[Jas Purewal is a games lawyer and writer of Gamer/Law. The following was reproduced from the original with his permission.] The second hand sale of physical and digital software has effectively been declared legal, according to a judgment published by the Court of Justice of the European Union today.  This has the potential to have a real impact on the way that software is sold and consumed – but at the same time the case raises more questions than it answers, so we're really not in a clear cut situation at all.  Read on for more details…

The facts:

The case related to a dispute between software companies Oracle and UsedSoft over whether UsedSoft could sell businesses and consumers used licenses for Oracle software without Oracle’s permission (previously discussed here).  Oracle therefore took UsedSoft to court in Germany, which was referred to the Court of Justice of the European Union ("CJEU").

The judgment – short view:

Essentially, the court held that, under EU law, the right of software developers to control distribution of a piece of software – whether stored physically or digitally –  is "exhausted" (i.e. lost) once the developer has been paid for it (known as a "first sale").  This means that developers lose the ability to prohibit any second hand sale. However, if a second hand sale goes ahead then the first purchaser must stop using her copy of the software and render it unusable, because the developer's right to control reproduction of software is not exhausted on a second hand sale.  In order to make sure that the first purchaser stops using the software she has sold on, it is permissible for the software developer to use "technical protective measures such as product keys". IF YOU DON'T WANT TO READ THE LEGAL GOODNESS THAT NOW FOLLOWS (SHAME ON YOU IF SO), SKIP TO "WHAT THIS MEANS" BELOW!

The judgment in more detail:

The case involved resolving complicated questions about how international and EU law determine the legal position of second hand software sales.  My summary (omitting some of the more arcane aspects of the case) follows:

Basically, the main part of the case hinged on the key question of whether the initial sale of software amounts to a "first sale" of that software.  If it did, then under Article 4.2 of the InfoSoc Directive the right of distribution would be exhausted and, if THAT happened, it would make it much harder to prohibit second hand sales.  Key Issue 1: is the sale of software a "first sale"? The CJEU held that 'sale' means "an agreement by which a person, in return for payment, transfers to another person his rights of ownership in an item of tangible or intangible property belonging to him" (para 42). Whether there is a first sale of software therefore depends on whether that "right of ownership" is transferred by the software developer to the purchaser. Oracle argued that there is no right of ownership transferred to its purchasers, and therefore no "first sale" of its software at all, because it makes its software available for free download and separately enters into license agreements with a downloader in return for that downloader paying a fee.  Oracle argued therefore that this was therefore a license arrangement, not a sales arrangement. The CJEU disagreed.  It held "the downloading of a copy of a computer program and the conclusion of a user license agreement for that copy form an indivisible whole. Downloading a copy of a computer program is pointless if the copy cannot be used by its possessor. Those two operations must therefore be examined as a whole for the purposes of their legal classification" (para 44). The CJEU therefore decided that making software available for download while at the same time entering into a license agreement with the downloader and receiving payment for it "examined as a whole, involve the transfer of the right of ownership of the copy of the computer program in question" (para 45). So, the CJEU held that since the sale of software involved a "transfer of ownership" in the software from the developer to the purchaser, that means it also constitutes a "first sale" under the InfoSoc Directive.  That in turn means that the developer's right of distribution is exhausted by that first sale (para 48). Key Issue 2: so if the sale of software by the developer to a first purchaser constitutes a first sale that exhausts the right of distribution, can the developer still control second hand sales using its right of reproduction? The key to understanding this issue is to remember that there are separate rights of distribution and rights of reproduction in EU copyright law.  By this stage in the case, the CJEU had decided that rights of distribution weren't a problem for second hand sales.  Now it had to decide whether software developers retain an exclusive right to control reproduction under Article 5(1) of Directive 2009/24 (aka the 'Computer Programs Directive') (which, if they do, could still be used to prohibit second hand sales). Essentially, the CJEU decided that the right to control reproduction is lost against the second purchaser (the reasons why take some explaining, but essentially it is because a second purchaser is held to be a "lawful acquirer" of the software under Article 5(1) of the Computer Program Directive).

Other issues discussed:

Issue 3: can the wording of the EU legislation be read such that the first sale/exhaustion of rights principle only applies to tangible software? No, said the CJEU following some slightly complex discussion of the relevant legislation (paragraphs 55 – 58).  Later, it said:  "…from an economic point of view, the sale of a computer program on CD-ROM or DVD and the sale of a program by downloading from the internet are similar. The on-line transmission method is the functional equivalent of the supply of a material medium" (para 69). And even more clear still: "To limit the application…of the principle of the exhaustion of the distribution right …solely to copies of computer programs that are sold on a material medium would allow the copyright holder to control the resale of copies downloaded from the internet and to demand further remuneration on the occasion of each new sale, even though the first sale of the copy had already enabled the rightholder to obtain an appropriate remuneration. Such a restriction of the resale of copies of computer programs downloaded from the internet would go beyond what is necessary to safeguard the specific subject-matter of the intellectual property concerned" (para 63). Issue 4: does it matter that the software has been patched/updated/changed between being bought by the first purchaser and then transferred to the second purchaser? Oracle argued that, because the software in question had been updated under a maintenance agreement since it was bought by the first purchaser, it could not be said that the second purchaser was purchasing the same software.  Therefore, Oracle said, there could not be an issue of exhaustion of rights here. The CJEU disagreed.  It said: "the exhaustion of the distribution right under Article 4(2) of Directive 2009/24 extends to the copy of the computer program sold as corrected and updated by the copyright holder" (para 68). Issue 5: what happens if the first purchaser acquires more licenses than he actually needs? The CJEU said that the first purchaser couldn't then slice and dice the licenses into piece and sell them off individually – they had to be transferred en masse (para 69).  (This is only likely to be relevant in block license deals of course). Issue 6: what happens to the first purchaser's installed copy of the software once he has sold it to a second purchaser? The CJEU held that the first purchaser needs to "make his own copy unusable at the time of its resale…in order to avoid infringing the exclusive right of reproduction of a computer program which belongs to its author", laid down in Article 4(1)(a) of Directive 2009/24". (This makes sense – if you sell the software on you shouldn't have the right to keep using it – otherwise you won't really have sold it at all). Later on, the CJEU acknowledged that in practice this could impose difficulties on the software developer because it'd be hard to know whether the first purchaser has made his copy "unusable".  The CJEU therefore briefly commented "to solve that problem, it is permissible for the distributor – whether ‘classic’ or ‘digital’ – to make use of technical protective measures such as product keys". Issue 7: can a software developer stop second hand sales on the basis that the second purchaser hasn't signed a license agreement with the developer? Some EU governments argued that a "lawful acquirer" could only be someone who had signed a license agreement with the developer (i.e. if you don't sign a EULA, you can't sell the game on). The CJEU disagreed and said: "that argument would have the effect of allowing the copyright holder to prevent the effective use of any used copy in respect of which his distribution right has been exhausted …by relying on his exclusive right of reproduction … and would thus render ineffective the exhaustion of the distribution right under Article 4(2)" (para 83). Issue 8: does it change things if the developer calls the software transfer a 'license' not a 'sale'? No.  The CJEU held "if the term ‘sale’ within the meaning of Article 4(2) of Directive 2009/24 were not given a broad interpretation as encompassing all forms of product marketing characterized by the grant of a right to use a copy of a computer program, for an unlimited period, in return for payment of a fee designed to enable the copyright holder to obtain a remuneration corresponding to the economic value of the copy of the work of which he is the proprietor, the effectiveness of that provision would be undermined, since suppliers would merely have to call the contract a ‘licence’ rather than a ‘sale’ in order to circumvent the rule of exhaustion and divest it of all scope" (para 49).

What this all means:

At first blush, this seems to be a pretty comprehensive decision by the CJEU coming down on the side of second hand sales of software.  The CJEU was clearly not persuaded that there is a legal justification for the prohibition on second hand sales (at least not as advanced by Oracle or its supporting parties). EU Member States are bound by EU law (which now includes this case) and have to interpret their own law in a way consistent with it – any domestic law which conflicts with EU law can (and has in the past been) struck down.  So, in principle this case now means across the EU that:

That said, there are some large holes in the case which means that unfortunately the position isn't completely clear-cut.  I've set out my initial thoughts below… Problem No. 1: what about software that physically doesn't permit second hand sales? How does this case apply to mobile apps, where of course there is no resale/trade ability?  We don't know.  On the one hand, a straightforward analysis might be that mobile apps are software just like Oracle's program in the case and therefore that the first purchaser of a mobile app should be able to sell it to a second purchaser (even if technically the ability  to do that doesn't exist…yet).  On the other hand, there is at least an argument that the first purchaser of an app shouldn't have the ability to resell the app to a third party due to this case, because when that first purchaser bought the app she would have had no technical ability – or even the expectation  - of being able to sell it to a third party.  In other words, what I'm saying here is, if the software was never technically capable of being sold to a third party in the first place, does this case change anything really?  The return might be, of course, that arguing about technical abilities isn't really the point: if the law says that mobile apps should be capable of being sold second hand, then the mobile platforms better do something about it. Leaving mobile aside, the real problem area is where software easily could be made capable of second hand sales – but hasn't.  Digital distribution platforms, for example, could in principle permit digital second hand sales (Green Man Gaming already does, for example) – so it will be interesting to see what impact this case has on them.   Problem No. 2: what about software which doesn't have an upfront sale value?  The case relates to Oracle software which I believe featured a single upfront payment.  What about World of Warcraft, or The Old Republic, with their subscription models?  Or freemium games, which don't even have a subscription model?  Does this case mean anything to them?  Arguably not, because their value lies in their experiential content and their 'services' aspect (more on that later)– not the actual software itself. That said, things could still get a little uncomfortable here because the case could be read to argue that free software can continue to be distributed for free from person to person once it has been released on to the market.  I doubt that many software companies would like having even their installer file, for example, legally passed around from person to person (in practice of course that happens often online, but software companies have been able to argue previously that that would be illegal, or at least a breach of the software EULA). Problem No. 3: what about software which has substantial periodic updates?  The CJEU rather blithely said that there isn't a problem if the software changes/is updated/patched in between being bought for the first time and then for a second time.  Really?  What if the software goes from alpha to gold, or if it has substantial additional content added to it?  Is it really the same thing then?  I suspect the CJEU has stored some trouble up for itself here.  Problem No. 4: how will "technical protection measures" work in practice?  The CJEU, despite its rather diplomatic language, clearly could see there was a big problem with its analysis: it permits first purchasers to sell software on, but what then stops the first purchaser from keeping a copy for herself at the same time? Like I said above, as a matter of law the first purchaser can't do that, but so what?  In practice, the software developer would need to use "product keys" or similar tech according to the CJEU.  But how will that work? To my mind, it suggests a situation in which product keys go from being one use only to becoming multi-use subject to some kind of transfer mechanism being put in place.  Imagine that Windows 9 goes from having a single, one-use product key to having a product key which can be 'wiped' and reused by a second purchaser.  Sound like it could cause problems to you?  Me too.  Problem No. 5: do other countries agree? There hasn't been much law on second hand sales abroad so far, but what there is doesn't necessarily agree with this case. I've written about the evolving position adopted in the USA in cases like Vernor v Autodesk for example here. Problem No. 6: is the real world going to pay any attention?  Not many businesses are using legal methods to control second hand sales anyway (apart from Oracle, obviously).  The focus is much on putting pressure on the retailers facilitating second hand sales while also devising technical, creative and business solutions to reduce the appeal of second hand sales. I'm not sure this case will do much to stop that (although, as I said, over time there might be more focus now on these 'workarounds' now it has been established that the principle of second hand sales is permitted).  Problem No. 7: does this even matter in the long run?  Two words: cloud computing.  Actually, four more words: Software as a Service.  As software and games increasingly become long-tailed services rather than digital goods, the question of the legality of second hand sales recedes into the distance.  (Of course, eventually we'll get to a stage when questions about the legal transferability of SaaS services starts coming up, but we're a way off that yet). 

Closing thoughts:

As you can see, this is a pretty big case (and probably one of the longest posts I've written on G/L!).  I think it will have a sizeable short term impact, with a whole range of software businesses considering how it affects them.  However, looking beyond that it seems clear already that the CJEU has posed more questions than it has answered and, in any event, nothing stays still in the world of tech and software.  Will this case seem so epic in a year or three's time?  Watch this space…