Database disputes

Database disputes

Database right

Database right is a proprietary right governed by the Copyright and Rights in Databases Regulations 1997 (CRD 1997), SI 1997/3032, which implemented Directive 96/9/EC (EU Database Directive). Database right arises automatically when there has been a substantial investment in obtaining, verifying or presenting the database contents. A database is defined as a ‘collection of independent works, data or other materials which are arranged in a systematic or methodical way and are individually accessible by electronic or other means’ (CRD 1997, SI 1997/3032, reg 12, and section 3A(1) of the Copyright, Designs and Patents Act 1988 (CDPA 1988)). For example, the definition of database would include an electronic or hard copy encyclopedia or a telephone directory.

Database right can subsist whether or not the database or its contents are a copyright work. There is no requirement for an 'author’s own intellectual creation' (as there is for copyright); the test is whether there has been a 'substantial investment' and this will turn on the facts as not all databases qualify for protection. Database right only protects the arrangement of the database as a means of storing

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

ICO publishes framework for handling data protection complaints

The Information Commissioner's Office (ICO) has published guidance detailing its approach to handling data protection complaints, including the criteria used to determine the extent of investigations. The framework introduces a triage system that prioritises complaints involving high levels of harm, vulnerable individuals, or strategic priorities. Additionally, the ICO is developing a threshold system that could trigger intervention for organisations receiving multiple complaints over a specified period, although the exact details of these thresholds have not yet been disclosed.

Commission launches consultation to revise the EU Cybersecurity Act and strengthen the EU cybersecurity framework

The European Commission launched a call for evidence to support the preparation of a legislative proposal to revise the EU Cybersecurity Act. The initiative aims to strengthen EU cyber resilience, update the mandate of the EU Agency for Cybersecurity (ENISA) and improve the effectiveness of the European Cybersecurity Certification Framework. The Commission noted that the cybersecurity landscape has become significantly more complex and threat‑intensive since the Act’s adoption in 2019, while subsequent EU legislation has expanded ENISA’s tasks beyond its original mandate, creating the need to streamline, simplify and supplement the existing framework to ensure coherence, reduce administrative burdens and improve implementation for businesses and users. The initiative focuses on measures to support a secure and resilient Information and Communication Technology supply chain and the EU cybersecurity industrial base, addresses shortcomings in the certification framework such as slow adoption, unclear roles, limited agility and insufficient clarity on covered risks, including non‑technical factors, and considers alignment with newer instruments such as the Cyber Resilience Act. The Commission outlined policy options ranging from non‑legislative measures to targeted or comprehensive regulatory revision, stating that EU‑level action is required to prevent internal market fragmentation and to secure long‑term economic and social benefits through greater harmonisation, stronger cybersecurity and resilience, more efficient incident response and enhanced protection of fundamental rights, including personal data. The call for evidence will run until 20 June 2025.

ICO updates data protection by design guidance following DUAA commencement

The Information Commissioner’s Office (ICO) has published its updated guidance on data protection by design and by default alongside the commencement of key Data (Use and Access) Act 2025 (DUAA 2025) provisions. The guidance clarifies that organisations must build data protection considerations into the design and operation of systems, services, products, and processes, ensuring that only the minimum necessary personal information is collected, used, stored, and accessed for each defined purpose. It explains the need for appropriate technical and organisational measures, including robust security controls, clear retention practices, strong default privacy settings, and regular assessment of risks through data protection impact assessments.

Information Law weekly highlights—5 February 2026

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

View Information Law by content type :

News