When your product is a dataset

A local business builds a dataset of accessible venues. It collects opening hours, measures door widths, writes original descriptions, adds photographs, and works out a useful way to organize it all. The founder asks: can someone just copy this?

In the United States, copyright does not protect individual plain facts. It protects a compilation of facts when the compilation is original, and some entries can carry their own protected expression. Collecting and arranging data as a purely mechanical task, such as moving records from paper into a computer, earns no copyright, however much work it took. 1 So sort the venue dataset into three piles: the door widths and opening hours (facts anyone may use), the written descriptions and photographs (protected on their own if they are original), and the way you chose and organized the venues (protected only if that choice is creative).

Protection of a collection is not ownership of every fact

If a second researcher measures the same doorway, your copyright does not stop them from publishing that width. A Copyright Office registration for a database covers the selection, coordination and arrangement of the data when the compilation is creative enough; it never covers the individual data points. 4 What you can stop is copying of your descriptions, your photographs and a creative compilation.

Treat the other layers of the product separately. Copyright does not protect ideas, methods or systems 1, so protect your collection method by keeping it confidential (see protecting trade secrets). Your software and your brand follow their own rules: see software and open source and choosing a brand name. Customers often pay for accuracy, updates and service as much as for the data itself, so put those in the offer too.

Register the database in the U.S.

1. File one version of a database that is not mostly photographs with the Copyright Office's online Standard Application in eCO, or on paper Form TX. The page links the current fee schedule. 4
2. Claim the compilation, plus any new text or photographs in the records that you own. Exclude earlier versions, previously published or registered material, public-domain material and anything owned by someone else. You do not need to exclude facts or data, because copyright does not protect them. 4
3. Deposit the sample of complete records the page asks for, not summary views that show only part of each record. A multi-file database also needs a descriptive statement of its files. 4
4. If you update often, register a group of updates instead: it covers updates created or published within a three-month period in one calendar year, is filed only on paper Form TX (eCO filings are refused), and covers only updates that add new selection, coordination or arrangement. Refreshing existing records without changing the compilation does not qualify. 5

Other countries can protect databases differently

In the EU, copyright protects a database only for the selection or arrangement of its contents, and never extends to the contents themselves. 2 The EU adds a separate (sui generis) right for the maker of a database who made a substantial investment in obtaining, verifying or presenting its contents. It lets the maker stop extraction (copying all or a substantial part of the contents to another medium) and re-utilization (making all or a substantial part available to the public), and the repeated, systematic taking of small parts that conflicts with normal use of the database. It applies whether or not the database or its contents are protected by copyright. 2

So "facts are free" does not settle a database question in the EU. The opposite claim is wrong too: the EU right controls taking contents out of your database, not the facts themselves. Know these limits before you rely on it:

• Term. The right lasts fifteen years from 1 January of the year after the database was completed, or after it was first made available to the public. A substantial new investment in the contents starts a new term for the resulting database. 2
• Who gets it. Makers who are nationals or habitual residents of an EU Member State, and companies formed under a Member State's law with their registered office, central administration or principal place of business in the EU. Makers outside that group are covered only if the EU concludes an agreement extending the right to them. 2 A U.S. business with no EU company should not tell EU customers its data is protected by the EU database right.
• Lawful users. Anyone lawfully using a database made available to the public may extract and re-use insubstantial parts of it for any purpose, and a contract term that says otherwise is void. 2
• Proof. The maker must prove when the database was completed 2, so keep a dated record of every version.

The permission to collect is not always permission to publish

List every source of the data (surveys, partners, purchased feeds, public records, online services) and the terms each came with. A fact being free from copyright does not free you from a contract: the venue project may be allowed to use a partner's feed internally and still be barred from reselling it.

If the data is about identifiable people, data-protection law applies whatever copyright says. In the EU, the GDPR covers any information relating to an identified or identifiable living person and any operation on it, from collecting and storing to sharing and deleting. It applies to a business outside the EU that offers goods or services to, or monitors the behaviour of, people in the EU. It does not cover data about companies: a venue's generic info@ address is company data, but a named staff member's work email or business phone number is personal data. 6 The EU's overview page links the full set of business guidance. 3

Before you publish or sell records about people:

1. Name the purpose of each personal field, tell people that purpose when you collect it, and collect only what the purpose needs. 7
2. Choose your legal ground: consent, a contract, a legal obligation, vital interests, a public task, or legitimate interests after checking that the person's rights are not seriously affected. 8
3. Test any new use, such as selling the feed, against the original purpose before you start. A volunteer's phone number collected for coordination stays out of the product. 7
4. Keep personal data accurate and set dates to delete or review it. 7

If the product will publish or sell personal data about people in the EU, have a data-protection lawyer confirm your legal ground before launch.

Explain what a customer is receiving

Write a dataset license that states access, permitted uses, the update schedule, attribution, redistribution, and any limits on identifying or contacting people (see understanding a license). Grant only what you control: you cannot license copyright in facts, and you cannot pass on rights a partner's feed did not give you. In the EU the database right can be transferred or licensed by contract 2, but your license cannot take away a lawful user's right to insubstantial parts. Keep a dated record of sources, collection methods, versions and the terms each source came with; it backs your license promises, your U.S. registration and your EU completion date.

Then describe the product as it is: original reviews and photographs, verified factual records, a selected and organized collection, and a dependable update service. That tells customers what they are paying for and claims no more than the law protects.