16 April 2014
Holding Data Hostage
Those in the data hosting industry may wish to revisit their contractual arrangements in view of a recent Court of Appeal decision in England. The case of Your Response Ltd v Datateam Business Media Ltd  EWCA Civ 281 has confirmed that suppliers have no right to retain electronic data pending payment for their services, in the absence of any contractual provision to that effect.
Datateam is a publisher, which keeps a database of subscriber information requiring frequent daily adjustments. Your Response is a database manager, which entered into a contract with Datateam for the management (including maintenance and updating) of its electronic database. The contract was partly oral, partly in writing, but contained no detail as to how the database was to be transferred to Your Response, nor what would happen to it when the contract ended. Indeed, there was no detail as to how and when the contract could be terminated. Datateam gave notice to terminate, but was faced with a refusal by Your Response to provide services for the entirety of the notice period. Your Response also refused to provide access to the database until its outstanding fees had been paid. Your Response instituted proceedings for its fees and breach of contract (arguing that the notice provided by Datateam was not “reasonable”); Datateam counterclaimed for damages as it had engaged a third party to reconstitute the database to enable it to continue with its business. At first instance, the court decided that a database manager could exercise a possessory lien over intangible property (an electronic database in this instance) in order to secure payment of outstanding fees. In doing so, the court recognised the importance of the law keeping track of technological developments and mirroring current commercial practices. It is frequently the case that the service provider’s customers are not located in the same jurisdiction, making recovery of outstanding fees a potentially difficult and costly process. Restricting access to the data is often used in practice as a mechanism to extract payment for outstanding charges. Having been unsuccessful at first instance (the court deciding that Your Response could exercise a possessory lien over the database), Datateam appealed.
There were two questions for the Court of Appeal: 1) The period of notice required of Datateam (i.e. was one month reasonable). 2) Whether Your Response could exercise a possessory lien over the database pending payment of its fees. At first instance, and in the absence of any contractual provision, a “reasonable” notice period was held to be three months (and therefore Datateam had repudiated the contract). This was upheld on appeal. However, the primary focus was on the second question. It has long been settled law that in certain circumstances, a party in actual physical possession of goods can retain possession of them until it has been paid for work carried out on those goods (for example, a mechanic can exercise a lien over the vehicle he is working on for a customer). However, the law has recognised a distinction between tangible property (capable of physical possession and control) and intangible property (which is a collection of rights to benefits obtainable only by action, for example a right of way). It was argued that electronic data was capable of being subject to a lien (and therefore would either have to be classed as tangible property or be subject to a new “hybrid” class of property). The Court considered that the treatment of databases in other areas of the law gave a clear indication that they are intangible property, incapable of “physical possession”; instead, the authors acquire a “database right”, capable of enforcement through legal action. As such, a lien would not attach to such intangible property. Four arguments were advanced by Your Response to counter that analysis: 1) The database itself was a physical object because it existed in physical form on the servers. 2) The essence of possession is physical control, coupled with an intention to exclude others (and therefore the ability to completely control access to something amounts to possession of it). 3) The database could be treated as if it were a document. 4) There is a distinction between electronic data and other types of intangible property. As to (1), the Court didn’t agree; whilst certain physical changes took place to the server upon the entry of data, they didn’t render the data capable of physical possession independent of the media upon which it was stored. The distinction between the data and the object upon which it is held is a long-established principle of law. In the instant case, there was no mechanism for the transfer of the data, however it was common ground that the data was to be transferred electronically and similarly held on the servers. There was no use of any physical media. In relation to argument (2), the Court noted that physical possession and practical control, whilst going hand in hand, were not the same thing; indeed the latter was a much broader concept. Whilst Your Response could exercise practical control, it could not exercise physical control over the data. The Court did not agree that a database could be treated as a document in the usual sense, given that it is not capable of physical possession in the same way as a ledger may be, for example. Argument (3) was therefore rejected. Following previous decisions of the Court and indeed the (then) House of Lords, the Court held that (in relation to argument (4)), it could not accept that the common law recognised electronic data as a separate category of intangible property. Two other arguments were run by Datateam to oppose the existence of a lien. The first was that the maintenance of the database was in the nature of mere “maintenance”. As such, the “work” carried out by the database manager was not “improvement” and therefore was incapable of supporting a lien. The Court did not have to decide the question, but commented that had it had to do so, it would have held that the work (keeping the database updated) did amount to “improvement”, since otherwise it would be akin to a “wasting” asset, becoming less valuable as the information it contained become increasingly outdated. This is of useful guidance for future cases. The second argument was that it was contrary to the terms of the contract for a lien to be exercised. The Court of Appeal was unable to formally decide the question, as the Judge at first instance had not made sufficient findings on the point to enable it to consider the question any further. However, Your Response had provided Datateam with a password which in effect allowed it to have access to the database during the currency of the contract and there were no express or implied terms which restricted or prevented such access. In those circumstances, the Court commented that it would likely have held a lien could not arise, as the exclusive control required in order to demonstrate continuing possession was absent. The Court refused to be drawn as to whether it was appropriate to extend the application of a common law lien to electronic data, noting that it was a matter for Parliament to consider. Also of note was the fact that the Court stated that it was implicit in the contract that once it came to an end, the database would be returned (in its latest iteration) to Datateam and in that respect, the refusal to do so amounted to a breach of contract.
In some ways the result is disappointing, in an age where the vast majority of data is stored and handled electronically. However, the Court did recognise that it was standard practice for liens to be provided for within contracts of this nature. Accordingly, the onus is very much on the contracting parties to ensure that they are sufficiently protected. This decision will have an impact on the bargaining position of the parties and, insofar as such liens are not provided for, hosting providers should consider reviewing their terms and conditions. It is also worth noting that the exercise of such a lien could impact on mortgagors, insolvency processes, and the like, as the beneficiaries would be able to take a more advantageous position than other creditors, albeit subject to challenge. Given the number of “unintended consequences”, it is perhaps appropriate for the Court not to break new ground in this area. There has been some helpful guidance arising from the case in terms of the treatment of electronic data and how it is seen by the Court and this will be of assistance to those involved in the broader digital industries such as e-commerce, hosting, e-gaming and the like.