A lawsuit filed against IBM in a Canadian court has called into question the giant's ownership of EPAL, the programming language for creating data privacy policies on computer networks.

Zero-Knowledge Systems filed the lawsuit in Superior Court of Quebec on Monday. It is seeking an injunction to stop IBM from continuing to distribute and license EPAL, as well as $5 million in damages, according to spokesman Craig Silverman.

IBM spokesman Cas Purdy declined to comment on the case, claiming the company never comments on pending legal matters.

IBM unveiled EPAL in July 2003, saying that the language, based on XML, would make it easier for software application developers to build features into applications for managing data security and privacy. EPAL allows companies to render privacy policies in a language that machines can read and protect data according to those policies as it is passed from system to system. As such, it replaces tedious, manual processes for implementing data privacy policies, said IBM. It plans to add EPAL support to its enterprise privacy management software, IBM Tivoli Privacy Manager.

In December 2003, IBM submitted a draft of EPAL to the World Wide Web Consortium (W3C) to develop, hoping to turn it into a standard that will help automate privacy management tasks, improve consumer trust and reduce the cost of privacy compliance.

However, Zero-Knowledge claims that EPAL is based on work that its Enterprise Privacy Unit (now incorporated as Synomos) did with IBM between June 2001 and February 2002. Together they were developing an XML privacy language standard called PRML (Privacy Rights Markup Language). The work on PRML was used as the foundation for EPAL, making Zero-Knowledge and IBM co-owners of the standard, Zero-Knowledge said in a statement.

Zero-Knowledge claims IBM violated its copyright and breached an agreement reached before the joint work on the PRML standard when it submitted EPAL to the W3C without acknowledging Zero-Knowledge's role in developing it, and when it licensed the technology without Zero-Knowledge's consent, the company said. The W3C did not respond to a request for comment on the case.

Zero-Knowledge filed suit in Canada because it is a Canadian company and because the company's lawyers determined that IBM had violated Canada's copyright laws, Silverman said. He declined to comment on whether a case might be brought against IBM in U.S courts.

The company negotiated with IBM to try to resolve the dispute over EPAL prior to filing suit but the two companies were unable to reach an agreement, Silverman said.