IPMojo

BOOK AN APPOINTMENT

Scott Coulthart

by

Paul Bender’s music has been sampled by Beyoncé and Kendrick. His band, Hiatus Kaiyote, has three Grammy nominations. His side project, The Sweet Enoughs, racks up millions of streams. So it came as a shock when fans started hearing tracks on his Spotify profile that he didn’t recognise — or approve.

Tracks that sounded like they’d been composed by an AI trapped in an elevator.

“It was probably the worst attempt at music I’ve ever heard,” Bender told Brisbane Times. “Just absolutely cooked.” His reaction soon gave way to a grim realisation: someone was uploading fake music — apparently AI-generated — directly to his artist profile. And it wasn’t just Spotify. Apple Music, Tidal, YouTube Music and Deezer all carried the same fakes.

No passwords were stolen. No logins compromised. Just a ticking time bomb in the music distribution supply chain.

The Loophole That Became a Business Model

The scam works like this: a grifter uploads garbage tracks via a digital music distributor, assigns them to a known artist name, and — voila — the platform “maps” it to the artist’s official profile. Instant legitimacy, with algorithmic discovery to match.

No ID check. No consent. No authentication.

This isn’t just a quirk of one platform’s back end. It’s systemic. And it’s being exploited on an industrial scale. One vlogger, TankTheTech, showed how anyone can assign AI music to an artist profile in under ten minutes.

And the numbers are staggering:

  • Deezer reports that 18% of its daily uploads in 2025 are AI-generated.

  • Mubert, an AI music tool, claims over 100 million tracks were made on its platform in just the first half of 2023.

  • The Music Fights Fraud Alliance estimates 10% of all global music streams are fraudulent, with some distributors seeing fraud rates as high as 50%.

That’s not fringe — it’s a revenue model. And it’s bleeding real artists.

Legal Implications: Between Passing Off and Platform Apathy

Let’s be clear: uploading fake music under someone else’s name looks a lot like impersonation, if not passing off, especially where artist reputation and income are at stake. There may also be:

  • Copyright infringement if elements of an artist’s work were used in training or replication.

  • Moral rights violations under the Copyright Act 1968 (Cth), especially the right of integrity where a fake work is falsely attributed.

  • Misleading or deceptive conduct under section 18 of the Australian Consumer Law.

Yet despite the legal exposure, platforms and distributors are playing hot potato with responsibility. Spotify calls it a “mapping issue.” Artists call it what it is: a scam that platforms are structurally enabling.

Why This Matters — Beyond Music

This isn’t just a niche concern for indie musicians. It’s a case study in what happens when:

  • AI-generated content floods creative ecosystems,

  • platforms prioritise volume over verification,

  • and IP rights become an afterthought to scale.

In short, it’s the algorithm’s world — and creatives are just living in it.

But not quietly. Artists like Bender and Michael League (of Snarky Puppy) are now speaking out and pushing for industry action. With growing numbers of testimonials and escalating complaints, the music world may be the canary in the coal mine for a broader wave of AI impersonation and platform indifference.

Until then, don’t be surprised if the next time you hit play on a favourite artist’s profile… what comes out is 100% algorithm, 0% soul.

Here’s a thought: 2FA authentication before allowing uploads? Verify before you amplify!

by

For many years, privacy enforcement in Australia was a bit… polite. The OAIC could nudge, issue determinations, and make a bit of noise, but it often lacked the real teeth needed to drive compliance in the boardroom. That era is over.

11 December 2024 saw the commencement of amendments to the Privacy Act 1988 (Cth) which overhaul Australia’s enforcement toolkit — with bigger fines, broader court powers, faster penalties, and forensic-level investigative authority. It’s not quite the GDPR, but it’s getting close enough to make a lot of GCs uncomfortable.

In this 7th part of our Privacy 2.0 series, let’s start with the money. The maximum fine for a serious or repeated privacy breach by a company is now $50 million, or three times the benefit obtained, or 30% of adjusted turnover — whichever is greater. That’s serious deterrent territory, not just a regulatory slap. Even mid-tier breaches now carry $3.3 million maximums for corporates. Individuals? You’re looking at up to $2.5 million if you seriously mess it up. There’s a new hierarchy of penalties too — with lower thresholds and infringement notices for technical breaches like bad privacy policies or sloppy notifications.

But it’s not just about fines. The OAIC can now issue infringement notices, bypassing court for certain minor but clear-cut breaches. Think of it like a privacy speeding ticket — faster, cheaper, but still stings. And yes, you can fight it in court if you want. Just hope your documentation holds up.

Then there are the new powers of investigation and monitoring. The OAIC is now plugged into the Regulatory Powers (Standard Provisions) Act 2014 (Cth), meaning it can get warrants, enter premises, seize devices, and even apply reasonable force — all while preserving privilege. This puts the Privacy Commissioner on more equal footing with ASIC and the ACCC, especially when it comes to serious or systemic non-compliance. If your data handling is shady, half-baked or undocumented — now’s the time to clean it up.

And finally, court powers have been expanded. The Federal Court and the Federal Circuit and Family Court can now order not just fines, but anything else appropriate — including remediation, compensation, and public declarations. This opens the door for privacy class actions to get seriously strategic – not just possible, but powerful.

Here’s the bottom line: privacy compliance can no longer sit in the “legal” corner or be outsourced to the IT team. It’s now a cross-functional risk category — and it’s time businesses treated it that way. If you’re not audit-ready, breach-ready, or regulator-ready… you’re not ready.

Next week in our Privacy 2.0 series: how the law tackles automated decision-making — and why your pricing algorithm, hiring bot, or fraud engine might need to show its work.

by

Before the amendments to the Privacy Act 1988 (Cth) on 11 December 2024, if your Australian business wanted to send personal data overseas — say, to a CRM hosted in the US or a support centre in Manila — you had to jump through a slightly vague hoop. Under APP 8.1, you were supposed to take “reasonable steps” to ensure the recipient wouldn’t do anything that would breach the Australian Privacy Principles. And if they did? Thanks to section 16C, you were still on the hook.

There were a couple of workarounds, one of which was found in APP 8.2(a) – this let you off the liability hook if you “reasonably believed” the recipient country had a law or binding scheme that was “substantially similar” to the APPs — and had real enforcement mechanisms. But what does “reasonable belief” mean in that context? And how similar is “substantially similar”? The vagueness of the whole thing often felt like a false sense of security.

The December amendments bring structure and at least some clarity. We now have APP 8.2(aa) and 8.3, which allow for the creation of a whitelist: a formal, government-endorsed list of countries and binding schemes deemed to have privacy protections and enforcement powers equivalent to ours. If your recipient is on the list, you don’t have to prove a thing — just document that the transfer aligns with the rules and you’re good to go.

This is huge. It streamlines compliance and brings us closer to the way other jurisdictions, like the UK and the EU under their respective GDPRs, handle cross-border data flows via “adequacy” decisions. It also gives businesses clarity about who’s in the safe zone, who’s not, and what conditions might apply. For instance, a country might only make the list for health data, or only for financial services entities. The flexibility is there — but so is the scrutiny.

One catch? At the time of publishing this post, the list doesn’t exist yet. It’ll be created via regulation, which means the real-world usefulness of this reform hinges on how quickly and smartly that list gets built. Until then, businesses still have to do the old assessment under APP 8.2(a), with all the murkiness that comes with it.

So if your infrastructure, vendors, or data processors are offshore, now’s the time to:

  • map your transfers,

  • review your contracts,

  • and prepare to align with the new safe-harbour system when it drops.

Because in the new privacy era, “we didn’t realise the US server was logging that” won’t fly anymore.

Next week in our Privacy 2.0 series: the enforcement overhaul — where civil penalties, infringement notices, and OAIC superpowers come roaring into view.

by

Crunch Time for CRUNCHIEZ: Cadbury Blocks Rival Chocolate Mark

In a sweet victory for brand owners, Cadbury UK Limited has successfully opposed the registration of the trade mark CRUNCHIEZ SURPRIZE in Australia, convincing the Trade Marks Office that the name was too close for comfort to its iconic CRUNCHIE mark.

Greek confectionery importer Relkon Hellas applied to extend international protection for its mark CRUNCHIEZ SURPRIZE (featuring stylised graphics) for use in relation to chocolate and confectionery in Class 30. Cadbury, relying on decades of use of the CRUNCHIE mark in Australia, opposed the application on several grounds — but ultimately succeeded on one: section 60 of the Trade Marks Act 1995 (Cth).

Under s 60, a trade mark may be refused if another mark had acquired a reputation in Australia before the relevant date, and the use of the new mark would be likely to deceive or cause confusion.

Here’s how the Delegate broke it down:

Reputation:
Cadbury’s CRUNCHIE has been sold in Australia since the 1950s and enjoys widespread recognition. Sales figures, advertising spend, historical ads, and retail presence all pointed to a strong reputation in Australia, particularly for chocolate and confectionery.

Similarity of Marks:
While not identical, CRUNCHIE and CRUNCHIEZ SURPRIZE share key elements:

  • The word CRUNCHIEZ was viewed as a near-plural of CRUNCHIE, differing by just one letter.

  • The additional term SURPRIZE was considered descriptive and did little to distinguish the overall impression.

  • Stylisation differences weren’t enough to avoid confusion.

Likely Confusion:
The Delegate found that ordinary consumers could reasonably wonder whether CRUNCHIEZ SURPRIZE products were from the same source as Cadbury’s CRUNCHIE line — especially when both appeared in close proximity in stores like Kmart and The Reject Shop.

Interesting side note – the evidence of where the competing brands sat in places like K-mart and The Reject Shop was adduced not by Cadbury, but by Relkon Hallas, whose lawyers used that evidence to submit that because the brands were not literally side-by-side, this supported a conclusion that there would be no confusion.

That turned out to be a bit of a strategic fail as the Delegate thought this evidence supported a finding of confusion because it was clear evidence that the relatively new CRUNCHIEZ SURPRIZE mark was being advertised in close proximity to the long-standing and very famous CRUNCHIE mark.

Oops.

The Outcome
Protection for CRUNCHIEZ SURPRIZE was refused in full. Cadbury was awarded costs, and Relkon Hellas left with a lesson in brand proximity.

Key Takeaways for IP Owners

  • Reputation is a powerful shield. Long-standing brand presence, even on basic goods like chocolate bars, can stop later marks in their tracks.

  • Adding a “z” won’t save you. Minor spelling tweaks and descriptive add-ons (like “Surprize”) rarely neutralise the risk of confusion.

  • Stylisation matters — but not enough. Graphic flourishes won’t rescue a mark if the words dominate and invite association with a famous brand.

  • Proximate promotions can pummel you. If your goods end up shelved near a well-known competitor, that visual proximity will weigh heavily in the analysis.

IP Mojo Takeaway:
If you’re naming a new chocolate product and your trade mark sounds like a Cadbury classic… you’re probably skating on thin nougat.

by

Reasonable Steps Just Got Real: What APP 11 Now Demands

For years, Australian Privacy Principle 11 has required businesses to take “reasonable steps” to protect personal information from misuse, interference, or loss. Sounds fair — but also vague. What exactly is “reasonable”? A locked filing cabinet? Two-factor authentication? Asking nicely?

In this 4th part of IP Mojo’s exclusive Privacy 2.0 blog series, we discuss how the latest privacy law amendments haven’t rewritten APP 11 — they’ve sharpened it. Specifically, they’ve clarified that “reasonable steps” include both technical and organisational measures. It’s a simple sentence, but it changes the conversation. Because now, the standard isn’t just what you thought was reasonable. It’s what you can prove you’ve done to make security part of your systems, your structure, and your staff’s day-to-day behaviour.

Let’s break it down. Technical measures? Think encryption, firewalls, intrusion detection systems, and strong password protocols. Organisational measures? Employee training, incident response plans, documented data handling procedures, and privacy-by-design baked into new systems and tools. It’s not just about buying tech — it’s about building a culture.

Of course, “reasonable” still depends on context: the nature of your business, the sensitivity of the data, the volume you handle. But this update sends a signal: the era of set-and-forget privacy compliance is over. If your team’s still using outdated software or storing customer records on someone’s laptop, that’s not going to cut it.

Here’s the kicker: while the amendment itself is modest — just a new clause (11.3) — the implications are not. It gives regulators clearer footing. It gives courts a stronger hook. And it gives businesses a chance to get ahead — by documenting what you’re doing, auditing what you’re not, and showing your privacy policies aren’t just legalese, but lived practice.

Tune in tomorrow for: a look at the new data breach response powers, and how the government can now legally share your customers’ personal information — yes, really — in a post-hack crisis.

by

Whose Work Is It Anyway? The Remix War, AI, Coffee Plungers and Swimsuits

From Elton John to anonymous meme-makers, a battle is raging over what it means to be “creative” — and whether it starts with permission.

Two stories made waves in copyright circles last week:

  • In the UK, Sir Elton John, Sir Paul McCartney and other musical heavyweights called for stronger rules to stop AI from “scraping” their songs without a licence.

  • In India, news agency ANI drew criticism for aggressively issuing YouTube copyright claims — even for sub-10 second clips — triggering takedown threats against creators.

At first glance, these might seem worlds apart. But they highlight the same question:

At what point does using someone else’s work become exploitation, not inspiration?

And who decides?

Creators vs Reusers: Two Sides of the Copyright Culture Clash

On one side: Creators — musicians, writers, filmmakers, photographers — frustrated by tech platforms and algorithms ingesting their work without permission. Whether it’s AI training data or news footage embedded in political commentary, their message is the same:
“You’re building on our backs. Pay up.”

On the other side: Remixers, meme-makers, educators, and critics argue that strict copyright regimes chill creativity. “How can we critique culture,” they ask, “if we’re not allowed to reference it?”

This isn’t new — hip hop, collage art, satire, and even pop music are full of samples and nods. But AI has industrialised the scale of reuse. It doesn’t borrow one beat or a single shot. It eats the entire catalogue — then spits out something “new.”

So what counts as originality anymore?

Australian Lens: Seafolly, Bodum, and the Meaning of “Original”

Seafolly v Madden [2012] FCA 1346

In this high-profile swimwear spat, designer Leah Madden accused Seafolly of copying her designs. She posted comparison images on social media implying that Seafolly had engaged in plagiarism. Seafolly sued for misleading and deceptive conduct under ss 52 and 53 of the Trade Practices Act 1974 (predecessors to s18 of the Australian Consumer Law – which had by then commenced but the relevant conduct being sued for took place before it had commenced).

The Federal Court found that Madden’s claims were not only misleading but also unsubstantiated, because the design similarities were not the result of actual copying. The case reinforced that:

  • Independent creation is a valid defence, even if the resulting works are similar

  • Superficial resemblance isn’t enough — there must be a causal connection

It’s a reminder that derivation must be substantial and material, not speculative or assumed.

Bodum v DKSH [2011] FCAFC 98

This case involved Bodum’s iconic French press coffee plunger — the Chambord — and whether a rival product sold by DKSH under the “Euroline” brand misled consumers or passed off Bodum’s get-up as its own.

Bodum alleged misleading or deceptive conduct and passing off, based not on name or logo, but on the visual appearance of the product: a clear glass beaker, metal band, and distinctive handles, which had come to be strongly associated with Bodum.

At trial, the Federal Court rejected Bodum’s claims. But on appeal, the Full Federal Court reversed that decision, holding that:

  • Bodum had a substantial reputation in the get-up alone;

  • The Euroline plunger was highly similar in appearance; and

  • DKSH’s failure to adequately differentiate its product through branding or design gave rise to a misleading impression.

Both passing off and misleading/deceptive conduct (also under the old s52) were found. The Court emphasised that reputation in shape and design can be enough — and differentiation must be meaningful, not tokenistic.

The AI Angle: Who Trains Whom?

AI tools like ChatGPT, Midjourney, and Suno don’t just copy works. They learn patterns from thousands of inputs. But in doing so, they arguably absorb creative expression — chord progressions, phrasing, brushstroke styles — and then make new outputs in that same vein.

AI developers claim this is fair use or transformative. Artists argue it’s a form of invisible appropriation — no different from copying and tweaking a painting, but with zero attribution or compensation.

It’s the Seafolly and Bodum problem, scaled up: if AI’s “original” work was trained on 10,000 human ones, is it really original? Or just a remix with plausible deniability?

The Bottom Line

Copyright law is meant to balance:

  • Encouraging creativity

  • Rewarding labour

  • Allowing critique and cultural dialogue

But that balance is breaking under the weight of machine learning models and automated copyright bots. As Seafolly and Bodum show, the law still values intention, process, and context — not just resemblance.

Yet in a world of remix and AI, intention is opaque, and process is synthetic.

So where do we draw the line?