Jusletter IT

Reuse of public sector information (henceforth «PSI») is a worldwide phenomenon for at least last three decades² because information produced by public sector bodies during fulfilling of their duties and tasks can bear a large socioeconomic potential.³ However, this potential is fully utilised only when there is an easy way which allows further use of such data by third parties. Therefore, in 2003, the European legislator adopted Directive 2003/98/EC (the so-called PSI directive) which generally aimed at the creation of a legal framework enabling transparent and non-discriminatory reuse of PSI. The main task of the directive was to enhance economic effectiveness,⁴ with a general rule that any information provided by the Member States should be published in a way that makes its reuse as easy as possible. The directive was amended in 2013⁵ and the new text pushed this approach even further by introducing a duty to publish such information in an open and machine-readable format. Furthermore, there has been an ongoing legislation procedure on the European level and a recast of the PSI directive is being prepared.⁶ The directive will be renamed as «Open Data Directive» and, for the first time, it mentions open data as a way of providing PSI.⁷ It also aims to support the publication of dynamic data gathered by IoT sensors, such as data concerning transportation, in real time by other novel technical means, specifically by Open API. Section 2 of this article describes the practical difference between PSI publication as open data and open API.

Apart from the technical issues of the PSI publication, the legal questions must be taken care of as well. Only then the third parties who use the data can do so as easily and freely as possible. An important part of the process is, therefore, licensing of intellectual property rights protecting provided content.⁸ The article elaborates on sui generis database right protection, its exceptions and limitations and its application on open data and open API. It examines practical issues of open data and open API way of providing PSI and its legal consequences. Section 3 therefore briefly introduces the legal framework of sui generis database right protection and its exceptions and limitations.

Sections 4 of this article is dedicated to a legal analysis of PSI publication in connection with the sui generis right. Firstly, there are examined both practical and legal obstacles presented by sui generis right during PSI open data and open API publication. Secondly, Czech regulation is proposed as a good example of how to overcome such obstacles.

PSI is a potential source of a great economic value that can be gained by their reuse. For example, data that are normally separated because of their different producers can be put together. Thus, they can show new contexts which can result in substantive savings, like in the case of the British National Health Service: «The visualization created from these data revealed potential savings for the National Health Service in UK of around 200 million pounds per annum, if two thirds of proprietary (expensive) statins were substituted with generic (inexpensive) versions of the same drugs.»⁹ Another example is the creation of applications utilising PSI and providing citizens with better services that are offered by the public sector.¹⁰ End users of such applications will gladly pay for them which creates another revenue for the public sector in the form of taxes, employment and other economic factors. The McKinsey Global Institute analysed seven areas (education, transportation, consumer relations, energetics, oil, healthcare and consumer finances) and estimated that the potential revenue of publishing and reusing data in these areas is worth USD 3 trillion annually.¹¹ Apart from the economic benefits of PSI, there are also societal ones, such as the transparency of public administration and greater involvement of citizens in public affairs and decision making.¹²

The European legislator introduced the PSI directive in 2003 and after the amendment from 2013, it requires the Member States to guarantee that PSI is provided as open and accessible as possible technically as well as legally. Public sector information is closely connected with the notion of «open data»,¹³ as a highly effective way of public sector information publication.¹⁴ The general definition describes open data as «data that can be freely used, shared and built-on by anyone, anywhere, for any purpose.»¹⁵ The data must be provided in a way that anyone can legally get it, download it, build on it, alter it and share it with a minimum of legal restriction.¹⁶ From a technical perspective, the data must be provided in an open¹⁷ and machine-readable format.¹⁸ The ideal state of open data is «linked data», an interconnected web of data providing each other necessary contexts.¹⁹ Furthermore, a distinctive characteristic of open data is that the whole database is provided to download in bulk.²⁰ A person who wants to work with open data, must download the whole dataset (a database of coherent data) and incorporate it in its application.

Another way of PSI publication, which also meets the requirements of openness, is using open API (Application Programming Interface). API is a way how two programs can exchange data when the first uses the API provided by the second to access its data.²¹ API can be therefore seen as a presentation layer of a database. It allows machine to machine access to a database without the need to download it completely in bulk. It is therefore perfect for IoT and machine to machine communication in general. According to Grabowski, open API refers to such API which is openly accessible because its specifications (the way how to connect to it and use it) are published online.²² Access to an API can be conditioned with an API key, which can serve as a way, how can an operator of such database control, what is being done with it, who is accessing which data and that it is not exploited in any way. A typical use of open API is a creation of a new application, which uses data and services from several open APIs, thus creating a mash-up.²³

Proposal of «Open Data» PSI directive recast also contains provisions concerning open API. Recital 28 states that well-designed API is useful. API is defined as a set of functions, procedures, definitions and protocols for machine-to-machine communication and the seamless exchange of data. Open API should be supported by clear online available technical documentation. The recital adds that when it is appropriate, also a bulk download should be available. It can be seen, that the proposal recognises both ways of providing PSI – open data and open API. Art. 5 of the proposal then specifies that APIs should be used when a public sector body is providing dynamic data. It can be therefore expected that the share of PSI publication via open API will be rising.

The Sui generis database right was introduced in 1996 by Directive 96/9/EC, and it protects the investment that was made for the creation of the database.²⁴ The right benefits to the maker of the database,²⁵ who is a person or a body «involved both in the initial organization of the database and its financing.»²⁶ A qualitatively or quantitatively substantial investment in obtaining, verification or presentation of the content of the database must be present in order to obtain protection.²⁷ Obtaining refers to a process of incorporating already existing elements into the database.²⁸ In the area of PSI, a public sector body’s investment in database collection of nationally approved pharmaceuticals can be an example of substantial investment in obtaining of the content. Another example might be a private company which wants to reuse public sector data, but first, it must gather them and edit into a right data format.²⁹ The second aspect, verification, refers to a cost spent on ensuring the reliability of the information contained in that database.³⁰ Finally, the third aspect, presentation of the content, refers to an investment, which is spent so the database can fulfil its information purpose and data it contains can be processed. In the light of PSI publication, an example can be a the creation of a script which exports database for a bulk download, but also the investment which is made in the creation and implementation of open API.

The sui generis database right is an absolute right that ensures that the maker of the database can extradite (copy in any way) and re-utilise (any further use) content of the database and that he can prevent anyone from doing so. It can be said that the sui generis database right indirectly protects the content of the database. The maker of the database can license and even waive the sui generis right.

Directive 96/9/EC contains in Art. 8 several limits of the right, which allow extraction and re-utilisation of qualitatively or quantitatively insubstantial parts of publicly available database content under a condition that this action is conducted by a lawful user and that it does not prejudice legitimate interests of the maker of the database. The maker of the database cannot contractually preclude application of this limit of protection.³¹

Art. 9 of the Directive introduces a limited number of statutory exceptions from the sui generis right, which can member states implement in their law. These exceptions cover only publicly available databases. A substantial part of content of such databases can be extracted and re-utilised if i) the database is non-electronic, and the extraction is for private purposes, or ii) extraction is done for illustration, teaching or scientific research, the source is indicated, and it is done only for a non-commercial purpose, or iii) extraction and/or re-utilisation is done for public security or an administrative or judicial procedure. As Hugenholtz mentions, only these few exceptions and that no others are allowed under European law.³² He rightfully claims that this may constitute problems, where sui generis rights overlap with copyright protection.³³ It also means that member states cannot generally set new exceptions from the sui generis database right.³⁴

The first conceptual question is whether the sui generis database right can protect databases produced by public sector bodies. The purpose of this legal instrument is to protect an investment in the database. However, public authorities generally make databases because it is part of their legal duties. They are financed from public funds and therefore any investment in the database is not stricto sensu present. This argumentation was used by Netherlandish Raad van State in a case, in which sui generis right to a database created by the City of Amsterdam was denied.³⁵ On the other hand, national legislation can differ, and there are examples of countries (e.g. Germany and the Czech Republic) in which public sector bodies can generally benefit from the sui generis right. This approach was also indirectly confirmed by CJEU in case Compass-Datenbank.³⁶ It should be therefore assumed that the sui generis right can generally protect databases made by public sector bodies.

PSI should be published in the possibly most open way, which means with as few legal obstacles as possible (preferably none). The easiest way for PSI publication would, therefore, be a case when we can apply statutory exceptions or limitations.

The way of PSI publication (open data or open API) does not play a role when it comes to exceptions from the sui generis right that are enumerated in Art. 9 of the database directive. The first exception, which allows extraction for private purposes of the contents of a non-electronic database cannot be used for the obvious reason that both open data and open API are provided electronically. The second and third exceptions can apply on data both provided as open data and via open API. However, these exceptions are not enough for proper openness of PSI, because the purposes for which the data can be used are very limited.

Art. 8 contains a right limitation that allows a lawful user to extract and re-utilise content of the database for any purpose whatsoever if only a non-substantial part of the database is used. This clearly cannot apply to open data publication; the bulk download always contains the whole database.³⁷ At first glance, it may appear that it should be different in the case of open API because through the API the program accesses only the data it needs at a specific moment, which can be quite a small portion of the whole. However, conclusions from the CJEU decision in the Innoweb case³⁸ should adequately apply to this situation. Even though during one request only a minor part of the content of the database is accessed and extracted, it is necessary to assess the whole process. Open API generally allows accessing the whole database. Thus, when it comes to the possibility of application of art. 8, publication as open data and as API leads to the same conclusion that this article is not very useful.

Where exceptions and limitations do not apply, maker of the database must license sui generis right to provide content of the database fully. As was demonstrated, PSI publication cannot effectively rely on statutory exceptions or limitations from the sui generis right and thus licensing is crucial for this field. Furthermore, proposal of PSI Directive recast contains a specific rule concerning sui generis right: «The right for the maker of a database provided for in Article 7(1) of Directive 96/9/EC shall not be exercised by public sector bodies in order to prevent the re-use of documents or to restrict re-use beyond the limits set by this Directive.»³⁹ Seemingly, this provision brings nothing new, as this rule is silently present in the current version of the Directive.⁴⁰ On the other hand, if the rule will be expressly stated this way in the final version of the proposal, it would put the accent on the necessity of providing PSI correctly. The proposed provision states that sui generis right «shall not be exercised». However, since a standard way of PSI reuse is a commercial application, mere «not to be exercised» does not bring proper legal certainty. Therefore, this proposed rule should be interpreted in the way, that unless there is an applicable exception, public sector bodies must license sui generis right.⁴¹

Practically speaking, the licence is provided as a part of metadata record of published PSI, both in the cases of open data, where the record is connected to a specific open data dataset bulk download, and open API, where the record is connected to the API specifications.⁴² It must be stressed out that in case of publishing open data, export of database content into a new file for bulk download is not a making of a new database, even though the new file fulfils the definition of a database in the meaning of the directive. It is just a copy of the original database.⁴³ As Hugenholtz puts it: «extracting data from a database that is itself a copy of another database may amount to infringement of the sui generis right in that database.»⁴⁴ This means that even though there is a technical difference between open data and open API regarding access to the original database, from a legal perspective of sui generis right protection, both mentioned ways of PSI publication are the same.

There are also practical problems with licensing. Firstly, quite often it is not clear whether a specific database is protected by a sui generis right because it can be hard to say if the substantial investment was present.⁴⁵ A solution of «providing licence, just to be sure», is not advisable as it can cause confusion and low legal certainty of the recipient. Secondly, in a situation (especially in the environment of IoT and machine to machine communication), where are involved dozens of data sets coming from many databases provided via open API or as open data, proper licencing can become very burdening. That is in opposition to the principle of PSI Directive that PSI should be provided in a way that makes reuse of data as open and as easy as possible.

Czech legislator offered an easier way of dealing with the problem of sui generis rights licensing by 2016 amendment of the copyright act.⁴⁶ The new wording of section 94 of the Copyright acts states that «official work exception applies mutatis mutandis to the maker of the database». Official work exception excludes from copyright protection governmental and other public sector documents («official works») created during public service.⁴⁷ Application of this exception can be quite broad because its definition is open: «Copyright protection shall not apply to … any other such works where there is public interest in their exclusion from copyright protection.»⁴⁸ This means that in situations when the database is made as a part of public administration agenda, sui generis right protection does not apply on it. The exception stems from the argument that public databases should not be protected with sui generis right since there is not an investment to protect. It also helps with PSI publication and further reuse of information, because licensing is not necessary, and it is also in line with the proposal of PSI directive recast.⁴⁹ Finally, in my opinion, it is not against European IP law, even though the database directive does not foresee such an exception. Since the official work exemption applies only to public sector databases, this Czech regulation should be understood as an ex-ante waiver of sui generis database rights by the government.

Recent technological and legislative development shows that publication of PSI in the way of open data or via open API and its reuse will be more and more frequent. However, both the public and the private sector must carefully approach the relating IP rights to ensure maximum utility of this process. Published databases are often protected by sui generis database right which must be properly licensed. This paper examined that from the legal perspective of sui generis right are open data and open API ways of data publication the same. Furthermore, it showed that the Czech application of the official work exception on sui generis right could serve as a good example how to regulatorily support PSI publication and reuse. This solution helps to improve legal certainty of both public and private sector; it lowers the administrative burden with licensing and it is compliant with the European legislation.

Adriaans, Pieter, Information. In: Zalta, Edward N. (Ed.), The Stanford Encyclopedia of Philosophy, Stanford 2013.

Buckland, Michael Keeble, Information as a Thing, Journal of the American Society for Information Science and Technology, 1991, Issue 5, p. 351–360.

Burkert, Herbert, Public Sector Information: Towards a More Comprehensive Approach in Information Law, Journal of Law and Information Science, 1992, Issue 1, p. 47–62.

Gilchrist, John, Accessing and Reusing Copyright Government Records, Queensland University of Technology Law & Justice Journal, 2010, Issue 10, p. 213–232.

Grabowski, Sebastian, What is Open Data and How to Benefit from It, Zagadnienia Informacji Naukowej, 2014, Issue 103, p. 43–51.

Hugenholtz, Bernt P., Directive 96/9/EC. In: Dreier, Thomas/Hugenholtz, P. Bernt (Eds.), Concise European copyright law, Second edition, Kluwer Law International, Alphen aan den Rijn, The Netherlands 2016, p. 379–420.

Kim, Doyoon/Kim, Jungchae/Kim, DongKeun/Choa, Minhong/Yoo, Sun K., Real-time Ambulance Location Monitoring using GPS and Maps Open API, Proc. of the 30th Annual International Conference of the IEEE Engineering in Medicine and Biology Society, 2008, p. 1561–1563.

Kim, Sang Il/Kim, Hwa Sung, Ontology-based open API composition method for automatic mash-up service generation, Proc. of the 2016 International Conference on Information Networking (ICOIN), 2016 p. 351–356.

Koščík Michal/Myška Matěj, Database authorship and ownership of sui generis database rights in data-driven research, International Review of Law, Computers & Technology, 2017, Issue 1, p. 43–67.

Mockus, Martynas/Palmirani, Monica, Legal Ontology for Open Government Data Mashups, Proc. of the 2017 Conference for E-Democracy and Open Government (CeDEM), 2017, p. 113–124.

Myška, Matěj/Harašta, Jakub, Less Is More? Protecting Databases in the EU after Ryanair, Masaryk University Journal of Law and Technology, 2016, Issue 2, p. 170–199.

Polčák, Radim, Structure and Proportionality of Fundamental Rights in PSI Re-use, Masaryk University Journal of Law and Technology, 2016, Issue 3, p. 381–400.

Ruijer, Erna H. J. M./Martinius, Evelijn, Researching the democratic impact of open government data: A systematic literature review, Information Polity: The International Journal of Government & Democracy in the Information Age, 2017, Issue 4, p. 233–250.

Safarov, Igbal/Meijer, Albert/Grimmelikhuijsen, Stephan, Utilization of open government data: A systematic literature review of types, conditions, effects and users, Information Polity: The International Journal of Government & Democracy in the Information Age, 2017, Issue 1, p. 1–24.

Sappa, Cristiana/Polcak, Radim/Myska, Matej/Harasta, Jakub, Legal Aspects of Public Sector Information: Best Practices in Intellectual Property, Masaryk University Journal of Law and Technology, 2014, Issue 2, p. 233–249.

Siné, Mehdi/Haezebrouck, Theo Paul/Emonet, Emeric, API – AGRO: An Open Data and Open API platform to promote interoperability standards for Farm Services and Ag Web Applications, Journal of Agricultural Informatics, 2015, Issue 4, p. 56–64.

Thorhildur, Jetzek/Avital, Michel/Bjørn-Andersen, Niels, Generating value from open government data, Proc. of the International Conference on Information Systems (ICIS 2013): Reshaping Society Through Information Systems Design, 2013, p. 1737–1756.

Yannoukakou, Aikaterini/Araka. Iliana, Access to Government Information: Right to Information and Open Government Data Synergy, Procedia – Social and Behavioral Sciences, 2014, p. 332–340.