Lawsuit questions IBM’s ownership of EPAL standard

A lawsuit filed against IBM this week in a Canadian court calls into question IBM’s ownership of Enterprise Privacy Authorization Language (EPAL), a programming language for creating data privacy policies on computer networks.

A lawsuit filed against IBM this week in a Canadian court calls into question IBM’s ownership of Enterprise Privacy Authorization Language (EPAL), a programming language for creating data privacy policies on computer networks.

Zero-Knowledge Systems of Montreal filed the lawsuit Superior Court of Quebec Monday. The company is seeking an injunction to stop IBM from continuing to distribute and license EPAL, as well as $7 million (Candian, $5 million U.S.) in damages, according to Craig Silverman, a company spokesman.

IBM spokesman Cas Purdy declined to comment on the case, citing a corporate policy that prohibits comment on ongoing or pending legal matters.

IBM unveiled EPAL in July 2003, saying that the language, which is based on XML, would make it easier for software application developers to build features into applications for managing data security and privacy. EPAL allows organizations to render privacy policies in a language that machines can read, and to protect data according to those policies as it is passed from system to system within an organization. EPAL will replace tedious, manual processes for implementing data privacy policies, according to IBM.

IBM plans to add EPAL support to its enterprise privacy management software, IBM Tivoli Privacy Manager, the company said.

In December 2003, IBM submitted a draft of EPAL to the World Wide Web Consortium (W3C) to develop, hoping to turn it into a standard that will help automate privacy management tasks, improve consumer trust and reduce the cost of privacy compliance, the company said.

Zero-Knowledge claims that EPAL is based on work the company’s Enterprise Privacy Unit, now incorporated as Synomos, did with IBM between June 2001 and February 2002 to develop an XML privacy language standard, Privacy Rights Markup Language (PRML). The work on PRML was used as the foundation for EPAL, making Zero-Knowledge and IBM co-owners of the standard, Zero-Knowledge said in a statement.

Zero-Knowledge claims IBM violated its copyright and breached an agreement reached before the joint work on the PRML standard when it submitted EPAL to the W3C without acknowledging Zero-Knowledge’s role in developing it, and when it licensed the technology without Zero-Knowledge’s consent, the company said.

The W3C did not respond to a request for comment on the case.

Zero-Knowledge filed suit in Canada because it is a Canadian company and because the company’s lawyers determined that IBM had violated Canada’s copyright laws, Silverman said. He declined to comment on whether a case might be brought against IBM in U.S. courts.

The company negotiated with IBM to try to resolve the dispute over EPAL prior to filing suit, but the two companies were unable to reach an agreement, Silverman said.