Welcome to the Jungle: The Liability of Internet Intermediaries for Privacy Violations in Europe

When Internet companies and private parties started to offer Internet services in the 1980s, there was already discussion concerning the position of Internet intermediaries. Initially, the provider was often seen as the digital equivalent of a postal company, which had neither knowledge of nor control over the post that was delivered by it and therefore could not, in principle, be held liable for any illegal content. At that time however, there existed two separate doctrines regarding third party liability for copyright infringements in the United States, where the Internet experienced its initial growth. “Vicarious liability” entailed that a third party could be held liable for infringing activities if it had the right and ability to control over and gained financial profits from the activity, and “contributory liability”, which regarded third parties that had knowledge of and contributed to the infringing activity.  [1] These doctrines were gradually also applied to Internet service providers. This meant that if an Internet intermediary wanted to avoid liability for, for example, copyright infringements by its users, the intermediary would have to prove that it did not know of the infringing nature of the material, that it did not contribute in any way to the infringement and that it had not received any financial gain from the infringement.  [2]

This jurisprudential doctrine was subsequently further developed in the US Digital Millennium Copyright Act (DMCA) of 1998, which makes a distinction between (1) providers that offer access to networks and data transmission via these networks (access providers/mere conduits), (2) providers temporarily storing material on their server (caching providers), (3) providers that store information or host websites (hosting providers) and (4) providers that offer links to websites or make content searchable (search engine providers).  [3] The European Union (EU) has a regulation similar to the DMCA,  [4] laid down in the e-Commerce Directive 2000.  [5] The rules therein contained form the general basis for the exclusion of liability of Internet intermediaries under European law (so called safe harbors). Although this regime applies to virtually all offenses, data protection issues are explicitly excluded.  [6] In such cases, the Data Protection Directive  [7] applies. There is a third regime that is increasingly applied as well, namely when an Internet intermediary relies on the freedom of expression to protect its own interests, for example under the European Convention on Human Rights (ECHR).

It should be borne in mind that in the early days, Internet intermediaries were predominantly of a passive nature, and that the e-Commerce Directive is written for providers that transmit or store material on behalf of users only. In the modern Internet landscape however, providers have become much more active, for example by providing the platform on which information is shared by users, by indexing this information, by making it searchable and by publishing and distributing the information over the Internet. Examples of active Internet intermediaries are platforms such as Facebook, video services such as Youtube, digital markets such as eBay and modern media such as WikiLeaks or news sites (partially or primarily) based on stories, contributions and comments written by users. In these examples, the content is still provided by the users, but the role of the Internet intermediary is no longer merely to transmit, store or publish the material on behalf of the user – rather it fulfils an active role in the organization and functioning of the websites and platforms. The question thus becomes what position these providers have with regard to material of an infringing nature uploaded by their users.

Recently, the Court of Justice (ECJ) ruled in its Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González verdict (hereafter: Google Spain) that Google may be required to block or delink certain information from other website in its search engine in order to respect the data subject’s right to be forgotten.  [8] The ECJ has also held that the obligation to monitor and store all Internet traffic, contained in the Data Retention Directive, is invalid and violates the rights to privacy and data protection.  [9] In Delfi v. Estonia, the European Court of Human Rights (ECtHR) in 2013 and the Grand Chamber of the ECtHR in 2015 ruled that online news sites that facilitate user reactions can invoke the right to freedom of expression, but can also be held liable for user comments that harm third party interests.  [10] The Council of Europe (CoE), in 2011, developed a new vision on modern media, proposing inter alia to apply the classic protection of journalists to bloggers and other new media.  [11] In addition, there are advanced plans in the EU to introduce the General Data Protection Regulation, which will radically change the legal data protection regime laid down in the current Data Protection Directive.  [12] Finally, for years now, there has been a discussion concerning the possible revision of the e-Commerce Directive, precisely as regards to the liability regime for Internet intermediaries, in which respect the European Commission in 2010 initiated a public consultation  [13] and in 2012 launched a special consultation on hosting providers.  [14]

This contribution will explain and analyze the three legal regimes in Europe that are applicable to Internet intermediaries, giving special attention to recent developments and case law. Section B discusses the liability regime under the e-Commerce Directive, the relevant case law of the ECJ and the plans to amend the directive. Section C discusses the regime under the Data Protection Directive, the relevant case law of the ECJ, including the Google Spain case, and the possible changes resulting from the pending General Data Protection Regulation. Section D discusses the doctrine on the freedom of expression enshrined in Article 10 ECHR, the relevant case law of the ECtHR, including the case of Delfi v. Estonia, and the recommendation of the CoE. Finally, section E will provide a conclusion and an overview of the three regimes. This contribution will focus specifically on the position of hosting providers and active Internet intermediaries, as active intermediaries are increasingly dominant in the modern Internet environment, but their legal position is often vague and unclear.  [15]

The e-Commerce Directive regulates a variety of different topics, including the liability of Internet intermediaries, providing so called safe harbors. A distinction is made between three types of services offered by providers. Firstly, Article 12 specifies that an access provider is not liable for the information transmitted, on the condition that the provider (a) does not initiate the transmission, (b) does not select the receiver of the transmission and (c) does not select or modify the information contained in the transmission. These providers are excluded from liability and have very limited additional responsibilities as long as they remain passive. Secondly, Article 13 regards providers engaged with caching. This provision has been of little importance so far and will therefore remain undiscussed in this contribution. Finally, Article 14 holds that a hosting provider is not liable for the information stored, provided that (a) the provider does not have actual knowledge of the illegal nature of the activity or information and, as regards to claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent and (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.  [16]

In addition, Article 15 provides that Member States may not impose a general obligation on intermediaries to monitor the information that they transmit or store, nor a general obligation to actively seek facts or circumstances indicating illegal activity. In the cases of Scarlet v. Sabam and Sabam v. Netlog,  [17] the ECJ held inter alia that the e-Commerce Directive, read in conjunction with other directives, precludes “a national court from issuing an injunction against a hosting service provider which requires it to install a system for filtering information which is stored on its servers by its service users, which applies indiscriminately to all of those users, as a preventative measure, exclusively at its expense and for an unlimited period, which is capable of identifying electronic files containing musical, cinematographic or audio-visual work in respect of which the applicant for the injunction claims to hold intellectual property rights, with a view to preventing those works from being made available to the public in breach of copyright.”  [18]

Remarkably, the e-Commerce Directive, unlike the DMCA, contains no specific provision for search engines. However, Article 21 states, among others, that the report on the implementation of the Directive should examine whether proposals ought to be made to amend the Directive in order to include rules on the liability of search engines. Meanwhile, the ECJ ruled in Google v. Louis Vuitton that Google's advertising service, which is provided in conjunction with its search engine, may fall within the scope of Article 14 since that provision must “be interpreted as meaning that the rule laid down therein applies to an Internet referencing service provider in the case where that service provider has not played an active role of such a kind as to give it knowledge of, or control over, the data stored. If it has not played such a role, that service provider cannot be held liable for the data which it has stored at the request of an advertiser, unless, having obtained knowledge of the unlawful nature of those data or of that advertiser’s activities, it failed to act expeditiously to remove or to disable access to the data concerned.”  [19] It is not unreasonable to argue that the search function itself, under certain conditions, may also fall under the regime of Article 14.  [20]

The question is, however, whether active Internet intermediaries (such as s Facebook, Ebay, Youtube and news sites that run on User Generated Content) can also rely on Article 14. Of course, this will not be the case with, for example, news sites that publish their own material, written by their own employees on their own website.  [21] They will be regarded as publishers, not as Internet providers. However, the question is more difficult to answer with respect to intermediaries such as Facebook, Ebay, Youtube and news sites that run on User Generated Content. The ECJ appears to have answered this question affirmatively in its L'Oreal v. Ebay ruling, which focused on illegal content posted by users on Ebay. The Court held in respect of Ebay that “the mere fact that the operator of an online marketplace stores offers for sale on its server, sets the terms of its service, is remunerated for that service and provides general information to its customers cannot have the effect of denying it the exemptions from liability provided for by Directive 2000/31.”  [22] However, at the same time, it cannot “rely on the exemption from liability provided for in that provision if it was aware of facts or circumstances on the basis of which a diligent economic operator should have realised that the offers for sale in question were unlawful and, in the event of it being so aware, failed to act expeditiously in accordance with Article 14(1)(b) of Directive 2000/31.”  [23]

The phrase “diligent economic operator” causes a new problem. As active Internet intermediaries have a greater influence on and control over the websites than traditional hosting providers, it is generally assumed that active intermediaries also have a broader duty of care to ensure that their sites and platforms remain free of infringing material, for example, by monitoring their sites, by installing filter systems or by appointing system administrators. A study from 2010 hinted towards exactly this potential vicious circle. “Checking Internet traffic for [enforcement purposes] is not effective, and it is technically unfeasible. A formal duty of care would lead to excessive intervention by Internet service providers and possibly could escalate in the creation of further duties of care in other fields. Intervention with regard to illegal content in general might be next and would result in disproportionate restrictions on (future) economic activities on the Internet.”  [24] Consequently, duties of care may create a Catch-22 situation.  [25] Since providers are more directly involved in the design and the layout of the websites, they have a broader duty of care; the broader duty of care implies that they should exercise additional control over the content submitted by users. However, this will create a situation in which they have an even greater involvement in and control over the platform or service, which again could entail an even broader obligation to monitor, filter and control content. This is a spiral to which there is no logical end. In practice, this issue creates much legal uncertainty, as national regulators and courts differ in their approach to this topic.  [26]

As an example a Dutch case may be referred to, in which a file sharing site did filter pornography and viruses, but did not filter with respect to possibly copyright infringing material. The judge concluded that the site, Mininova, was liable for this content because it had the capacity and the means to control the site on illegal content, but refused to do so with respect to content infringing on intellectual property.  [27] This means that from the capacity to control, a duty of further control may be derived.  [28] This is partly due to the fact that Europe lacks a clear Good Samaritan clause, such as, inter alia, contained in the Communications Decency Act of the United States. 47 U.S. Code § 230, on the protection for private blocking and screening of offensive material, sub C, on the protection for “Good Samaritan” blocking and screening of offensive material, provides: “(1) Treatment of publisher or speaker. No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. (2) Civil liability. No provider or user of an interactive computer service shall be held liable on account of — (A) any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or (B) any action taken to enable or make available to information content providers or others the technical means to restrict access to material described in paragraph (1).”  [29]

In connection to this, mention should be made of the former plans to revise the system of liability under the e-Commerce Directive with regard to active Internet intermediaries and search engines. Both in 2003  [30] and in 2008,  [31] reports were issued, but both were very reticent about making actual proposals regarding effective changes to the liability regime. In 2010, the European Commission launched a public consultation on a possible revision, and the report, among other conclusions, states: “National jurisprudence on hyperlinking is very fragmented. A UK court considered it to be a mere conduit activity (art 12 ECD), a German court considered it to be a form of hosting (art 14 ECD), while a Belgian court considered that the ECD was not relevant for hyperlinking activities. Spain and Portugal have extended the liability exemption to hyperlinking and search engine activities.”  [32] This is just one example of the diversity of and imparity between the different national approaches to Internet liability. However, many respondents saw no benefit in changing the current protection regime. Reportedly, ISPs were afraid of further obligations and responsibilities; Intellectual Property organizations for a greater role for consumer rights; consumer groups for excessive lobbying by the industry, etc. For now, the current regime remains unaltered and it is left mainly to national courts and authorities to interpret the liability regime and apply it to new developments.

Finally, a noteworthy point regarding the application of the e-Commerce Directive to data protection matters. It follows from Article 1 paragraph 5 sub b, that the safe harbors do not apply to questions relating to information society services covered by the Data Protection Directive and the e-Privacy Directive.  [33] Recital 40 of the e-Commerce Directive states that the existence of different regimes in respect of civil and criminal liability in the different countries distorts the internal market, which the directive would like to end by harmonization. The recital continues: “the provisions of this Directive relating to liability should not preclude the development and effective operation, by the different interested parties, of technical systems of protection and identification and of technical surveillance instruments made possible by digital technology within the limits laid down by Directives 95/46/EC [the Data Protection Directive] and 97/66/EC [the predecessor of the e-Privacy Directive].” These are notoriously vague statements. For example, do they mean that the e-Commerce Directive could apply to data protection issues, but should not lead to a lower level of protection, or that the e-Commerce Directive simply does not apply to data protection issues at all?

The ECJ case law demonstrates that a distinction should be made between three types of cases. First, cases in which intermediaries are held liable for an infringement committed by a user through its network, for example, an intellectual property right - the e-Commerce Directive is applicable. Second, cases in which intermediaries are held liable for an infringement, committed by a user via its network, of a person’s right to data protection - the Data Protection Directive is applicable. Third, cases in which an infringement of an intellectual property right has been initiated by a user and an Internet service provider is asked to provide the name and address of the user (that is to provide personal data) or to effectuate a monitoring system - both directives apply. In such cases, the ECJ will assess the case by relying on various directives, such as the e-Commerce Directive, the directives on data protection and the directives regarding the protection of intellectual property. For example, this was the case in the aforementioned matter of Scarlet v. Sabam, regarding the potential monitoring obligation imposed on an Internet intermediary.  [34]

As an illustration, reference can also be made to the case of Promusicae v. Telefonica, which concerned the request for obtaining the names and addresses of users of Telefonica, whom were suspected of having used the KaZaA P2P network.  [35] When the case went to court, Telefonica objected and argued that it could only provide the data in the context of criminal proceedings or in the case that it would be necessary to safeguard public order and national security, but not in the context of civil proceedings or as an interim measure prior to such proceedings. The question of the Spanish court to the ECJ was whether it was obliged to rule that Telefonica was obliged to provide the personal data of their customers. The Court held that the e-Commerce Directive, two directives regarding the protection of intellectual property,  [36] and the e-Privacy Directive had to be read in conjunction with each other and concluded that they “do not require the Member States to lay down, in a situation such as that in the main proceedings, an obligation to communicate personal data in order to ensure effective protection of copyright in the context of civil proceedings.”  [37] How the balance between the different interests should be made depends on the circumstances of the case. Consequently, in the Promusicae v. Telefonica case, the ECJ refrained from providing a standard line of interpretation.  [38]

The previous paragraph discussed the rules regarding the liability of Internet intermediaries with respect to infringements other than on the right to data protection. It also discussed the situation in which the right of users’ data protection and the right to intellectual property of third parties clash. This section will analyze cases in which Internet intermediaries may be held liable for infringements on the right to data protection of third parties, conducted by their users through their networks. The Data Protection Directive generally applies when four criteria are met: (1) personal data, (2) are processed, (3) by a controller and (4) the territoriality principle applies. (1) Any data is personal data when a person could possibly be identified through it; importantly, “personal data” does not only revolve around private or privacy-sensitive data.  [39] General and public information that can identify someone, such the phrase (indicating a person), “the man next to the lamppost”, may already qualify as personal data.  [40] Even if data at a given point in time does not identify anyone, but may do so over the course of time, for example by using advanced identification techniques, they will be considered “personal data”. Consequently, ISPs will typically process personal data, as in almost every message, in every comment and on every website, personal data is contained.  [41] (4) Additionally, the element of territoriality will usually be met, but this will not be discussed in depth in this contribution.  [42]

(2) When something is done with personal data, it almost always falls under the legal definition of “processing”, whether it denotes storing, publishing, distributing, blocking or even deleting data – it is all considered to be “processing”.  [43] Only the pure transmission of information provided by a user over a network will usually not fall under its scope. Consequently, access providers are in principle excluded from upholding the rights and duties under the Data Protection Directive.  [44] Finally, there must be (3) a controller. The controller is the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. The controller is contrasted to the "processor", which is the natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.  [45] It follows, inter alia, that purely passive hosting providers, that neither determine the means nor the purpose of the data processing, will in principle not be considered the controller, but the processor of personal data. Therefore, they are not responsible for upholding the rights and duties under the Directive, the controller is. “An ISP providing hosting services is in principle a processor for the personal data published online by its customers, who use this ISP for their website hosting and maintenance. If however, the ISP further processes for its own purposes the data contained on the websites then it is the data controller with regard to that specific processing.”  [46]

To this extent, the regime with regard to the responsibilities of Internet intermediaries under the Data Protection Directive, is largely consistent with that of the e-Commerce Directive. However, a number of points should be noted in this respect. First, the e-Privacy Directive is applicable to passive Internet intermediaries such as access providers.  [47] The directive determines, among other things, that these providers need to adequately secure their networks and that they must process personal data confidentially.  [48] Without the consent of the user, for example, providers may in principle not put information on or pull information from a computer device, for example, through the use of a cookie.  [49] Further information may in principle only be processed if this is necessary for or related to the provision of the service requested by the user or for related services.  [50] With respect to these data processing activities, the providers are responsible for processing these data.

Active Internet intermediaries will in principle be considered the controller of data within the context of the Data Protection Directive because they determine the goal and the means of the data processing. This also applies to search engines,  [51] as recently evidenced by the Google Spain judgment of the ECJ. In its search engine, Google had referred to a story in a newspaper, that had digitalized its archive and published it online. Mr. Costeja González’s name appeared in relation to a real-estate auction connected to proceedings for the recovery of social security debts. The content of the message itself was not illegal, neither was the newspaper requested to remove the announcement from its paper archive or even from its website. The question was whether Google should be obliged to delete the link to the story from its search engine and related to that, whether it could be held responsible for processing personal data because it had indexed the material and made it possible to search the contents of the material. The Court held: “It is the search engine operator which determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within the framework of that activity and which must, consequently, be regarded as the ‘controller’ in respect of that processing []”.  [52] Consequently, there seems to be a fundamental difference in comparison to the regime under the e-Commerce Directive, because even more active Internet intermediaries can, under certain conditions, invoke the safe harbors therein contained and search engines presumably can too. To recount briefly, the ECJ held in its Google v. Louis Vuitton decision that Article 14 must “be interpreted as meaning that the rule laid down therein applies to an Internet referencing service provider in the case where that service provider has not played an active role of such a kind as to give it knowledge of, or control over, the data stored.”  [53]

The disparity between the two regimes is aggravated by the fact that the person responsible under the data protection regime is the one who “alone or jointly” determines the purpose and means of the processing. Since active Internet intermediaries typically provide the technical infrastructure and make the platform available, which users use to share their information, they will often be partially or wholly responsible.  [54] “Social network service providers provide online communication platforms which enable individuals to publish and exchange information with other users. These service providers are data controllers, since they determine both the purposes and the means of the processing of such information. The users of such networks, uploading personal data also of third parties, would qualify as controllers provided that their activities are not subject to the so-called ‘household exception’.”  [55]

The active Internet intermediaries will therefore generally be regarded as having a (shared) responsibility for the data processing. There are, however, two important exceptions, namely the household exception and the journalistic exception - the latter is linked to the protection of freedom of expression, as enshrined, among others, in Article 10 ECHR. The first exemption specifies that the provisions of the directive do not apply to the processing of personal data carried out by a natural person in the course of a purely personal or household activity.  [56] In Lindqvist, the ECJ held in this regard that the household exemption in principle does not apply to personal data published on the Internet, even if a site is relatively unknown and used for private purposes only. “That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the Internet so that those data are made accessible to an indefinite number of people.”  [57] Possibly, the exemption may still apply to webpages that can only be accessed with a password or to private profiles on social media that have a limited number of users. The exact boundary between public and private (e.g. in number of users) must be determined on a case-by-case basis. It is important to underline that Internet intermediaries cannot invoke the exception themselves because they are not natural persons.

Second, there is an exemption if personal data are processed solely for journalistic purposes.  [58] In the Satamedia case, the ECJ stated that this exception does not only apply to media undertakings, but to all those engaged in journalism. The fact that processing is linked to a commercial business model does not mean that it is not an activity solely for journalistic purposes. According to the ECJ, each company after all, engages in undertakings for profit; commercial success may even be the sine qua non for the survival of professional journalism. Furthermore, the means by or the media-type through which the data is transmitted, whether they are conventional carriers such as paper or newer phenomena such as digits, as are used on the Internet, is of no importance. According to the Court, the concept of “journalism’” must be interpreted broadly too, so that non-traditional media companies may also rely on it.  [59] This interpretation seems to pave the way for an interpretation under which modern media and active Internet intermediaries using User Generated Content, amateur journalists and bloggers may also invoke the journalistic exception.

In the recent Google Spain case, however, a much narrower interpretation was adopted. Although under the interpretation of the ECtHR, Internet intermediaries may also rely on the freedom of expression as protected by the ECHR, the ECJ seems far more hesitant. “Furthermore, the processing by the publisher of a web page consisting in the publication of information relating to an individual may, in some circumstances, be carried out ‘solely for journalistic purposes’ and thus benefit [] from derogations from the requirements laid down by the directive, whereas that does not appear to be so in the case of the processing carried out by the operator of a search engine.”  [60] It therefore follows that active Internet intermediaries usually have to be considered as the controller of personal data, but in principle cannot invoke the journalistic exception if they are not the editor of the published news story. This constellation, in which the intermediary is a “controller” and in which it cannot invoke an exception, implies that the Internet intermediary must fulfill all obligations under the Directive, such as maintaining transparency, security, confidentiality and the legitimacy of processing personal data.  [61]

For example, the Internet intermediary needs a legitimate ground for processing personal data. If the information processed concerns data provided by a user about another person (which will often be the case), then the only possible legitimation ground is weighing the interests of the intermediary against the interests of the data subject. This balance will have to be made on a case-by-case basis, but in practice, the fundamental rights and freedoms of the data subject will often prevail.  [62] Intermediaries also have to uphold other duties enshrined in the Data Protection Directive, such as the data minimization principle, which specifies that data may only be processed if they are necessary for and proportionate to a clear and specified purpose, that they cannot be further processed for another purpose, that they should be deleted when they are no longer necessary and anonymized when possible.  [63] In addition, the directive specifies the right of the data subject to rectification, to have data removed or to oppose, in certain cases, further processing of those data.  [64] These duties were initially applied on Internet intermediaries only very cautiously. However, in the case law of the ECJ, a far more extensive interpretation is adopted. Search engines are full-fledged “controllers”, according to the court, and consequently they must fulfill all requirements and obligations specified in the Data Protection Directive. Obviously, if this holds true for search engines, there seems to be no reason why this would not also count for (other) active Internet intermediaries.

In general, there is a trend towards additional and stronger rights for data subjects and greater and broader obligations for data controllers in data protection law. This appears inter alia from the pending General Data Protection Regulation, which in time will replace the Directive from 1995. It contains numerous new rights such as the right to be forgotten,  [65] the right to data portability,  [66] which entitles data subjects to transfer their profiles from one to another social network, and the right to resist profiling.  [67] The proposed regulation also contains very far-reaching obligations for controllers, such as the requirement to keep detailed records,  [68] to undertake risk assessments  [69] and to appoint an internal privacy auditor.  [70] Finally, very high penalties are proposed when controllers do not abide by the rules contained in the Regulation, which amount up to 2% of worldwide annual revenue of a company.  [71] This can have very serious consequences for the liability and responsibility of active Internet intermediaries. At the time of writing, however, it is still unclear if and when this regulation will be adopted and in what form.

Finally, Internet intermediaries may also rely on fundamental rights themselves. As discussed earlier, many providers do not want to supply personal data of their users to third parties or monitor the communications running through their networks. They may refuse to do so in order to protect the interests of their users, but they may also want to protect their own interests: legal persons may also invoke the right to privacy  [72] and data protection to protect their own interests.  [73] Alternatively, providers can rely on the freedom of expression, again either directly or indirectly, to protect their own interests or those of their users. Article 10 of the European Convention on Human Rights holds in paragraph 1: “Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.’ Already in the case of Handyside v. UK from 1976, the ECtHR adopted a broad interpretation of this right, linking it to the protection of an open and vital democracy. ‘Freedom of expression constitutes one of the essential foundations of such a society, one of the basic conditions for its progress and for the development of every man. Subject to paragraph 2 of Article 10, it is applicable not only to ‘information’ or ‘ideas’ that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population. Such are the demands of that pluralism, tolerance and broadmindedness without which there is no ‘democratic society’.”  [74] In later judgments, the ECtHR not only adopted a broad interpretation of the freedom of speech itself, but also of those that may rely on Article 10 ECHR.  [75]

The fact that Internet intermediaries are one of the parties that may invoke Article 10 ECtHR has recently been confirmed by the ECtHR in the case of Delfi v. Estonia, in which a news site published a critical article about a company that provided ferry services and about L., the sole shareholder. The article itself was nuanced and balanced, the comments of the users posted under the article, however, were less refined. When L. asked the website to remove 20 of these comments and to pay damages, the site removed the comments, but refused to do the latter. In the legal proceedings that followed, the question was posed to which extent the website was responsible for the user comments. A lengthy juridical procedure followed on the national level, in which the website was sometimes treated as an Internet intermediary under the rules of (the implementation of) the e-Commerce Directive and sometimes as a journalistic news medium under the doctrine of freedom of expression, because the site was considered too active to qualify as a passive Internet intermediary. Both in the national proceedings and before the ECtHR, the latter vision ultimately prevailed and the website was treated under Article 10 ECHR and not under the e-Commerce Directive.

The argument of the Estonian government before the ECtHR on this point is interesting, as is the rejection of it by the ECtHR: “The Government pointed out that according to the applicant company it had been neither the author nor the discloser of the defamatory comments. The Government noted that if the Court shared that view, the application was incompatible ratione materiae with the provisions of the Convention, as the Convention did not protect the freedom of expression of a person who was neither the author nor the discloser. The applicant company could not claim to be a victim of a violation of the freedom of expression of persons whose comments had been deleted. (...) The Court notes that the applicant company was sued for defamation in respect of comments posted on its Internet portal, it was deemed to be discloser (...) of the comments – along with their authors – and held liable for its failure to prevent the disclosure of or remove on its own initiative the unlawful comments.”  [76] From this, the ECtHR concluded that the provider was curtailed in its right to freedom of expression. This was confirmed on 16 June 2015 by the Grand Chamber.  [77]

Consequently, the ECtHR adopts a broad interpretation of the freedom of expression. Parties that remain relatively passive can also invoke Article 10 ECHR, though parties that have no involvement whatsoever, such as purely passive providers, will normally not be able to invoke this right.  [78] Some activity or control is necessary; the exact interpretation will depend on the circumstances of the case. In this connection, a comparison can be made with the position of the “controller” under data protection law, although that position primarily entails duties and this one also entails numerous rights and privileges. Although Internet intermediaries, can, under certain conditions, invoke the freedom of expression, this right may be curtailed if the conditions under paragraph 2 of Article 10 of the Convention apply: “The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”

It should be noted that Article 8 of the ECHR (right to privacy) is based on Article 12 of the Universal Declaration of Human Rights (UDHR), which states: “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.”  [79] Although almost all elements of this provision are incorporated in 8 ECHR, the protection of honor and reputation is not. Article 8 ECHR, paragraph 1: “Everyone has the right to respect for his private and family life, his home and his correspondence.” The protection of honour and reputation is moved to paragraph 2 of Article 10 ECHR, so that it is not a subjective right which natural persons can invoke, but one based on the grounds on which a state may legitimately curtail the right to freedom of expression.  [80] Although the ECtHR has respected this choice of the drafters of the Convention for a long time; since 2007 it has abandoned this line and argued that individuals may, under certain conditions, also invoke a subjective right to the protection of their honor and reputation under Article 8 ECHR.  [81] It should also be borne in mind that in general, Article 8 ECHR has been given a very wide scope by the court, which among other things entails that issues surrounding the protection of property and the dissemination of child pornography or similar material (matters that fall under the e-Commerce Directive, rather than the Data Protection Directive in EU law) are also (partially) protected under the right to privacy, under the European Convention on Human Rights of the Council of Europe.  [82] Moreover, the right to data protection is also (partially) protected under the scope of Article 8 ECHR.

Consequently, in cases like Delfi v. Estonia, two fundamental rights clash. On the one hand the freedom of expression of Internet intermediaries and its users, and on the other hand the right to privacy of third parties. These fundamental rights must be seen as equivalent interests. Consequently, they must be weighed and balanced against each other.  [83] “The Court has considered that where the right to freedom of expression is being balanced against the right to respect for private life, the relevant criteria in the balancing exercise include the following elements: contribution to a debate of general interest, how well known the person concerned is, the subject of the report, the prior conduct of the person concerned, the method of obtaining the information and its veracity, the content, form and consequences of the publication, and the severity of the sanction imposed.”  [84] Both the Chamber and the Grand Chamber of the ECtHR concluded in Delfi v. Estonia that the limitation on the freedom of expression of Delfi by the conviction of the Estonian Supreme Court did not violate Article 10 ECHR.

In particular, the ECtHR felt that the measures taken by Delfi were insufficient, i.e. the terms and conditions which prohibited defamatory comments, the notice and takedown system, the monitoring activities and the automatic filter system it employed. Although these measures go beyond what is necessary for the duty of care under Article 14 e-Commerce Directive, they are apparently insufficient when it comes to the duty of care under Article 10 ECHR. A salient detail is that the Court ruled that it was legitimate to hold Delfi liable, while not even trying to press charges against the actual authors of the comments, because Delfi allowed them to post comments anonymously. “It notes that it was the applicant company’s choice to allow comments by non-registered users, and that by doing so it must be considered to have assumed a certain responsibility for these comments.”  [85] This is remarkable because the ECtHR also agrees that the ability to post comments in full anonymity is an important part of both the right to privacy, the right to data protection and the right to freedom of expression; while the efforts to that end by Delfi show that in fact there runs a higher risk of being held liable for the comments of users than if it would not have allowed anonymous comments.

Finally, it should be noted that journalists and journalistic media enjoy enhanced protection under the regime of freedom of expression, in part because their role as "public watchdog" is deemed necessary in a democratic society.  [86] Journalists also enjoy additional protection of their sources,  [87] a larger freedom to engage in newsgathering and a greater protection with respect to publishing classified information,  [88] including a limitation of their liability.  [89] However, not everyone can invoke the status of journalist; only those who write newsworthy stories and abide by the journalistic principles.  [90] With this respect, the ECtHR has chosen to adopt a functional instead of an institutional approach, which means that it does not (only) look at whether a person or company is an established journalist or an established journalistic medium,  [91] but rather assesses whether a person or organization contributes to the public debate, engages in journalistic research, observes the journalistic standards, produces newsworthy stories on a more or less regular basis, etc.  [92]

The European Court of Human Rights has recognized that the Internet-related services of a media enterprise may fall under the scope of Article 10 ECHR: “In the light of its accessibility and its capacity to store and communicate vast amounts of information, the Internet plays an important role in enhancing the public’s access to news and facilitating the dissemination of information in general. The maintenance of Internet archives is a critical aspect of this role and the Court therefore considers that such archives fall within the ambit of the protection afforded by Article 10.”  [93] To what extent this principle also applies to online platforms, news sites using UGC and amateur bloggers is unclear. Yet it seems that there are no fundamental objections or obstacles for them to rely on these principles. Consequently, sites like Delfi could rely on the journalistic position for the part of their activities that relate to journalism; for example, the story written by one of its employees, which condemned the defamatory user comments and triggered the court case.

This line also seems to follow from the recommendation of the Committee of Ministers of the Council of Europe regarding a “New Notion of Media” from 2011,  [94] in which it suggests that even amateur bloggers can rely on the extra protection of journalists if they meet the conditions and journalistic standards. “As regards in particular new media, codes of conduct or ethical standards for bloggers have already been accepted by at least part of the online journalism community. Nonetheless, bloggers should only be considered media if they fulfil the criteria to a sufficient degree.”  [95] It should be noted that in order to rely on the regime for journalists under the freedom of expression, actors should abide by a number of additional duties of care and principles. Consequently, if Internet intermediaries want to rely on this position, they should abandon their traditional passivity even further.

The e-Commerce Directive was adopted at the beginning of this millennium to harmonize the various national approaches to the liability of Internet intermediaries for wrongful acts conducted by their users through their networks. The fear was that the existing diversity at that time would lead to legal inequality and uncertainty, which could hamper the digital economy. It was decided to exclude passive Internet intermediaries, under certain conditions, from liability for actions conducted by their users. Although this regime is still ensured for these traditional Internet providers, a number of factors have complicated this system.  [96]

First, providers have become increasingly active, for example by indexing information and making it searchable, by creating social platforms and by creating sites which are based on User Generated Content. The question is whether they can also rely on the safe harbors for liability specified in the e-Commerce Directive. The ECJ seems to allow active Internet intermediaries to invoke these safe harbors to a relatively large extent, on the condition that these providers assume additional duties of care. This may create a Catch-22 situation. Providers that are more active have more control over the content they distribute and are thus supposed to have greater duties of care, but these duties of care imply that the Internet intermediaries gain even further control over the content. This might mean that they must adopt even further standards of care and exercise even greater control.

Secondly, the e-Commerce regime does not apply to issues falling under the data protection regime. For passive Internet intermediaries, the two regimes are more or less comparable. Under the Data Protection Directive, passive actors are in principle exempt from responsibilities and duties of care. For active intermediaries, however, the data protection regime is substantially different from the e-Commerce regime. The Data Protection Directive imposes many duties on active Internet intermediaries and this burden will only be intensified when the General Data Protection Regulation is adopted. Active Internet intermediaries can rely on the exclusion of liability under the e-Commerce regime much more quickly than under the data protection regime.

Thirdly, Internet intermediaries increasingly rely on fundamental rights themselves, to protect their own interests or those of their users. One example that has not even been discussed in this paper is the freedom to conduct a business, as enshrined in Article 16 of the EU Charter of Fundamental Rights. What has been discussed is that Internet intermediaries may rely on data protection law to protect their own data or those of its users. Internet intermediaries are sometimes asked to provide information about users (that are suspected to have carried out unlawful activities via their networks) to third party right holders (often of intellectual property), to monitor their networks and to detect or block infringing activities. Internet intermediaries often find themselves in a difficult position, having to judge the legitimacy of the claims and having to balance the rights of two different parties. As in Europe, in contrast to the DMCA in America, no legislative framework exists for the handling of such requests and these decisions are often made before a case is judged by a court of law; thus, Internet providers often have to make an assessment of the case independently and assume the role of a judge.

Providers additionally rely on the freedom of expression. This may be an indirect claim in order to protect the freedom of expression of users of a platform against filter obligations or against obligations to remove certain messages, information or files. More importantly, providers can also rely on the freedom of expression themselves, for the protection of their own interests, even if they are considered responsible for illegitimate actions of the users of their services through their network. This predominantly applies to active Internet intermediaries, as purely passive providers that provide storage space for third parties and mere conduits will usually not qualify as a publisher or an initiating party in the publication, distribution or gathering of information. If an active Internet intermediary successfully invokes the freedom of expression, then it is this right that should be balanced and weighed against the rights of the third party, such as his copyright. To further complicate matters, what has remained undiscussed in this contribution are third parties’ rights to freedom of expression or the freedom of enterprise, for which being findable in search engines like Google may be pivotal. Moreover, third parties’ claims may also revolve around privacy and data protection interests. This can also be invoked against the freedom of expression of the provider.

It should be stressed that in most freedom of expression regimes around the globe, a special position is reserved for journalists. Traditionally, they have more rights, wider freedoms and enjoy greater protection from liability. It seems that there are no obstacles for Internet intermediaries such as news sites that use UGC to claim such a position as well, provided that they comply with the additional safeguards and obligations that go with being a journalist. It should be remembered that in order to obtain the “status” of a journalist, the provider’s passivity is put under pressure to an even greater extent. Consequently, there is a certain tension between the different regimes. The most striking consequence is perhaps that providers are encouraged to either remain fully passive (and therefore have no form of control over their services), in order to qualify for the exemption from liability under the e-Commerce and the data protection regime, or to abandon their passivity almost fully (and gain a very large form of control over the actions of their users), in order to rely on the freedom of speech and possibly even to qualify for the position of a journalistic medium.  [97]

It follows that Internet intermediaries can rely on a variety of different positions and regimes. Each of the three regimes discussed here (the e-Commerce Directive, the Data Protection Directive and the freedom of expression contained in the ECHR) has roughly three positions.