Your Movements Shall Be Traced: The New EU Regulation on Cross-Border Portability (Guest Blog Post)

by guest blogger Marketa Trimble

On May 18, 2017, the European Parliament adopted with amendments the EU Cross-Border Portability Regulation (Regulation (EU) of the European Parliament and of the Council on cross-border portability of online content services in the internal market). The Regulation, which is – as of May 29, 2017 – awaiting approval by the EU Council, introduces important changes to the business of Netflix and other online content service providers (“providers”) that will affect not only providers who are incorporated in the European Union, but also any other providers who provide online content to subscribers in the European Union. The Regulation is a remarkable piece of legislation that raises a number of questions, a discussion of all of which would be too lengthy for a single blog post. This post focuses on only one interesting aspect of the Regulation: the Regulation’s endorsement and justification of providers’ tracking of user movements.

The Regulation requires that providers of paid online content offer EU subscribers who are temporarily present in another EU member state “the same content on the same range and number of devices, for the same number of users and with the same range of functionalities as those offered in their Member State of residence” (Article 3.1 & Recital 21 of the Regulation). For example, when an Estonian subscriber vacations in Belgium, he will no longer see only Belgian Netflix programming; instead, while in Belgium, he will have access to his originally-subscribed Estonian Netflix programming. Netflix will still be allowed to offer its Belgian programming to the Estonian subscriber in addition to his Estonian programming (Recital 23), but the Regulation will not require that Netflix provide its Belgian programming – only its Estonian programming will be required for the Estonian subscriber. The cross-border portability regime within the European Union is mandatory for providers of paid online content; unpaid online content providers may opt in to the regime “to take advantage of the legal mechanism” of the Regulation (Recital 20; also Article 6).

The keys to the functioning of the cross-border portability mechanism under the Regulation are location and localization. First, providers must identify a user’s EU member state of residence (Article 5 & Recital 26). Second, although it is unstated in the Regulation, providers must in some manner trace a user’s movements throughout the European Union to determine the user’s temporary presence, i.e. how long the user is located in an EU member state other than the user’s member state of residence. (Note that the EU legislators have shied away from defining the duration of “temporariness,” which for example the German Bundesrat and the Czech Senate suggested that they do.) Third, for choice-of-law purposes, the actions of the user in the EU member state of the user’s temporary presence will be localized (deemed to occur) in the state of the user’s residence for the purposes of the cross-border portability regime (Article 4 & Recital 24).

It is possible that not all users will be pleased about having their providers follow (and presumably at least temporarily store information about) their physical movements, even if only at country-level detail (Recital 28). Some providers may choose to trace user movements in an unobtrusive way (e.g., by asking users to voluntarily report that they are temporarily outside their member state of residence, although still in the European Union). More likely, though, content providers will use geolocation to trace their users’ movements and verify the temporariness of their users’ location – a practice that may be objectionable to some users. While many providers have been using geolocation to identify users’ current locations, perhaps the providers’ tracing of the durational aspect of users’ movements is not yet common.

Some users may also object to submitting a particular type of document for verification of their residence; for example, it is conceivable that a user might not want to submit a scanned copy of the user’s ID card, which is one possible means of verification that a provider may require (Article 5.1(a)). The requirement by providers of particular means of verification, and their tracing of user movements may lead at least some users to wish they could opt out of cross-border portability if the users are concerned about their privacy and do not want their physical movements to be traced. (Although European Parliament member Kaja Kallas referred to e-IDs as “the most user-friendly means of verification,” most users would not necessarily always equate user friendliness with a high level of privacy and security.)

However, the Regulation does not contemplate the possibility that users would wish to opt out of cross-border portability (e.g., in the example above, that the Estonian user would wish to forego access to Estonian Netflix programming while he is temporarily present in Belgium). Article 7.1 explicitly precludes users from contracting out of cross-border portability because, as Recital 21 summarizes, “parties should not be able to exclude [cross-border portability], derogate from it or vary its effect.” Additionally, Recital 25 precludes contractual choice-of-law provisions that would lead to providers avoiding their obligation to provide cross-border portability. Article 5.4 allows a copyright holder to waive the requirement of location verification, but only as to the initial verification of the user’s member state of residence (also Recital 29), and not as to any verification of the user’s temporary location.

It is perhaps symptomatic of today’s society that the Regulation does not anticipate a user protesting the “advantageous” ability to enjoy the user’s home content while temporarily abroad. As some of my colleagues have noted, it is an unfortunate commentary on the world that users are presumed to want to spend their vacations watching their home programming rather than enjoying local programming and learning about the country they are visiting. Although Julia Reda, a European Parliament member, expressed concern that, without cross-border portability, “making Europe’s amazing cultural diversity accessible to all Europeans” might be inhibited, it is questionable whether cross-border portability will in fact improve the accessibility of diversity and encourage users to enjoy diversity. (See the German Bundesrat’s emphasis in its decision concerning the proposed Regulation that cultural diversity not be impaired by “a more European copyright law.”)

There is something even more troubling about the language of the Regulation that is based on the following interpretation of the Regulation: Providers could interpret the Regulation as giving them no choice but to verify the residency and current location of all their users. While it seems illogical that EU legislators would intend to impose a burdensome obligation on users to accept cross-border portability (with all of its potentially undesirable location verification requirements) without giving users the possibility of opting out of cross-border portability, legislators did not express any such intent in the Regulation. Providers could argue that the Regulation requires them to enable cross-border portability for every user (“shall enable” in Article 3.1), necessitating that they verify the residency and current location of all users, regardless of whether or not a user wishes to enjoy cross-border portability. This argument would mean that the Regulation endorses and justifies large-scale tracking of user movements by providers – an unlikely proposition.

If the omission of any possibility for users to opt out of cross-border portability is by design, one could see the omission as a purposeful attempt to create public outcry about tracing user movements and to instigate public opposition against any territorial limitations on cross-border content. The omission would thus create increased public pressure on copyright owners and content providers to provide content on an EU-wide basis, an outcome that would be in line with the EU Commission’s unfulfilled desire for widespread EU-wide licensing (for a 2014 EU directive on multi-country licensing of musical works see here), if not for completely uniform EU copyright law or unitary EU copyright (see here and here).

P.S.: Once the Regulation is approved, published in the Official Journal of the European Union, and eventually enters into effect, it will require no implementing national legislation; it will be directly applicable in all EU member states, plus in Iceland, Liechtenstein, and Norway.