On May 24, Recommendation (EU) 2023/1018 on combating commercial-scale online piracy of sports content and other live events, such as concerts and theatrical performances, was published in the Official Journal of the EU.

This Recommendation encourages Member States, national authorities, rights holders, and intermediary service providers to adopt effective, balanced, and appropriate measures to combat unauthorized rebroadcasts of such events. By stepping up the fight against online piracy, the Recommendation will help strengthen the competitiveness of the EU’s creative and sports industries.

The Recommendation focuses on three main areas:

– Prompt handling of notifications related to live events: This underscores the importance of hosting service providers taking urgent action to minimize the damage caused by illegal rebroadcasting.

– Dynamic injunctions: The Recommendation promotes the use of injunctions tailored to live events and, in the case of live sporting events, encourages Member States to grant sporting event organizers the standing to seek an injunction when this is not currently possible.

– Commercial offerings and awareness-raising: It recommends that organizers and broadcasters of sporting and live events increase the availability, affordability, and appeal of their commercial offerings to end users throughout the Union. It calls on Member States to raise awareness among consumers about legal options for accessing this type of content and to raise awareness among law enforcement authorities about the problem of piracy.

It also strengthens cooperation between the relevant national authorities and between rights holders and intermediaries to better address the issue of unauthorized retransmissions of live events. Cross-border cooperation among Member States is important given the nature of piracy, which transcends national borders.

Finally, the Recommendation establishes a robust monitoring system to assess its impact on the fight against piracy and to explore new measures if necessary, with the support of the EUIPO Observatory.

Given that the implementation of the Digital Services Act will advance the broader fight against illegal content on online platforms, the Commission will assess the effects of the Recommendation by November 17, 2025 (the deadline by which the Commission will assess how the Digital Services Act interacts with other legal acts, including copyright legislation).

Dr. Juan José Caselles, Head of the Anti-Piracy Department at Elzaburu

On February 21, the long-awaited Whistleblower Protection Act (Law 2/2023 of February 20, regulating the protection of individuals who report regulatory violations and combat corruption) was published in the Official State Gazette (BOE).

This law transposes Directive 2019/1937 of October 23, 2019, on the protection against retaliation of persons who report violations of Union law, also known as the Whistleblowing Directive.

The law incorporates two objectives of the Directive itself: to protect whistleblowers and to establish minimum standards for reporting channels.

What is the scope of the law?

The law protects individuals who report violations of European Union law and serious or very serious criminal or administrative offenses under our legal system.

Therefore, the law focuses on investigations into violations that are considered to have the greatest impact on society as a whole.

What exclusions are provided for in the law?

The law shall not apply to information relating to classified information. Nor shall it affect the obligations arising from the protection of professional secrecy for medical and legal professionals, the duty of confidentiality of law enforcement agencies in the course of their duties, or the confidentiality of judicial deliberations.

Nor shall the law apply to information concerning violations in the conduct of procurement procedures that contains classified information or that has been designated as secret or confidential, or to those whose implementation must be accompanied by special security measures or where required to protect interests essential to national security.

Who are the protected individuals?

Protection extends to all individuals who have professional or employment ties to entities in both the public and private sectors, including those whose professional relationship has ended, as well as volunteers, interns, trainees, and even individuals currently in the hiring process.

Protection is expressly extended to individuals who may provide assistance to whistleblowers, to those in their circle, and to legal entities owned by the whistleblower.

Internal Information System?

The Internal Reporting System is considered the preferred channel for reporting information, since prompt and effective action within the organization itself could prevent the harmful consequences of the actions under investigation.

The internal reporting system must always consist of a channel, a person responsible for the system, and a specific procedure.

The channel must meet the requirements for accessibility, confidentiality, proper monitoring procedures, investigation, and protection of the whistleblower.

The administrative or governing body of each obligated entity or agency shall be responsible for implementing the internal information system and shall act as the controller of personal data.

The administrative or governing body must designate the person responsible for managing the system. The appointment must be reported to the Independent Whistleblower Protection Authority (A.A.I.).

The person responsible for the system must perform his or her duties independently and autonomously from the entity’s or agency’s other bodies; he or she may not receive instructions of any kind in the performance of those duties and must have all the necessary personnel and material resources to carry them out.

Channel management may be carried out within the organization itself or through an external third party, provided that independence, confidentiality, data protection, and the secrecy of communications are guaranteed.

Internal channels must allow for communication in writing (mail, electronic means) or verbally (telephone, voice messaging) or a combination of both. In-person meetings are also permitted at the request of the whistleblower.

Are anonymous complaints allowed?

The law permits the filing and processing of anonymous complaints, subject to the provisions of any national law, or when requested in the context of legal proceedings, or when it is argued that the court needs to know the complainant’s identity to ensure the right to a defense.

Which entities are required to have information systems in place?

All private-sector individuals or legal entities with more than 50 employees are required to have an information system in place.

Likewise, regardless of their number, political parties, labor unions, business organizations, and the foundations affiliated with them are required to comply, provided they receive public funds for their financing.

Regardless of their size, all public institutions and agencies must have an information system.

Private-sector legal entities with between 50 and 249 employees may share among themselves the Internal Information System and the resources allocated to the management and processing of communications, if they expressly so decide.

Is there any external communication system?

The law provides for the creation of an external reporting channel to complement the internal one, which would be administered by the Independent Whistleblower Protection Authority (A.A.I.), an independent administrative authority yet to be established.

This channel must be independent and autonomous.

Any individual may use this channel, either directly or after first filing a complaint through the internal communication channel.

The A.A.I. may accept the complaint for processing, reject it with a statement of reasons, immediately notify the Public Prosecutor’s Office if the conduct could constitute a crime, or refer it to another competent authority or agency.

The time limit for investigating the matter and responding to the whistleblower may not exceed three months from the date the report is entered into the registry. Whatever the decision, it will be communicated to the whistleblower, unless the whistleblower has waived this right or the report was submitted anonymously.

Decisions issued by the A.A.I. do not provide for any appeal, whether administrative or judicial, without prejudice to any administrative or contentious-administrative appeal that may be filed against any decision that concludes the disciplinary proceeding that may be initiated in connection with the facts described.

Rights and Protections Against Retaliation?

Whistleblowers who use internal and external channels will be covered by a specific protection program against retaliation.

Any conduct that could be classified as retaliation and that occurs within two years after the conclusion of the investigations is prohibited and shall be deemed null and void.

The following could be considered retaliation: suspension of the employment contract, dismissal, or termination of the employment or statutory relationship; nonrenewal or early termination of the employment contract; imposition of disciplinary measures; demotion; denial of promotions; etc.

Penalties?

The law provides for penalties in both the public and private sectors in the event of violations, which include, as very serious violations, violations of confidentiality and anonymity guarantees; actions intended to reveal the whistleblower’s identity; breaches of the duty of confidentiality regarding the information; publicly communicating or disclosing information while knowing it to be false; and failure to comply with the obligation to have an internal reporting system in place, among others.

Fines for legal entities can amount to a maximum of 1,000,000 euros for very serious violations.

When does the law take effect, and what is the deadline for its implementation?

The law will take effect 20 days after its publication. The deadline for establishing internal reporting systems is three months from the law’s effective date.

As an exception, for private-sector legal entities with 249 employees or fewer, as well as municipalities with fewer than 10,000 residents, the deadline will be extended to December 1, 2023.

Tránsito Ruiz, Associate at ELZABURU.

After months of uncertainty following the release of the draft bill and several amendments in the Senate, the Whistleblower Protection Act was published in the Official State Gazette on February 21, 2023, as Law 2/2023 of February 20, regulating the protection of individuals who report regulatory violations and combat corruption. Thus, Directive 2019/1937 on the protection of persons who report breaches of Union law—commonly known as the WhistleblowingDirective—has finally been transposed into Spanish law.

This Law, which takes effect 20 days after its publication in the Official State Gazette (BOE), provides for the proper implementation of a whistleblower system—or, in the terms of the Law, an “internal reporting system”—as an essential tool for companies to provide adequate protection to whistleblowers. By their very nature, these systems involve the processing of personal data that presents certain specific considerations that must be taken into account; for this reason, the Act devotes its entire Title VI to the protection of personal data.

In this post, we analyze the most significant legislative developments regarding data protection in whistleblower systems following the publication of this law in the Official State Gazette (BOE):

• Data Limited to the Intended Purposes: Personal data that is not relevant to the investigation of the complaint within the scope of this law must not be collected; if such data is collected by mistake, it must be deleted without undue delay.

• Lawfulness of Data Processing: Data processing that is necessary to comply with this Act is presumed to be lawful. The appropriate legal bases are legal obligation and public interest. For these purposes, special category data may be processed in the complaint system, as it is necessary for the purposes of the corresponding investigation and in accordance with Article 9.2.g) of the GDPR: because it is necessary for reasons of substantial public interest, provided that the processing of the data is proportionate to the objective pursued, essentially respects the right to data protection, and appropriate and specific measures have been taken to protect the fundamental rights and interests of the data subject.

• Duty to Provide Information: Data subjects (including both the organization’s own employees and third parties) must be provided with information regarding the processing of their data in accordance with the provisions of the GDPR; however, confidentiality must be maintained regarding the complainant’s data, whose identity must remain confidential and under no circumstances may be disclosed to the respondent. The identity of the whistleblower—when known because the complaint was not filed anonymously—may only be disclosed to the judicial authority, the Public Prosecutor’s Office, or the competent administrative authority in the context of a criminal, disciplinary, or sanctioning investigation.

• Exercising Rights: Individuals whose data is processed in the complaint system have all the rights provided for in the GDPR, with the sole exception that if the person against whom the complaint is filed exercises the right to object, it is presumed—unless proven otherwise—that there are compelling legitimate grounds justifying the processing of their data; therefore, their request may be denied.

• Access to Personal Data: Only the following individuals may access personal data in the reporting system:

• The person responsible for the system itself and who manages it directly.
• The human resources manager or the appropriate authority when disciplinary action may be taken against an employee.
• The head of the legal department when legal action is warranted.
• Data controllers who need the data to provide their services.
• The Data Protection Officer.

In addition, the information may be shared with other individuals or third parties when necessary to implement corrective measures within the organization or to carry out any applicable disciplinary or criminal proceedings.

• Data Retention Period in the Reporting System: The general rule is that personal data contained in the reporting system shall be retained therein only for as long as necessary to determine whether an investigation should be opened. In any case, if three months have passed without an investigation having been initiated, the data must be deleted from the reporting system, unless it has been anonymized or the purpose of retention is to provide evidence of the system’s operation.

• Data Protection Officer: Notwithstanding the provisions set forth above in the Draft Bill, it is confirmed that the requirement to appoint a Data Protection Officer has ultimately been eliminated for companies that were required to implement an internal reporting system solely because they were subject to this obligation, without prejudice to the fact that they will have to appoint one if it applies to them in accordance with the provisions of the General Data Protection Regulation and/or the Organic Law on Data Protection and the Guarantee of Digital Rights.

• Joint Control. In cases where there is joint control over the management of a complaint-handling system (for example, because a group of companies shares a single system that they manage jointly), the Law expressly mentions the obligation to enter into a joint control agreement in accordance with the provisions of Article 26 of the GDPR.

• Security Measures: Obviously, every reporting channel must have robust security measures in place to ensure, to the greatest extent possible, above all the confidentiality of data, as well as its integrity and availability.

Eduardo Oliveros Caballero, attorney at ELZABURU.

The challenges, risks, and opportunities for exhibitors and holders of patents, trademarks, and designs are back as the MWC takes place in Barcelona in late February 2023!

With its proverbial punctuality, the “Barcelona Commercial Court,” in conjunction with the European Union Trademark and Design Courts in Alicante, has just released its newPROTOCOLFOR ON-CALL DUTY AND RAPID RESPONSE FOR THE MOBILE WORLD CONGRESS 2023.

Legal Remedies to Protect#IP

It should be noted that this Protocol marks the starting point for mobile phone companies to finalize theirstrategiesin light of the possibility (for some) or the risk (for others) that precautionary measures will be adopted to prevent the display of mobile devices and other computing and communication devices (tablets, laptops, wearables, etc.) that infringe on patent, trademark, or design rights.

Depending on each party’s position, the strategy involves the appropriate use of thethree procedural mechanismsto which the Protocol willgive priority:preliminary proceedings (to verify whether the infringing content is being displayed),injunctive reliefwith or without a hearing (to compel the cessation of display), andpreventive briefs(to avoid the risk of surprise actions by rights holders).

A Look Back at#MWC22and Strategies for the Next Edition

According to the Findings Report published by the Barcelona Commercial Court, the previous edition of MWC in 2022 resulted in amisleading outcome: six preliminary notices and only two fact-finding proceedings.

It is important to remember that the previous edition was still held under the shadow of the pandemic, with attendance taking place primarily online rather than in person.

Next year, however, all signs point to the MWC regaining its massive turnout (more than 100,000 attendees, 2,499 exhibitors), and the “swords” of intellectual property will once again be at the forefront.

Mari Cadarso, Associate at ELZABURU

The recent class-action lawsuit filed againstGitHub,Microsoft,OpenAI, and OpenAI Codex, seeking $9 billion, is evidence of a problem that was bound to arise for#artificialintelligence: its development may infringe on#copyright, and great care must be taken.

The lawsuit in question challenges the legality of using GitHub repositories to train GitHub Copilot, a service that auto-completes programming code using artificial intelligence. The lawsuit, filed by Matthew Butterick, alleges that 11 open-source licenses and copyrights have been infringed.

How do artificial intelligence systems work?

The fact is that training AI systems requires feeding them enormous databases (such as those found on GitHub) to develop the large language models (LLMs) that power this technology.

In the case at hand, we are dealing with a large database containing#opensource code. This code, used to train AI, may be copyleft—with viral licenses—or under permissive licenses—which are less open. In any case, they require respect for copyright.

This may require anyone who uses open-source code to disclose its use, attribute it to the author, and comply with the terms of the license, which, among other things, may require keeping the code open source for extended or modified versions of it or for any code into which it is integrated as a component.

Content That Infringes Copyright

Well, this is not the case with the GitHub Copilot service, which would not only violate those rights and terms but would also encourage copyright infringement among its users, since they are unaware that the code snippets used to autocomplete their own code belong to someone else. Thus, they may even be creating commercial code without having true freedom to use the code provided by GitHub Copilot for this purpose.

AI systems from other companies, such as Google and Facebook, are being developed in the same way. And they are not only using programming code to power this technology, but also other types of copyrighted texts, such as literary works, journalistic texts, music, etc.

For this reason, many experts are questioning whether the use of such works to fuel the development of this technology is valid and what measures need to be taken to ensure that it is. Of course, human inspiration draws from sources and not from nothing, and it is legitimate for AI to do the same; but what measures need to be taken to ensure that AI does not generate content that infringes copyright after reading those sources?

At the very least, this will force companies that use GitHub Copilot and other similar tools to conduct thorough code audits. Otherwise, they risk having all their work rendered commercially unusable, among other things.

Alberto López Cazalilla, attorney at ELZABURU

On November 3, the Congress of Deputies approved the Draft Law on the Promotion of the Startup Ecosystem, better known as the Startup Law. It was finally enacted on December 21 and took effect upon its publication in the Official State Gazette (BOE) the following day. This law has the following main objectives:

– Creation and growth of innovative, knowledge-based, digitally driven, and fast-growing companies (hereinafter referred to as “startups”).
– Attracting talent and investment by creating favorable ecosystems.
– Attracting specialized investors or “business angels.”
– Fostering the development of hubs in outlying cities as well as in rural areas.
– Promoting investment in innovation, leveraging available public support instruments, and strengthening public-private partnerships

It is important to note that in order to benefit from the provisions of this law, it will be mandatory—as an essential requirement—to obtain the “startup” designation issued by the National Innovation Agency SME S.A. (ENISA).

This agency will assess whether the company meets all the requirements: being newly or recently established, being independent, having its registered office or permanent establishment in Spain, having at least 60% of its workforce in Spain, being innovative, not being publicly traded or having distributed dividends, and having annual revenue of no more than ten million euros.

Given the need for legal provisions that adapt the current reality to the intrinsic characteristics of these companies, the bill introduces a series of new provisions in the areas of tax, commercial, civil, and labor law, which will be analyzed from three perspectives: that of the startup itself, that of the employee, and that of the investor.

Startups will enjoy significant tax and legal benefits

As we noted in the introduction, the company must apply for startup status. Once the application is submitted, ENISA will have a maximum of three months to grant the corresponding certification; if it does not issue a decision within that period, the administrative silence will be deemed a positive decision.

Once ENISA issues the authorization, the startup will be entitled to the following incentives:

First, a reduction in the corporate income tax rate from the current 25% to 15%, for a maximum of four years starting from the first fiscal year in which the taxable income is positive, provided that the company maintains its status as a startup, bearing in mind that after five (or seven) years, the startup will no longer be eligible for the benefits of the law. Second, the startup’s general meeting may authorize the acquisition of treasury stock up to a maximum of 20% of the capital, for the sole purpose of implementing a compensation plan.

Third, all corporations are subject to dissolution due to losses when such losses reduce their net worth to an amount less than half of their share capital. The bill introduces a new provision stating that startups will not be subject to such dissolution until three years have elapsed since their incorporation.

Attractive incentives for employees to attract talent

With the aim of attracting talent and providing an attractive and appropriate compensation policy, the tax treatment of the regime known as stock options has been improved. The tax exemption limit, which was 12,000 euros, has been raised to 50,000 euros per year. In fact, and as a significant new development, under the new regulations, taxation will be deferred until the gain from the stock options is realized and liquidated or, if that is not possible, ten years after the shares or equity interests are granted.

Furthermore, with the aim of attracting foreign talent, this bill improves access to the special personal income tax regime for workers posted to Spain: it reduces the number of tax years prior to the posting to Spain during which the taxpayer cannot have been a tax resident in Spain, from ten to five years.

In addition, workers covered by the Special Social Security Regime for Self-Employed Workers (RETA) who exercise effective control over a startup and who are also employed by another employer will receive a 100 percent reduction in their RETA contributions for three years.

Improvements to Tax Deductions for Domestic and Foreign Investors

The tax deduction for investments in new or recently established companies is being increased, raising the deduction rate from 30 to 50 percent of the amounts paid for the subscription of shares or equity interests and raising the maximum base from 60,000 to 100,000 euros per year.

In addition, the time limit for claiming this deduction on the purchase of shares or equity interests is generally extended from three to five years, counting from the entity’s incorporation, and up to seven years for certain categories of startups, such as those in the biotechnology, energy, or industrial sectors.

Tax incentives are provided for the performance-based management of venture capital firms

On the other hand, if the investment in startups is made through an investment fund, there will be a team of people responsible for managing that fund. It is very common for them to be compensated with a performance fee (carried interest), in addition to other types of fees.

In line with regulations in neighboring European countries, the tax treatment of compensation earned for successful management is regulated. In this regard, carried interest will be considered income from employment. However, a 50% tax credit will apply, with the aim of aligning the tax treatment with that of neighboring countries.

In conclusion, the passage of this law marks a decisive step forward in a sector that has been calling for specific regulation for years, especially considering that Spain ranks fourth in Europe in terms of the number of startups, with 11,100 companies employing 140,000 people, according to the PwC report “The Socioeconomic Contribution of South Summit in Spain.”

Alberto López Cazalilla, Attorney at ELZABURU

On October 19, 2022, Law 18/2022 of September 28 on the Creation and Growth of Businesses entered into force following its approval by the Spanish Parliament. Its main objectives are as follows:

• Improve the business climate to promote business creation and growth by adopting measures to streamline the process of starting a business
• Improving regulation and removing barriers to economic activity
• Reducing Commercial Delinquency
• Improving Access to Financing

To achieve these objectives, the legislation introduces a series of new provisions, which are detailed below:

• Incorporation and Digitization of Companies

The legal minimum of 3,000 euros required to form a limited liability company is now 1 euro, but the following must be taken into account:

• An amount equal to at least 20 percent of the profit must be allocated to the company's legal reserve until that reserve, together with the share capital, reaches 3,000 euros.
• In the event of liquidation, if the company’s assets are insufficient to cover its obligations, the partners shall be jointly and severally liable for the difference between 3,000 euros and the amount of the subscribed capital.

This first measure aims to promote the creation of businesses by lowering their incorporation costs (both registration and notary fees), expanding the options available to founding partners regarding share capital in accordance with their needs and preferences, and reducing any incentives to establish businesses in other countries with lower incorporation costs.

In addition, reforms are being introduced to facilitate and promote the formation of companies in a fast, streamlined, and electronic manner through the Information Center and Business Creation Network (CIRCE) and by using the Single Electronic Document (DUE), thereby reducing registration and notary fees.

• Measures to Combat Commercial Delinquency

Excessive payment delays are common in our country, with small businesses having the highest rates of late payments and defaults because they lack the economic and financial strength of large companies.

To foster a change in corporate culture, the government will first establish the National Delinquency Observatory, which will be responsible for monitoring trends in payment data and promoting best practices.

Second, since electronic invoicing is a useful tool for reducing transaction costs and facilitating access to information on payment terms, its scope of use will be expanded; as a result, it will be mandatory for all companies and self-employed individuals to issue and send electronic invoices in their business transactions.

It is important to note that, today and for several years now, the use of electronic invoices has been widespread among businesses and individuals. In fact, since January 2015, electronic invoices (e-invoices) have been mandatory for all businesses that have commercial relationships with public administrations and whose transactions exceed 5,000 euros.

Consequently, the legislature’s intent is to make its use mandatory in all commercial transactions between companies and self-employed individuals in our country, with a transition period to be established by regulation issued by the Ministries of Economic Affairs and Digital Transformation and of Finance and Public Administration, with the aim of setting forth the technical and information requirements, the minimum interoperability requirements, and the security, control, and standardization requirements for the devices and computer systems that generate the documents. The deadline for its approval will be six months from the publication of the Law in the Official State Gazette (BOE), that is, until March 29, 2023.

In this regard, one year after its adoption, its use will be mandatory for business owners and professionals with annual revenue exceeding eight million euros, while two years after its adoption, it will be mandatory for all other business owners and professionals.

Third, grant programs are being proposed that will enable the widespread acquisition and implementation of digitization solutions (e.g., the adoption of electronic invoicing), notably the Digital Toolkit Program, which has been allocated more than 3,000 million euros in grants.

Finally, an average payment period (60 days, as established in Article 4.3 of Law 3/2004, which establishes measures to combat late payment in commercial transactions) is included as a requirement for accessing grants and as grounds for termination and a criminal offense in public procurement.

Therefore, companies and self-employed individuals seeking grants exceeding 30,000 euros will only be eligible for such assistance if they meet the payment deadlines, which are 60 days for business-to-business transactions; compliance must be demonstrated by submitting a sworn statement.

• Crowdfunding platforms

A new legal framework is being introduced for this type of platform, which seeks to raise funds from a variety of sources for the purpose of financing a specific project, based on Regulation (EU) 2020/1503 of the European Parliament and of the Council of October 7, 2020, on European providers of crowdfunding services for businesses.

The main change introduced by the law is that these types of organizations will be able to provide their services freely without having to obtain a separate authorization in each Member State.

In other words, these platforms will have to apply to the competent authority of the Member State in which they are established for authorization to operate as a crowdfunding service provider. They will then be required to notify the European Securities and Markets Authority (ESMA) so that they may operate throughout the European Union.

In addition, some of the main changes introduced by the regulation regarding the obligations of these types of operators are as follows:

• Portfolio Management: The crowdfunding service provider will be permitted to invest funds on behalf of the investor.
• Per-investor limit: A single individual investment limit per project is established for retail investors, set at the higher of 1,000 euros or 5% of net worth (excluding real estate and pension funds). There is no issue with investing above these limits, but investors will be warned of the risks.
• Total limit: Previously , the maximum amount of funds that could be raised per project could not exceed 2,000,000 euros within a 12-month period.

With the entry into force of the aforementioned European Regulation and, consequently, of this Act, that limit is raised to 5,000,000 euros, provided that investments exceeding that amount will require the issuance of a specific prospectus, the requirements for which are succinctly set forth in Regulation 2017/1129 on the prospectus to be published in the event of a public offering or admission to trading of securities on a regulated market

• These types of platforms may establish and group investors into a limited liability company whose corporate purpose will be to hold shares in the company in which it invests.

• Collective Investment and Venture Capital

On this point, a series of reforms is being introduced that aim to promote and improve collective investment and venture capital in Spain—a sector that needs regulations enabling it to contribute even more to overall economic activity and to protect investors, particularly individual investors.

By way of example only—and this list is not exhaustive—we highlight the following:

• The introduction of a type of vehicle derived from European legislation calledthe “European Long-Term Investment Fund (ELTIF),” which is designed to give retail investors access to investments in unlisted small and medium-sized enterprises, allowing them to invest in asset classes (such as syndicated loans and private debt) that have, until now, been available only to institutional investors.

• Recognition of“debt funds,”which, in the context of economic recovery, can help alleviate companies’ debt burdens and facilitate their growth; additional obligations and requirements are established for their formation.

In other words, the range of options for closed-end funds is being expanded to include structures that have a long track record in other countries in our region.

• Economic Activities

The legislation expands on cooperation and mutual trust among the various public administrations and strengthens the channels through which companies can file complaints when they believe that public administrations are not adhering to the principles of sound economic regulation.

In addition, the list of economic activities exempt from licensing requirements is being expanded, helping to reduce bureaucracy. This list is incorporated into the national list of activities that have been deemed harmless by at least one Autonomous Community.

To this end, numerous articles of Law 20/2013, on Guaranteeing Market Unity, are amended, as well as Article 7 of Law 29/1998, Regulating Contentious-Administrative Jurisdiction, and Article 8 of Law 12/2012 on Urgent Measures to Liberalize Trade and Certain Services.

———-

In conclusion, and pending the adoption of implementing regulations, this law aims to promote the creation of businesses and facilitate their growth and expansion, viewing this as an essential step toward business growth and as one of the most important reforms of the government’s Recovery, Transformation, and Resilience Plan, all with the goal of increasing productivity, improving job quality, and fostering the internationalization of the Spanish economy.

Alberto López Cazalilla, attorney at ELZABURU

Bibliography

• [1] https://www.boe.es/diario_boe/txt.php?id=BOE-A-2022-15818
• [2]https://portal.mineco.gob.es/es-es/ministerio/participacionpublica/audienciapublica/Paginas/Anteproyecto_Ley_Creaci%C3%B3n_y_Crecimiento_Empresarial.aspx
• [3] Law 15/2010, of July 5, amending Law 3/2004, of December 29, which establishes measures to combat late payment in commercial transactions.
• [4] https://www.boe.es/buscar/doc.php?id=DOUE-L-2020-81532

As of yesterday, the Court of Justice has issued another ruling regarding the exhaustion of trademark rights in cases involving the resale of the original product.

The judgment stems from a preliminary ruling requested by a Finnish court in the context of a dispute between “SodaStream” and MySoda Oy regarding an alleged infringement of the SODASTREAM and SODA-CLUB trademarks.

SodaStream is an international company that manufactures and sells carbonation devices that allow consumers to make sparkling water and flavored carbonated beverages using tap water. In Finland, SodaStream markets these machines with a refillable carbon dioxide cylinder, which it also sells separately. The SODASTREAM and SODA-CLUB trademarks are engraved on the labeling and on the aluminum body of those cylinders.

MySoda, a company domiciled in Finland, sells in Finland carbon dioxide cylinders originally manufactured and marketed by SodaStream, which are intended to be reused and refilled numerous times. MySoda, after receiving, through distributors, SodaStream carbon dioxide cylinders that consumers have returned empty, refills those cylinders, removes the label bearing the original brand name, and replaces it with its own labels, which feature the MySoda logo, leaving the original brand name engraved on the body of the cylinders visible.

The preliminary ruling sought to determine whether the owner of a trademark who has marketed products bearing that trademark in a Member State—products that are intended to be reused and refilled numerous times—has the right to oppose the subsequent marketing of those products, in that Member State, by a reseller who has refilled them and replaced the label bearing the original trademark with another label, while still leaving the original trademark visible on the products in question.

Based on existing case law, it was clear that the sale of a refillable gas cylinder by the owner of the trademarks appearing on it exhausts the exclusive rights, such that competitors may refill and exchange the empty cylinders. However, replacing one set of labels with another may be subject to penalties when the conditions under which the product is marketed undermine the legitimate interests of the trademark owner.

When interpreting that exception to the exhaustion of trademark rights, the Court of Justice had previously taken into account only the specific characteristics of the pharmaceutical market. With this ruling, the Court is venturing into a different market.

The key to the ruling is determining whether there is a mistaken impression regarding the economic link between the trademark owners and the reseller who refilled the bottles. Although it is up to the national court to make that determination based on the circumstances of the case, the ruling does not hesitate to provide some interpretive guidelines.

The criteria set forth in the ruling in this regard are quite comprehensive (the degree of clarity of the information provided by the label, industry practices, and whether or not the original trademark remains visible), but it gives the impression that it does not fully side with a “condemnation” in the case at hand and prefers to leave the final decision on the matter to the discretion of the national court. It would not be surprising if each party interpreted the ruling in its own way and if we had to wait for the Finnish court’s decision to learn the outcome.

Author: Enrique Armijo Chávarri

Last Monday, the U.S. Supreme Court agreed to hear a lawsuit against Google LLC that essentially seeks to establish a uniform legal standard regarding the U.S. Communications Decency Act (CDA): whether Section 230 protects the “recommendations” made by platforms such as YouTube, or whether that protection is limited to traditional editorial functions[1].

This has to do with the origin of the lawsuit and the lack of consistency in case law. Regarding the former, the González family lost their 23-year-old daughter, Nohemi González, in November 2015 during the jihadist attack at the Bataclan concert hall in Paris. In the lawsuit, the González family argues that the automated recommendation algorithms used by YouTube were a necessary vehicle for the radicalization of terrorists who later joined the jihad; that is, YouTube’s (and therefore Google’s) recommendation system had helped ISIS grow and recruit followers, which, in the court’s words:

The application of Article 230 to these recommendations eliminates any civil liability incentives for interactive computer services to avoid recommending such harmful materials, and denies redress to victims who might have been able to prove that such recommendations caused their injuries or the death of their loved ones[2].

Why is this important? Because it would mark—since the CDA took effect in the 1990s—the first precedent for limiting the protection granted to Internet service providers with respect to user-generated content.

Section 230 prohibits courts from accepting lawsuits that seek to hold a service provider liable for performing tasks that traditionally fall to publishers, such as deciding what to publish, remove, postpone, or alter.

Examples of cases dismissed under the CDA include Zeran v. American Online, Reno v. ACLU, and others. Since the CDA took effect, the courts have consistently ruled in favor of granting protection to Internet service providers, citing the protection of freedom of speech and information online, as enshrined in the First Amendment to the U.S. Constitution.

The family questions whether the protection afforded by that provision is limited to the traditional functions of a publisher, or whether it also includes the auto-recommendation features of these algorithm-driven systems.

There could be two solutions to this: either establish that such providers will be liable for the recommendations made by their algorithms when the content of those recommendations is defamatory, abusive, or a threat to public safety; or exclude recommendations made by autonomous algorithms from Section 230, given that the platform itself would be directly suggesting content hosted on its servers to the user, who otherwise would not have accessed it, and would therefore be acknowledging“de facto”that it is aware of the content. In both cases, without the help of the platform’s recommendation system, the user would not have accessed the content, which, in the eyes of the González family, was key to the radicalization of the individuals who carried out the Paris attacks.

While it is difficult to predict a possible outcome, the Supreme Court will likely uphold the current line of case law, including “recommendations” within the exemptions of Section 230. It will argue that it is protecting freedom of speech and the press, as enshrined in the First Amendment, and that the question is not sufficiently defined to hold internet service providers liable for what is published on their platforms or to limit any rights in that manner.

However, it is interesting to note the shift in the interpretation of privacy and liability in the United States, which is moving toward positions closer to the approach taken by the European Union.

Various courts have ruled in favor of establishing liability for content posted by users (Force v. Facebook and Dyroff v. Ultimate Software Group, Inc.), aligning with European positions, where if a platform receives notice that defamatory, harassing, or similar content exists, and fails to remove it, it will be held liable for its inaction, as provided for in Directive 2000/31/EC on Electronic Commerce[3], which distinguishes between different service providers—active and passive—and the liability associated with each role. With the adoption on April 23, 2022, of the proposed Digital Services Regulation[4], which amends the E-Commerce Directive and will take effect on January 1, 2024, the liability of these providers increases, bringing the regulations in line with new technologies.

We will have to wait for the U.S. Supreme Court's ruling to confirm whether there will be a change of course—with the greater security for citizens that this would entail—or whether everything will remain the same, and American citizens will continue to live in the Wild West of the internet.

Author: Jaume Mourisco Ayuso.

The judgment of the Court of Justice of the European Union (“CJEU”) dated October 13, 2022, in Case C-256/21 reveals that filing a lawsuit for infringement of a European Union trademark carries risks. If the trademark is vulnerable in terms of its validity, its owner risks the defendant filing a counterclaim for invalidity. Faced with this defense, it is out of the question to simply throw in the towel, withdraw the lawsuit, and wait for the case to end.

If the defendant continues to seek a declaration of invalidity of the trademark in the proceedings, the European Union Trademark Court retains jurisdiction to do so even if the plaintiff withdraws the action. This is the ruling of the Court of Justice.

The ruling stems from a request for a preliminary ruling filed by a German court in the context of a trademark infringement lawsuit brought by KP, as the owner of the EU word mark “Apfelzügle,” against TV, the owner of a fruit farm.

The defendant filed a counterclaim seeking a declaration of invalidity of the trademark to the extent that the term “Apfelzügle” refers to a convoy used for apple harvesting, consisting of several trailers pulled by a tractor.

At the trial hearing, the plaintiff formally withdrew her claim of infringement, but the defendant maintained its counterclaim seeking the invalidation of the trademark registrations.

Given that the jurisdiction of a European Union Trademark Court to declare a trademark invalid is limited to the case of a counterclaim in an infringement action, since general jurisdiction lies with the European Union Intellectual Property Office (“EUIPO”), the German court questions whether the European Union Trademark Court retains jurisdiction to rule on invalidity even after the action for infringement of that trademark has been validly withdrawn.

The withdrawal of a lawsuit alleging infringement of European Union trademarks does not end the litigation when there is a counterclaim for invalidation.

The CJEU’s response was significant: if the European Union Trademark Court were no longer competent, the defendant would have had to file a new action with the EUIPO to obtain a declaration of invalidity, and the plaintiff would have withdrawn from the lawsuit without prejudice to its registered ownership. In other words, filing an infringement action would not entail the risk of losing the trademark because, in the event of a counterclaim for invalidity, it would suffice to withdraw the action.

The CJEU, however, puts a stop to that strategy. The ruling notes that the determination of the validity of a European Union trademark falls under the “shared” jurisdiction of the EUIPO and the European Union Trademark Courts in the event of a counterclaim filed in response to an infringement action. Once the counterclaim has been filed, the European Union Trademark Court not only retains its jurisdiction—even if the plaintiff withdraws its infringement action—but is also, in a sense, required to rule on the validity of the trademark.

Although under the Spanish procedural system the same conclusion could have been reached by applying the principle of “perpetuatio iurisidictionis,” the CJEU’s ruling establishes an important legal doctrine in the specific context of actions involving European Union trademarks. It also draws attention to that other, unwritten principle of “procedural prudence,” which should never be lost sight of when bringing legal actions.

Author: Ana Sanz