Sony's PlayStation Network data breach - the largest ever?

Posted by Lucy McGovern & Elisabeth Koster

Image courtesy of DeclanTM

On 26 April 2011, Sony Corporation (Sony) announced that user information from its PlayStation Network (PSN) and Qriocity online music and video service had been compromised.

Sony stated that between 17 and 19 April 2011, an unauthorised person obtained PSN user information including names, addresses, email addresses, birth dates, usernames, passwords, logins, security answers and purchase history. Most significantly, Sony could not rule out the possibility that credit card data had been taken.

With approximately 77 million account holders affected, the security breach has been dubbed one of the largest thefts of user information on record.

Sony's response

There is no indication as yet from Sony as to how the breach occurred.

Sony have since engaged an external security firm to conduct an investigation into the breach. The FBI has also been informed of the breach, and Sony has begun rebuilding its system in an effort to prevent future breaches. Sony has liaised with three major United States credit bureaus to offer United States customers the option of placing a 'fraud alert' on their credit file to ensure tighter credit security.

Public scrutiny

Sony has come under particular heat due to its delay in publicly announcing the breach. Although Sony appears to have learned of the intrusion on 19 April 2011, customers were not informed until one week later. This is despite Sony turning off both the PSN and Qriocity services in the interim. Sony has explained that its knowledge of the intrusion came before the company learnt of the full scope of the breach and its potential effect on consumers' data.

On 27 April 2011, the first lawsuit was filed in the United States District Court against Sony by a PSN user. The law suit seeks class action status and claims that Sony failed to maintain 'adequate computer data security of consumer personal data and financial data', and 'unduly delayed' notifying the public. This delay prevented customers from taking mitigating actions such as closing their accounts, checking their credit card reports, or changing their credit card number. Amongst the relief claimed is monetary compensation and an order that Sony pay for credit card monitoring for the plaintiff and all members of the class.

Claim against Sony such as this may, however, be challenging to make out, in light of PSN and Qriocity's Terms of Service and User Agreement, under which Sony expressly excludes all liability 'for loss of data or unauthorised access to [user] data'.

Australian consumers

Sony Australia has confirmed that Australian consumers have been amongst those affected.

The New South Wales Police Fraud Squad has warned Australian customers to be vigilant of identity crime and phishing in the aftermath of the breach, advising that consumers should cancel their credit cards, change their passwords if they use their PSN password for other services or, at the very least, notify their bank that their information has been compromised.

And the Australian Privacy Commissioner has stated that he intends to launch an Own Motion Investigation into the matter.

Partner: Paul Kallenbach

Software licences and royalty withholding tax

Posted by Robert Yunan

The Federal Court of Australia handed down its decision in International Business Machines Corporation v Commissioner of Taxation on 12 April 2011, which addressed whether payments under a software licence agreement (Licence Agreement) between Australian subsidiaries of IBM and its US parent were royalties and consequently were subject to royalty withholding tax (RWHT).  The judgment reaffirms the importance of ensuring that the documentation under which cross border payments are made is carefully drafted to ensure that rights which do not involve the use of IP are separately identified.  This will assist in ensuring that RWHT is not charged on payments for these rights.

Federal Court judgment

The legal principles were not in dispute. 

Under the double tax agreement between Australia and the United States (DTA), a payment will be a royalty where it is a payment of any kind to the extent to which the payment is in consideration for the use of or the right to use any copyright, patent, design, models, plans, secret formulas or process, trademark or other like property or right.  The payment may be for any one or combination of the following:

• the use of an IP right;
• the right to use an IP right (even if the IP right is not used);
• for the use or right to use another like property or right;
• for the supply of certain knowledge/information;
• for assistance furnished to enable the application or enjoyment of an IP right or certain knowledge/information.

The dispute in the case was centred around the rights provided under the Licence Agreement.  IBM argued that the Licence Agreement was essentially a distribution agreement and the IP rights provided were ancillary to the enjoyment of the distribution rights.  The Commissioner successfully argued that the clear intent of the Licence Agreement was to give IBM's Australian subsidiary (IBMA) the rights to IBM's IP (to enable IBMA to carry out its function as the user, distributer and marketer of IBM's goods).  On this construction, IBMA was granted IP rights and the payments were therefore payments for the use of the IP rights (and therefore royalties and subject to RWHT).

The Federal Court's decision in favour of the Commissioner relied on the following key points in the drafting of the Licence Agreement:

• there was no reference in the Licence Agreement to the payments being for the exercise of general distributorship rights;
• the Licence Agreement did not look like a typical distributor licence;
• the Licence Agreement specifically referred to a grant of certain non-exclusive rights; and
• the recitals to the Licence Agreement stated that the Licence Agreement was intended to grant IBMA certain IP rights to assist in IBMA's marketing and distribution role, implying that such a role pre-existed the Licence Agreement and was accordingly covered by a separate agreement.

Lessons to learn from the decision?

While this case does not raise novel points of law, it illustrates the importance of clear drafting to ensure that rights which do not give rise to royalties are separable.  Where a payment is genuinely for a distribution right, the documentation should explicitly refer to a separate distribution right and potentially calculate the payment for those rights separately from any rights to use or access associated IP held offshore.

Partner: Adrian Varrasso