Do not upload what you don't own In the recent case of Hays Specialist Recruitment (Holdings) Limited and Another v Ions and Another [2008] the UK Courts have allowed a pre-action disclosure in relation to a confidentiality claim where Mr Ions, an ex-employee of Hays Specialist Recruitment, had uploaded his employer's confidential information obtained during his employment to the LinkedIn business social networking site.  Notwithstanding that Hays were aware that employees were using LinkedIn and indeed Mr Ions suggested that they encouraged such activity, the Court held that was no reason for business confidential information to be "cut and pasted" and uploaded to the public domain.  With the increasing use of instant messaging, accessing social networking sites in the workplace and virtual workplaces in virtual worlds such as Second Life, it is important for businesses to consider how they can manage their trade secrets and business information.  Existing staff internet and email policies need to be expanded to cover web 2.0.    If you want copyright get it in writing! Once again the Courts have held that unless there is a contract in writing assigning ownership of copyright from a developer to a customer, then no assignment can be implied. In the case of Meridian International Services Limited v Richardson and Others, a decision from the Court of Appeal on 4 June 2008 shows that where there is no formal agreement between the parties as to assignment of ownership notwithstanding that the work was commissioned by an oral arrangement the developer retained copyright and the customer only had a license to use the software that had been developed to order.  Businesses are once again reminded to clearly put in writing roles and responsibilities and to address rights in commissioned works.  For further information please see Meridian International Services Limited v Richardson and Other [2008], 4 June 2008.   Denmark's DPA publishes guidelines for internet and email information security It is reported that on 16 June 2008 the Danish Data Protection Agency issued guidelines on the security requirements for personal data processed by data controllers via the internet or email. The Danish DPA indicates that where sensitive personal data is processed online it needs to be encrypted and where data controllers fail to encrypt they may be subject to criminal prosecution. The Danish DPA recommends that even where non-sensitive personal data is being processed online data controllers should also consider encryption as a means of adding security, although responsibility for decisions in data security remains with the data controllers.