Richmond Journal of Law and Technology

The first exclusively online law review.

Author: Sean Livesey (Page 3 of 8)

Intellectual Property Rights in Virtual Worlds

By: Etahjayne Harris,

“Virtual Reality (VR) is the use of computer technology to create a simulated environment. Unlike traditional user interfaces, VR places the user inside an experience.”[1] With virtual technology, a user can be transported to a destination of their choice in an instant. Today, virtual reality is increasingly becoming part of our actual reality.[2] For example, “[t]he virtual world Second Life is populated by 1 million people on a daily basis, and there are expected to be as many as 171 million active VR users by 2018.”[3] Companies like Microsoft Corp., Sony Corp., Facebook, Inc. and Samsung Electronics Co. Ltd., are major investors in this emerging technological field.[4] The number of virtual reality devices sold is projected to rise from 2.5 million units in 2016 to 24 million units in 2018. [5] Today, consumers may experience virtual worlds through products like Google Cardboard glasses, Samsung VR, and the Facebook owned Oculus Rift.[6]

Accurate environmental sounds and visual characteristics are essential to creating a truly lifelike virtual reality experience.[7] “As virtual worlds continue to grow in scope and popularity, they also become inextricably linked with the real world.”[8]  The need to create realistic, immersive virtual worlds necessarily means using multisensory effect designs (touch, appearance, sound, smell, taste). Do intellectual property rights like trademark rights extend to multisensory effect designs in virtual worlds?

Currently, intellectual property rights do not extend to multisensory effect designs in virtual reality worlds; but they should. Multisensory effect designs are what make virtual worlds seem more like the real world. Environmental elements like touch, taste, sound, smell, and appearance are very important in real life so it follows that these multisensory effects would be essential to creating quality immersive virtual reality experiences. Can these virtual reality multi-sensory effect designs be protected under trade dress? “Trade dress is a specific type of trademark.”[9] Under the Lanham Act, trademark protection extends to, “any word, term, name, symbol, or device” that “is likely to cause confusion, or to cause mistake, or to deceive” as to the source of a product.”[10] This is a very broad standard. In order to get trademark protection, a word, term, name, symbol, or device must be distinctive and used in commerce.[11] A trademark is considered distinctive if consumers recognize the mark as an indicator of the product source, such that they can use it to distinguish one producer’s product from another. [12] Thus, trade dress protection is limited to, “the meaningful use of a mark in a trade or business.”[13] Furthermore, [i]f the trade dress is not inherently distinctive, it can be protected only if, as a result of use, it has acquired secondary meaning in the marketplace.”[14]

“[W]hether a VR sensory scheme will be categorized as product design or packaging will have profound implications in its trade dress eligibility.”[15] If the Lanham Act requirements are satisfied, a virtual reality business owner may be afforded protection over multisensory effect designs that are either inherently distinctive or have acquired distinctiveness attributable to their business over time. The test for trade dress infringement is, “whether there is a likelihood of confusion resulting from the impression created by the defendant’s accused trade dress.”[16] So if the virtual reality business owner has a valid trademark in their multisensory effect design, he or she would be able to bring a claim against another virtual reality business owner that, “inappropriately used the mark in a way that generates consumer confusion.”[17]

The courts have not yet decided whether multisensory effect designs are protected under current trademark law. As of today, these designs are not protected under intellectual property law. As virtual reality gains in popularity and becomes more widespread, it will be important for the courts to resolve this issue.

 

 

[1] Brian Jackson, What is Virtual Reality? [Definition and Examples] Marxentlabs (2015), http://www.marxentlabs.com/what-is-virtual-reality-definition-and-examples/ (last visited Nov 30, 2016).

[2] See Jonathan M. Purow, Virtual Reality May Create Novel IP Issues In The Real World Law360 (2016), http://www.law360.com/articles/769479/virtual-reality-may-create-novel-ip-issues-in-the-real-world (last visited Nov 30, 2016).

[3] Id. 

[4] See id.

[5] See id.

[6] See id.

[7] See Brian Jackson, What is Virtual Reality? [Definition and Examples] Marxentlabs (2015), http://www.marxentlabs.com/what-is-virtual-reality-definition-and-examples/ (last visited Nov 30, 2016). 

[8] Erez Reuveni, ARTICLE: On Virtual Worlds: Copyright and Contract Law at the Dawn of the Virtual Age, 82 Ind. L.J. (2007).

[9] Ellii Cho, Copyright or Trade Tress? Toward IP Protection of Multisensory Effect Designs for Immersive Virtual Environments, Cardozo Arts and Entertainment Journal, 823 (2016).

[10] 15 U.S.C. § 1125(a) (2012).

[11] See Abercrombie & Fitch Stores, Inc. v. American Eagle Outfitters, Inc., 280 F.3d 619, 630 (6th Cir. 2002) (“Because we can conceive of no ‘thing’ inherently incapable of carrying meaning, any ‘thing’ can come to distinguish goods in commerce and thus constitute a mark within the meaning of the Lanham Act.”).

[12] See Inwood Labs., Inc. v. Ives Labs., Inc., 456 U.S. 844, 851 n.11 (1982).

[13] See Abercrombie & Fitch Stores, Inc. v. American Eagle Outfitters, Inc., 280 F.3d 619, 630 (6th Cir. 2002) (“Because we can conceive of no ‘thing’ inherently incapable of carrying meaning, any ‘thing’ can come to distinguish goods in commerce and thus constitute a mark within the meaning of the Lanham Act.”).

[14] Ellii Cho, Copyright or Trade Tress? Toward IP Protection of Multisensory Effect Designs for Immersive Virtual Environments, Cardozo Arts and Entertainment Journal, 824 (2016).

[15] See id.

[16] J. Thomas McCarthy, MCCARTHY ON TRADEMARKS AND UNFAIR COMPETITION § 8:1 (4th ed. 2014).

[17] Ellii Cho, Copyright or Trade Tress? Toward IP Protection of Multisensory Effect Designs for Immersive Virtual Environments, Cardozo Arts and Entertainment Journal, 824 (2016).

Image Source:

https://broadly-images.vice.com/images/articles/meta/2016/07/14/virtual-reality-1468505507.jpg?crop=1xw:1xh;center,top&resize=2000:*&output-quality=70

 

Understanding “Smart Contracts”

By: Hsiao-Han Wang,

The term “smart contract” refers to “the use of computer code to articulate, verify and execute an agreement between parties.”[1] Unlike traditional contracts, smart contracts are written in codes, stored on distributed ledgers (like a database that can store all sorts of information) and secured by cryptographic keys, which make them immutable and help to avoid malfunction.[2]

The idea of a smart contract is not new, but the development of “blockchain” technology provides a way for this concept to be put into practice.[3] Blockchain is a technology that creates “a decentralized, digital ledger that encrypts, registers, and verifies transactions” through a peer-to-peer system, “essentially making public (or private, if you want) record of transactions, stored on thousands of different computers.”[4] With these characteristics, smart contracts allow the transactions over computer system “be verified, monitored, and enforced without the presence of a trusted third party or central institution.”[5] Smart contract requires no direct human involvement after it has been made a part of the blockchain, and will automatically execute once the pre-set conditions are met.[6] As a result, smart contracts have the potential to avoid risks on implement of contracts, to improve efficiency and to reduce transaction costs in financial or commercial agreements.

As blockchain technology continues to advance, some people have begun to believe that smart contracts will soon become alternatives to traditional contracts.[7] People who embrace technologies are excited about the possibility that smart contract might encode and perform complex agreement automatically.[8] However, there are still some potential practical risks and problems that can arise from the use of smart contracts.

Coding errors and software bugs may be among the key concerns that users have. For example, just like traditional contracts where words and specific terms are used in the agreement, the code base may not perfectly reflect what the parties understand to be their agreement, or the effect of the code base may be misrepresented by a party to be different to what it actually is.[9] Since the execution of smart contracts relies on computer network, cybersecurity is also a potential risk area that should be taken into consideration. A $50 million hack happened to DAO, a decentralized investment fund which was funded by thousands of people raising about $160 million with code based on smart contract protocol, is an example showing the problem of lacking proper programming to secure the system against external attack.[10] Some smart contracts that rely “real-time data feeds” to execute entire or certain parts of the agreement may also face the risk that potential manipulation of underlying data feeds and indices will trigger real-time contract execution.[11]

In addition to the technology, other issues also need to be considered when disputes between parties arise. When parties take legal action, questions such as where to bring suit or what law to apply come into play. There is currently no international internet law. Therefore, negotiation on jurisdiction may need to be set up beforehand when parties involved are from different states or even nations.[12]

The underlying characteristics of blockchain and smart contracts bring up potential legal issues as well. For example, one of the characteristics of blockchain is its transparency, which allows users to gain access to any permanent records on blockchain.[13] While the records are anonymously stored, which does not show the identity of transactions, information regarding the detail of transactions allow others to guess on it.[14] This, therefore, may raise the privacy concerns for contracts and property ownership, after all, some financial and commercial data is highly sensitive.[15] Another example may be deriving from the character of decentralization. Blockchain allows people to create a new type of entity, which is called “decentralized organization.” Such organizations are composed with “autonomous individuals given discrete tasks and rewards,” and operate in the way more like corporations but without formal legal structure.[16] Lack of formation initially does not sound like a big deal in terms of day-to-day operation. It would become a serious problem for participants, however, when this kind of organization gets sued in the court. Since it is a new type of entity, what law or classification should apply to them is still a question up in the air. But without formalized legal structure, courts are likely to hold individuals in the organization personally liable.[17]

The term “smart contract” does not have a settled definition yet, and the concept is apparently still at an early stage of development. However, as the technology progresses, state and federal government may need to develop a set of statutes or regulations to deal with various possible situations in the future to address risks and issues that may result from this new type of contract. It may be fair to say that smart contracts might be able to replace some of the functions of traditional contracts in the future. Nonetheless, it also creates new legal issues which are still waiting for a more definitive and suitable solution to come by.

 

 

[1] Josh Stark, How Close Are Smart Contracts to Impacting Real-World Law?, CoinDesk (Apr. 11, 2016, 2:00 PM), http://www.coindesk.com/blockchain-smarts-contracts-real-world-law.

[2] See Kate H. Withers, Smart Contracts: Opportunities and Legal Risks in FinTech, National Law Review (Nov. 8, 2016), http://www.natlawreview.com/article/smart-contracts-opportunities-and-legal-risks-fintech.

[3] See Lee Bacon, Nigel Brook & George Bazinas, “Smart Contracts”: Where Law meets Technology, Clyde & Co (June 22, 2016), http://www.clydeco.com/insight/article/smart-contracts-where-law-meets-technology.

[4]Casey C. Sullivan, What Is Blockchain? A Lawyer’s Guide, FindLaw (Nov. 14, 2016, 10:58 AM), http://blogs.findlaw.com/strategist/2016/11/what-is-blockchain-a-lawyers-guide.html; see also Joe Dewey & Shawn Amuial, What Is A Blockchain, Big Law Business (Sept. 22, 2015), https://bol.bna.com/what-is-a-blockchain.

[5] Benjamin Beck & Dr. Ulrich Worm, Blockchain-Based Applications – Evolving Legal Issues, Mayer Brown (Sept. 8, 2016), https://www.allaboutipblog.com/2016/09/blockchain-based-applications-evolving-legal-issues.

[6] See Joe Dewey & Shawn Amuial, What Is a Smart Contract?, Big Law Business (Sept. 24, 2015), https://bol.bna.com/what-is-a-smart-contract.

[7] See Stark supra note 1.

[8] See Cheng Lim, TJ Saw & Calum Sargeant, Smart Contracts: Bridging the Gap Between Expectation and Reality, Oxford Business Law Blog (July 11, 2016), https://www.law.ox.ac.uk/business-law-blog/blog/2016/07/smart-contracts-bridging-gap-between-expectation-and-reality.

[9] See id.

[10] See Klint Finley, A $50 Million Hack Just Showed That the DAO Was All Too Human, Wired (June 18, 2016, 4:30 PM), https://www.wired.com/2016/06/50-million-hack-just-showed-dao-human; See also Jamie Redman, How Should We Prepare Smart Contracts to Replace Law Firms?, Bitcoin.com (June 26, 2016), https://news.bitcoin.com/smart-contracts-replace-law-firms.

[11] See Withers supra note 2.

[12] See Richard Howlett, A Lawyer’s Perspective: Can Smart Contracts Exist Outside the Legal Structure?, Bitcoin Magazine (July 11, 2016, 6:52 PM), https://bitcoinmagazine.com/articles/a-lawyer-s-perspective-can-smart-contracts-exist-outside-the-legal-structure-1468263134.

[13] See Peter Kirby, Blockchain Transparent Lending: How Accountable Lending Systems Can Prevent A ‘Big Short’ For The Digital Age, Blockchain News (Feb. 24, 2016), http://www.the-blockchain.com/2016/02/24/blockchain-transparent-lending-how-accountable-lending-systems-can-prevent-a-big-short-for-the-digital-age.

[14] See David Cornwell & James Lawrence, Blockchain – emerging legal issues, Lexology (Oct. 12, 2015), http://www.lexology.com/library/detail.aspx?g=6e5a942e-94ea-4891-a07c-a9d96343dc95.

[15] See Id.

[16] Stephen D Palley, How to Sue A Decentralized Autonomous Organization, CoinDesk (Mar. 10, 2016), http://www.coindesk.com/how-to-sue-a-decentralized-autonomous-organization/#; see also Cornwell supra note 14.

[17] See Palley supra note 16.

Image Source:

http://bluzelle.com/wp-content/uploads/2015/09/smartcontracts.png

Social Media Posts as Evidence

 

By: Kathleen Pulver,

Social media has changed the face of the legal landscape as we know it. As of 2015, nearly two-thirds of American adults were using social media. [1] The percentage is even higher among young adults, reaching an outstanding 90%. [2] It is now commonplace to see warrants appear in cases for access to social media pages and photographs. [3]

In order for evidence to be admitted in court, a four step analysis must be conducted.[4] First, under Rule 401, for any evidence to be admissible in court, it must be relevant.[5] A finding of relevance requires that the evidence have a tendency to make a fact more or less probable than it would be without the evidence, and the fact must be one of consequence in determining the action.[6] Second, after a finding of relevance, the evidence must meet the standard laid out by Rule 901.[7] Federal rule of evidence 901 states: “to satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce the evidence sufficient to support a finding that the item is what the proponent says it is.”[8] The rule provides several specific examples of the appropriate way to authenticate different kinds of evidence, however the most common way to authenticate is through the testimony of a witness, with knowledge of the evidence, that it is what it claims to be.[9] Third, the evidence may not be hearsay, defined by rule 801 as, an out of court statement made by a declarant offered to prove the truth of the matter asserted.[10] Finally, the admission of the evidence must not be blocked by another rule, such as privilege, or rule 403 which blocks the admission of evidence which has its probative value “substantially outweighed by a danger of one or more of the following: unfair prejudice, confusing the issues, misleading the jury, undue delay, wasting time, or needlessly presenting cumulative evidence.” [11] Social media and other electronic evidence present unique challenges when conducting this analysis.

Social media evidence can certainly meet the first prong as we can think of numerous reasons why a certain posting or picture could be relevant to a criminal or civil case. Social media postings have been used as evidence of prior intent to harm and to rebut a claim of injury with photos of the person claiming injury doing things they shouldn’t be able to do while injured.[12] It is also clear that certain social media postings could get around the third and fourth prongs by meeting a hearsay exclusion, such as statement made against interest, and being more probative than prejudicial. [13] The difficulty with social media evidence is the second prong, ensuring that there is enough evidence presented to authenticate the posting to be what it claims to be.

When the evidence rules were first created, creating fraudulent documents was nowhere near as simple as it is now. With the evolution of technology, people are now placing more of their trust in the information provided by online sources, however this faith may be misplaced. Evidenced by the recent Facebook fake news scandal, we cannot trust everything we read online.[14] Like fake news stories, it is not difficult to create a fake social networking page.[15] In fact, a simple google search of “creating a fake Facebook” brings up more than 5 sources willing to assist in the creation of a fake Facebook.[16] This constant availability of means to create fraudulent sources brings up difficult authentication questions under the second prong that have yet to be significantly addressed by most courts. Only time will tell how courts adjust to these newly presented problems.

 

 

[1] See PEW RESEARCH CENTER, Social Media Usage: 2005-2015 (Oct. 8, 2015), http://www.pewinternet.org/2015/10/08/social-networking-usage-2005-2015/.

[2] See id.

[3] See e.g., Bradley v. State, 359 S.W.3d 912 (2012); Elonis v. United States, 135 S. Ct. 2001 (2015).

[4] This post discusses only the federal rules of evidence. Each state has their own rules of evidence, although many closely follow the same analytical structure as the rules for the federal courts.

[5] See Fed. R. Evid. 401.

[6] See id.

[7] See Fed. R. Evid. 901.

[8] Id.

[9] See id.; See also David I. Schoen, The Authentication of Social Media Postings, ABA Association (May 17, 2011), https://apps.americanbar.org/litigation/committees/trialevidence/articles/051711-authentication-social-media.html.

[10] See Fed. R. Evid. 801.

[11] Fed. R. Evid. 403. See Fed. R. Evid. 502.

[12] See Jessica Velasco, Social Media Can and Will Be Used Against You in Court, Socialnomics (Dec. 30, 2014), http://socialnomics.net/2014/12/30/social-media-can-and-will-be-used-against-you-in-court/.

[13] See Fed. R. Evid. 403; Fed. R. Evid. 801(d)(2).

[14] See Mirren Gidda, Facebook Staff Form ‘Secret Taskforce’ to Deal with Fake News Controversy, Newsweek (Nov. 15, 2016, 6:58 AM), http://www.newsweek.com/2016-election-facebook-google-fake-news-donald-trump-521255.

[15] See, e.g., How Do I Create a Page, Facebook, https://www.facebook.com/help/104002523024878?helpref=faq_content (Last visited Nov. 20, 2016).

[16] Search on Instructions for Creating a Fake Facebook Page, Google, https://www.google.com/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=creating%20a%20fake%20facebook.

Image Source:

http://www.klugerkaplan.com/blog/wp-content/uploads/2013/01/12_5_LG06.png

“Smart” Contact Lenses: Spy Gadget or Formidable Threat to Privacy?

By: Genevieve de Guzman,

Wearable technology is not new to the world of action and science fiction movies, but this technology has developed from being mere speculation to having real-world possibilities. As technology becomes an increasingly integral part of people’s daily lives, it seems an inevitability that it also becomes increasingly integrated with our physical beings, and what could be more intimate than an individual’s perception of their world?

Google pioneered “smart” glasses with Google Glass[1] and “smart” contact lenses with glucose-sensing and monitoring contact lenses[2] and solar-powered contact lenses capable of communicating with computers and mobile devices and collecting biological data such as internal body temperature and blood-alcohol content.[3] More recently, Google filed a patent describing a device akin to a bionic eye.[4] This device is described as an intra-ocular implant that features an electronic lens that can be controlled to provide an optical power to focus images alternatively, essentially correcting and enhancing vision.[5] However, this device serves less as a contact lens and more as a surgical implant.

Arguably following Google’s lead, other researchers and companies have reportedly began developing similar “smart” contact lenses. Scientists at the University of Michigan are working on night vision contact lenses that uses thermal imaging to view a full spectrum of light, including ultraviolet light.[6] Researchers at the University of Wisconsin are developing contact lenses that autofocuses within milliseconds without the loss of contrast and sensitivity that come with glasses, conventional contact lenses, and surgery.[7] Johnson & Johnson are collaborating with a subsidiary of HP, Inc. to develop a contact lens that can adapt to the environment to “reduce glare and eyestrain indoors and out[doors],” change the cosmetic coloring of eyes, and treat presbyopia.[8] Swiss start-up company Sensimed recently received approval from the United States Food and Drug Administration (FDA) to start human testing for its contact lenses that promise to cure glaucoma.[9]

Samsung and Sony also join the race to develop “smart” contact lenses but aim to make them smarter and to reach a wider consumer base. Both companies describe contact lenses with built-in cameras, various movement sensors, and antennae that transmit and receive data as well as supply and receive electric power.[10] These contact lenses may be considered a response to the growing use of wearable technology and social media. Samsung filed its patent application in South Korea in 2014 and notes that the lenses would “allow users to view augmented reality” in more natural ways with a small display unit in the center of the lens and can sync up to smartphones wirelessly via the antenna.[11] Motion sensors in the lenses would allow the user to control the lens’ camera feature using blinking, similar to how Google Glass captured photos with winking, and a playback feature.[12] Samsung seems to function like a contact lens version of Google Glass.[13] Sony filed its patent application in the United States. Its lens would use piezoelectric sensor (example of pressure sensor), an infrared sensor, an acceleration sensor, a gyro sensor (example of tilt sensor), or an ocular potential measurement unit that converts eye movement into electrical power to control the smaller versions of part of a modern digital camera embedded in the lens.[14] Unlike the Samsung Lens, the Sony lens can store data without the need for a smartphone as well as contain features such as autofocus, automatic exposure adjustment, aperture controls, adjustable zoom, and playback.[15]

While these advancements in wearable technology are substantial steps toward the future, “smart” contact lenses differ from other wearable products in their covertness. Needless to say, these “smart” contact lenses present many privacy and security concerns. Google Glass raised similar issues, but its design was distinguishable while these lenses would enable clandestine photography that is virtually undetectable. Privacy with these lenses, in public places and even in semi-public places such as restrooms, would be virtually impossible. Covert surveillance of private meetings dealing with sensitive information, unconsented recordings of intimate interactions, violations of stalking laws, and the lenses’ susceptibility to hacking, involuntary use, malfunction, etc. are all necessary considerations, not to mention social harms as technology will be an even more intimate, integral part of daily life. This could also add a new dimension to the discussion of law enforcement body cameras and government surveillance of its citizens. The Sony and Samsung patent applications have not yet been granted, nor would their issuance guarantee that the products would be on the market any time soon. Until then, these “smart” contact lenses will be the subjects of conspiracy theories, hypothetical analyses, and spy movies.

 

 

[1] See U.S. Patent No. 9,195,067 (filed Sep. 28, 2012).

[2] See U.S. Patent No. 8,985,763 (filed Sep. 26, 2012).

[3] See U.S. Patent No. 9,158,133 (filed Jul. 26, 2012).

[4] See U.S. Patent Application No. 20160113760 (filed Oct. 24, 2014).

[5] See id.

[6] See Kate McAlpine, New tech could lead to night vision contact lenses, Michigan News (Mar. 16, 2014), http://www.ns.umich.edu/new/releases/22042-thermal-vision-graphene-light-detector-first-to-span-infrared-spectrum (last visited Nov. 17, 2016).

[7] See Fish and insects guide design for future contact lenses, EurekAlert! (Mar. 14, 2016) https://www.eurekalert.org/pub_releases/2016-03/nei-fai031116.php (last visited Nov. 17, 2016).

[8] See Richard Kirkner, J&J’s Plans for Smart & 3D Printable Contact Lenses, OIS News (June 8, 2016) http://ois.net/jjs-plans-for-smart-3d-printable-contact-lenses/ (last visited Nov. 17, 2016).

[9] See Sensimed announces first-of-a-kind product approval for its Contact Lens based sensing device by U.S. FDA, Sensimed (Mar. 15, 2016) http://www.sensimed.ch/images/pdf/PR_2016-03-15_sensimed_FDA_US_E.pdf (last visited Nov. 17, 2016).

[10] See Sony U.S. Patent Application No. 20160097940 (filed Feb. 12, 2014); S. Kor. Patent Application No. (filed Sept. 26, 2014).

[11] See Danielle Muoio, Samsung just patented a contact lens with a built-in camera, Business Insider (Apr. 11, 2016) http://www.businessinsider.com/samsung-filed-a-patent-for-smart-contact-lenses-2016-4 (last visited Nov. 17, 2016).

[12] See Amit Chowdhry, Samsung Patent Unveils Idea For Smart Contact Lenses With A Camera And Display, Forbes (Apr. 11, 2016) http://www.forbes.com/sites/amitchowdhry/2016/04/11/samsung-patent-unveils-smart-contact-lenses-with-a-camera-and-display/#438a947067be (last visited Nov. 17, 2016).

[13] See id.

[14] See Sony U.S. Patent Application No. 20160097940 (filed Feb. 12, 2014).

[15] See Sony Filed a Patent for Video-Recording Contact Lens, Huffington Post (Apr. 28, 2016) http://www.huffingtonpost.com/entry/sony-contact-lens-camera_us_57220fc6e4b0f309baefd3f2 (last visited Nov. 17, 2016).

Image Source:

http://cdn.pocket-lint.com/r/s/320x/assets/images/phpocj7cd.jpg

The Uber Important Uber Lawsuit

George, 35, protests with other commercial drivers with the app-based, ride-sharing company Uber against working conditions outside the company's office in Santa Monica, California June 24, 2014. REUTERS/Lucy Nicholson (UNITED STATES - Tags: BUSINESS EMPLOYMENT TRANSPORT CIVIL UNREST) - RTR3VKJ9

By: Nicole Desbois,

Uber’s 100 million-dollar settlement agreement with its drivers was just recently rejected by a federal Judge in California. The Judge rejected the lawsuit claiming 100 million wasn’t enough to adequately settle the dispute. The issue is whether Uber drivers are contractors or employees entitled to benefits: making Uber venerable to state penalties. If the drivers were to be classified as employees rather than contractors, then 100 million would be “only 10 percent of what lawyers for the drivers estimate that Uber could owe them and provided only $1 million toward state penalties that could add up to more than $1 billion.”[1]

The ruling of the Federal District Judge, Chen, rejected the settlement on the basis of a California law called the Private Attorneys General Act (“PAGA”). PAGA allows “private lawyers to sue companies on behalf of the state government.”[2] Again, in that case the settlement’s 1 million dollars toward state penalties would barely even touch the surface of Uber’s potential future litigation costs and state penalty fees.

It is not entirely clear whether or not Uber Drivers are employee’s rather than contractors. The courts remained undecided, and “‘[t]here is no set definition of the term “independent contractor,”’ according to the California Department of Industrial Relations website.[3] Rather, the state refers to an 11- point test. Is the worker paid per hour or per job? Who supplies the necessary workspace and tools? And, most importantly, how directly does the company control what workers do?”[4] No single factor in this 11-point test is dispositive.[5] The answer is often left up to a juries’ judgment.[6]

For now, the rejection of this settlement offer appears to be a double edge sword. The bright side for Uber driver’s is that Uber may in fact be violating state laws by classifying their employees as contractors. And had the agreement been approved then Uber’s drivers would have remained classified as contractors without employee benefits. Drivers’ now still have the option to either sue in court, or attempt to renegotiate a larger settlement.

However, an arbitration clause in the drivers’ contract could prevent many from participating in a class action lawsuit.[7] Uber has already successfully appealed to one court the classification of many of the drivers’ as a class because a majority of the participants would be in violation of the arbitration clause. [8]

This recent ruling overturned a lower courts ruling that the arbitration clause was not enforceable.[9] However, the drivers’ lawyer, Liss-Riordan, still has a second, separate appeal pending arguing the clause is unenforceable “for a different reason – because it violates the drivers’ rights under the National Labor Relations Act to engage in concerted activity.”[10]

Forcing drivers to bring their claims individually court drastically affect the amount Uber would be required to pay out.[11] The reason for this is many individuals do not seek to pursue arbitration.[12] However, Liss-Riordan is more than ready to pursue this avenue. Claiming already 1,000 drivers have signed up. [13]

The outcome of this lawsuit could have a large scale ripple effect. With the evolution of technology and the ability of companies to outsource work to contractors, employers need to be careful not to cross the line.

Classifying the driver’s as employees may also have negative impacts for the drivers themselves.[14] Although there are no state laws that prohibit employees from working with competitors, i.e. a Lyft driver working for Uber and vice versa, Uber and companies would likely begin to draft in those stipulations.[15]

For now, the issue remains undecided. A decision regarding the arbitration clause is still pending. Until the arbitration clause issue is decided, Uber has successfully requested that the other issues up on trial remain pending.

One thing is for sure, the relationship between employers and contractors is likely to change within the next decade. Some experts within the field of employment contracting believe that on-demand independent contractors could grow to 40% of the workforce by the end of 2020.[16] As the workforce continues to grow towards a trend of independent contractors, employment benefits for contractors should grow too.

 

 

[1] Andrea Peterson, Judge: $100 Million Not Enough to Settle Uber Employment Lawsuit, Washington Post (Aug. 19, 2016), https://www.washingtonpost.com/news/the-switch/wp/2016/08/19/judge-100-million-not-enough-to-settle-uber-employment-lawsuit/.

[2] Id.

[3] Adam Brinklow, Year in Preview: What the Uber Lawsuit Means for Workers in the Sharing Economy, SF Weekly, (Dec. 30, 2015), http://uberlawsuit.com/Year%20in%20Preview%20What%20the%20Uber%20Lawsuit%20Means%20for%20Workers%20in%20the%20Sharing%20Economy.pdf.

[4] Id.

[5] See id.

[6] See id.

[7] See Andrea Peterson, Judge: $100 Million Not Enough to Settle Uber Employment Lawsuit, Washington Post (Aug. 19, 2016), https://www.washingtonpost.com/news/the-switch/wp/2016/08/19/judge-100-million-not-enough-to-settle-uber-employment-lawsuit/.

[8] See id.

[9] See id.

[10] Uber Lawsuit, http://uberlawsuit.com (last visited Nov. 21, 2016).

[11] See Curt Woodward, Uber Lawsuit Could Shed Drivers After Settlement, Boston Globe (Aug. 19, 2016), https://www.bostonglobe.com/business/2016/08/19/uber-lawsuit-could-shed-drivers-after-settlement-rejected/G0zhHjOsjqpt7LoOZ3vjKJ/story.html.

[12] See id.

[13] See id.

[14] See Adam Brinklow, Year in Preview: What the Uber Lawsuit Means for Workers in the Sharing Economy, SF Weekly, (Dec. 30, 2015), http://uberlawsuit.com/Year%20in%20Preview%20What%20the%20Uber%20Lawsuit%20Means%20for%20Workers%20in%20the%20Sharing%20Economy.pdf.

[15] See id.

[16] See Elaine Pofeldt, Intuit: On-Demand Workers Will More Than Double by 2020, Forbes (Aug. 13, 2015), http://www.forbes.com/sites/elainepofeldt/2015/08/13/intuit-on-demand-workers-will-more-than-double-by-2020/#7716e3ed679d.

Image Source:

http://blogs-images.forbes.com/dandiamond/files/2015/06/Uber_protest-e1434569997112.jpg

Privacy and Encryption in Trump’s America

By: Ellie Faust,

During Donald Trump’s campaign, he certainly had an opinion regarding cyber security, but his opinions have been pretty inconsistent. While the president-elect vowed to protect the nation’s networks against foreign spies and criminals, he also encouraged Russian hackers to distribute emails stolen from Democratic nominee, Hillary Clinton.[1] While we do not know much about Donald Trump’s stance on technology policies, we do know that the man loves surveillance and hates encryption.

With Trump’s victory and the reelection of Republican Senator Richard Burr, the chairman of the Senate intelligence committee, the battle over encryption could intensify. Last year, Burr led a failed effort to pass legislation that would require companies to build “back doors” into their products in order to allow the government to evade encryption and other data protection.[2] The tech industry is unwavering in adamantly opposing back doors and believes the government has no right to dictate the design of tech products.[3]

It is likely that Burr will soon reintroduce his encryption legislation. This year, with the support of the White House and Republican majorities in both houses of Congress, the passing of legislation is much more likely. Not to say that Democrats and the more libertarian minded Republicans of the House will not put up a fight.[4]

Many believe that a Trump presidency could very well lead to a restoration of the Patriot Act along with increased pressure on Silicon Valley companies to break encryption.[5] It has become apparent throughout the course of his campaign that Trump is supportive of reinstating the dormant portions of the Patriot Act and the collection of bulk cell phone metadata by the National Security Agency.[6]

Trump’s campaign has always been less than tech friendly. From encouraging a boycott of Apple products to a plea to close off parts of the Internet in order to limit Islamist propaganda, the majority of Silicon Valley is certainly not thrilled about the outcome of this election.[7] The battle between the tech world and Donald Trump has begun. While we wait for the action, there are a few things we can do now to ensure some sort of personal security in the future.

If you are one of the many concerned about the possible increased surveillance, there are a few simple steps you can take to protect yourself now. To keep text messages private, you should look to install a service that provides end-to-end encryption. Apple’s iMessage currently offers this service but only between iMessage users.[8] If you do not have an iPhone, the apps Signal and WhatsApp both offer end-to-end encryption but again, both users need to have the app installed in order for the encryption to work.[9] For those with a questionable search history, the Internet browser, Tor, is the way to go. This browser makes your search activity anonymous by routing the data though a variety of destinations before sending it out to the web.[10] While we do not know what is ahead of us, it never hurts to protect yourself just in case.

 

 

[1] See Hiawatha Bray, Trump, the digital authoritarian, Boston Globe (Nov. 10, 2016), https://www.bostonglobe.com/business/2016/11/09/trump-digital-authoritarian/77tnj7mF95eZManXFOkZ7N/story.html.

[2] See Dustin Volz and Joseph Menn, Trump election ignites fears over U.S. encryption, surveillance policy, Reuters (Nov. 9, 2016, 7:50 PM), http://www.reuters.com/article/us-usa-election-cyber-idUSKBN13503H.

[3] See id.

[4] See id.

[5] See Phil Muncaster, Trump’s Presidency Raises Encryption and Surveillance Fears, InfoSecurity (Nov. 10, 2016), http://www.infosecurity-magazine.com/news/trumps-presidency-raises/.

[6] See David Gilbert, What a Donald Trump presidency would mean for privacy and security, Comparitech (Sept. 6, 2016), https://www.comparitech.com/blog/vpn-privacy/trump-privacy-cyber-security/.

[7] See Volz, supra note 2.

[8] See id.

[9] See id.

[10] See id.

Image Source:

http://www.gannett-cdn.com/-mm-/44780648f78c92d2c4a567d1cd826b912f8e8a29/c=637-87-2091-1180&r=x404&c=534×401/local/-/media/2015/07/12/USATODAY/USATODAY/635723201689613363-AP-GOP-2016-Trump.1.jpg

Shut The Yak Up

geofence

By: Victoria Linney,

Yik Yak is a popular app among many college and university students. The app is a location-based network that helps people connect with others around them.[1] However, the app differs from Twitter and Facebook in that users are able to post on the app anonymously and must be within a certain radius to see the posts.[2] Only users who are seventeen and older are allowed to use the app, and the company actively blocks middle and high schools from Yik Yak by using geofences.[3] Geofencing is a method of placing boundaries based on location, and depending on where you fall in said boundary you are either able to use the Yik Yak app or not.[4]

Due to the anonymity of the app, users feel free to post whatever they are currently thinking, and sometimes these posts lead to cyberbullying.[5] But, Yik Yak takes cyberbullying very seriously, and asks that users screenshot and “downvote” the post before reporting the post.[6] Once the yak has been reported, it is removed from the user’s feed and if the yak violates Yik Yak’s rules the user who posted the yak is suspended and the yak is removed from all feeds.[7]

However, the measures taken by Yik Yak to prevent cyberbullying are not enough for some people. While middle and high schools are unable to access the app, there has been a call for college campuses to block Yik Yak.[8] Some campuses have responded to this call by banning the app from their wireless networks.[9] But this move is largely symbolic, because as long as students are able and willing to switch off wifi on their phones, they are able to access the app by using phone data.[10] In an attempt to make more than a purely symbolic move, some colleges have asked Yik Yak to install a geofence around their campuses, which would prevent students from accessing the app, even while using data.[11] However, Yik Yak does not comply with these requests, and states clearly on the geofence request form on their website that they “only geofence middle and high schools (primary and secondary) and will not geofence an entire town or college campus.”[12]

But, the question still remains – even if Yik Yak was willing, or compelled, to put geofences around university campuses, would doing so violate students’ First Amendment rights? If a public college or university were to implement a geofence to ban Yik Yak, they would be violating the First Amendment.[13] This is because the Supreme Court has stated that the purpose behind the First Amendment is to “protect unpopular individuals from retaliations – and their ideas from suppression – at the hand of an intolerant society.”[14]

Protecting unpopular ideas, however, does not mean that threatening language is protected. True threats of violence are constitutionally unprotected, but true threats are not the only things being posted on Yik Yak.[15] People post about what the dining hall is serving, or about a tough breakup they are going through.[16] To block an entire platform designed for people to express their thoughts and opinions simply because some posts on the app are unpopular is contrary to the spirit of the First Amendment. As such, implementing a geofence to ban Yik Yak on college campuses would likely be held as unconstitutional, regardless of whether the university is public or private.

 

 

[1] See About, Yik Yak, https://www.yikyak.com/about (last visited Nov. 13, 2016).

[2] See Tasnim Shamma, Yik Yak Tests Universities’ Defense of Free Speech, NPR (Jan. 23, 2016), http://www.npr.org/sections/alltechconsidered/2016/01/23/463197593/yik-yak-tests-universities-defense-of-free-speech.

[3] See How Do You Prevent Children From Using Yik Yak?, Yik Yak, https://www.yikyak.com/support/faqs/sections/201022049/204565809 (last visited Nov. 13, 2016).

[4] See Shamma, supra note 2.

[5] See Adam Steinbaugh, The Futility of ‘Banning’ Yik Yak on Campus, The FIRE (Feb. 22, 2016), https://www.thefire.org/the-futility-of-banning-yik-yak-on-campus/.

[6] See I’m Being Bullied/Targeted, Yik Yak, https://www.yikyak.com/support/faqs/sections/201022049/205758949 (last visited Nov. 13, 2016).

[7] See id.

[8] See Steinbaugh, supra note 5.

[9] See Nathan Rubbelke, Campuses ‘Symbolically’ Ban Yik Yak as Battle Over App Rages, The College Fix (Oct. 21, 2015), http://www.thecollegefix.com/post/24735/.

[10] See Tyler Kingkade, Students Dip Into Their Data Plans to Get Around College’s Yik Yak Ban, Huff Post (Apr. 12, 2016), http://www.huffingtonpost.com/entry/illinois-college-banned-yik-yak_us_570d0bb7e4b0836057a25ad7.

[11] See College of Idaho Tries to Ban App Yik Yak on Campus, Wash. Times (May 15, 2015), http://www.washingtontimes.com/news/2015/may/15/college-of-idaho-tries-to-ban-the-app-yik-yak-on-c/.

[12] Geofence Request, Yik Yak, https://www.yikyak.com/support/requests/geofence (Nov. 13, 2016).

[13] See Steinbaugh, supra note 5.

[14] McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 357 (1995).

[15] See Eugene Volokh, National Coalition in Favor of Campus Censorship, Wash. Post (Oct. 26, 2015), https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/10/26/national-coalition-in-favor-of-campus-censorship/.

[16] See Shamma, supra note 2.

Image Source:

https://lh6.ggpht.com/1qpT_PhfVep6JrqIZT9ONyUofE03_V9jmPpc3b_KOmUf0r184qXjRFB3QHkHP5cJ9RZ8=w300

Volume XXII Issue IV

May 16, 2016

Dear Readers,

The Richmond Journal of Law and Technology is proud to present its fourth and final issue of the Twenty-Second Volume. At its inception in 1995 JOLT became the first law review to be published exclusively online. From this moment on, the Journal has continued to set trends in legal scholarship. As one of the leading publications in the legal technology field, JOLT has the privilege of publishing articles that address topics at the forefront of the law. The articles in the Fourth Issue offer exciting discussions on forward-looking areas of the law and give readers a glimpse into the ways in which technology is transforming the legal landscape. The Journal hopes that these articles will drive advancements in the law and in practice, and we look forward to the discussions they evoke.

In our first article, entitled “Digital Direction for the Analog AttorneyData Protection, E-Discovery, and the Ethics of Technological Competence in Today’s World of Tomorrow,” authors Stacey Blaustein, Melinda McLellan, and James Sherer outline some of the many challenges facing attorneys operating in the current high-tech legal environment. The article examines the ways in which existing and emerging ethical rules and guidelines may apply to the practice of law in the digital age. Cloud technology and social media are among the prominent technical platforms which, while convenient and efficient, pose significant threats to the technologically incompetent lawyer and his clients. This article is certain to spark further conversation about these issues as they continue to evolve.

Our second article, and final article of Volume XXII, is the selected 2016 JOLT Student Comment. Written byJOLT’s graduating Managing Editor, Megan Carboni, this article makes an exciting and bold proposal to bridge the gap in employment classification for workers in the “sharing” or “collaborative” economy. This new technology-enabled marketplace, spurred by Uber and mimicked by numerous other innovative service-sharing applications, posits a vexing balancing act between meeting the needs of businesses and their quasi-employees. Uber and similar businesses rely on classifying their workers as independent contractors, avoiding the potentially crippling benefits and obligations that these businesses would be forced to provide for their employees. At present there are only two definitions—employee and independent contractor—making it difficult to strike a balance without severely interfering with the employer’s business or employee expectations and needs. This article proposes an innovative third classification, the “dependent contractor,” as the best solution to meet the needs of both employer and employee.

On behalf of the entire 2015–2016 JOLT staff, I want to extend our sincerest thanks for your continued readership. I would also like to thank each of our authors for the time and hard work they have put into these articles. As always, JOLT greatly appreciates the ongoing support from the University of Richmond School of Law and is especially grateful for the guidance of our faculty advisors, Dean Jim Gibson and Professor Chris Cotropia.

On a more personal note, I wanted to extend my utmost appreciation and gratitude to the 2015–2016 JOLTEditorial Board and staff. It has been a pleasure serving as the Editor-in-Chief of Volume XXII and I could not have successfully completed the Volume without the consistent hard work and dedication of the Journal’s members. On behalf of the outgoing class of 2016, I would like to wish Volume XXIII and the new Editorial Board all the best as they continue shaping JOLT’s reputation as the leading publication in the legal technology world.

 

Sincerely,

 

John G. Danyluk                                                                                                                             Editor-in-Chief, Volume XXII

 

Digital Direction for the Analog Attorney – Data Protection, E-Discovery, and the Ethics of Technological Competence in Today’s World of Tomorrow, by Stacey Blaustein, Melida L. McLellan, and James A. Sherer

A New Class of Worker for the Sharing Economy, by Megan Carboni

The Skeleton of a Data Breach: The Ethical and Legal Concerns

pdf_icon BDM Publication Version PDF

Cite as: Hilary G. Buttrick et al.,The Skeleton of A Data Breach: The Ethical and Legal Concerns, 23 Rich. J.L. & Tech. 2 (2016), http://jolt.richmond.edu/wp-content/uploads/volume23_article2_Buttrick.pdf.

Hilary G. Buttrick,* Jason Davidson,** Richard J. McGowan***

 

Introduction 

[1]       After over thirty data breaches spanning the third and fourth quarter of 2012, Forbes magazine labeled the summer of 2012 as “The Summer of the Data Breach.”[1] Four years later, businesses across multiple industries have suffered brand-image damage and paid millions of dollars in remedial expenses; we are living in the era of the mega breach.[2] In 2014, companies such as Target, Home Depot, JP Morgan Chase, Anthem, Sony, UPS, Jimmy John’s, Kmart, Neiman Marcus, Community Health Systems, and the White House suffered data breaches.[3] The Home Depot breach alone resulted in the loss of “56 million credit card accounts,” “53 million email addresses,” and an estimated 63 million dollars in damage.[4] In addition to the economic fallout associated with data breaches, the 2015 Ashley Madison data breach highlighted the personal toll faced by consumers when their “private” information becomes “public.”[5] That data breach exposed the identities of millions of would-be philanderers, shaming not only the subscribers to Ashley Madison’s service, but also innocent bystanders such as their family members.[6] The frequency of data breaches has shown no signs of abating in 2016—in the first quarter, multiple hospitals fell victim to “ransomware,” a data breach that allows hackers to literally hold patient data hostage.[7] Several hospitals had to pay hackers to regain access to their patients’ data.[8]

[2]       “Decentralized technology” creates a different set of problems than the simple misuse of a single individual’s “technological profile” and information.[9] Today, unauthorized access to electronic information, a result of what Burnham in 1983 referred to as “transactional information,”[10] includes “hackers breaking into systems or networks, third parties accessing personal information on lost laptops or other mobile devices, or organizations failing to dispose of personal information securely.”[11] Data breaches exemplify the first type of unauthorized access and despite their frequent occurrence, they are little examined from an ethical standpoint. Though Google Scholar lists over 82,000 entries under “ethics of a data breach,” very few combine both terms in the title.[12] One article that does so notes a “dearth of prior organizational-level privacy research, which has largely overlooked ethical issues or the personal harms often caused by privacy violations.”[13] Even within the field of technology, “there has not been a huge literature on ethics within the mainstream of information systems journals.”[14] Part of the problem is the novelty of data breach cases. They are so new and different that they appear to be technologically, morally, and legally unlike other problems. We suggest that analogies and analyses exist which can help resolve some of these moral and legal puzzles.

[3]       First, this paper discusses the anatomy of a data breach, providing technical background on the way breaches occur. Next, we identify the ethical dimensions of data breaches. While privacy is a key topic in any ethical analysis of a data breach, other issues are more pressing, such as the responsibility of organizations to prevent and to repair consequences of data breaches. Then we analyze the current status of the law with regard to data breaches. We note immediately that the laws of various states are exactly that, various and eclectic. No consistent and stable legal understanding appears to have availed itself. The article concludes with guidance regarding data breach prevention, which can help businesses meet their ethical and legal obligations.

I. Data Breach Basics

[4]       According to popular folklore, the first computer “bug” was officially documented in 1945.[15] This was years before the first personal computer was released, and instead of malware or social engineering deception, the “bug” was literally a moth that was stuck between two components of IBM’s Harvard Mark II.[16] After a cataclysmic data breach in the modern computing age, however, postmortem reports eventually surface that provide the details of each individual breach.[17] These reports explain the hacker’s methodology, the company’s missed warning signs, and the collateral damage from the breach.[18] Each individual breach has its own signature as every data system is as unique as a fingerprint; however, these breaches generally occur in one of several ways.

[5]       The most common and well-documented method of cyber-attack uses malware.[19] Malware, which includes viruses, worms, and trojan horses, is the “generic name for evil software.” [20] A 2016 data breach report by Verizon found that malware continues to be the major contributor to data breaches involving stolen credentials and point of sale attacks. [21] Malware attacks, specifically worms, were publically credited for both the Target[22] and Home Depot[23] data breaches. Ironically, the first worm was created in 1975 by Xerox as a network analysis tool.[24] Modern day worms are standalone programs that can replicate and spread throughout a network when activated.[25] Some of the more notable worms include Melissa, ILOVEYOU, Slammer, and the Morris worm.[26] Malware is not the only factor that can lead to network compromise. Security breaches often are attributable to social engineering.[27]

[6]       Social engineering employs deception tactics to persuade the user to simply give the cybercriminal direct access to the system under attack, similar to the modus operandi of a traditional con-artist.[28] Social engineering attacks direct messages and correspondence to users who have access to the systems that are being attacked.[29] Through different methods of deception, the user is prompted to give away the information needed to access the system.[30] The most common methods of social engineering are spear phishing, smishing, and vishing.[31] Spear phishing is direct correspondence, usually via email, that is personally crafted to gain the trust of the end user.[32] Once trust is obtained, the user is prompted for login credentials and the system is compromised. Smishing and vishing are similar to spear phishing; however, they use text messages (smishing) and voice communication (vishing) as mediums.[33] It is also worth noting that old-fashioned tactics such as breaking and entering, removing files from the printer, or simply guessing passwords are still commonly used tricks of the trade.[34]

[7]       To circumvent the millions of dollars companies invest in information technology security, hackers often use a combination of the tactics discussed above. As detailed in the Dell SecureWorks report on the Target infiltration, a combination of social engineering and malware was used to cause the collapse.[35] Hackers first targeted Fazio Mechanical Services, a vendor for Target.[36] They were able to gain login credentials through spear phishing, which in turn granted them direct access to the systems that opened a pathway to Target’s network.[37] Upon accessing Target’s data network, the hackers injected a worm into the system.[38] This worm compromised Target’s point of sale systems using a customized version of malware called Black POS.[39] This malware then compromised Target’s server, which allowed the data to be distributed and copied to servers located throughout the world; accordingly, the hack was very difficult to trace.[40]

[8]       For businesses, the question of data breach is not “if” but “when.” It is indisputable that the hackers in the examples discussed above bear the moral responsibility for their acts.[41] But the moral responsibility of the business that sustains the data breach presents a closer question. Businesses require consumers to provide their private information when completing even the most routine transactions; this places the business in a unique position of trust. The scope of a business’s moral responsibility for breach of that trust is discussed below.

II. Moral Responsibility and Data Breach 

[9]       Of course, the right to privacy is at the fore. However, information technology “explicitly embodies particular important values…privacy, autonomy, universal usability, trust, and cooperation.”[42] The existing literature does not explore the scope of a business’ moral responsibility for data breach. Accordingly, reference to other areas, such as moral responsibility for marketing, is instructive. The values associated with information technology suggest moral analysis based on the ethics of marketing and on notions of corporate responsibility, inasmuch as knowledge plays a role in making autonomous choices and trust is associated with responsibility.[43]

[10]     Three main positions have been staked out over the years with regard to marketing: the contractual view, the due care theory, and the social costs view, sometimes referred to as the “deep pockets” view.[44] Captured in the phrase, caveat emptor, the contractual view of the buyer-seller relationship holds that the seller, typically a business, only has the duties to the buyer that the contract states.[45] Thus, under the contract view, Ford could indeed sell a product which, when struck from behind at 21 miles per hour, could produce a flaming inferno.[46]

[11]     The problem is that consumers lack the knowledge that the producer has and therefore cannot act knowledgably in purchasing a product. The due care position recognizes the imbalance and the vulnerable position of the consumer by placing additional duties on the business.[47] As Culnan and Williams put the matter, “[w]e further argue that because consumers are vulnerable in their dealings with businesses due to information and control deficits, organizations have a moral duty—often overlooked, we observe—that extends beyond legal compliance requiring them to take reasonable precautions with consumer data and to avoid harm in using this data.”[48] The “deep pockets” view­–analogous to the legal notion of strict liability–would have the seller assume all costs–even when exercising “due care” to protect the consumer from risk and injury–of a product.[49] In other words, when a problem occurs, no investigation need be undertaken: the seller takes the responsibility, or caveat vendor.[50] Given the poor record of businesses with regard to handling data breaches,[51] the third option appears most reasonable.

[12]     Corporations have been reluctant to take steps to exhibit moral responsibility in the area of data breach.[52] Normally, when wrongdoing occurs in an organizational setting, the elements of magnitude and certitude of harm as well as connection and contribution to the harm are utilized.[53] Corporations appear to underestimate magnitude and certitude of harm and appear to ignore the contribution they make to data breaches by being primarily reactive rather than proactive.[54] While an analysis of a business’s moral responsibility for a data breach suggests the appropriateness of a rule akin to strict liability, the law is far from imposing such an obligation.[55]

III. Legal Liability and Data Breach

[13]     Not surprisingly, the development of data breach law has lagged behind the speed of technological innovation.[56] There are two significant legal questions surrounding data breaches. First, what legal obligations does a business owe its customers regarding data security and notifications of a breach? Second, what legal remedies do consumers have if their private information is compromised as the result of a data breach? As discussed below, there is currently no comprehensive federal regulatory scheme addressing data breach.[57] Instead, businesses must attempt to comply with a patchwork of state laws addressing data breach notifications.[58] Additionally, consumers are left with few effective civil remedies when their private information is breached.[59]

A. Data Breach Notification Laws

[14]     At present, there is no comprehensive federal statute addressing a business’s obligation to safeguard personal information.[60] While there are a few federal statutes aimed at protecting personal information in narrow contexts (such as the protection of medical and health-related information under the Health Insurance Portability and Accountability Act of 1996),[61] the legal rules governing data breach are handled largely at the state level.[62] Currently, “[f]orty-seven states, [and] the District of Columbia” have laws addressing business obligations with regard to data breaches.[63] Three states—Alabama, New Mexico, and South Dakota—have no statutes on the books addressing consumer notification of data breaches.[64] Most states impose obligations on businesses to maintain “reasonable security” measures “to protect personal information.”[65] While definitions vary from state to state, “personal information” commonly includes an individual’s social security number,[66] or

[A]n individual’s first and last names, or first initial and last name, and one (1) or more of the following data elements that are not encrypted or redacted: (A) A driver’s license number. (B) A state identification card number. (C) A credit card number. (D) A financial account number or debit card number in combination with a security code, password, or access code that would permit access to the person’s account.[67]

[15]     A “breach” occurs when there is an “unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. . . .”[68]

[16]     In the event of a data breach, existing statutes require businesses to provide some type of notification to the consumer.[69] The type and timing of that notice, however, varies from state to state.[70] Some states require consumer notification whenever unauthorized access of personal information occurs.[71] Other states require businesses to notify consumers only if there appears to be a reasonable risk that some harm will result from the breach.[72] Many states require businesses to notify the attorney general of data breaches.[73] Some statutes require notification within a specified time frame, while others simply require that notification be done expediently.[74] Businesses that serve consumers in multiple states must comply with the notification requirements of each of the states where affected consumers reside.[75] Thus, when a large data breach occurs, businesses face a considerable challenge in ensuring compliance with the various notification laws throughout the country.[76]

[17]     This patchwork of state regulation leads commentators and policy advocates to suggest that a comprehensive federal data breach statute should be enacted.[77] A federal data breach statute would preempt state regulation, thus simplifying the breaching business’s compliance requirements and costs.[78] Instead of struggling to comply with the various notification laws of multiple states, a business would look to only one source—federal law—to discern its obligations in the event of a data breach.[79] While federal bills have been proposed,[80] Congress has failed to pass any comprehensive proposal.[81]

[18]     Moreover, critics claim that draft bills are weak and do not offer enough protection for consumers.[82] In particular, critics note that the proposals do not do enough to incentivize data breach prevention because they focus on consumer notification after a breach has already occurred.[83] To incentivize data breach prevention, businesses must view added security measures as solid investments that minimize risks of loss.[84] The primary business risks associated with data breaches are loss of customer goodwill and, of course, lawsuits from affected consumers.[85] As discussed below, data breach lawsuits are difficult to pursue. Accordingly, the threat of consumer litigation has not played an extensive role in influencing businesses to adopt more stringent security measures.[86]

B. Consumer Remedies for Data Breach

[19]     Some commentators have argued that in order to meaningfully encourage businesses to adopt better data protection measures, businesses must view customer litigation as a serious threat.[87] The threat of litigation in this context has been largely hollow because consumers have few legal remedies when their personal information is breached.[88] While data breach statutes require businesses to notify consumers in the event of a breach, only a handful of those statutes create a private cause of action that allows the consumer to bring a lawsuit against the business.[89] Thus, in the majority of states with data breach statutes, the consumer is statutorily entitled to notice of the breach but little else.[90] Given the lack of meaningful statutory remedies for data breaches, consumers have looked to the common law for a cognizable theory of recovery.[91] Consumers have sought damages for data breaches under theories of negligence, breach of contract, breach of fiduciary duty, and infliction of emotional distress.[92] These common law theories are not well-suited to data breach cases and often end in dismissal for several reasons.[93]

[20]     First, the harm that results from data breaches is most commonly economic harm—there is no personal injury or physical property damage sustained by the consumer as a result of the data breach.[94] Many jurisdictions follow a rule called the “economic loss doctrine,” which prevents consumers from recovering purely economic damages under a tort theory (such as negligence or infliction of emotional distress).[95] Thus, in jurisdictions that follow the economic loss doctrine, data breach claims sounding in tort rarely reach the jury because they are dismissed as the result of pretrial dispositive motions filed by the defendant.[96]

[21]     Second, many data breach cases are dismissed because the consumer lacks standing to bring such a claim.[97] Standing is a constitutional prerequisite to litigation that requires the plaintiff to have suffered an injury in fact.[98] In other words, the harm sustained by the plaintiff must be real, not hypothetical or speculative.[99] In data breach cases, the injury can be hard to define. Plaintiff consumers often argue that the data breach itself and the risk of future identity theft are sufficient harms; defendant businesses contend that no injury has occurred unless the plaintiff can show a link between the data breach and an actual instance of identity theft.[100] Not surprisingly, the courts are divided on what type of injury suffices to confer standing in a data breach case.[101]

[22]     Even if the plaintiff consumer in a data breach case survives the standing hurdle, he or she must still prove all of the elements of his or her case in order to win. In most instances, the consumer will have to prove that his or her injury was caused by the defendant’s data breach.[102] Proving causation in data breach cases can be difficult because the plaintiff’s personal information may have been compromised in other data breaches, making it nearly impossible to establish that the suffered identity theft was solely the result of the defendant’s breach.[103]

[23]     The procedural and substantive difficulties associated with data breach litigation mean that very few of these cases are likely to survive dispositive motions and reach a jury, which in turn makes them less attractive to class action attorneys.[104] The procedural hurdles, the cost of litigation, and the prospect of a small recovery are enough to deter most individual consumers from bringing a data breach lawsuit.[105] Without effective legal remedies, most consumers must simply put up with the headaches associated with data breaches.[106] While external litigation pressures and the current data breach regulatory state may not incentivize businesses to take additional steps to safeguard consumer privacy, ethics would certainly suggest that businesses should voluntarily adopt higher standards for data protection.[107]

 

IV. Business Strategies to Minimize the Risk of Data Breach

[24]     Several tactics can help reduce the threat of cybercrime. The first tactic is infrastructure.[108] A modern company must continually perform routine maintenance including, but not limited to, security patches, operating system upgrades, and hardware upgrades. Often cyber criminals exploit older software to maliciously gain access to data networks.[109] The initial discovery of these exploits before the software manufacturer has developed a security patch is called a “zero-day attack.”[110] Once a hardware or software exploit is identified, software and hardware vendors act to create patches to repair the problem as quickly as possible.[111] It is up to the corporation to obtain and apply these patches.

[25]     The second prevention method is active monitoring.[112] Similar to the way that the FBI manages the national threat level, a company’s IT department must manage the cybercrime threat level.[113] Myriad firewall and IT monitoring software is available to monitor network traffic.[114] Many anti-virus software programs automatically scan and remove commonly found malware.[115] In addition, IT security companies provide external monitoring services to augment a company’s internal monitoring procedures.[116] These offsite IT services offer network traffic monitoring and even provide built-in client insurance/reimbursement if a data breach occurs due to negligence within their services.

[26]     The third prevention method is education.[117] While most people envision a hacker in a dark basement surrounded by computers, social engineering is a remarkably effective method of data intrusion.[118] For example, a study of data breaches occurring in 2015 found that “30% of phishing messages were opened by the target across all campaigns.”[119] The risk of data breach can be mitigated if employees know they should never share passwords; they should frequently change passwords, and they should lock their office doors.[120] Additional security measures such as key fobs, biometric readers, and similar devices that must remain with employees, should also be kept private. While no one strategy can guarantee that a business will not sustain a data breach, the preceding measures will lessen the risk.

V. Conclusion

[27]     Though data breaches are a relatively new phenomena, guidance about the technology, morality, and legality of data breaches is available. If we are correct, corporations must do a better job of determining where data breaches are likely to occur, whether from human error or informational system flaw. Corporations must take steps to minimize risk before data breaches occur. Protocols must be put in place that assume responsibility for the consumers’ negative consequences, such as notifying them immediately and providing help in diminishing the harm from the data breach. The legal liability will be mitigated; trust and cooperation will more likely flourish.

 

 

 

*J.D., Assistant Professor of Business Law, Butler University.

**M.B.A., Instructor of Management Information Systems, Butler University.

***Ph.D., Instructor of Business Ethics, Butler University.

[1] See Dave Lewis, Notes from RSA: Accountability in Security, Forbes, (Apr. 29, 2015, 6:30 PM), http://www.forbes.com/sites/davelewis/2015/04/29/notes-from-rsa-accountability-in-security/#47e46e292163, archived at https://perma.cc/HV4B-D7T8.

[2] See Bill Hardekopf, The Big Data Breaches of 2014, Forbes, (Jan. 13, 2015, 7:06 PM), http://www.forbes.com/sites/moneybuilder/2015/01/13/the-big-data-breaches-of-2014/#4ad6aa5f3a48, archived at https://perma.cc/WYT4-8JX8.

[3] See id.; see Ellen Nakashima, Hackers Breach Some White House Computers, Wash. Post (Oct. 28, 2014), https://www.washingtonpost.com/world/national-security/hackers-breach-some-white-house-computers/2014/10/28/2ddf2fa0-5ef7-11e4-91f7-5d89b5e8c251_story.html, archived at https://perma.cc/HD4S-MUX2.

[4] The Home Depot, Inc., Annual Report (Form 10-K) (Mar. 25, 2015), at 18–19.

[5] See Eric Basu, Cybersecurity Lessons Learned from the Ashley Madison Hack, Forbes, (Oct. 26, 2015, 11:55 AM), http://www.forbes.com/sites/ericbasu/2015/10/26/cybersecurity-lessons-learned-from-the-ashley-madison-hack/#14c58a7eed99, archived at https://perma.cc/U4L3-R6VE.

[6] See id.

[7] See Seung Lee, Ransomware Wreaking Havoc in American and Canadian Hospitals, Newsweek, (Mar. 23, 2016, 10:23 AM), http://www.newsweek.com/ransomware-wreaking-havoc-american-and-canadian-hospitals-439714, archived at https://perma.cc/MJ2N-UW4T.

[8] See id.

[9] See Mary J. Culnan & Cynthia Clark Williams, How Ethics Can Enhance Organizational Privacy: Lessons From the ChoicePoint and TJX Data Breaches, 33 MIS Q. 673, 673 (2009).

[10] David Burnham, The Rise of the Computer State 50 (1983).

[11] Culnan & Williams, supra note 9, at 675.

[12] See Search Results for “Ethics of a Data Breach,” Google Scholar, https://scholar.google.com/scholar?hl=en&q=ethics+of+a+data+breach&btnG=&as_sdt=1%2C47&as_sdtp=, archived at https://perma.cc/7HZG-UK9D (last visited Sept. 20, 2016).

[13] Culnan & Williams, supra note 9, at 673.

[14] John Mingers & Geoff Walsham, Toward Ethical Information Systems: The Contribution of Discourse Ethics, 34 MIS Q. 833, 837 (2010).

[15] See Computerworld Staff, The Moth in the Machine: Debugging the Origins of the Bug, Computerworld (Sept. 3, 2011, 7:00 AM), http://www.computerworld.com/article/2515435/app-development/moth-in-the-machine–debugging-the-origins-of–bug-.html, archived at https://perma.cc/KC3P-8QRF; see also Fred R. Shapiro, Etymology of the Computer Bug: History and Folklore, 62 American Speech 376, 376–77 (1987).

[16] See Shapiro, supra note 15, at 376–77 (noting that a moth was found in the Mark II in 1945, but contending that the word “bug” was used to describe defects in machines long before 1945; thus, the term did not originate with the insect found in the Mark II).

[17] See Pragati Verma, You’ve Been Breached — What Now? A Post-Mortem Checklist, Forbes: AllClear ID (Aug. 17, 2015, 11:27 AM), http://www.forbes.com/sites/allclearid/2015/08/17/youve-been-breached-what-now-a-post-mortem-checklist/#13a42ec34384, archived at https://perma.cc/Z365-VFCT.

[18] See id.

[19] See Raymond R. Panko & Julia L. Panko, Business Data Networks and Security 91 (Pearson, 10th ed. 2015).

[20] Id.

[21] See Verizon, Inc., 2016 Data Breach Investigations Report, at 20 (2016), http://www.verizonenterprise.com/verizon-insights-lab/dbir/2016, archived at https://perma.cc/E8S4-RHVU (follow “Download the 2016 DBIR”) [hereinafter Verizon Report].

[22] See Keith Jarvis & Jason Milletary, Inside a Targeted Point-of-Sale Data Breach, Dell SecureWorks, at 1 (Jan. 24, 2014), http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf, archived at https://perma.cc/5V6Y-CAED.

[23] See Hardekopf, supra note 2.

[24] See Michael A. Hiltzik, Computer Viruses Can Be Healthy for Innovation, L.A. Times (Apr. 5, 1999), at 1, http://articles.latimes.com/1999/apr/05/business/fi-24293, archived at https://perma.cc/A5ZD-P4R4.

[25] See Panko & Panko, supra note 19, at 93.

[26] See, e.g., Ned Potter, Top 10 Computer Viruses and Worms, ABC News (Sept. 3, 2009), http://abcnews.go.com/Technology/top-computer-viruses-worms-internet-history/story?id=8480794, archived at https://perma.cc/C6DW-YT2P (listing the top 10 most well-known computer viruses and worms).

[27] See Verizon Report, supra note 21, at 17 (noting that most phishing cases “feature phishing as a means to install persistent malware,” leading to security breach).

[28] See Panko & Panko, supra note 19, at 96–97.

[29] See id. at 96.

[30] See id. at 97.

[31] See id. at 96–97; see FBI, Smishing and Vishing and Other Cyber Scams to Watch Out for This Holiday, Federal Bureau of Investigation (Nov. 24, 2010), https://archives.fbi.gov/archives/news/stories/2010/november/cyber_112410/cyber_112410 [hereinafter Smishing and Vishing].

[32] See Panko & Panko, supra note 19, at 97.

[33] See Smishing and Vishing, supra note 31.

[34] See, e.g., Eric Geier, Your Printer Could Be a Security Sore Spot, PC World (Apr. 25, 2012, 6:01 PM), http://www.pcworld.com/article/254518/your_printer_could_be_a_security_sore_spot.html, archived at https://perma.cc/7PZY-87MX (discussing five security threats network printers may impose); see also Matt Smith, The 5 Most Common Tactics Used to Hack Passwords, Make Use Of (Dec. 20, 2011), http://www.makeuseof.com/tag/5-common-tactics-hack-passwords/, archived at https://perma.cc/YJ4K-NDLR.

[35] See Jarvis & Milletary, supra note 22, at 1,10.

[36] See Staff of S. Comm. on Com., Sci., and Transp., 113th Cong., A “Kill Chain” Analysis of the 2013 Target Data Breach 4 (2014), http://www.public.navy.mil/spawar/Press/Documents/Publications/03.26.15_USSenate.pdf, archived at https://perma.cc/SLX8-24UD.

[37] See id. at 8.

[38] See id. at 9.

[39] See id. at 2, 9.

[40] See id. at 4.

[41] See generally Richard J. McGowan & Hilary G. Buttrick, Moral Responsibility and Legal Liability, or Ethics Drives the Law, 11 J. Learning in Higher Educ. 9, 10 (2015) (discussing the three basic elements of moral responsibility).

[42] Mingers & Walshman, supra note 14 at 839.

[43] See generally John Rawls, A Theory of Justice 347-50 (1971) (discussing the moral psychology and the acquisition of the sentiment of justice).

[44] See Manuel Velasquez, Business Ethics: Concepts and Cases 308 (7th ed. 2012).

[45] See id. at 314; see generally Thomas Garrett & Richard Klonoski, Business Ethics 88 (2nd ed. 1986) (discussing the fairness of a sales contract and the importance of protecting the dignity of the buyers).

[46] See generally Clark Butler, Human Rights Ethics: A Rational Approach 80 (2008) (discussing the moral psychology and the acquisition of the sentiment of justice).

[47] See Edgar H. Schein, The Problem of Moral Education for the Business Manager, 8 Indust. Rev. 3, 4 (1966).

[48] Culnan & Williams, supra note 9, at 674.

[49] See Reed Dickerson, The Basis of Strict Products Liability, 16 Food, Drug, Cosmetic L.J. 585, 591 (1961).

[50] See David A. Hall, Strict Liability and Computer Software: Caveat Vendor, 4 Computer/L. J. 373, 373 (1983).

[51] See generally Culnan & Williams, supra note 9, at 681-82 (discussing the ways in which consumers are vulnerable when businesses lack appropriate data security measures); see also Simon Petravick & Stephan G. Kerr, Protect Your Portable Data—Always and Everywhere, 6 J. of Acct. 30, 31 (2009) (discussing the ways in which businesspeople often fail to appropriately safeguard confidential client information).

[52] See Culnan & Williams, supra note 9, at 681-82.

[53] See McGowan & Buttrick, supra note 41, at 11.

[54] See Culnan & Williams, supra note 9, at 674.

[55] See Norman C. Simon, Brendan M. Schulman & Samantha V. Ettari, Beware the Breach: Data Breaches, Notification Duties, and Legal Liability, Lexology.com (Aug. 29, 2012), http://www.lexology.com/library/detail.aspx?g=221e63eb-ccea-4f5f-80e7-b72905037a6f, archived at https://perma.cc/9FBG-KKQY.

[56] See Adi Snir, Dealing with the Law Lag, LegalVision (May 6, 2016), https://legalvision.com.au/dealing-with-the-law-lag/, archived at https://perma.cc/7SW7-4KFE.

[57] See Peter J. Arant, Understanding Data Breach Liability: The Basics Every Attorney Should Know, 40 Mont. L. 8, 8–9 (2015) (“At the federal level, there is no comprehensive data privacy or security law. Instead the U.S. follows a ‘sectoral’ approach, meaning there are federal laws that apply to specific sectors.”).

[58] See id.; see also Comparison of U.S. State and Federal Security Breach Notification Laws, Steptoe & Johnson LLP (Jan. 21, 2016), http://www.steptoe.com/assets/htmldocuments/SteptoeDataBreachNotificationChart.pdf, archived at https://perma.cc/4R39-6XJQ.

[59] See Rachel M. Peters, So You’ve Been Notified, Now What? The Problem with Current Data-Breach Notification Laws, 56 Ariz. L. Rev. 1171, 1175 (2014) (“[O]nce an individual has been notified of a breach, she has limited legal recourse against the company or organization that exposed her personal information.”).

[60] See Arant, supra note 57, at 8–9.

[61] See Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936; see Arant, supra note 57, at 9 (noting that the Federal Trade Commission may bring lawsuits against companies with “lax security and privacy practices” because they are considered “unfair or deceptive practices”); see also Charlotte A. Tschider, Experimenting with Privacy: Driving Efficiency Through a State-Informed Federal Data Breach Notification and Data Protection Law, 18 Tul. J. Tech. & Intell. Prop. 45, 47, 53–54 (2015) (“Because no federal law in the United States provides a broad, comprehensive set of data breach notification or data protection requirements for all businesses and consumers, other federal administrative bodies have provided catch-all protection in some circumstances.”).

[62] See Jeff Kosseff, Cyberwars: Navigating Responsibilities for the Public and Private Sector: Positive Cybersecurity Law: Creating a Consistent and Incentive-Based System, 19 Chap. L. Rev. 401, 402 (2016) (We have “a patchwork of related laws, including breach notification and privacy statutes, that focus on penalizing companies for inadequate data security. But our legal system lacks a coordinated network of laws that are designed to promote cybersecurity and prevent data breaches from occurring in the first place.”); see also Peters, supra note 59, at 1181 (discussing various state law data-breach notification statutes).

[63] Security Breach Notification Laws, Nat’l Conf. of St. Legislatures (Jan. 4, 2016), http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx, archived at https://perma.cc/8JUS-CXX5 [hereinafter NCSL Security Breach Research]

[64] See id.

[65] Timothy J. Toohey, Beyond Technophobia: Lawyers’ Ethical and Legal Obligations to Monitor Evolving Technology and Security Risks, 21 J.L. & Tech. 1, 14 (2015) (explaining general state law requirements for data breach security in context of attorneys’ obligations to secure data).

[66] See Ind. Code § 24-4.9-2-10(1) (2014).

[67] Ind. Code § 24-4.9-2-10(2)(A)-(D) (2014).

[68] Ind. Code § 24-4.9-2-2(a) (2014).

[69] See NCSL Security Breach Research, supra note 63.

[70] See Data Breach Charts, Baker Hostetler 1, 17-18, http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/Data_Breach_Charts.pdf, archived at https://perma.cc/MM5K-ZRT3 (last visited Oct. 4, 2016) (providing state-by-state-survey of data breach notification requirements).

[71] See id. at 9.

[72] See id. at 9-12.

[73] See id. at 13-16.

[74] See id. at 15-16, 18-19.

[75] See Sasha Romanosky et al., Empirical Analysis of Data Breach Litigation, 11 J. Empirical Legal Stud. 74, 80 (2014) (“[I]t is the residence of the individual that drives disclosure, not the location of the breach. That is, disclosure to an individual is required only if the state in which the individual is a citizen has adopted a disclosure law.”).

[76] See Arant, supra note 56, at 10 (“Given the heterogeneous nature of state data breach notification laws, simultaneous compliance with multiple laws can be a logistical nightmare—and an expensive one at that.”).

[77] See Jill Joerling, Note, Data Breach Notification Laws: An Argument for a Comprehensive Federal Law to Protect Consumer Data, 32 Wash. U. J.L. & Pol’y 467, 486 (2010) (“Congress should take action immediately to enact a federal data breach notification law.”); see also Jay P. Kesan, et al., A Comprehensive Empirical Study of Data Privacy, Trust, and Consumer Autonomy, 91 Ind. L.J. 267, 346-48 (2016) (suggesting “a complete overhaul of data privacy law[s] and the creation of [centralized] profile repository” for consumers’ data that would operate in a fashion similar to credit bureaus); Tschider, supra note 61, at 72 (“a federal statute should regulate all businesses involving consumer personal information to effectively preserve customer choice and control with respect to their information, to drive contract efficiency, and to facilitate international trade.”).

[78] See Joerling, supra note 77, at 486.

[79] See id. (“Replacing the current patchwork of . . . state laws with a single comprehensive federal law would give businesses a clear road map to follow after a breach.”).

[80] See, e.g., Data Security and Breach Notification Act of 2015, H.R. 1770, 114th Cong. (2d Sess. 2016) (demonstrating a proposed federal data breach law that did not pass in Congress).

[81] See Brett V. Newman, Hacking the Current System: Congress’ Attempt to Pass Data Security and Breach Notification Legislation, 2015 U. Ill. J.L. Tech. & Pol’y 437, 445 (2015) (“The patchwork state legislation and numerous bill introduced in Congress show how difficult it is to agree on breach notification and data security measures. There is likely an agreement that the United States needs a data breach law, but that does not mean that one will be passed. The problem may also come from a surplus of Congressional committees claiming jurisdiction and trying to tackle the issue—resulting in too many different bills.”).

[82] See Peters, supra note 59, at 1196. (Although Peters analyzes an earlier draft bill, the Data Security & Breach Notification Act of 2013, her criticism holds true for the Data Security Breach Notification Act of 2015.)

[83] See id.; see also Tschider, supra note 61, at 74-75 (emphasizing the need for a federal law that focuses on data protection in addition to data breach notification: “Having clear data protection standards will dramatically reduce uncertainty for consumers and business, as standard data protection requirements will be articulated and required for implementation . . .”); see also Andrea Peterson, Why this National Data Breach Notification Bill has Privacy Advocates Worried, Wash. Post (Apr. 15, 2015), https://www.washingtonpost.com/news/the-switch/wp/2015/04/15/why-this-national-data-breach-notification-bill-has-privacy-advocates-worried, archived at https://perma.cc/C9U3-S3W3 (noting that consumers could have fewer protections under Data Security Breach Notification Act of 2015 than they have under existing state laws).

[84] See Kosseff, supra note 62, at 403 (arguing that laws should create incentives through tax credits and litigation safe harbors to encourage businesses to invest in cybersecurity infrastructure; rather than focus solely on penalties for data breaches).

[85] See Ponemon Inst., 2016 Cost of Data Breach Study: United States, IBM, 1, 3, 13 (2016).

[86] See Peters, supra note 59, at 1193.

[87] See id. at 1197 (noting that a national data breach law that gives consumers a private right of action or requires mandatory credit monitoring “will be an incentive for companies to minimize data breaches.”).

[88] See, e.g., Nicole Hong, For Consumers, Injury Is Hard to Prove in Data-Breach Case, Wall St. J. (June 26, 2016, 8:06 PM), http://www.wsj.com/articles/for-consumers-injury-is-hard-to-prove-in-data-breach-cases-1466985988, archived at https://perma.cc/F3VF-8LKD.

[89] See Baker Hostetler, supra note 70, at 16–18.

[90] See Kesan et al., supra note 77, at 277 (noting that “many other states merely require companies to notify customers of data breaches and the relevant statutes do not create any additional duties or entitlements.”).

[91] See also Thomas Martecchini, A Day in Court for Data Breach Plaintiffs: Preserving Standing Based on Increased Risk of Identity Theft After Clapper v. Amnesty International USA, 114 Mich. L. Rev. 1471, 1474 (noting that courts are divided on “whether increased risk of identity theft is an injury-in-fact sufficient to create standing…”).

[92] See Peters, supra note 59, at 1185 (discussing various common law theories available to consumers for data breach).

[93] See id. at 1185-87 (“[A] principle reason that civil causes of action in data-breach cases are rarely successful is the difficulty consumer data-breach victims have in meeting the standing and injury requirements.”).

[94] But see Kesan et al., supra note 77, at 344 (discussing the various types of harm that result from loss of control over personal data, “including dignitary harms; a chilling effect from law enforcement having too much control over individual expression; and circumstances that interfere with an individual’s ability to exercise freedoms or develop a sense of self-determination.”).

[95] See, e.g., Gunkel v. Renovations, Inc., 822 N.E.2d 150, 154 (Ind. 2005) (holding that economic losses are not recoverable in a tort action premised on the failure of a product or service to perform as expected unless the failure results in personal injury or physical harm to property other than the product; proper remedy sounds in contract).

[96] See Peters, supra note 59, at 1186 (discussing data breach cases dismissed on economic loss grounds).

[97] See id. at 1187 (discussing split of authority with regard to whether consumers have standing to bring suit in data breach cases).

[98] See, e.g., Remijas v. Nieman Marcus Group, LLC, 794 F.3d 688, 691–92 (7th Cir. 2015) (holding that standing requires a litigant to show a concrete injury that is causally linked to the defendants conduct and can be redressed by the court).

[99] See id.

[100] See Peters, supra note 59, at 1189–92 (collecting cases addressing standing and injury-in-fact in context of data breach litigation).

[101] See id.; see also Martecchini, supra note 91, at 1474 (noting that courts are divided on “whether increased risk of identity theft is an injury-in-fact sufficient to create standing…”).

[102] See Michael D. Simpson, All Your Data Are Belong to Us Consumer Data Breach Rights and Remedies in an Electronic Exchange Economy, 87 U. Colo. L. Rev. 669, 685–86 (2016) (discussing difficulties of applying common law tort theories to data breach cases).

[103] See Peters, supra note 59, at 1188 (“[I]f a person is the victim of two or more data breaches in which similar personal information is stolen and that information is not used until years later to harm her, it may be difficult for the victim to demonstrate which breach was the source of the information used.”); see also Newman, supra note 81, at 440 (“proving that a customer lost money due to a specific breach can be difficult.”).

[104] See Peters, supra note 59, at 1192–93.

[105] See generally Jeff John Roberts, This Court Ruling Just Made It Easier to Sue Companies That Get Hacked, Fortune (July 29, 2015, 7:00 PM), http://fortune.com/2015/07/29/data-breach-7th-circuit/, archived at https://perma.cc/C4ZT-SQD7 (discussing the hurdles victims of data breaches face when trying to sue).

[106] See Simpson, supra note 102, at 698 (observing that “the average consumer is essentially at the mercy of a breached entity’s largesse to gain any recompense for stolen data.”).

[107] See supra Part II; see also Martecchini, supra note 91, at 1473 (noting that while many businesses are implementing data protection plans, “many other businesses still remain in denial about the threat of data breaches, either failing to implement any data-security changes or making only nominal modifications.”).

[108] See Pierluigi Paganini, Preventing and Recovering From Cybercrime, Tripwire (Nov. 4, 2014), http://www.tripwire.com/state-of-security/incident-detection/preventing-and-recovering-from-cybercrime/, archived at https://perma.cc/PYB7-VKN5.

[109] See Panko & Panko, supra note 19, at 92.

[110] See id.

[111] See id.

[112] See Paganini, supra note 108.

[113] See DC Metro Cyber Security Summit, The CyberWire (June 3, 2015), https://www.thecyberwire.com/events/dc-metro-cyber-security-summit-2015.html, archived at https://perma.cc/Z4XN-M6NK.

[114] See, e.g., Panko & Panko, supra note 19, at 116–23 (discussing various forms of firewalls, their strengths, and their weaknesses).

[115] See id. at 124.

[116] See, e.g., Third Party Monitoring – Vendor Monitoring, ObserveIT, http://www.observeit.com/solutions/third-party-monitoring, archived at https://perma.cc/P3SX-SW4W (last visited Sept. 23, 2016) (illustrating the monitoring services that a third party security company provides).

[117] See Paganini, supra note 108.

[118] See Verizon Report, supra note 21, at 17.

[119] Id. at 18.

[120] See generally Jerry Fitzgerald, Alan Dennis & Alexandra Durcikova, Business Data Communications and Networking 362 (11th ed. 2012) (noting that security policies should explain to employees how to control the risk of intrusion).

Co-Developing Drugs with Indigenous Communities: Lessons from Peruvian Law and the Ayahuasca Patent Dispute

Sem Publication Version PDF

Daniel S. Sem*

Cite as: Daniel S. Sem, Co-Developing Drugs with Indigenous Communities: Lessons from Peruvian Law and the Ayahuasca Patent Dispute, 23 Rich. J.L. & Tech. 1 (2016), http://jolt.richmond.edu/2016/12/02/volume23_issue1_sem.

I.  Introduction

[1]       This paper will examine the issues surrounding the co-development of drugs derived from traditional medicines used by indigenous peoples in Amazonia, with a focus on Peru. In particular, this paper will explore what national, regional and international legal structures are in place to protect the interests of indigenous peoples, while at the same time providing medical benefit to the world. This issue is explored in the context of Peruvian, U.S., and international treaties – especially the TRIPS agreement, the Andean Community, sui generis protections, and the US-Peru Trade Promotion Agreement.

[2]       Commenters have noted that historically, drug development ventures based on traditional medical knowledge (TMK) from Amazonia had not been pursued in a manner that was fair and just to the indigenous peoples who owned this knowledge.[1] There are two pragmatic “fairness” considerations in the U.S.-Peruvian co-development of drugs derived from indigenous peoples in Amazonia, based on TMK.[2] First, any co-venture should identify the best legal structure(s) that protects the interests of researchers in both Peru and the United States, and the need to also protect the interests of indigenous peoples.[3]

[3]       Second, any co-venture should consider whether international pharmaceutical patent protection is inherently biased to protect drugs as defined in western (U.S.) medical practice, versus the traditional and historically-based practices of indigenous peoples.[4] There are potential problems for intellectual property (IP) protection, since medical treatments in traditional cultures are typically developed by groups over long periods of time, as opposed to the more rapid discovery by individual researchers or companies in the pharmaceutical industry. In the former situation, it may be impossible to patent a medical treatment if it has been “in use” for many years since prior public use can create novelty or obviousness bars to patenting.[5] Furthermore, most traditional medicines are mixtures of natural products (i.e., chemical compounds that are “products of nature”), comprised of two or more active chemical ingredients; whereas, drug discovery and development in the U.S. focuses on composition of matter patent protection for single chemical compounds. Additionally, most pharmaceutical companies will not develop drugs in the U.S., unless they can obtain composition of matter patent protection on single chemical compounds.

[4]       Given these differences in how medicines are developed and used in the U.S. versus Peru, coupled with different views of IP and TMK, what is the best IP protection and collaborative structure for co-development of medicines by pharmaceutical researchers in the U.S. and Peru, and traditional healers (shamans) in Amazonia? This paper explores the legal and cultural issues surrounding this question, then proposes solutions that build on existing legal structures and trends in the U.S. and Peru.

[5]       Section I of this paper introduces challenges associated with co-development of drugs by researchers, defines key terms and concepts, and provides an example of one TMK-based medicine used by Amazonian shamans. Section II presents an attempted drug development initiative where indigenous rights were ignored. This involved the attempted patenting in the U.S. of a traditional medicine from Amazonia, ayahuasca. Section III of this paper explores the various legal structures and treaties in Peru, the Andean region, and the U.S., as well as international treaties that pertain to intellectual property rights (IPR) of indigenous peoples, with respect to their general traditional knowledge (TK), and TMK in particular. Section IV builds on this background, and proposes a collaborative co-development research agreement that could be used by U.S. and Peruvian researchers who team up to discover and develop new medical treatments based on TMK. Such collaborations could be a tremendous new source of medicines.

[6]       As the pipeline of new medicines coming from the U.S. pharmaceutical industry is dwindling, research and development costs are increasing and productivity of the industry is decreasing.[6] These forces are converging to create intense market pressures, and perhaps more openness to explore new solutions to address the world’s medical needs.[7] These solutions will likely include academic researchers in the U.S. (and Europe) teaming up with researchers in Amazonia, to learn from their indigenous peoples.[8] Together, they can co-develop new medical treatments based on the TMK possessed by Amazonian shamans; but, this can only work efficiently and fairly if the interests of the collaborating research teams and of the indigenous peoples from which the TMK originates, are considered upfront and with equal weight.[9] This paper aims to facilitate that process.

          A.  What are Traditional Knowledge (TK) and Traditional Medical Knowledge (TMK)?

[7]       Traditional knowledge (TK) is defined by the World Intellectual Property Organization (WIPO) as “knowledge, know-how, skills and practices that are developed, sustained and passed on from generation to generation within a community, often forming part of its cultural or spiritual identity.”[10] Negotiations on an international legal instrument, developed by the WIPO Intergovernmental Committee (IGC), are focused on developing protections for TK, along with protections for Traditional Cultural Expressions and Genetic Resources. This paper will focus on identifying protective strategies for a subset of TK, with a focus on TMK.

[8]       Traditional Environmental Knowledge (TEK) is a subset of TK and the focus of western scientific fields such as ethnobotany and ethnomedicine.[11] Martha Johnson defined TEK as “…a body of knowledge built by a group of people through generations, living in close contact with nature. It includes a system of classification, a set of empirical observations about the local environment, and a system of self-management that governs resource use.”[12] TEK can be distinguished from western science in a number of ways, including that: (a) it is transmitted via oral tradition, (b) is holistic (versus reductionist), (c) is based on a view of social and spiritual connections between life forms, (d) views the natural elements as having a life force (infused with spirit), and (e) explains natural phenomena based on cumulative and collective experiences that are regularly validated and revised over time.[13] Thus, while TEK bears some resemblance to western scientific knowledge, it is also distinct in many ways.[14] TEK is especially relevant for this paper, since it is a source of TMK.

[9]       Traditional medical knowledge (TMK) is a type of TK that centers specifically on the knowledge of traditional healers in their use of plant-based medicines.[15] The World Health Organization (WHO) defines TMK as “the sum total of the knowledge, skills and practices based on the theories, beliefs and experiences indigenous to different cultures, whether explicable or not, used in the maintenance of health, as well as in the prevention, diagnosis, improvement or treatment of physical and mental illnesses.”[16] This paper focuses on the use and protection of TMK in Amazonia, with a focus on Peru.

          B.  TMK as a Source of New Medicines

[10]     The pharmaceutical industry benefits greatly from TMK. One estimate is that of the 119 plant-derived chemicals used in modern medicine, 74% have similar current uses as the medicinal plant from which the chemical was identified.[17] The market value of plant-derived medicines was estimated at over $15 billion in 1990, for United States pharmaceutical sales.[18] Amazonia, and Peru in particular, is an especially rich source of traditional medicines.[19] One of the most prominent and spiritually important traditional medicines to Peruvian shamans is ayahuasca.[20]

           C.  Peruvian TMK – Ayahuasca

[11]     Of particular fame and importance amongst shamans in Peru is the ayahuasca plant (Banisteripsis caapi),[21] of the plant family Malpighiaceae. Ayahuasca was discovered and introduced to the scientific community by Harvard biologist and “father of modern ethnobotany,” Richard Evans Schultes.[22] In the native Quechua language of Amazonia, ayahuasca means “vine of the soul.”[23] Ayahuasca is used by indigenous peoples in religious and healing ceremonies.[24] Shamans have used ayahuasca for centuries to treat various psychiatric disorders, which indigenous peoples sometime believed were associated with witchcraft.[25]

sem pic

Fig. 1. Picture of a live ayahuasca root (left panel), and a piece of the root sold in a Peruvian market (right panel).[26]

 

[12]     While available for purchase in markets (Fig. 1),[27] the use of ayahuasca is generally restricted to shamans or ayahuasqueros who possess valuable TMK, since they know best how to prepare it in a way that is safe and effective.[28] The ayahuasca plant (Banisteriopsis caapi) vine is mixed in defined ratios and manners with plants such as Psychotria viridis, then boiled.[29] Chemicals from both of these plants work synergistically to produce the desired effect. Specifically, “harmala alkaloid” molecules (Fig. 2)[30] in ayahuasca inhibit an enzyme called monoamine oxidase (MOA) – preventing the chemical breakdown of the active chemical present in the Psychotria viridis plant, dimethyltryptamine (DMT).[31] DMT produces the psychoactive effects of this traditional medicine by altering the activity in brain synapses of the serotonin receptors (Fig. 2).[32]

 

sem pic 2

Fig. 2. Active chemical components in ayahuasca teas used by shamans, with serotonin comparison.[33]

 

[13]     In cases where shamans develop and administer medical treatments based on TMK, and scientists later explain the molecular basis for that medical effect and identify the active chemical components, who is the inventor? This question, exemplified in the case of ayahuasca, is complicated.[34] While the shamans, as TMK practitioners, knew how these plants needed to be mixed to achieve the desired effect, scientists ultimately discovered the molecular reason for needing the mixture.[35] Indeed, scientists could extract the active chemical components, mix them in the correct ratio, and develop this as a drug – taken perhaps as a pill. Which is the greater discovery? Both are important, and certainly the shaman’s TMK is a “but for” cause of the scientific (i.e. molecular) discovery. It seems self-evident that the scientific discovery cannot and should not proceed to the benefit of others, without first considering the rights of the indigenous peoples who made the initial discovery.

[14]     By using TMK, Amazonian shamans uncovered a pharmacologically useful and valuable medical treatment from ayahuasca. This treatment exists only because of specific molecular level interactions. While these molecules might not be patentable subject matter (as products of nature)[36], combinations of molecules might be considered patentable subject matter, as composition of matter. Pharmaceutical companies will typically only develop a drug if composition of matter protection can be obtained. Thus, co-development of TMK-derived drugs poses a challenge to the IP community, in terms of how a useful medical treatment can be patented. It is possible to patent at the level of the plants used, the active chemical components extracted from the plants, or mixtures of those active chemical components.

[15]     TMK-derived drug development also challenges the international community to consider whether it is ethically permissible to allow this type of patenting. Is it right to allow researchers who discover the active molecular components, used in traditional medicines, to patent and then profit from their scientific discoveries, without returning benefit to the shamans? Can they patent them, or are there 35 U.S.C. §102 novelty (prior art) bars that prevent patenting, since shamans have been treating with traditional medicines, like ayahuasca, for centuries? These questions are addressed in Section III. While the scientists who discovered the active chemical components in ayahuasca made no attempt to patent their discovery, there was a significant controversy over an attempt to patent the ayahuasca plant itself.[37] It was after this ayahuasca patent dispute that significant changes to protect TK and TMK were implemented in Peru.

 

II.  A Case Study in Bioprospecting of TMK: Lessons from Ayahuasca

[16]     Despite the fact that ayahuasca use was in the shaman’s TMK toolbox for centuries, Loren Miller obtained a U.S. patent, Plant Patent No. 5,571 on the ayahuasca plant (Banisteriopsis caapi), which issued on June 17th, 1986 (Fig. 3).[38]

 

sem pic 3

Fig. 3. Patent on ayahuasca (Banisteriopsis caapi).[39]

 

[17]     Recognizing this as an exploitation of TK and TMK, in what is referred to as “bioprospecting,” David Downes and Glenn Wiser filed a request for re-examination.[40] Downs and Wiser were with the Center for International Environmental Law (CIEL), working on behalf of the Coordinating Body of Indigenous Organizations of the Amazon Basin (COICA) and the Amazon Coalition, on March 30, 1999.[41]

[18]     The Miller patent had a single claim, for “a new and distinct (cultivar) of the species Banisteriopsis caapi,” which Miller called “Da Vine.”[42] Downs and Wiser argued this claim was invalid on a number of legal theories, but especially based on prior art that included publications and plant specimen sheets, such as one listed as: “Plants of Cultivation: Banisteriopsis caapi, Accessioned Specimen Sheet, The University of Michigan Herbarium (mounted Jan. 5, 1981).”[43]

[19]     Wiser and Downes raised five arguments before the U.S. Patent and Trademark Office (PTO) as to why the Miller patent was not valid.[44] First, they claimed the existence of significant prior art, which should produce 35 U.S.C. §102 rejections.[45] Specifically, they argue that the plant Miller is patenting is not new and distinct, because it is “well described in the scientific literature and in the ‘traditional knowledge of indigenous peoples throughout Amazon.’”[46] Banisteriopsis caapi was described in herbarium specimens, as well as a number of more typical printed publications that discuss the medicinal and ceremonial use of ayahuasca.[47]

[20]     Second, Wiser and Downes argued that under the U.S. Patent Act one cannot patent plants if they “[are] found in an uncultivated state,” in the wild.[48] There is a statutory bar in 35 U.S.C. §161 that prevents patenting of plants found in the wild, and this should prevent patenting of Miller’s “Da Vine.” While Miller argues that “Da Vine” was only found in a garden (i.e. in a cultivated state), this was apparently not true. Banisteriopsis caapi is actually found throughout the Peruvian Amazon region.[49]

[21]     Downes and Wiser then make a third argument – one that has significant implications, since it also suggests a mechanism by which indigenous peoples might protect their plant-based TMK.[50] They argue that accession sheets of plants from herbarium collections can be categorized as prior art within the meaning of 35 U.S.C. §§ 102 and 103.[51]

 

sem pic 4

Fig. 4. Sample of a herbarium sheet from Cayetano University in Peru.[52]

 

[22]     The existence of such herbarium sheets should bar any future patenting of the plant that was preserved on the sheet.[53] While there may only be a single copy of the herbarium sheet, if it is accessible to the public, it may be considered prior art. In the same way that “a single catalogued thesis in one university library [constitutes] sufficient accessibility to those interested in the art exercising reasonable diligence,” is considered a printed publication, for purposes of a prior art rejection under 35 U.S.C. §102.[54] To serve as prior art, the herbarium sheets must be accessible and available to persons interested in the subject matter­–in this case medicinal plants associated with the TMK of Amazonian shamans. If this is true, then one way for indigenous peoples to prevent patenting of their medicinal plants is to make herbarium sheets containing dried plant specimens with written entries (e.g. describing the plant, where collected, date collected), such as that shown in Fig. 4 from the University of Cayetano in Peru.[55]

[23]     Downs and Wiser make a fourth argument, based more on a sense of social justice than on patent law.[56] They argue that the patent should be canceled because the plant (ayahuasca) has been used by indigenous peoples for hundreds of years, long before Miller considered patenting “Da Vine.”[57] Of course, the challenge from a patent perspective is that this use – part of an oral tradition – may not have been documented in any printed publication and U.S. patent law does not prevent patenting of subject matter that was simply “in use” in a foreign country (at least not before the 2013 America Invents Act [AIA]).[58] In an analogous situation, a U.S. patent for use of turmeric in wound healing (based on Indian TMK) was issued in 1995.[59] This patent was canceled because turmeric had actually been used for many generations by indigenous peoples in India for this same purpose, so the invention was not considered novel.[60]

 

[24]     Finally, Downs and Will argued that the Miller patent should not be allowed on moral and public policy grounds:

“… issuance of the Patent does not meet the public policy and morality aspects of the Patent Act, which preclude awarding a patent on a plant … that is sacred to indigenous peoples … and revered in their cultures for many generations … the PTO should not provide patent protection to a plant based on supposed medicinal characteristics that are well known in the systems of traditional knowledge of indigenous peoples … the PTO may and should decline to award intellectual property rights where their imposition would violate established moral, religious and cultural values.”[61]

[25]     While this moral argument is attractive, there is little support in U.S. patent law for an argument based on protection of “moral, religious and cultural values.”[62] U.S. patent law has no equivalent to the moral rights doctrine of copyright law. Although, a PTO Media Advisory statement[63] offers a glimmer of hope for moral grounds arguments – noting that courts had excluded inventions that are “injurious to the well-being, good policy, or good morals of society.”[64] Downs and Wiser argue that patenting plants like ayahuasca, which are used widely in religious ceremonies as part of indigenous peoples’ TMK, “offends religious and moral sensibilities” and “wrongly appropriates traditional knowledge of indigenous and local communities [and] may deprive its creators and conservators of incentives to preserve, develop and improve upon it.”[65] Perhaps because this moral sensibilities argument is not supported by U.S. patent law and associated legal precedent, the PTO ultimately based its decision to reject the Miller patent on other arguments presented by Downs and Wiser.[66]

[26]     After considering the request for reexamination and the various arguments presented by Downs and Wiser, the PTO responded by rejecting the Miller patent in a November 3, 1999 office action.[67] They did this in part based on a consideration of the herbarium specimen sheets as being “printed matter” that could serve as prior art, under §102(b).[68] One particular herbarium specimen that was identified as prior art was: “Plants of Cultivation: Banisteriopsis caapi, The University of Michigan Herbarium (mounted Jan. 5, 1981).”[69] This is significant precedent because it is the first such consideration of herbarium sheets as prior art. Thus, herbarium sheets like those in Fig. 4 could be used as a bar to prevent patenting of plants that are part of TMK, and a potential source of new drugs.[70] This result suggests one mechanism by which countries with indigenous populations might protect their plant-based TMK – by creating herbarium collections documenting the plants they use in traditional medicine. By rejecting the patent based on this narrow view only (i.e. §102, prior art), the PTO avoided the broader question of rejection based on public policy and morality grounds, which could potentially be associated with the Patent Act’s utility requirement, as noted in the Media Advisory statement.[71]

 

[27]     The “Da Vine” patent reexamination teaches three important lessons. First, one way to prevent biopiracy is to create “printed documents” that could serve as prior art, and therefore block the patenting of plant-based TMK. Second, one effective type of “printed document” that can be used for this purpose are collections of herbarium sheets that document the plants that are part of shamanic TMK. If indigenous peoples take this defensive move of creating herbarium sheets as prior art, they should be aware that this may also prevent them from patenting as well, either alone or as part of a collaborative drug co-development effort. Prior art creation is a protective tool that cuts both ways; so, it should be used with caution. Third, an argument based on the moral and social harm caused to indigenous peoples, while intuitively attractive, may not carry weight with the PTO due to lack of supporting legal precedent and statutory language.

 

III. Legal protections of TMK For Drug Co-Development in Peru

          A.  Peruvian, Bolivian and Ecuadoran Law

               a.  Constitutional Protections in Peru, Bolivia and Ecuador

[28]     While Peru does not directly protect indigenous rights, Chapter II, Article 68 of the Peruvian Constitution provides a related protection: “The State is obliged to promote the conservation of biological diversity, and protected natural areas.”[72] So, to the extent that TMK is associated with biological diversity (i.e. plant-based medicines), Peru has some relevant constitutional protection. In contrast, Bolivia and Ecuador’s more recent constitutions have more explicit protections for indigenous people’s TK, with several articles of the Bolivian Constitution excerpted below:

Article 42: The promotion of traditional medicine shall incorporate a registry of natural medicines and their active substances, as well as the protection of the associated knowledge as intellectual, historical and cultural property, and as patrimony of indigenous nations and peoples.

Article 100. The State shall protect knowledge by means of a registry of intellectual property that safeguards the intangible rights of indigenous nations and peoples…

Article 304. Indigenous autonomies have the following competences: … safeguard and register collective intellectual rights related to knowledge on genetic resources, traditional medicine and germplasm …[73]

[29]     The Bolivian Constitution is relatively new, having been approved only in 2009; and, it is a result of the 2005 election of Evo Morales, an Aymara coca peasant who fought for the rights of indigenous peoples.[74] Given its origins in a political movement focused on indigenous peoples, it can be viewed as a model for national protection of TK IP rights. While Bolivia and Ecuador are unique in having these protections at the constitutional level, their Constitutions may have value as persuasive legal authority for other Andean Community countries like Peru, and for any country that seeks to protect the TK and TMK of its indigenous peoples.

               b. Sui Generis Protections in Peru: Law No. 27811

[30]     While Peru does not protect TMK at the constitutional level, it does protect TK and TMK in its national legislation.[75] In particular, Peru passed Law No. 27811 in 2002, introducing a Protective Regime for the Collective Knowledge of Indigenous People Derived from Natural Resources. The objectives of Law No. 27811 are stated in Article 5:

(a) To promote respect for and the protection, preservation, wider application and development of the collective knowledge of indigenous peoples;

(b) To promote the fair and equitable distribution of the benefits derived from the use of that collective knowledge;

(c) To promote the use of the knowledge for the benefit of the indigenous peoples and mankind in general;

(d) To ensure that the use of the knowledge takes place with the prior informed consent of the indigenous peoples;

(e) To promote the strengthening and development of the potential of the indigenous peoples and of the machinery traditionally used by them to share and distribute collectively generated benefits under the terms of this regime;

(f) To avoid situations where patents are granted for inventions made or developed on the basis of collective knowledge of the indigenous peoples of Peru without any account being taken of that knowledge as prior art in the examination of the novelty and inventiveness of the said inventions.[76]

[31]     Noteworthy is the emphasis on informed consent and equitable sharing of benefits, along with specific protections for patents and other protections.[77]

[32]     The “Protective Regime for the Collective Knowledge of Indigenous People Derived from Natural Resources” (Law No. 27811) goes beyond the general objectives outlined in Article 5, to describe in detail how TK (and TMK) is to be protected. It explains the key considerations when intellectual property is to be licensed from indigenous peoples. In particular, if a third party is going to commercialize traditional knowledge (Article 7) it requires outside parties to sign license agreements to “ensure due reward for said access and … equitable distribution of the benefits … .”[78] A percentage of benefits (at least 10%) must go to the Fund for the Development of Indigenous Peoples (Article 8).[79] Thus, it ensures that the indigenous owners of TMK are duly rewarded, and benefits obtained in any drug co-development efforts are shared equitably. Furthermore, it explicitly points out that protected knowledge does not belong to individuals, but rather to groups of indigenous peoples.[80] That is, knowledge and discovery is “collective” (Article 10), in contrast to the individualistic approach that underlies U.S. patent law and, more generally, U.S. culture.[81]

[33]     The law goes on to describe how national registers of TK and TMK are to be created. Title VI describes the formation of registers of collective knowledge, with Article 15 explicitly creating three types of registers: (a) Local Registers of Collective Knowledge of Indigenous Peoples, (b) Private National Registers of Collective Knowledge of Indigenous Peoples, and (c) Public National Registers of Collective Knowledge of Indigenous Peoples.[82] Article 20 describes what type of information must be included in the registration of the TK and TMK into these registers.[83]

[34]     These three registers each serve unique and important purposes. The first, The Local Registers, are managed by indigenous peoples with assistance of the National Institute for the Protection of Competition and Intellectual Property (INDECOPI).[84] They serve the local needs of indigenous peoples, to enable sharing of their TMK with each other, and to provide a high level of access to and control of information by the local community. The second, the Private National Registers, are kept confidential, and contain what could be viewed as trade secrets.[85] These trade secrets could be licensed to third parties, if desired. The third, the Public National Registers, could serve the alternative purpose of providing prior art that will prevent the patenting of TMK by other countries (e.g. via 35 U.S.C. §102 in the U.S.).[86] Indeed, Article 23 specifically states that “INDECOPI shall send the information entered in the Public National Register to the main patent offices of the world in order that it may be treated as prior art in the examination of the novelty and inventiveness of patent applications.”[87] Thus, Peru has made a very explicit defensive move to prevent the patenting of its TK and TMK; this was a valuable lesson from the ayahuasca case above (section II), and is now institutionalized in national policy.[88] Interestingly, the recent passage of the U.S. AIA has obviated some of the need for this defensive strategy, since prior use (even if no printed publication exists) is now considered a bar in considering novelty or non-obviousness (inventiveness).[89] This is discussed in greater detail in section III(E).

 

[35]     The Private National Register contains TK and TMK trade secrets which could be of significant value to the world as a source of new medicines. To enable dissemination of this TMK, if desired, indigenous peoples can license their TMK to third parties, such as pharmaceutical companies. But, they must register the license according to the Article 26 “Compulsory written form for license contracts” requirements.[90] The contents of this contract are designed to protect the intellectual property rights (IPRs) of the indigenous owner, and are specified in Article 27:

(c) A statement of the compensation that the indigenous peoples receive for the use of their collective knowledge; such compensation shall include an initial monetary or other equivalent payment for its sustainable development, and a percentage … of the gross sales resulting from the marketing of the goods developed …;

(d) The provision of sufficient information on the purposes, risks and implications of the said activity … ;

(e) The obligation on the licensee to inform the licensor periodically … of progress in the research on and industrialization and marketing of the goods developed …;

(f) The obligation on the licensee to contribute to the improvement of the ability of the indigenous peoples to make use of the collective knowledge …[91]

[36]     A “toolkit” to assist in compliance with this licensing process is available from WIPO.[92] The required elements of a TMK license contract are designed to protect the interests and rights of the indigenous owners, and should be considered in the preparation of any drug co-development research agreements between Peruvian researchers and their U.S. or other foreign collaborators.[93]

          B.  U.S.-Peru Trade Promotion Agreement (TPA)

[37]     Beyond the scope of TRIPS (Trade Related Aspect of Intellectual Property) standards, the U.S.–with WTO (World Trade Organization) enforcement (as described in Section III(D))[94]–has also pursued bi-lateral trade agreements with individual countries, typically seeking higher IPR standards.[95] Such bi-lateral agreements often lead to less protection for TK, so are often conceded to by developing countries only because of the other benefits they receive. While the end result may provide broader benefits to the government that signs, such bi-lateral agreements – and the associated concessions that are made – can anger indigenous groups and their representatives. This appears to have been the case in Peru as well.

[38]     The U.S. and Peru signed the Trade Promotion Agreement (TPA) in 2006.[96] Within the TPA is a benefit to the so-called Andean Community countries (Bolivia, Peru, Ecuador, Columbia)[97], via the Andean Trade Protection Act (ATPA). This benefit to the Andean Community countries required that IPRs be protected adequately under WTO, as specified by TRIPS standards. Peru signed various amendments on Dec. 21st, 2008, to permit compliance with the TPA with the U.S. These changes generally strengthened IP, and weakened protections of TK, TMK and biodiversity, against patenting and bioprospecting.[98] At about this same time (Dec. 31st, 2008), likely in reaction to signing of the TPA, the local government in Cusco released an executive order to “protect traditional knowledge, practices and innovations of local communities.”[99] This protection included a requirement to use “informed consent, compulsory benefit sharing and the right of communities to say no to bioprospecting.” [100] Furthermore, any bioprospecting requires a permit, and the government will monitor such activities to protect the interests of local communities.[101] These protections of TK and TMK are in keeping with the Article 5 priorities outlined in Peru’s sui generis protection (described above, in section III(A)(b)), and are consistent with the Constitutional IPR protections provided in Bolivia (described in section III(A)(a)).[102]

 

[39]     Importantly, the TPA with the U.S. included an “Understanding Regarding Biodiversity and Traditional Knowledge,” in an effort to provide some protection of TK and TMK.[103]   The Understanding stated:

The Parties recognize the importance of traditional knowledge … to cultural, economic, and social development. The Parties recognize the importance of the following: (1) obtaining informed consent from the appropriate authority prior to accessing genetic resources under the control of such authority; (2) equitably sharing the benefits arising from the use of traditional knowledge and genetic resources; and (3) promoting quality patent examination to ensure the conditions of patentability are satisfied …

Each Party shall endeavor to seek ways to share information that may have a bearing on the patentability of inventions based on traditional knowledge or genetic resources by providing:

(a) publicly accessible databases that contain relevant information; and

(b) an opportunity to cite, in writing, to the appropriate examining authority prior art that may have a bearing on patentability. [104]

[40]     While the Understanding does not oblige each country or its nationals to undertake specific actions in relationship to TMK, the Understanding’s basic recognition of TMK sets an important precedent. Previously, the U.S. had felt that TK and TMK protections should be secured through the WIPO; but, the Andean Community countries – operating as a regional group with enhanced political bargaining power – were successful in getting this Understanding added to the TPA.[105] This Understanding can hopefully serve as a starting point and model for how the IPRs of indigenous peoples can and should be protected in trade agreements, as well as in other contexts. Noteworthy is its emphasis on informed consent, sharing of benefits, assistance in obtaining patents, and use of TK databases.[106] These are also key elements in regional regulations for the Andean Community, described in the next section.

 

          C.  Regional Protections: The Andean Community Intellectual Property Regime

[41]     The Andean Community is an agreement that was signed in 1969, and currently includes Peru, Bolivia, Ecuador and Columbia (Venezuela withdrew in 2006 when Peru signed the Free Trade Agreement (FTA) with the U.S.).[107] The Andean Community has generated a number of supranational institutions, including the “Commission of national executives, a General Secretariat of regional administrators, and a Tribunal of Justice (the ATJ or the Andean Tribunal).”[108]

[42]     This Andean Community has had its most significant successes in the realm of protecting intellectual property (96% of rulings relate to IP), developing supranational laws called “Decisions” to regulate patents, trademarks and copyrights.[109] Andean IP Decisions are adopted at the national level by member states. Then they are interpreted in national courts, administrative agencies in member states, or by the ATJ.[110]

[43]     The Andean governments have used the political clout afforded to them, via participation in the Andean Community, to facilitate incorporation of normally optional TRIPS “flexibilities” as obligatory features of Andean law.[111] To this end, “member states made a collective decision to capitalize on TRIPS’ flexibilities as a way to promote public health,” and to resist pressure from stronger international forces, like pharmaceutical companies from the United States.[112] In effect, membership in the Andean Community gives strength to individual countries, by virtue of their banding together, to enforce what are sometimes optional and yet advantageous TRIPS features. This enhanced bargaining power plays a central role in securing TK and TMK protections for indigenous peoples, as in the U.S.-Peru TPA agreement discussed above.

[44]     As a complement to regional treaties, local laws can provide additional protections – as Cusco had pursued in parallel with Peru’s signing of the U.S.-Peru TPA.[113] As discussed above, the signing of this international agreement (the TPA) by Peru was closely linked to complementary and compensatory initiatives at the local (Cusco) and regional (Andean Community) levels, which ultimately led to stronger TK and TMK protections. Accordingly, any drug co-development initiative with Peru must recognize the complementary TMK protections that have been created at the local, national, regional, and international levels.

          D.  International Treaties: Role of UN, TRIPS, WTO and WIPO

[45]     International protections for indigenous IPRs go beyond bi-lateral agreements like the TPA. Although they are not a focus of this paper, since regional and bi-lateral agreements are usually compliant with and more specific than the international treaties. Nonetheless, a brief overview of key international treaties and agreements will be presented. One such agreement is the United Nations (UN) Convention on Biological Diversity.[114] This agreement protects TK, which is related to biological diversity, and encourages sharing of the benefits of that knowledge. Article 8(j) of the Convention provides that each Party shall:

[s]ubject to its national legislation, respect, preserve and maintain knowledge, innovations and practices of indigenous and local communities embodying traditional lifestyles relevant for the conservation and sustainable use of biological diversity and promote their wider application with the approval and involvement of the holders of such knowledge, innovations and practices and encourage the equitable sharing of the benefits arising from the utilization of such knowledge, innovations and practices.[115]

[46]     The emphasis on preservation of TK is noteworthy, promoting the wider application of the TK and the sharing of benefits obtained through the use of the TK. More broadly, the Convention on Biological Diversity focuses on protecting biological diversity in the context of other goals such as the need for medicines.[116] The treaty has importance for bioprospecting, as well as collaborative research between countries involving natural products and TMK.

[47]     The Trade Related Aspects of IP (TRIPS) agreement is an international treaty that seeks to harmonize IP laws between member countries while still honoring and respecting national laws and sovereignty.[117] TRIPS is the most extensive multinational agreement on IP and covers patents, trademarks, copyrights, and trade secrets.[118] But TRIPS has not provided significant protections for TMK (beyond certain “flexibilities”), since the interests of developing nations must often yield to those of more powerful developed countries (and opt-out of the “flexibilities”).[119] The World Trade Organization (WTO) requires TRIPS ratification for membership. So it is not uncommon for developing countries to make undesired concessions regarding IP rights (defined in TRIPS), in order to secure the trade benefits they desire.[120] Counteracting this pressure is the strength that regional alliances, like the Andean Community, provide so that TMK protections can be obtained (e.g. making TRIPS “flexibilities” mandatory in member countries).[121]

[48]     Both Peru and the United States are members of TRIPS. Membership in TRIPS requires compliance with earlier IP treaties and conventions, including WIPO, the Paris Convention for the Protection of Industrial Property (Paris Convention),[122] and the Berne Convention for the Protection of Literary and Artistic Works (Berne Convention).[123] While TRIPS provides the underlying IP principals, enforcement typically occurs within member states and disputes are handled by the World Trade Organization (WTO).[124] Since any IPR agreement or treaty developed by or between Peru and the U.S. must be compliant with TRIPS, the agreements and treaties with greatest impact on drug co-development between researchers in Peru and the U.S. are the bi-lateral, regional and national agreements discussed in sections III A-C.

 

          E.  Changes in U.S. Patent Law: the America Invents Act (AIA)

[49]     What effect do the America Invents Act (AIA) changes to U.S. patent law have on protections of indigenous IPR?[125] Under the old 35 U.S.C. §102, if TMK was “in use” for hundreds of years by shamans in Peru but never recorded in a printed publication, then there would be no prior art bar to patenting in the U.S. This would seem to enable biopiracy of TMK in an undesirable way. Prior to March 16th, 2013 (when the AIA went into effect), U.S. patent law did not recognize TK and TMK as prior art if it was only “in use” in a foreign country.[126] Indeed, the Patent Act of 1952 would have permitted patenting of an invention based on long-held TMK (as long as it was undocumented) based on the previous version of 35 U.S.C. §102 (key elements underlined):

A person shall be entitled to a patent unless –

(a) the invention was known or used by others in this country, or patented or described in a printed publication in this or a foreign country, before the invention thereof by the applicant for patent, or

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on sale in this country, more than one year prior to the date of the application for patent in the United States.[127]

[50]     According to the plain language of the statute, while an invention may have been used in the country of origin (e.g. Peru), 35 U.S.C. §102 will only prevent patenting of inventions that were in use in the U.S. or described in a printed publication anywhere.[128] Thus, when the University of Mississippi Medical Center tried to patent turmeric for healing wounds, they were not prevented from patenting simply because turmeric was widely used for that purpose in India.[129] Rather, what led to the patent being revoked was the appearance of this use of turmeric in printed publications.[130] Likewise, even though ayahuasca had been used for centuries by Amazonian shamans (i.e. been “in use”), this did not produce a 35 U.S.C. §102 prior art rejection (see section II). Rather, the rejection of the Miller patent on ayahuasca was based on the presence of herbarium sheets that described the ayahuasca plant.[131] Indeed, this is a significant reason why countries like Peru are documenting the plants associated with their TMK in registries and using herbarium sheets. One of the objectives of Peru’s sui generis protections (section III(A)(b)) is to ensuring that foreign bioprospectors are barred from patenting due to the existence of this prior art.[132] But the situation has changed under AIA, where the new language of 35 U.S.C. §102 is:

(a) A person shall be entitled to a patent unless:

(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention;[133]

[51]     Notably, now 35 U.S.C. §102 considers “public use … or otherwise available” anywhere (in foreign countries and in the U.S.) as creating a prior art bar to patenting.[134] Thus, under the AIA, the need for countries to maintain registries and herbarium sheets of plants used in TMK is lessened, as long as they have other means to establish that the plant and/or TMK had been “in use … or otherwise available.”[135]   This is a significant step forward in the prevention of biopiracy, and the protection of TK and TMK.

 

IV.  Model For U.S.-Peru Collaborative Drug Development

          A.  Building on Current IPR Protections for TMK in Peru

               a.  Key Elements of TMK Protections to Include in Research Agreements Involving Indigenous Communities

[52]     Constitutional protections of TMK in Peru are limited to “conservation of biological diversity,” which includes plant-based medicines.[136] Bolivia, a member of the Andean Community along with Peru, has constitutional protections (see section III(A)(a)) that go further to explicitly ensure “promotion of traditional medicine” by mandating a “registry of natural medicines and of their curative properties … as well as the protection of their knowledge as intellectual … property … of nations and indigenous peoples.”[137] This theme of protecting TMK in registries and protecting it as the IP of indigenous peoples, is also manifested in Peru’s sui generis protections (see section III(A(b))).

[53]     Peruvian sui generis protections emphasize creation of databases of TMK, both public (as a defense against foreign patents) and private (as a source of licensable trade secrets). Other elements of the sui generis protections include: (a) promotion of respect, preservation, and wider application of TMK, (b) promotion of the use of TMK to benefit the “indigenous peoples and mankind in general,” (c) freedom to license TMK (with state oversight; to be registered using the WIPO “toolkit”), (d) release of TMK only with informed consent of the indigenous owners, based on full disclosure of risks and benefits, (e) equitable sharing of benefits derived from the use of TMK (including >10% for the Fund for Development of Indigenous People), and (f) a desire to prevent patenting of indigenous peoples’ TMK by others.[138] These elements and priorities should be addressed in any collaborative research agreement between research scientists in Peru and foreign collaborators seeking to co-develop drugs derived from TMK. Significantly, all of these elements fall under the broader umbrella of the U.S.-Peru TPA (e.g. informed consent; equitable sharing of benefits). So, there is a strong foundation for including them in collaborative agreements between U.S. and Peruvian researchers.[139]

               b.  Defensive Strategy to Protect TMK – Creation of Public Databases of TMK as Prior Art

[54]     One of the key elements in the Bolivian Constitutional protections and the Peruvian sui generis protections is the creation of public databases of TMK. The stated purpose of these databases is, in part, to create prior art that prevents others from patenting – without permission – the TMK that belongs to indigenous peoples.[140] The need for and value of such databases is illustrated within the ayahuasca patent dispute described in section II. While post AIA changes in U.S. patent law lessened the need for such databases, they still provide a clear demonstration of what TMK was “in use or otherwise available.” This serves the stated goal of providing a strong defense against uninvited and undesired foreign patents, like the Miller “Da Vine” patent. Such patents could exploit the TMK of indigenous peoples, without equitable sharing of the benefits derived from that TMK and without informed consent.

[55]    It is important to point out that this defensive use of databases as prior art can have undesired consequences if the indigenous peoples ever want to patent their own TMK. A key element of the indigenous peoples’ TMK protections (sections III(A)(b) and IV(A)(a)) was a desire to benefit “indigenous peoples and mankind in general” and to permit – with informed consent – licensing of TMK-based discoveries in a co-development initiative.[141] But, pharmaceutical companies will not develop a drug if they cannot obtain composition of matter patent protection. Therefore, the inability to patent TMK-derived medicines – or active substances derived from them – prevents any co-development of drugs.

[56]     The most likely patentable subject matter in a drug co-development collaboration, since the plant cannot be patented (i.e. as TMK, it has already been “in use”), are the extracted chemical substances – or combinations thereof. For example, the ayahuasca plant could not have been patented under AIA, even if there were no “printed documents” describing it, since it was already “in use” by shamans. But, the active ingredients shown in Fig. 2, mixing in the ratios needed to obtain clinical effect, might have been patentable as composition of matter (ignoring for now any potential § 101 issues because they are “products of nature”).[142] In this regard, the registry suggested in the Bolivian Constitution seems to anticipate the patenting of active substances (like those in Fig. 2) since it suggests adding “active substances” to the registry.[143] This would enlarge the prior art shield beyond plants, to include the active components contained in the plants.

[57]     While the inclusion of active chemical substances in national registries might prevent undesirable patenting by foreign bioprospectors, it would also prevent desired patenting by Amazonian researchers seeking to develop or co-develop drugs derived from TMK. This is unfortunate, since there may be situations where an Amazonian research scientist may want to co-develop a drug derived from TMK, but now will not be able to do so. The irony of pharmaceutical development is that no matter how noble one’s intentions are (e.g. to “benefit mankind”), a strong patent position is needed so that a company financing the drug development can at least recoup its significant investment, often estimated to be in excess of $1 billion.[144] How can the stated goal of using TMK to benefit mankind be achieved, if there is no way to finance the clinical trials that are required as part of drug co-development? This should be considered when Andean countries decide to pursue registries as a source of prior art; and, it is a reason to consider keeping chemical structures of active substances in private rather than public registries.

               c.  Trade Secrets – Private Databases of Licensable TMK

[58]     The above dilemma is largely solved by using private rather than public databases of TMK, so that the ability to patent is not lost. For this reason, and in light of the recent passage of AIA, the private database should be considered the preferred strategy for protecting the IPR of indigenous peoples. It is preferred because it leaves open the option to license their TMK-based IP if and when it is desired, as part of a license agreement. Such an agreement would of course only be executed with informed consent and the promise of equitable sharing of benefits. Although, given that TMK is typically already “in use,” it is questionable whether – under AIA – it will ever be possible to patent TMK-based treatments again. But, combinations of active chemical substances, like those in Fig. 2, may still be patentable; so, that type of information should be kept private, if indigenous peoples may ever want to patent and/or license this valuable TMK-derived knowledge.[145] It is these active chemical substances, and strategic combinations thereof, that may be the only patentable subject matter based on TMK. It is this IP that is most likely to be the topic of drug co-development projects. And, it is in enabling these drug co-development projects, eventually involving a pharmaceutical company that demands composition of matter patent protection, that the lofty goal of benefiting mankind with TMK can be best achieved.

               d.  Strategies to Obtain Composition of Matter Patent Protection for TMK-derived Drugs

[59]     Given the stated desire to benefit the world with TMK, and to – in some cases – license TMK, there may be times when indigenous peoples, in collaboration with academic researchers in Peru and abroad, would want to patent TMK-related inventions, including active substances.[146] Is it possible that the active chemical substances extracted from these plants – the “drugs” – may be patented as composition of matter (e.g. see Fig. 2)? Naturally occurring chemicals (aka “natural products”) are not patentable subject matter under 35 U.S.C § 101 if those chemicals are considered “products of nature.”[147] Thus, the answer to this question is, or was, thought to be no. In general natural products are not thought to be patentable, unless there is some unique manmade combination of natural products that is useful in an unanticipated way; and, that combination may be patentable as composition of matter.[148]

[60]     But, the definition of a “product of nature” may be changing in a way that could open the door to patenting natural products. While an early case decided by Justice Learned Hand allowed patenting of adrenalin[149], a purified natural product with clinical value, there has not been subsequent case law to support patenting of natural products simply because they have been purified.[150] This may change, as the U.S. Supreme Court recently clarified what molecules fall under the “product of nature” exclusion, in Ass’n for Molecular Biology v. Myriad.[151] In this case, Myriad identified mutated genes (BRCA1 and BRCA2) associated with breast cancer, and sought to patent this for use as a breast cancer diagnostic.[152] The issue is whether purified naturally occurring deoxyribonucleic acid (DNA) segments are patentable subject matter, or whether they are excluded as a product of nature under 35 U.S.C. § 101. Justice Thomas, speaking for the majority, held that purified DNA was naturally occurring, and therefore could not become “patent eligible under § 101 simply because they have been isolated.”[153] In contrast, complementary DNA (cDNA) that was synthesized in the laboratory based on that same DNA sequence was not considered naturally occurring, so was not excluded as patentable subject matter; and, therefore, was not considered a product of nature.[154] This is because cDNA is prepared synthetically in the laboratory, and because it differs from naturally occurring genomic DNA (gDNA) in that it has noncoding DNA segments (called “introns”) removed, making it distinct from gDNA.[155]

 

[61]     Myriad teaches that naturally occurring molecules like gDNA (and by analogy, the ayahuasca active substances in Fig. 2) cannot be patented, because they are simply purified products of nature. But, if the chemical substance that is a product of nature is synthesized in a laboratory, and modified in a routine manner that makes it distinct from its naturally occurring form, then the molecule is no longer excluded as patentable subject matter.[156] By analogy, one would only need to synthesize and make routine modifications to the molecules shown in Fig. 2, to be able avoid the product of nature exclusion. This is a significant change in IP law surrounding natural products, and may increase the interest of pharmaceutical companies in the pursuit of such molecules as drugs.

[62]     It remains to be seen whether the post-Myriad broadened definition of “product of nature” will extend to natural products, like the active chemical substances from ayahuasca (Fig. 2); and, if it does, what will be the nature of the routine modifications (if any) that are needed. It is possible that copies of plant-derived molecules, which are synthesized in the laboratory by chemists, will be considered patentable as composition of matter under 35 U.S.C. § 101, just as the manmade cDNA copy of gDNA was found to be patentable in Myriad. It might be argued that the cDNA molecule is more than simply a manmade copy of the naturally occurring gDNA molecule, because it has been modified by removal of introns.[157] But, intron removal is a trivial and routine change that is inspired by what nature does anyhow (introns are removed in making mRNA).[158] It cannot be considered a novel or inventive modification to the naturally occurring gDNA molecule; although, admittedly, novelty and inventiveness do not have direct bearing on this § 101 question. Myriad seems to indicate that one can patent a synthetic copy of a naturally occurring molecule, if a routine modification is made.[159] The key point is that the molecule does not occur in nature.[160] Applying this new test to other natural products, like the active substances in Fig. 2, there are a number of foreseeable routine chemical changes that would make the molecule chemically distinct. A non-exclusive list of possibilities is provided here:

 

  1. Synthesize chemical variants that have isotopic substitutions, such as replacing hydrogen atoms with deuterium atoms. This is a commonly used chemical substitution in drug design.[161]
  2. Convert the basic amine to HCl or other salts. This is also a routine change to the naturally occurring molecules, and often has utility for increasing drug bioavailability.[162]
  3. Make a simple chemical modification, such as acetylation of amines or alcohols (g. with acetic anhydride).[163] This type of modification is what led to drugs like aspirin (acetylated salicylic acid, from willow tree bark) and heroin (acetylated morphine, from opium).[164]

[63]     All of the above chemical modifications are routinely used in drug development, so do not represent novel techniques or changes. But, they are analogous to and at least as novel as the changes made and techniques used in going from gDNA or mRNA to cDNA.[165] The latter techniques are performed so routinely that scientists can purchase kits to perform the production of cDNA from mRNA.[166] Thus, it seems that Myriad has opened the door to patenting natural products, after small and even routine chemical structure changes are made.

[64]     If natural products (after routine chemical alteration) can be patented as composition of matter, this would increase the pharmaceutical industry’s interest in pursuing natural products as drugs. This would open the door to more patenting of drugs derived from TMK in co-development initiatives. This could lead to significant revenue generation (to be shared equitably with indigenous peoples) and to medical benefits for the rest of the world.

[65]     Even if individual plant-derived molecules (after modification) cannot be patented as easily as just described, combinations like those shown in Fig. 2 could be patentable.[167] Indeed, combinations of active substances are central to how many traditional medicines, like ayahuasca, work (see section II). This is a distinguishing feature of traditional medicines relative to western medicine.[168] Only the shaman, based on TMK, knows which combinations of plants will produce the desired therapeutic effect. Then, the chemist can build on this TMK to identify which combinations of purified active chemical substances extracted from those plants are needed to reproduce these clinical effects. This combination, discoverable only through a collaborative co-development effort between indigenous peoples and scientific researchers, could then be patented.[169]

[66]     In summary, indigenous peoples should consider the value of composition of matter patent protection, if they hope to reap the full benefit of their TMK for themselves and the world. Recent developments in U.S. patent law suggest new strategies to obtain composition of matter protection to increase the value of indigenous peoples’ TMK to a potential drug co-development partner from the pharmaceutical industry.

 

          e.  Proposed Structure for a Drug Co-Development Research Agreement

[67]     In the interest of transparency and ensuring that the interests of all parties are considered, it is advisable that drug co-development projects between Peruvian and U.S. researchers execute a research agreement when working with indigenous peoples. Such an agreement should build upon the above legal protections for TMK (section IV(A)(a)), and be consistent with regional and international laws. A sample agreement is provided below:[170]

 

(Sample) TMK-Based Drug Co-Development Research Agreement

[68]     This research and drug co-development agreement (“Agreement”) is made by and among the following collaborating parties (“Parties”): Indigenous Peoples Representative (“Party 1”), Peruvian Research Team Representative (“Party 2”), and U.S. Research Team Representative (“Party 3”).

DEFINITIONS

[69]     “TMK” means traditional medical knowledge: “knowledge, know-how, skills and practices that are developed, sustained and passed on from generation to generation within a community, often forming part of its cultural or spiritual identity.”[171]

[70]     INDECOPI” means National Institute for the Protection of Competition and Intellectual Property: an organization that manages the Local, National and Public Registers of Collective Knowledge of Indigenous Peoples.[172]

[71]     “TPA” means The U.S.-Peru Trade Promotion Agreement, the agreement between the U.S. and Peru that governs trade, but also includes the “Understanding Regarding Biodiversity and Traditional Knowledge.”[173]

[72]     “Indigenous Peoples” means “aboriginal peoples holding rights that existed prior to the formation of the Peruvian State, maintaining a culture of their own, occupying a specific territorial area and recognizing themselves as such. These include peoples in voluntary isolation or with which contact has not been made, and also rural and native communities.”[174]

[73]     “Informed Consent” means authorization given under this protection regime, by the representative organization of the indigenous peoples possessing collective knowledge and in accordance with provisions recognized by them, for the conduct of a particular activity that entails access to and use of the said collective knowledge, subject to the provision of sufficient information on the purposes, risks or implications of the said activity, including any uses that might be made of the knowledge, and where applicable on its value.[175]

[74]     “CDA” means confidential disclosure agreement.

PROVISIONS

[75]     WHEREAS, the Parties share a common interest in developing drugs derived from TMK;

[76]     WHEREAS, the Parties share a desire to see TMK and associated intellectual property rights (IPRs) protected, yet also benefiting the world;

[77]     WHEREAS, the Parties agree to equitably share financial and other benefits that could result from this collaboration;

[78]     WHEREAS, the Parties agree to show mutual respect for each other’s governing laws, customs and values;

[79]     WHEREAS, the Parties agree that TMK is owned by Indigenous Peoples, and any development and patenting of drugs derived from TMK will only occur with permission that is be granted by Party 1, after being fully informed of all relevant risks and benefits via Informed Consent;

[80]     WHEREAS, Parties 1 and 2 agree to collaboratively pursue studies directed to identifying the active chemical component(s) derived from TMK-based plants, which are responsible for desirable medical effects;

[81]     WHEREAS, the Parties agree to negotiate in good faith any license agreements for TMK and TMK-derived patents, including composition of matter patents on active chemical substances;

[82]     NOW, IT IS THEREFORE RESOLVED, in consideration of the forgoing, that the parties hereby agree to the following:

[83]     1. Purpose and Scope

The Parties recognize that Amazonian TMK is a rich source of useful medical treatments that have been collectively developed over many years, and is owned by the Indigenous Peoples which Party 1 represents. Parties are mutually committed to the promotion of respect, preservation and wider application of TMK, as well as the use of TMK to benefit Indigenous Peoples, and mankind in general. Such benefits include the development and dissemination of new and better medical treatments. Benefits may also be financial, based on revenue generated from sales drugs and/or licensing of IP based on development of TMK-based medicines. Such development is only to be pursued according to the other sections of this agreement, which emphasis equitable sharing of benefits, and Informed Consent (Appendix A) from Party 1, before developing TMK-derived drugs.

The research and drug co-development team shall engage in activities that include biological demonstration of safety and efficacy of TMK-derived treatments, including plant extracts that are prepared by Party 1. Activities performed by Parties 2 and 3 may also include purification and chemical characterization of the active chemical components present in TMK-derived treatments. This may be followed by chemical synthesis of these active chemical components, and demonstration of their biological safety and efficacy, alone and in combinations. Parties 2 and 3 agree to keep Party1 informed of significant developments in these studies, and to seek the Informed Consent (Appendix A) of Party 1 before filing patent applications on composition of matter identified in these studies. Likewise, Parties 2 and 3 agree to enter these chemical structures into Peru’s National Registries for TK. If a decision is made to patent the composition of matter, submission will only be made to the private registry (until the patent publishes). If Party 1 decides to keep the chemical structure information as a trade secret, Parties 2 and 3 agree to honor this request, subject to §2 of this agreement.

 

[84]     2. Decision-making

Party 1 agrees to develop governance procedures that ensure they are representing the broader interests of the Indigenous Peoples that own the TMK which is the topic of this research and drug co-development collaboration. Party 1 has the sole power to decide if chemical structures of active substances, derived from plant extracts, are to be: (a) kept as trade secrets, (b) the subject of a patent application, or (c) entered in the National Public Registry of Collective Knowledge of Indigenous Peoples. Party 1 agrees to not unreasonably withhold permission to patent; and, if both Parties 2 and 3 wish to file a patent application, but Party 1 refuses, Parties 2 and 3 may appeal the decision to an appellate body that has previously been chosen by the Indigenous People who Party 1 represents. Other project decisions, which do not directly relate to IPRs, will be made by majority vote of the three representatives.

 

[85]     3. Confidential Information

Parties agree to sign a CDA (Appendix B) to protect all confidential information that is shared or developed in this collaboration. Such information may include TMK-related trade secrets of Party 1, including those that are kept in the National Private Register of Collective Knowledge of Indigenous Peoples. Parties agree to not publicly disclose chemical structures that are identified during this collaborative co-development initiative, without unanimous agreement by all three representatives. Likewise, Parties 2 and 3 agree to not publicly disclose trade secrets that have been revealed to them by Party 1, unless Party 1 grants permission to do so.

[86]     4. Intellectual Property (IP)

Parties 2 and 3 agree that all TMK-related trade secrets that pre-date this agreement, including those that were previously entered into the National Private Registry of Collective Knowledge of Indigenous Peoples, are property of Party 1. Such trade secrets will be revealed and/or licensed at the discretion of Part 1. Parties 2 and 3 will not patent any TMK-derived invention without first obtaining permission from Party 1, and this permission is to be granted only after Party 1 has signed the Informed Consent document in Appendix A that outlines all significant risks and benefits.

The IP that is most likely to result from this collaborative co-development initiative includes chemical structures of active substances that are purified from plant extracts of TMK-based therapies. These chemical structures will be protected via composition of matter patents or trade secrets or, at the discretion of Party 1, publicly released via the Public National Register of Collective Knowledge of Indigenous Peoples, in order to create prior art that prevents patenting by other parties (subject to § 3 of this agreement). Parties will work with INDECOPI to enter TMK-derived information into the National Registers of Collective Knowledge of Indigenous Peoples, including chemical structures.

 

[87]     5. Licensing of TMK and TMK-derived Intellectual Property

Since Parties share an interest in benefiting the world based on TMK-derived therapies, and associated discoveries, and since drug development is extremely expensive, it may become necessary to license IP to an external partner. Such an external partner would typically be a pharmaceutical or biotechnology company that has the resources and experience needed to develop drugs that result from this collaboration. Such arrangements typically require that the composition of matter patent protecting the drug lead molecule be licensed to them; and, it is expected that the pharmaceutical partner and Parties would negotiate a revenue sharing arrangement that could include upfront financial payments, payments upon achievement of certain milestone events (e.g. completion of different phases of clinical trials), and royalties on net or gross profits from drug sales, once the drug is approved by appropriate regulatory agencies, such as the Food and Drug Administration in the U.S.

Parties agree to negotiate in good faith an agreement that equitably shares benefits between all three groups, and will be defined in detail in the license agreement (Appendix C). Such an agreement might include an equal sharing of revenues between all three groups, although other arrangements could be negotiated. In negotiating terms, Parties agree to consider and honor existing legal structures, such as those associated with the TPA, the Andean Community, and the sui generis protections in Peru (esp. Law No. 27811).[176] Accordingly, Parties agree that the license agreement will be prepared, executed and properly recorded using the WIPO “toolkit”[177]. Any license agreement will ensure equitable sharing of benefits derived from the use of TMK, including >10% of revenues provided to the Fund for Development of Indigenous People, before distribution to the three groups that comprise the Parties.[178] Such an agreement will only be executed after Party 1 has been made aware, via Informed Consent (Appendix A), of all the risks and benefits associated with pursuit of the license agreement (Appendix C). Any license agreement that is executed, even those which are categorized as “exclusive,” will provide an exception for the Indigenous People that Party 1 represents, to ensure that they will be able to continue to use their TMK as they had before the license agreement was executed.

 

[88]     Appendices: (A) Informed consent form, (B) Confidential disclosure agreement (CDA), (C) Draft license agreement.

V.  Conclusion

[89]     The TMK underlying medical treatments used by indigenous peoples has great value to their communities and may also have great untapped value for the rest of the world. The goal of the collaborative drug development projects described herein, involving researchers in the U.S. and Peru, is to extend the benefits of TMK to the rest of the world, while respecting the IPR of the indigenous peoples from whom TMK-based discoveries may be derived. Of particular importance is ensuring equitable sharing of any future benefits of drug co-development successes with the indigenous peoples, and making sure all decisions are made based on informed consent that fully discloses all material risks and benefits.

[90]     A model example of a TMK-based medicine is ayahuasca (Fig. 1).[179] For ayahuasca to work effectively, the shaman mixes two or more plants and prepares a tea – a type of plant extraction. Subsequent scientific research has established why it is necessary to mix these plants, based on chemical substances that have been extracted and identified from each (Fig. 2).[180] While the researchers who identified these active chemical substances did not pursue a composition of matter patent on them, such a strategy could have been taken. If it had, it should only have been pursued with the informed consent of the indigenous peoples who owned this TMK-based IP; and, there should be equitable sharing of future benefits. The example of the Miller patent on the ayahuasca plant (Fig. 3) illustrates an unsavory effort to bypass this process, which led to public outcry and the subsequent creation of laws and procedures to ensure protection of Peru’s IPRs.[181]

 

[91]     Future drug co-development initiatives should build on these lessons from ayahuasca, to ensure protection of IPR via compliance with national, regional and international laws and treaties, including those embodied in Peru’s sui generis protections (Law No. 27811), the Andean Community, and the U.S.-Peru TPA. With these constraints and guidelines, research collaborations between U.S. researchers, Peruvian researchers, and indigenous communities can proceed to co-develop TMK-derived drugs. To guide this process, a draft drug co-development agreement has been provided in this paper (section IV). Central to this agreement is a focus on identifying active chemical components from plant extracts and patenting them as composition of matter. This focus is a pragmatic requirement, since pharmaceutical companies who may license these patents for further co-development will only make a significant financial investment if they have the strong protection that composition of matter (not method of use) patents provide. This co-development process has the potential to extend the benefits of TMK to the rest of the world, which is a shared goal of all parties involved.

 

 

 

 

 

 

 

 

* The author is Dean and Professor of Business, and Professor of Pharmaceutical Sciences, at Concordia University Wisconsin. He would like to thank Dean Arneson, Pharm.D, Ph.D. (Professor and Dean of the CUW School of Pharmacy) for providing the pictures from his trips to Peru, and Professor Kali Murray at Marquette University for many helpful comments and guidance. This research was supported, in part, by National Institutes of Health (NIH) grants AI101975, GM118304 and HL112639.

 

[1] See, Manuel Ruiz, Isabel Lapeña, and Susanna E. Clark, The Protection of Traditional Knowledge in Peru: A Comparative Perspective, 3 Wash. U. Glob. Stud. L. Rev. 755, 760 (2004).

 

[2]See Ley N° 27811 [Law No. 27811], art. 5, Aug. 10, 2002, El Peruano, http://www.wipo.int/edocs/lexdocs/laws/es/pe/pe011es.pdf, archived at https://perma.cc/28J9-VW3L (trans. at http://www.wipo.int/edocs/lexdocs/laws/en/pe/pe011en.pdf, archived at https://perma.cc/99RJ-GWCM (Peru) (Law Introducing a Protection Regime for the Collective Knowledge of Indigenous Peoples derived from Biological Resources).

 

[3]See generally, Howard Mann, Intellectual Property Rights, Biodiversity and Indigenous Knowledge: A Critical Analysis in the Canadian Context, Report Submitted to the Canadian Working Group on Articles 8(j) of the Convention on Biological Diversity (Ottawa, 1997) (Analyzing intellectual property rights of Aboriginal people in Canada with regard to today’s laws, and addressing the correlating barriers and opportunities for the use of intellectual property rights in relation to indigenous knowledge and resources).

 

[4] See, e.g., Heather A. Sapp, Monopolizing Medicinal Methods: The Debate Over Patent Rights for Indigenous Peoples, 25 Temp. J. Sci. Tech. & Envtl. L. 191, 196 (2006) (“…[W]estern patent systems appropriately exclude [Traditional Knowledge] from patent protection.”).

 

[5] See Gene Quinn, The Impact of the America Invents Act on the Definition of Prior Art, IP Watchdog (Oct. 3, 2012), http://www.ipwatchdog.com/2012/10/03/the-impact-of-the-america-invents-act-on-the-definition-of-prior-art/id=28453/, archived at https://perma.cc/6RGD-KTJ7.

[6] See Ish Khanna, Drug Discovery in the Pharmaceutical Industry: Productivity Challenges and Trends, 17 Drug Discovery Today 1055, 1088 (2012), http://ac.els-cdn.com/S1359644612001833/1-s2.0-S1359644612001833-main.pdf?_tid=4b6731ea-7ede-11e6-ab65-00000aab0f01&acdnat=1474340569_16e7ca651037b847bcc9a375343d47de, archived at https://perma.cc/Y7QN-4ZQG.

 

[7] Id. at 1095-96.

 

[8] See e.g., Carolyn Gregoire, Scientists Put Shamanic Medicine Under the Microscope, Huffington Post (Oct. 16, 2015), http://www.huffingtonpost.com/entry/shaman-medicine-autoimmune-disease_us_55f8737be4b0d6492d633c23, archived at https://perma.cc/K3XP-W3S8.

 

[9] See id.

 

[10] World Intellectual Prop. Org. (WIPO), Traditional Knowledge, http://www.wipo.int/tk/en/tk/, archived at https://perma.cc/96MH-S43M (last visited Sept. 21, 2016).

 

[11] Joe McCarter & Michael C. Gavin, Perceptions of the Value of Traditional Ecological Knowledge to Formal School Curricula: Opportunities and Challenges From Malekula Island, Vanuatu, 7 J. Ethnobiology & Ethnomedicine, no. 38, 2011, https://ethnobiomed.biomedcentral.com/articles/10.1186/1746-4269-7-38, archived at https://perma.cc/S8UF-FUQG.

[12] See Martha Johnson, Research on Traditional Environmental Knowledge: Its Development and Its Role, in Lore: Capturing Traditional Environmental Knowledge 3, 4 (Martha Johnson ed., 1992).

[13] See Fulvio Mazzocchi, Western Science and Traditional Knowledge: Despite Their Variations, Different Forms of Knowledge Can Learn From Each Other, 7 European Molecular Biology Organization Reports 463, 463–466 (2006).

[14] See Graham Dutfield, TRIPS-Related Aspects of Traditional Knowledge, 33 Case W. Res. J. Int’l L. 233, 242 (2001).

 

[15] See Ryan Abbott, Documenting Traditional Medical Knowledge, WIPO, 3 (Mar. 2014) http://www.wipo.int/export/sites/www/tk/en/resources/pdf/medical_tk.pdf, archived at https://perma.cc/2F3G-55CT citing Fact Sheet No. 134: Traditional Medicine World Health Org. (WHO) http://www.who.int/mediacentre/factsheets/2003/fs134/en/, archived at https://perma.cc/7Q4N-E7Z2.

[16] See World Health Org. (WHO), General Guidelines for Methodologies on Research and Evaluation of Traditional Medicine (2000), http://apps.who.int/iris/bitstream/10665/66783/1/WHO_EDM_TRM_2000.1.pdf, archived at https://perma.cc/4HZY-45KQ.

 

[17] See Norman R. Farnsworth, Screening Plants for New Medicines, in Biodiversity 83, 95 (E. O. Wilson ed., 1988).

 

[18] See Peter Principe, Economics and Medicinal Plants, in Medicinal Plants: Their Role in Health and Biodiversity 42, 44 (Timothy R. Tomlinson & Olayiwola Akerele eds., 1998).

 

[19] See Rainer W. Bussmann & Douglas Sharon, Traditional Medicinal Plant Use in Northern Peru: Tracking Two Thousand Years of Healing Culture, 2 J. Ethnobiology & Ethnomedicine, no. 47, 2006, http://ethnobiomed.biomedcentral.com/articles/10.1186/1746-4269-2-47, archived at https://perma.cc/H3E6-GKU8.

 

[20] See id.

[21] See infra Figure 1.

 

[22] See Richard E. Schultes, The Botanical and Chemical Distribution of Hallucinogens, 9 J. Psychedelic Drugs 247, 251 (1977).

 

[23] See Kenneth W. Tupper, The Globalization of Ayahuasca: Harm Reduction or Benefit Maximization?, 19 Int’l J. Drug Pol’y 297, 297–303 (2006).

 

[24] See Marlene Dobkin De Ríos, Banisteriopsis in Witchcraft and Healing Activities in Iquitos, Peru, 24 Econ. Botany 296, 296 (1970).

 

[25] See id.

 

[26] E-mail attachment from Dr. Dean Arneson, Pharm.D, Ph.D., Dean of School of Pharmacy, Concordia University Wisconsin, to author (2013) (on file with author).

 

[27] See supra Figure 1.

 

[28] See De Ríos, supra note 24, at 296.

 

[29] See id. (stating that the boiled ayahusca infusion is sometimes mixed with additives like chacruna, a Quechua word describing the plant otherwise known as Psychotria viridis).

 

[30] See infra Figure 2.

 

[31] See J.C. Callaway et al., Pharmacokinetics of Hoasca Alkaloids in Healthy Humans, 65 J. Ethnopharmacology 243, 244 (1999).

[32] See id.; see also Dennis J. McKenna, J.C. Callaway & Charles S. Grob, The Scientific Investigation of Ayahuasca: A Review of Past and Current Research, 1 Heffter Rev. Of Psychedelic Research 65, 67 (1998); see infra Figure 2.

 

[33] See Callaway et al., supra note 31, at 245.

 

[34] See, e.g., Andrea Rinaldi & Pryia Shetty, Traditional Medicine for Modern Times: Facts and Figures, SciDev.Net (June 6, 2015), http://www.scidev.net/global/medicine/feature/traditional-medicine-modern-times-facts-figures.html, archived at https://perma.cc/9A3E-BUSS.

 

[35] See generally Bussman & Sharon, supra note 19 (discussing Chiappe and Millones as the first scientists to study the Shaman’s use of ayahuasca).

 

[36] See Richard Seth Gipstein, Note, The Isolation and Purification Exception to the General Unpatentability of Products of Nature, 4 Colum. Sci. & Tech. L. Rev. 2 (2003).

 

[37] See Leanne M. Fecteau, Note, The Ayahuasca Patent Revocation Questions About Current U.S. Patent System, 21 B.C. Third World L.J. 69, 70 (2001).

 

[38] See U.S. Patent No. Plant 5,751 (filed Nov. 7, 1984); see infra Figure 3.

 

[39] Id.

 

[40] See David R. Downes & Glenn M. Wiser, Center for Int’l Envtl. Law, Comments on Improving Identification of Prior Art: Recommendations on Traditional Knowledge Relating to Biological Diversity Submitted to the United States Patent and Trademark Office, Aug. 2, 1999, at 15, www.ciel.org/Publications/IdentificationofPriorArt.pdf‎, archived at https://perma.cc/R26N-LSRW [hereinafter Comments on Improving Identifications of Prior Art]; see also David R. Downes & Glenn M. Wiser, The Legal Elements of the “Ayahuasca” Patent Case, Center For International Environmental Law (Mar. 30, 1999), http://ciel.org/Publications/ayahuascalegalelements.pdf, archived at https://perma.cc/F7JE-BFPX [hereinafter Legal Elements].

 

[41] See Downes & Wiser, Legal Elements, supra note 40.

 

[42] U.S. Patent No. Plant 5,751 (filed Nov. 7, 1984).

 

[43] David R. Downes, et al., Request for Reexamination of U.S. Patent No. Plant 5,751 (Mar. 30, 1999), at 1, http://www.ciel.org/wp-content/uploads/2015/06/ReexaminationofUSPlantPatent5751.pdf, archived at https://perma.cc/L6JE-N6YV;

Downes & Wiser, Comments on Improving Identifications of Prior Art, supra note 40, at 15.
[44] See generally Downes & Wiser, Comments on Improving Identifications of Prior Art, supra note 40, at 13–16 (discussing arguments against the validity of Miller’s patent).

 

[45] See id. at 4.

 

 

[47] See Downes, et al., supra note 43, at 1–2.

 

[48] Downes & Wiser, Comments on Improving Identifications of Prior Art, supra note 40, at 13 n. 39.

 

[49] See id. at 13; see also, supra note 35.

 

[50] See Downes & Wiser, Comments on Improving Identifications of Prior Art, supra note 40, at 14–15.

 

[51] See id. at 15.

 

[52] See E-mail from author, to Dr. Dean Arneson, Pharm.D, Ph.D., Dean of School of Pharmacy, Concordia University Wisconsin (2013) (on file with author).

 

[53] See Downes & Wiser, Comments on Improving Identifications of Prior Art, supra note 40, at 15.

 

[54] In re Hall, 781 F.2d 897, 900 (Fed. Cir. 1986) (“…we reject appellant’s legal argument that a single cataloged thesis in one university library does not constitute sufficient accessibility to those interested in the art exercising reasonable diligence.”).

 

[55] See supra Figure 4.

 

[56] See generally Downes & Wiser, Comments on Improving Identifications of Prior Art, supra note 40, at 3, 5–6, 16 (discussing the social implications on the traditional knowledge of indigenous communities).
[57] See id.; see also Glenn Wiser, Center for Int’l Envtl. Law, U.S. Patent and Trademark Office Reinstates Ayahuasca Patent: Flawed Decision Declares Open Season on Resources of Indigenous Peoples, (June 25, 2001) at 1, http://www.ciel.org/wp-content/uploads/2015/06/PTODecisionAnalysis.pdf, archived at https://perma.cc/PY75-MJZG.

 

[58] See infra Section III (E).

 

[59] Use of Turmeric in Wound Healing, U.S. Patent No. 5,401,504 (filed Dec. 28, 1993).

 

[60] Sanjay Kumar, India Wins Battle with USA Over Turmeric Patent, 350 The Lancet 675, 724 (1997); Use of Turmeric in Wound Healing, U.S. Patent and Trade Office Reexamination Certificate B1 5,401,504 (Apr. 21, 1998).

 

[61] Detailed Statement in Support of Request for Reexamination of U.S. Plant Patent No. 5,751 from David R. Downs & Glenn Wiser to the Commissioner of Patents and Trademarks (filed Nov. 7, 1984), http://www.ciel.org/wp-content/uploads/2015/06/ReexaminationofUSPlantPatent5751.pdf, archived at https://perma.cc/5XJ9-YQMN [hereinafter Detailed Statement].

 

[62] Id. at 4.

[63] See generally Press Release 98-6, USPTO, Facts on Patenting Life Forms Having a Relationship to Humans, (April 1, 1998) (on file with author), http://www.uspto.gov/about-us/news-updates/facts-patenting-life-forms-having-relationship-humans, archived at https://perma.cc/7MDZ-SSLJ.

 

[64] Tol-O-Matic, Inc. v. Proma Produkt-Und Marketing Gesellschaft m.b.H., 945 F.2d 1546, 1553 (Fed. Cir. 1991) (citing Lowell v. Lewis , Fed. Case No. 8568 (C.C. Mass. 1817)).

 

[65] Downes & Wiser, Detailed Statement, supra note 61, at 24.

 

[66] See infra Section III (E).

 

[67] See Glen M. Wiser, U.S. Patent and Trademark Office Reinstates Ayahuasca Patent, Flawed Decision Declares Open Season on Resources of Indigenous Peoples CIEL 2 (June 25, 2001).

 

[68] See Ex parte Nehls, No. 2007-1823 (B.P.A.I. Jan. 28, 2008).

 

[69] Downes & Wiser, Detailed Statement, supra note 61, at 1.

 

[70] See generally Glen M. Wiser & David R. Downes, Center for Intn’l Envtl. Law, Comments on Improving Identification of Prior Art: Recommendations on Traditional Knowledge Relating to Biological Diversity Submitted to the United States Patent and Trademark Office, (Aug. 2, 1999), http://www.ciel.org/wp-content/uploads/2015/03/IdentificationofPriorArt.pdf, archived at https://perma.cc/7P9U-QTSN.

 

[71] See Press Release 98-6, USPTO, supra note 63.

 

[72] Constitución Política Del Perú [C.P.] art. 68.

 

[73] See GRAIN, The Struggle Against IPR in the Andes, Seedling, July 12, 2009, at 21.

 

[74] Id. at 20.

 

[75] See Ley N° 27811 [Law N° 27811], Ley que Establece el Régimen de Protección de los Conocimientos Colectivos de los Pueblos Indígenas Vinculados a los Recursos Biológicos [Law Introducing a Protection Regime for the Collective Knowledge of Indigenous Peoples Derived from Biological Resources], Aug. 10, 2002, El Peruano, at 227953–54 (Peru).

 

[76] Id. at art. 5.

 

[77] See id at art. 5(d),(e).

 

[78] Id. at art. 7.

 

[79] See Ley N° 27811 [Law N° 27811], supra note 75 at art. 8.

 

[80] See id. at art. 10

 

[81] Id.

 

[82] Id. at art. 15.

 

[83] See id. at art. 20.

 

[84] See Ley N° 27811 [Law No. 27811], supra note 75 at art. 24.

 

[85] See id. at art. 18.

 

[86] See id. at art. 23.

 

[87] Id.

 

[88] See discussion supra Section II.

 

[89] See infra Section III(E).

 

[90] See Ley N° 27811 [Law No. 27811], supra note 75 at art. 26.

[91] Id. at art. 27.

 

[92] See World Intellectual Prop. Org. (WIPO), Traditional Knowledge Documentation Toolkit (2012), http://www.wipo.int/export/sites/www/tk/en/resources/pdf/tk_toolkit_draft.pdf, archived at https://perma.cc/85DN-5V4S (last visited Nov. 11, 2013).

 

[93] See id. at 22.

 

[94] See infra Section III(D).

 

[95] See Free Trade Agreements, Off. of the U.S. Trade Representative, http://www.ustr.gov/trade-agreements/free-trade-agreements, archived at https://perma.cc/BQ9K-8X67 (last visited Sept. 9, 2016).

 

[96] See Final Text United States – Peru Trade Promotion Agreement, Off. of the U.S. Trade Representative, (Apr. 12, 2006), http://www.ustr.gov/trade-agreements/free-trade-agreements/peru-tpa/final-text, archived at https://perma.cc/GH7G-VSNX.

 

[97] See Communidad Andina, http://www.comunidadandina.org/Seccion.aspx?id=189&tipo=QU&title=somos-comunidad-andina, archived at https://perma.cc/B2U5-PASZ (last visited Sept. 9, 2016) (describing the countries benefitting).

 

[98] See GRAIN, The Struggle Against IPR in the Andes, supra note 73 at 18.

 

[99] Id.

 

[100] Id. (emphasis added).

 

[101] Id.

 

[102] See supra Sections III(A)(a)-(b); see Grain, The Struggle Against IPR in the Andes, supra note 73, at 17.

 

[103] U.S.-Peru Trade Promotion Agreement: Potential Economy-wide and Selected Sectoral Effects. Inv. No. TA-2104-20, USITC Pub. 3855 at 6-12 (June 1, 2006).

[104] Understanding Regarding Biodiversity and Traditional Knowledge, U.S.-Peru, (April 12, 2006), http://www.ustr.gov/sites/default/files/uploads/agreements/fta/peru/asset_upload_file719_9535.pdf, archived at https://perma.cc/66P2-X795.

 

[105] Id.

 

[106] See id.

 

[107] See GRAIN, The Struggle Against IPR in the Andes, supra note 73 at 17,19.

 

[108] Laurence R. Helfer & Karen J. Alter, The Influence of the Andean Intellectual Property Regime on Access to Medicines in Latin America, in Balancing Wealth and Health: Global Administrative Law and the Battle Over Intellectual Property and Access to Medicines in Latin America 1 (Rochelle Dreyfuss & César Rodríguez-Garavito, eds., 2013).

 

[109] See id. at 2.

 

[110] See id. at 1.

 

[111] See id. at 4.

 

[112] Id.

 

[113] See GRAIN, The Struggle Against IPR in the Andes, supra note 73 at 17,18.

 

[114] See Convention on Biological Diversity, June 5, 1992, 1760 U.N.T.S. 79, 31 I.L.M. 818 (1992), http://www.cbd.int/doc/legal/cbd-en.pdf, archived at https://perma.cc/4BVB-MTFW.

 

[115] Id. at 6.

[116] See id. at 24.

 

[117] See generally, Agreement on Trade-Related Aspects of Intellectual Property Rights, Annex 1C, Apr. 15, 1994, Legal Instruments-Results Of The Uruguay Round, 1869 U.N.T.S. 299, 33 I.L.M. 81 (1994) (supporting need for multilateral framework between member countries).

 

[118] See Overview: The TRIPS Agreement, World Trade Org., https://www.wto.org/english/tratop_e/trips_e/intel2_e.htm, archived at https://perma.cc/9ZST-3HXV (last visited Sept. 9, 2016).

 

[119] See J.H. Reichman, The TRIPS Agreement Comes of Age: Conflict or Cooperation with the Developing Countries?, 32 Case W. Res. J. Int’l. L. 441, 452 (2000).

 

[120] See id.

 

[121] See World Intellectual Prop. Org. (WIPO), Advice on Flexibilities under the TRIPS Agreement, http://www.wipo.int/ip-development/en/legislative_assistance/advice_trips.html, archived at https://perma.cc/DE85-UJEE (last visited Aug. 30, 2016).

 

[122] See Paris Convention for the Protection of Industrial Property, Mar. 20, 1883, as last revised July 14, 1967, 21 U.S.T. 1583, 828 U.N.T.S. 311 (applying international treaty to industrial intellectual property).

 

[123] See Berne Convention for the Protection of Literary and Artistic Works, Sept. 9, 1886, as last revised July 24, 1971, 25 U.S.T. 1341, 828 U.N.T.S. 221 (international agreement governing copyright law).

 

[124] See e.g.,Overview: the TRIPS Agreement, supra note 118.

 

[125] See generally Leahy-Smith America Invents Act, Pub. L. No. 112-29, 125 Stat. 284 (2011) (modernizing the United States Patent Law system).

 

[126] See 35 U.S.C. § 102(a), (b) (2006) (emphasis added).

 

[127] Id. (emphasis added).

 

[128] See id. (emphasis added).

 

[129] See supra note 59.

 

[130] See supra note 60.

 

[131] See Leanne M. Fecteau, The Ayahuasca Patent Revocation: Raising Questions About Current U.S. Patent Policy, 21 B.C. Third World L. J. 69, 86 (2001).

 

[132] See id. at 73-74.

 

[133] 35 U.S.C. §102(a)(1).

 

[134] Id.

 

[135] Id.

 

[136] See Ley N° 27811 [Law No. 27811], supra note 75 at art. 2(e) (explaining the protections created by the Peruvian government for collective knowledge of indigenous peoples in regard to biological resources).

 

[137] Plurinational State Of Bolivia [Constitution] 2009, Ch. V, art. 43 (Bol.), https://www.constituteproject.org/constitution/Bolivia_2009.pdf, archived at https://perma.cc/A9YV-8AP5.

[138] See World Intellectual Prop. Org. (WIPO), Comparative Summary of Existing National SUI GENERIS Measures and Laws for the Protection of Traditional Knowledge, Intergovernmental Committee on Intellectual Property and Genetic Resources, Traditional Knowledge and Folklore, Fifth Session, WIPO Doc. WIPO/GRTKF/IC/5/INF/4 http://www.wipo.int/meetings/en/doc_details.jsp?doc_id=17394, archived at https://perma.cc/D7HC-DJY8 (June 20, 2003).

[139] See Peru Trade Promotion Agreement, Office Of The U.S. Trade Representative https://ustr.gov/trade-agreements/free-trade-agreements/peru-tpa, archived at https://perma.cc/AW2U-RUYC (last visited Sep. 9, 2016).

 

[140] See Ley N° 27811 [Law No. 27811], supra note 75 at art 42.

 

[141] See supra note 138.

 

[142] See supra Figure 2.

 

[143] See id.

 

[144] Drug Developers Are Aggressively Changing the Way They Do R&D, Tufts Center For the Study of Drug Dev. (Jan. 5, 2011), http://csdd.tufts.edu/news/complete_story/pr_outlook_2011, archived at https://perma.cc/55GK-T5BA.

 

[145] See supra Figure 2.

 

[146] This is an example situation.

 

[147] See Ass’n for Molecular Pathology v. Myriad Genetics, Inc., 133 S. Ct. 2107, 2116 (2013).

 

[148] See e.g., U.S. Patent No. 7,915,265 B2 (filed Feb. 15, 2006); see also U.S. Patent No. 8,067,433 B2 (filed Nov. 8, 2006); Alice Yuen-Ting Wong & Albert Wai-Kit Chan, Myriad and Its Implications for Patent Protection of Isolated Natural Products in the United States, Chinese Medicine, http://cmjournal.biomedcentral.com/articles/10.1186/1749-8546-9-17, archived at https://perma.cc/K3VL-4SGX (last visited Sep. 7, 2016).

 

[149] See Parke-Davis & Co. v. H. K. Mulford & Co., 189 F. 95., 114 (S.D.N.Y. 1911); see also Michael D. Davis, The Patenting of Products of Nature, 21 Rutgers Computer & Tech. L. J. 293, 326 (1995).

 

[150] See id. at 324.

 

[151] See supra note 147 at 2111.

 

[152] See id at 2113.

 

[153] Id. at 2120.

 

[154] See id.

[155] Id. at 2119.

 

[156] See supra note 147 at 2111.

 

[157] See Jason Rantanen, Myriad: Isolated DNA out, cDNA in, patentlyo (June 13, 2013), http://patentlyo.com/patent/2013/06/myriad-isolated-dna-out-cdna-in.html, archived at https://perma.cc/3AZD-BQLW (discussing the outcome of Ass’n for Molecular Pathology v. Myriad, 133 S. Ct. 2107, 2118 (2013)).

 

[158] See Z. Peter Sawicki et al., Patenting Biologicals: Myriad Issues and Options in the Wake of Myriad, Bench & Bar (Sept. 9, 2013), http://mnbenchbar.com/2013/09/patenting-biologicals/, archived at https://perma.cc/GR3J-8PBT.

 

[159] See supra note 147 at 2112, 2117 (indicating that a small modification to naturally occurring DNA would likely qualify as a patentable product).

 

[160] Id. at 2116.

 

[161] See, e.g., Kristin C. Buteau, Deuterated Drugs: Unexpectedly Nonobvious?, 10 J. High Tech. L. 22, 26̀–27 (2009); Amanda Yarnel, Heavy-Hydrogen Drugs Turn Heads, Again: Firms Seek to Improve Drug Candidates by Selective Deuterium Substitution, Chem. & Eng’g News (June 22, 2009), http://cen.acs.org/articles/87/i25/Heavy-Hydrogen-Drugs-Turn-Heads.html, archived at https://perma.cc/NSX4-7CRN.

 

[162] See, e.g., Patrick Makary, Principles of Salt Formation, 2 U.K. J. Pharmaceutical & Biosciences 4, 1, 3 (2014), http://www.ukjpb.com/pdf/UKJPB_SuperAdmin_49_49_1411846931.pdf, archived at https://perma.cc/9CXQ-BHVY .

 

[163] See C.R.A. Wright, On the Action of Organic Acids and their Anhydrides on the Natural Alkaloids, 27 J. Chem. Soc’y. 1031, 1032 (1874), http://pubs.rsc.org/en/content/articlepdf/1874/js/js8742701031, archived at https://perma.cc/ECR9-V8UC.

 

[164] See id; see also U.N. Office on Drugs & Crime, History of Heroin, 5 Bull. on Narcotics 3, 3 (1953), https://www.unodc.org/unodc/en/data-and-analysis/bulletin/bulletin_1953-01-01_2_page004.html, archived at https://perma.cc/S5SP-3FSE; Bayer, Felix Hoffmann, http://www.bayer.com/en/Felix-Hoffmann.aspx, archived at https://perma.cc/HF2J-8JL4 (last visited Sep. 8, 2016).

 

[165] See cDNA Production, Davidson Coll. Dept. of Biology, http://www.bio.davidson.edu/genomics/method/cDNAproduction.html, archived at https://perma.cc/4PZE-F428 (last visited Sep. 8, 2016).

 

[166]See e.g., Thermo Fisher Scientific, http://www.thermofisher.com/us/en/home/life-science/pcr/reverse-transcription/cdna-synthesis-kits.html, archived at https://perma.cc/FKX6-FYBQ (last visited Sep. 8, 2016).

 

[167] See supra Figure 2.

 

[168] E. Chan, M. Tan, J. Xin, S. Sudarsanam & D.E. Johnson, Interactions Between Traditional Chinese Medicines and Western Therapeutics, 13 Current Opinion Drug Discovery & Devel. 50, 52 (2010); see supra Section II.

 

[169] Id. at 63.

 

[170] This sample agreement was created for purposes of this article.

 

[171] See supra note 16.

 

[172] See Ley N° 27811 [Law No. 27811], supra note 75 at art. 20.

 

[173] See supra note 96.

 

[174] See Ley N° 27811 [Law No. 27811], supra note 75 at art. 2(a).

 

[175] Id. at art. 2(c).

[176] See id.

 

[177] See WIPO Toolkit, supra note 92 .

 

[178] See Ley N° 27811 [Law No. 27811], supra note 75 at art. 8.

 

[179] See supra Figure 1.

 

[180] See supra Figure 2.

 

[181] See supra Figure 3.

Page 3 of 8

Powered by WordPress & Theme by Anders Norén