to grant copyright protection to AI-generated works could affect the economic incentives of companies to produce works using AI.  Additionally, markets for computer-generated works, which often include non-fungible tokens (NFTs) may be put at risk if they do not fit into the copyright system and are not patentable.  Considering the widespread use of computers to generate works both entirely autonomously or with minimal human involvement, it will be important to monitor courts’ interpretation of the Copyright Act and the extent to which intellectual property protection can be afforded to AI-generated works.

Dr. Thaler’s District Court copyright complaint can be found here, and the USCO’s response to Dr. Thaler’s second request for reconsideration can be found here. The Federal Circuit decision in Thaler v. Vidal can be found here.

Supreme Court poised to clarify fair use defense for copyright infringement

On March 28, 2022, the Supreme Court granted certiorari in Warhol Foundation v. Goldsmith, a case which will be heard during the Supreme Court’s 2022-2023 term.  The case centers around a series of prints and illustrations created by Andy Warhol and based on Lynn Goldsmith’s 1981 photograph of Prince.  Goldsmith licensed the photo to Vanity Fair in 1984 for use as an artist reference, and the magazine in turn commissioned Warhol as the artist.  After the work for Vanity Fair, and beyond the initial granted license, Warhol produced an additional fifteen works that became known as the “Prince Series.”  Upon seeing the Prince Series in 2016, Goldsmith notified the Andy Warhol Foundation (AWF) that the works infringed her copyright in the photo.  In April 2017, AWF filed a declaratory judgment action seeking, among other things, a judgment that the Prince Series is protected as fair use.

Under the Copyright Act, fair use is a defense against claims of copyright infringement.  The test for fair use, as codified in Section 107 of the Copyright Act, considers, among such other factors as the court may determine: (1) the purpose and character of the use; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and (4) the effect of the use upon the potential market for or value of the copyrighted work.  The concept of “transformative use” was first introduced in the Supreme Court in 1994 in Campbell v. Acuff-Rose Music, in which the Court stated that the first prong of the fair use test “focuses on whether the new work merely supersedes the objects of the original creation, or whether and to what extent it is ‘transformative.’”

Campbell was the last case in which the Supreme Court squarely considered “transformative” fair use of an artistic work, and lower courts have since struggled with a clear test as to what makes a work “transformative.”  On April 5, 2021, the Supreme Court decided Google v. Oracle, holding that that Google’s copying of portions of Oracle’s code was “transformative,” because Google used the code to “create new products,” operating in “a distinct and different computing environment,” such that its use “was consistent with that creative ‘progress’ that is the basic constitutional objective of copyright itself.”  However, the Court tailored its opinion to fair use in the context of computer programs and functional, rather than artistic, works.

On July 1, 2019, the district court granted summary judgment to AWF on its fair use claim, finding the works to be transformative because they “add something new to the world of art and the public would be deprived of this contribution if the works could not be distributed.”  Then, on March 26, 2021, the Second Circuit reversed the lower court decision, granting summary judgment to Goldsmith.  The court stated that “an overly liberal standard of transformativeness … risks crowding out statutory protections for derivative works.”  Moreover, “given the degree to which Goldsmith’s work remains recognizable within Warhol’s, there can be no reasonable debate that the works are substantially similar.”  On August 24, 2021, the Second Circuit amended its opinion in light of Google v. Oracle, noting that the decision did not impact the court’s original opinion, because the inquiry of “purpose” which the Court considered in Google was “perhaps a less useful metric” in the case of two works of visual art which “share the same overarching purpose.”

AWF argued in its petition that the Second Circuit incorrectly held that visual similarity – not the meaning-or-message test – drives the transformativeness inquiry.  AWF urged that the transformativeness inquiry be on what a follow-on work “means, not on how much of the original material is discernible.”  The Supreme Court’s clarification of transformativeness for artistic works may have implications for all types of creative work, including digital art, music and literature.

On August 8, 2022, Goldsmith filed her reply brief, arguing that AWF’s petition focused on just one element of the fair use standard under the Copyright Act, and that the Copyright Act does not refer to a “new meaning or message.”  Goldsmith argued that the facts are a classic case of nontransformativeness, and asked the Supreme Court to affirm the Second Circuit.  Oral arguments in the case are set for October 12, 2022.

The amended Second Circuit opinion can be found here. The Andy Warhol Foundation for the Visual Arts’ brief on the merits can be found here, while Goldsmith’s brief can be found here.

Utah and Connecticut enact comprehensive consumer data privacy laws

On March 24 and May 10, 2022, respectively, Utah and Connecticut became the fourth and fifth U.S. states to enact comprehensive consumer privacy legislation, following in the footsteps of California, Virginia and Colorado.  The Utah Consumer Privacy Act (UCPA) will take effect on December 31, 2023, and the Connecticut Data Privacy Act (CTDPA) will go into effect on July 1, 2023, the same day as the Colorado Privacy Act.

While the UCPA shares similarities with the three state privacy laws that came before it, it is narrower in scope and more business friendly.  For example, the UCPA will apply only to controllers or processors conducting business in Utah that meet both (i) an annual revenue threshold of $25 million and (ii) a data collection threshold of either (A) during a calendar year, controlling or processing the personal data of 100,000 or more consumers, or (B) deriving over 50% of their revenue from the sale of personal data while controlling or processing the personal data of 25,000 or more consumers.  In addition, the defined terms of the UCPA further narrow its scope.  Individuals are considered “consumers” only if they reside in Utah and are acting in an individual or household context and such definition expressly excludes individuals acting in an employment or commercial context.  “Personal data” excludes aggregated or deidentified data, as well as “publicly available information,” which includes information that is obtained from a person to whom a consumer disclosed the information, so long as the consumer has not restricted that information to a specific audience.  The “sale” of personal data is also limited to only transactions where the consideration is monetary.  Additionally, the UCPA provides broad exemptions for financial and health information, and does not require data controllers to conduct data protection assessments related to data processing activities. The UCPA is the first comprehensive consumer privacy law passed in a state with a Republican-controlled legislature, and the bill’s sponsor, state senator Kirk Cullimore, has characterized it as “a workable standard” that “significantly pares back the more burdensome and confusing provisions found in similar state privacy legislation.”

In contrast, the CTDPA closely models the comprehensive consumer privacy laws seen in Virginia and Colorado.  Under the CTDPA, Connecticut consumers are granted certain rights to their personal data, including (i) a right to confirm whether a covered entity is processing their data, and access to that data, (ii) the right to correct inaccuracies in their personal data, (iii) the right to delete personal data, and (iv) the right to opt out of the processing of their personal data for the purposes of it being sold, used for targeted advertising, or profiling.  The CTDPA emphasizes consumer opt-out rights, and, effective January 1, 2025, data controllers must employ a mechanism to provide consumers a “freely given and unambiguous choice to opt out” that is “consumer-friendly and easy to use by the average consumer.”  The CTDPA does not have an annual revenue threshold, which means whether an entity is subject to the law is dependent on whether it meets thresholds of either (1) controlling or processing the personal data of 100,000 or more Connecticut consumers or (2) controlling or processing the personal data of 25,000 or more Connecticut consumers and deriving more than 25% of the entity’s gross revenue from the sale of personal data.  However, the CTDPA explicitly excludes personal data processed solely for the purpose of payment transactions from being subject to the law, thereby creating a carve-out for data like credit card information. 

Neither the UCPA nor the CTDPA contains a private right of action, and enforcement of any violations rest solely with the respective state attorney general.  In the event the attorney general seeks to bring an enforcement action, prior to bringing an enforcement action, both the UCPA and CTDPA allow an accused controller or processor a period to cure and remedy the alleged violation, with the UCPA granting a 30-day cure period and the CTDPA granting a 60-day cure period.  However, beginning January 1, 2025, the CTDPA’s statutory 60-day cure period will expire, and the Connecticut attorney general will have the discretion to grant a controller or processor an opportunity to cure.

While the UCPA and CTDPA are the most-recent instances of states passing comprehensive consumer privacy laws, privacy concerns are gaining traction in legislatures across the country.  Certain states have focused on more narrowly tailored privacy laws – for example, Kentucky’s recently proposed Genetic Information Privacy Act relates to privacy issues covering biological samples, such as tissue, blood, urine, and saliva known to contain DNA, while Maryland recently enacted legislation that provides the right to access and delete genetic data.  However, for those states considering comprehensive legislation, the UCPA and CTDPA will serve to illustrate two different directions legislatures may take as they evaluate what framework they want to adopt.

The text of the UCPA can be found here while the CTDPA can be found here.

This communication, which we believe may be of interest to our clients and friends of the firm, is for general information only. It is not a full analysis of the matters presented and should not be relied upon as legal advice. This may be considered attorney advertising in some jurisdictions. Please refer to the firm's privacy notice for further details.