Virtues and Perils of Anonymity: Should Intermediaries Bear the Burden?

Anonymity is a feature, not a bug, of the Internet. As Larry Lessig explained when commenting on the clash between the technical and the social architecture of the net, “the Internet protocol doesn’t require that[…] you credential who you are before you use the Internet.”  [1] In other words, it is only because of the social protocol that we are pushed towards identification  [2] .

At the same time, however, anonymity is also a fundamental feature in the social architecture for it gives individuals the ability to speak in a variety of circumstances where the revelation of their identity would compromise it. Peter Steiner effectively illustrated the centrality of anonymity to our understanding of the Internet in a cartoon published in The New Yorker in July 1993, which birthed the famous adage “On the Internet, nobody knows you're a dog”  [3] . The cartoon featured a dog sitting in front of a computer and (presumably) inserting his preferences and generalities into a virtual profile, sharing the insight of the adage to a fellow dog. That sentence reflected an essential property of Internet communication: individuals engaged in such communication can mask the real identity to their audience. The “masking” can be accomplished by two different means: online anonymity and pseudonymity. While both are manifestations of the broader concept of anonymity - the latter being an attenuated version of the former- it is important to make clear in what respect the two differ, and the extent to which they relate to “real world” anonymity.

The most direct form of online anonymity for a user is, when permitted by the platform where communication takes place, to avoid giving his or her generalities altogether. In this case, any message or action by the user is labeled as originating from “anonymous” or, alternatively, with some kind of serial number following the word “user.” A similar type of online anonymity can be attained if, in a system of mandatory user registration, there is no requirement to provide information which will make him or her actually identifiable as pre-condition to accede to or actively engage in the platform. Although there is no agreed-upon definition of the exact type of information that would trigger a loss of online anonymity  [4] , it is generally understood that authentication via email address to “join the community” would suffice for that purpose. In contrast, pseudonymity does not exclude long-term relationship with the community of the platform, but presupposes the creation of a user profile that identifies him or her within that community as the holder of a particular pseudonym. However, the system of registration does not guarantee that the online “persona” chosen by the user represents, in any way, his or her real identity. In fact, pseudonymity not only enables people to maintain several online identities but also allows multiple individuals to manage a unique persona.

The “mask” provided by online anonymity and pseudonymity is not a peculiarity of Internet communication; the possibility of corresponding anonymously was long established prior to the invention of the Internet, and pseudonyms had been used throughout history by a number of literary figures, musicians and authors of political articles  [5] . What is different in the context of the Internet is the ease with which the digitalization of communication and the advancement of tracking technologies have made it possible for a real identity to be uncovered. Not only are the logs of every communication originating from our devices systematically recorded by internet service providers or the servers through which we connect, but the use of cookies and other tracking mechanisms has significantly affected our ability to keep anonymity vis a vis the websites that we visit; in addition, the tools available to infer real identity from network analysis, patterns of behavior, and data mining have minimized the extent to which pseudonymity can be considered an effective anonymization technique vis a vis not only the other users of that particular website, but more crucially the State and private entities offering their services online. In fact, extensive literature points out the failure of the conventional mechanisms currently used to secure anonymity  [6] ; in other words, “real world” anonymity has simply become much more difficult to accomplish today, in a society that is increasingly based on online interactions.

Furthermore, new technologies have emerged that afford platforms the opportunity to authenticate the identity of users in an increasingly reliable manner: for example, certain platforms have started using software to verify identities by scanning national ID cards  [7] , and asking security questions- the answer to which must match the one contained in the credit file linked to a particular person’s bank account  [8] . Soon, we might be confronted with widespread use of facial recognition technologies for ID verification, which have already become available on the market  [9] . Currently, these advanced verification technologies are used on an opt-in basis, in exchange for access to special privileges or simply to promote a higher trust with the other members of the community. Yet, it is not hard to imagine a future in which the gap between basic and premium services is so significant as to make the anonymous use of Internet inconceivable as a practical matter. It is precisely to warn against this danger that this paper aims to offer a critique of a judgment of the European Court of Human Rights which, if confirmed on appeal, would likely lead to the realization of this gloomy picture.

Before plunging into the specifics of the judgment, however, it is important to clarify that a discussion on anonymity cannot abstract from the questions “against whom” and “in what circumstances”, both of which qualify as different subtypes of anonymity. The first question departs from the assumption that anonymity is to be seen as an absolute quality –i.e., erga omnes- and recognizes that an individual might just aspire to achieve anonymity vis a vis the other users of the platform, as opposed to an internet service provider, or the public authority. In this respect, one should differentiate between: (1) platform anonymity; (2) customer anonymity; and (3) citizen anonymity  [10] .

(3) (Citizen anonymity) is invariably the most protected type, one with constitutional rules in place in different countries to guard citizens from arbitrary interferences, yet one which tends to be most easily abridged for law enforcement purposes, and probably the hardest to ensure at the technological level  [11] . (2) (Customer anonymity) refers to the identity given to the provider of the Internet connection –which can only be hidden in very limited circumstances; for example, from a public wifi not requiring registration, or another online service –in which case, anonymity can be ensured through the use of VPNs, web proxies or anonymity networks  [12] , along with decentralized and anonymized payment systems. What remains under (1) (Platform anonymity) then is just a thin version of anonymity, which can be achieved inter alia under some form of pseudonymity. It is clear that escaping identification by the three target audiences at the same time can be very challenging and can, occasionally, be an impossible task to accomplish.

The second important clarification concerns the circumstances in which anonymity should be protected. In practice, this depends on the weight of the respective interests of the two sets of stakeholders: those claiming or exerting anonymity privileges and those who invoke identity disclosure. For example, in the case of threat of serious criminal offences, the public authority will have broader powers of investigation under (3); likewise, the discretion of a prosecutor or a judicial authority to curb anonymity under (1) and (2) will be significantly broader  [13] . On the other hand, the need to protect (who?) from an imminent threat of violence or other seriously adverse consequences will enhance the weight of anonymity interests, possibly even at the expense of legitimate law enforcement operations. In short, the protection of anonymity can hardly be seen as a monolithic concept: anonymity has different breadth depending on the target group against which it operates, and a balancing between conflicting interests is often necessary to understand the contours of its protection.

The following section puts platform anonymity into context by describing the facts and the issues at stake in the case of Delfi v. Estonia  [14] , where the European Court of Human Rights attributed the anonymous character of the comments a role of trigger Heather Hufstedler HH for a special responsibility of host providers. After an introduction to the facts of the case and the domestic proceedings, the second section will highlight the problematic aspects of the reasoning followed by the Court to reach that conclusion. Subsequently, the third section will provide an assessment of the adverse implications that a similar judgment would have on the creation of user-generated content on the Internet. Finally, the fourth section will conclude by suggesting which principles should be followed to promote an intermediary liability regime that ensures prompt and effective remedies while respecting the fundamental right to anonymity.

The previous section explained and criticized the way in which the ECtHR has reached the conclusion that states can impose secondary liability for defamatory comments posted by non-registered users, even if a content host has promptly reacted to a victim’s notification. This section takes this conclusion as given, and explores the implications that the enactment of such a policy could have for the governance of content on the Internet.

Although the judgment did not prescribe any particular procedure that would prevent content hosts from further incurring into liability in Estonia and in other regimes that replicate the same conditions  [33] , two clear routes seem possible: 1) the most straightforward solution: disabling anonymous commenting and anonymous user content creation, and 2) the most challenging and articulated solution: increasing ex-ante control over comments.

Logically, the vast majority of operators will, for practical reasons, choose n. (1). For this reason, it is important to stress that this move, combined with the recent trend of certain social networks  [34] and microblogs  [35] to adopt a “real name” policy, can be a dangerous step towards the establishment of an integrated real-name-based network. While a reading of the Delfi judgment suggests that the news portal would probably have been able to escape liability by allowing users to interact under a pseudonym, the underlying rationale for this was –at its core- the difficulty of identifying infringing users for purposes of compensation. Now, although a registration via email makes a user somewhat more traceable, it is a far less effective means to that end than registration with a government-issued ID-- as supra mentioned, it is not hard for a user to circumvent the requirement in order to avoid recognition of his or her real identity. Thus, the idea that courts will in the near future find the use of pseudonyms insufficient from an enforcement perspective does not seem far-fetched. Registration through government ID is likely to be effective regardless of the procedure chosen to enforce it. Currently, the solutions implemented on the market are of three types: the strictest form of verification is that of scanning the document to ensure it matches the credential in the website, as in the case of Airbnb  [36] ; the intermediate form is the one in place in China, where people are required to provide their ID number (which may or may not be checked by the relevant authority) before logging in microblogs; and finally, the weakest form of oversight is that of social networks like Facebook and Google Plus, where an ID may only be requested in case of contestation of the self-declared generalities. In all these scenarios, the request for verification is accompanied by the threat of criminal sanctions for use of a fake ID, which in turn may be considered sufficient for obtaining an order to the Internet service provider to disclose connection and traffic data in relation to that particular user. In any case, it is clear that an immediate consequence of this ruling would be a slippery slope towards real-name Internet surfing.

Fragmentation of cyberspace would be another problem caused by a bias against platform anonymity, at least as long as countries do not adopt a uniform system of legal protection for online anonymity or pseudonymity. For example, Germany’s article 13 VI of the Telemedia Act of 2007 requires Internet service providers to “allow the anonymous or pseudonymous use of telemedia services and their payment, insofar as this is technically feasible and reasonable. The user must be informed about this possibility”. Even though it has been clarified that this does not mean a right to stay anonymous vis a vis the service provider  [37] , which may require his or her real name in their contractual relationship, this provision has led to a court battle between the German data protection authority and Facebook over the possibility to use pseudonyms within the Facebook website  [38] . Although the controversy was not resolved on the merit but with a finding of inapplicability of German data protection law in light of the processing of data occurring in Ireland, the difficulty in ascertaining the actual location of the processing data and the conflict between the application of two different data protection laws (one requiring and the other not requiring pseudonymity) highlighted how concrete the possibility is that multinational providers will be unable to enforce a real-name policy uniformly, across different countries. A similar conflict could occur with the analogous pseudonymity requirement recently introduced into legislation by the Australian Privacy Principles, which went into effect on March 12, 2014  [39] . These inconsistencies may end up motivating several users to utilize VPNs or proxies in order to circumvent geo-location and receive the privileges offered by the law of a particular country, ultimately pushing towards anonymity not only vis a vis users of the platforms, but also against law enforcement agencies- even for serious criminal matters.

Further segmentation is likely to occur even within countries if content hosts choose to adopt a mixed regime, in which they offer second-tier services to anonymous users, with limited or abridged capacity to create content and interact with other users. This would lead to the creation of a suboptimal Internet experience for those wishing to remain anonymous, and impair their ability to use the Internet to further what is its fundamental goal: enabling communication. As this practice turns into a convention, the use of differentiated services between anonymous and registered users will likely make anonymity so unattractive as to become, in the long run, gradually meaningless. In other words, modeling liability on the basis of characteristics relating to the originator of content, as opposed to the content, itself, would lead to the creation of an important bias against pseudonymous speakers, running counter to the idea of the Internet as a global public resource available to all, and an empowering technology. As a matter of fact, this would lead to the exclusion of the voices of several people who seek anonymity for a variety of legitimate reasons that are often related to safety, fear of retaliation or repercussions in the professional context, and prejudices which a potential speaker wishes to overcome in order to freely engage in Internet communication  [40] . Again, this will push those people who treasure anonymous speech to increasingly resort to circumvention technologies-- and, if necessary, even the use of fake IDs-- thus, simply increasing the amount and scope of “illegal acts”, and reducing the ability of public authorities to enforce a law that, depending on the amount of “civil disobedience” generated by the adoption of these policies, will be perceived less and less socially acceptable. And, given the magnitude of the public outcry following the recent revelations by Edward Snowden about the US National Security Agency and the civil movement that it has generated  [41] , one can expect significant support from the crypto community to ensure the protection of anonymity. To be clear, this is not to deny the importance of a phenomenon that is already occurring, and that regulators can arguably do little to prevent; the argument is simply that oppressive control inevitably leads to increased instances and forms of evasion. Much like between hackers and security systems, malwares and antivirus programmers, and, in some sense, peer-to-peer copyright infringers and the copyright industry, there will always be a set of more “skilled” or simply “undismayed” users managing to circumvent the technology of control that proves sufficient for the majority of the population. However, when such technology is used to deprive those users of their essential liberties (a reaction from content hosts that may unfold from the confirmation of the Delfi judgment), the movement of protest and liberation from control will be of a much wider scale, thereby leading to the complete ineffectiveness and repulsion of the current system of law and governance.

We have already touched in the previous section upon the main challenges to an effective implementation of the alternative solution (n. 2) to disabling pseudonymity following the Delfi judgment, i.e. enhanced content oversight. In particular, it has been pointed out that the sensitivity of certain fine-grained distinctions required in determining the legality of content makes it impossible to rely on a completely fool-proof machine, and that systemic human oversight implies substantially raising the costs of doing business for content hosts. So, what kind of scenario can we expect in the aftermath of Delfi, were the notion of responsibility for pseudonymous comments to be confirmed by the Grand Chamber? The most visible consequence would be that big players with adequate economies of scale and of scope would be willing and able to use reliable algorithms for the detection of potentially illegal content, as they are currently doing for copyright infringement. The other, small- and medium-sized websites would probably end up outsourcing this task to independent technology providers, which are increasingly emerging in the marketplace  [42] , but will never attain the same degree of accuracy and effectiveness. As the economics of search engines demonstrates  [43] , the key factor to the improvement of algorithms is not simply a large enough amount of data points to form a rich database of “potentially illegal” content (although that is clearly a first threshold requirement), but more importantly, the capacity to connect through them in a sensible manner. This can only be done through continuous experimentation, which in turn requires a continuous flow of traffic that can be used to test, verify and challenge the accuracy of the connections established by the algorithms. For this reason, it is clear that large operators already have a significant advantage over small content hosts, which are unlikely to catch up absent a regulatory obligation on the part of the established operators to share their tools for detection. Worse yet, the scenario prospected here would increase the dominance of the big market players, in light of the liability that is likely to be imposed upon the adopters of “inferior” technologies in the detection of illegal content; this is because large operators would be able to rely on a bonus pater familias defense  [44] , proving their diligence in having adopted “state-of-the-art” technology to detect defamatory content. What is unclear from the Delfi judgment is the extent to which a content host would also need to prove that the utilized technology is effectively functioning for its purpose; again, this is largely due to the case-specific nature of ECtHR rulings, but a question remains concerning how much more sophisticated (and effective) should Delfi’s screening system have been in order to escape liability, in the Court’s view. This may leave some wiggle room for smaller platforms that achieve a sufficiently effective detection algorithm, but they would have to risk their judgment regarding the margin of error that is likely to be tolerated for the purpose of accepting a particular technology as offering “adequate protection” of the rights of third parties.

In any case, it should be kept in mind that the potential sufficiency of an effective detection algorithm was considered in Delfi only in conjunction with the operation of a user notification system, whereby requests for takedown could be received by the company so as to proceed expeditiously to removal. This constitutes an essential component of the envisaged system of protection, which enables the achievement of the ultimate purpose by complementing the best technology with the sensibility that only a human being can have towards nuanced uses of language and complex balancing exercises. In the case of smaller platforms, for the reasons mentioned above, the extent of human involvement will have to be extensive, if not exclusive. As noted, this runs contrary to the provision excluding the imposition of monitoring obligations, which is widely recognized in Internet intermediary liability regimes around the world Heather Hufstedler HH  [45] . Others have expressed disappointment with the fact that the Court in Delfi has seen this prohibition as an innovative policy measure, and not strictly as a requirement of human rights law  [46] . In fact, what the Court is missing here is, on the one hand, the privacy issues stemming from such practice and, on the other, the consequences that this is likely to generate in terms of competition amongst platforms and their ability to set restrictive terms of service, to the detriment of the freedom of expression of their users.

Although the core objective of this article is to show the problems that an acceptance of Delfi would generate for intermediaries and Internet users, it seems appropriate to suggest, also with a pars construens, how the Court should have ruled – and how the Grand Chamber should approach this issue going forward.

As it has been stressed already, there are a number of situations where anonymity constitutes, as an enabler of speech, an essential pre-requisite to the enjoyment of human rights. At the same time, it is clear that not all cases of anonymity are matters of human rights, and it is very difficult to ascertain the extent to which a request for anonymity belongs to one group or the other. First of all, this is a difficult task because anonymity is not a human right, in and of itself; rather, it may constitute an intermediate condition for the enjoyment of a variety of human rights – such as freedom of expression, privacy, life, liberty and security, freedom of thought, conscience and religion. Therefore, in order to establish whether anonymity is required by human rights law, it needs to be determined the extent to which it is needed for the enjoyment of one of those rights. This is inherently hard to accomplish because the merits of the argument that may be put forward in support of protection of anonymity depend on the accuracy of a prospective evaluation, i.e. on the occurrence of an action or a series of actions in the future.

Secondly, the very act of evaluating the necessity of anonymity in a particular case requires a disclosure that may defeat its purpose: unless there is strict separation between the entity that is seeking disclosure and the one who is adjudicating, combined with a strong system of safeguards to prevent leaks from the latter, anonymity may be compromised by the mere act of evaluating whether it is well-founded.

Due to the complexity of these evaluations, it is quite logical to expect intermediaries to steer away from case-specific assessments and, therefore, embrace categorical solutions- generally speaking, either allowing or not allowing online anonymity or pseudonimity. However, as we have seen in Section 1, anonymity is not a monolith: it is a concept which can be modeled in scope and depth. Accordingly, in order to allow for the emergence of a human-rights compliant solution, it is necessary to identify which aspects of anonymity are specifically sought by users. Since the range of users and demands is very wide across different groups and geographies, it is argued here that a key, and often underestimated, value for the establishment of balanced and respected legal rules of anonymity protection is the encouragement of competition on this feature: only competition in the market can ensure the continuous availability and improvement of empowering technologies.

This is exactly the opposite of what the Delfi decision stimulated: a system of incentives that impose technological mandates tipping the market in favor of the already-established big players deters market-based solutions to the problems of human rights compliance, and impairs the ability of the State to ensure protection of the rights of users vis a vis intermediaries. In contrast, a market-based system would enable the existence of certain platforms that offer better protection for privacy and of the reputation of others, even if it comes, admittedly, at some cost for ease of use or freedom of expression. Thanks to the ability of technology to incorporate the modularity of anonymity, protection can be granular and tailored to the needs of users, allowing competition to unleash on even the smallest details. As a result, people would get to learn about the pros and cons of new technologies and would be naturally attracted to those platforms and applications that offer features (including anonymity privileges) that best cater to their needs.

However, it is necessary to draw a line in order to prevent those technologies from making law enforcement impossible or unfeasible. Competition in technological solutions to anonymity is, indeed, welcome for the development of innovative solutions, but only as long as it occurs within a framework of minimum standards -which may be called of “procedural” and “substantive” due process- that protect fairly and equally the interests of the parties involved. For this reason, it is suggested here that the ECtHR should have reflected on what those standards are, particularly to the extent to which an alleged infringer has a right to have its anonymity protected by a third party, and eventually asked this question: should the intermediary bear the burden for failing to actively engage in the evaluation of such entitlement? I suggest that it should not; rather, the ability of the intermediary to provide a forum for the evaluation of respective weight of the claims of protection can be harnessed to promote the respect of ECHR rights in a consistent manner across ECHR member States.

Since we are discussing an ECtHR case, the solution should, in principle, be sought in the jurisprudence of that Court, defining the way to handle balancing of the right to anonymity of third parties with conflicting state interests. While the Court only adjudicates specific matters and grants States a certain margin of appreciation in undertaking their balancing of conflicting interests, there are situations where it has made clear that a State has exceeded its margin, crossing the line of permissible interference with a Convention’s right. Thus, these “red lines” crossed by the Court can be taken as useful guidance in defining minimum standards. Such red lines are concerned with both substantive and procedural due process concerns.

First of all, procedural due process: to define whether the State’s appreciation has remained within an acceptable limit, the Court needs to ascertain whether the interference was prescribed by law. As often clarified by the Court  [47] , such law should not only be formally in place, but also be both adequately accessible and foreseeable. This means that it must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention, indicating with sufficient clarity the scope of any such discretion conferred on the competent authorities and the manner of its exercise. This measure of protection can only be guaranteed if the law describes the scope of the discretion granted to the authorities with sufficient clarity, and includes legal procedural safeguards commensurate with the importance of the principle at stake. At a minimum, this must include the guarantee of review by a judge or another independent and impartial decision-making body. For example, in Sanoma Uitgevers B.V.  [48] , the Court was required to decide the proportionality of the interference by the police with the right to non-disclosure of anonymity for public order reasons. Here, the right to anonymity concerned the identity of third parties engaged in illegal car races, who appeared in the pictures taken by a reporter that had been authorized to do so only after having guaranteed that it would preserve the anonymity of the participants. However, prior to the publication of the reporter’s article, police officers suspected that one of the vehicles participating in the race had been used as a getaway car following a ram raid. Having been informed of the picture taken at the race, the authorities compelled the editor of the magazine to release the photos, which enabled the police to identify the drivers of that car. The Court found this to be an interference with regards to the journalistic privilege of source protection (stemming from the right to freedom of expression  [49] ) and not prescribed by law, in that the legal system did not allow review by an independent body before access and use of the seized material.

In more complex cases, the Court needs to engage in a more detailed overview of the balancing of the interests at stake. However, the way it does so and avoids substituting itself in toto to the judgment of the states is by adopting a procedural posture (also known as “proportionality balancing”  [50] )- that is, defining whether the appropriate procedural framework was in place to be able to satisfy (in general terms) the holders of the different interests at stake, and whether the measure adopted is, as a result, more restrictive than necessary. In doing so, by ranking values and solving conflicts on the basis of relative weight, it inevitably delineates a doctrine of “substantive due process”.

In Godelli  [51] , for example, the Court had to determine whether the grant of perennial anonymity to women giving birth in public hospitals was a proportionate interference with the applicant’s right to know her origins, which is integral part of the right to respect for private and family life. The reasons given for the existence of a law guaranteeing such a strict adherence to anonymity were the protection of a woman’s interest in remaining anonymous in order to protect her health by giving birth in appropriate medical conditions, the freedom of women to decline their role as mother or to assume responsibility for the child, and the general interest of the State to protect the mother’s and child’s health during pregnancy and birth and to avoid illegal abortions and children being abandoned in ways other than under the proper procedure. Despite recognizing these objectives as well-founded, the Court contrasted the measure taken by the Italian State with the more flexible approach of France, analyzed in Odièvre  [52] , which permitted a son or daughter to obtain non-identifying information about the anonymous parents and to request the mother’s identity be disclosed with the consent of the latter to a National Council for Access to Information about Personal Origins. It concluded that, since the Italian system did not attempt to strike any balance between the competing rights and interests at stake, the interference was disproportionate.

In a vocal dissent, Judge Sajo stressed the importance of what he believed to be direct emanation of the highest value of the convention: the right to life. Reflecting on the system of incentives that the provision in question created, he pointed out that what this serves, ultimately, is the right to life of the offspring – which would have, otherwise, been endangered. Interestingly for our purposes, he specified:

Of course, the right to life is only indirectly protected by the anonymity provision. However, this supremacy is decisive for me in the balancing exercise, which cannot be limited to a conflict between two Article 8 right-holders.

While it is questionable –as deemed by the majority- that this principle would necessarily lead to the permissibility of a blanket grant of anonymity, this judgment is illustrative of one important parameter in the methodology that should be used to assess the rank of anonymity protection: above all, anonymity should be guaranteed when it clashes against the right to life (protected by article 2 of the Convention). At the same time, because of the rank of the right to life in the Convention, anonymity should be protected more forcefully when it is justified by the need to protect such a right.

A further notable aspect of the dissent is its focus on the long-term consequences of the decision, and in particular on the incentives that a grant of disclosure would have on the behavior of prospective mothers in similar cases. This is precisely the kind of reasoning that would have allowed the Court to ascertain, in Delfi, the enormous consequences that a ruling allowing intermediary “responsibility” for user comments would have on the ability of individuals to express themselves anonymously in the future, and thereby receive protection for some of their Convention rights while exercising their right to speak.

Another complex case on anonymity protection is K.U. v Finland  [53] , where the Court was asked to establish whether the absence in the legal framework of an injunction to compel ISPs to disclose the identity of a subscriber liable of a criminal offence amounted to a disproportionate interference with the right to respect for private and family life for the victim, and a justified interference with his right to an effective remedy. In particular, such possibility existed for certain offences, but not for the type of misrepresentation committed by the customer in question (posting the photo and contact information of a minor and inviting people to contact him “to show him the way”). The Court noted that the facts at hand concerned a serious matter of interference with private life in the sense protected by article 8 ECHR (because of the potential threat of sexual abuse), and that effective deterrence against grave acts where fundamental values and aspects of private life are at stake requires efficient criminal law provisions  [54] . The Court conceded that freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, but remarked that such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others  [55] . For this reason, and without prejudice to the question whether the conduct of the person who placed the offending advertisement on the Internet can attract the protection of Articles 8 and 10, the Court made clear that “it is nonetheless the task of the legislator to provide the framework for reconciling the various claims which compete for protection in this context  [56] ”.

This judgment illustrates again the typical approach taken by the Court to complex balancing: bearing in mind that its role is not to substitute its view to that of the member State in question, it ensures that the adequate procedural framework is set in place so that the conflicting interests are taken into account. However, what procedural framework will be considered adequate depends on the weight attached to the interest to be protected. In this case, having regard for the potential threat to the victim’s physical and moral integrity, the Court reminded us? of the vulnerability of individuals at such a young age (12 years old) and concluded that there had been a violation of article 8 because both the public interest and the protection of victims of crimes committed against their physical and psychological well-being require the availability of a remedy enabling the actual offender to be identified and brought to justice.  [57]

Again, one can see the role that incentives play in this regard: the reasoning of the court is that if there is no possibility of identifying the perpetrator and bringing him to justice, it is unlikely that prospective offenders will refrain from engaging in such conduct in the future. And once again, what the Court took issue with was the lack of an appropriate procedural framework to duly take into account the respective interests at stake, which the State had a positive obligation to ensure  [58] . By doing so, the Court showed the way in which substantive considerations are to be taken into account for “procedural due process” purposes: when balancing between conflicting interests, States must ensure that the legal system does not neglect or insufficiently take into account the interest of protection from “grave” acts.

Today, technology offers an opportunity for companies to market products that incorporate modularity, and to ensure that such procedural framework can be implemented by design, enabling the intermediary to undertake a first instance balancing between competing rights and interests. For example, the recent platform Whisper grants anonymity but, in exchange, “vets” the content posted by users in line with its terms and conditions  [59] , deciding over publication on the basis of the public interest character of the matter to be disclosed  [60] . Similarly, in the copyright context, Vimeo’s Copyright Match immediately fingerprints its content and searches for matches in its database to detect any possible infringement by videos being uploaded by its users, enabling immediate removal. At the same time, however, Vimeo allows users to explain possible circumstances justifying the upload notwithstanding the match, including the open-ended and balancing-centered defense of “fair use”  [61] .

It should also be clarified that the specific programs or applications which guarantee anonymity by default are of two different kinds: one offering anonymity vis a vis users of the same platform (“platform anonymity”) but not vis a vis the internet service provider (“customer anonymity  [62] ”) or the public authority (“citizen anonymity)  [63] ; the other (and more difficult to accomplish) gives partial “citizen anonymity” and “customer anonymity”, through the use of Tor or VPNs and other technological arrangements that minimize the disclosure of identifying information  [64] . However, both types of anonymity are imperfect: they only operate at one layer- respectively, the application layer and the network layer. In addition, the latter also requires the users to de-identify themselves by clearing cookies between sessions and not logging into identifying applications. Furthermore, some countries (as well as some payment intermediaries  [65] ) have started to block or prohibit VPN providers  [66] , thus making the task even more complicated for an average user. Even admitting that skilled users will easily circumvent those blocks and that highly sophisticated identification techniques exist for exceptionally important targets, it should be borne in mind that more complexity requires higher expenditures for law enforcement, and it is therefore unwise for a legislator to devise a whole regulatory procedure focusing on anything other than the “average user”. For an average user, who doesn’t know all the precautions that he or she needs to take in order to be completely anonymous, nothing is available in the market that provides protection simultaneously at the application and the network level; so, when talking about platforms, it is clear that there will always be the possibility of tracing individual users, unless they have themselves combined the two functionalities above. It must be understood, therefore, that except for the very narrow group of skilled users, technological traceability dominates the net.

What this implies is that it is generally possible for platforms, in line with their terms of service, to retain, obtain and disclose the data they have gathered to perform their services. Some may voluntarily choose to erase data about their users in a very limited timeframe  [67] , and some may be forced by law to keep it for a longer period. The latter scenario had, in fact, materialized in the national implementation  [68] of the EU Data Retention Directive (2006/24/EC), which established an obligation for providers of publicly available electronic communications services and of public communications networks to retain traffic and location data for up to six months or two years for the purpose of the investigation, detection, and prosecution of serious crime. However, the past tense is required when speaking about this Directive, since it was recently invalidated by a decision of the CJEU for its inconsistency with the protection of fundamental rights.  [69] In the aftermath of the invalidation of the Directive, it is expected that its national implementations will be repealed or declared unconstitutional  [70] . However, it is submitted here that a complete absence of European coordination on this matter would be problematic for the lack of uniformity that would arise as a consequence in national laws  [71] and, worse yet, for the risk of insufficient protection of the rights of European citizens, who may have no, or limited, remedies available without the traffic and connection data.

One thing that the saga of the rejection of the data retention provisions  [72] has taught legislators is that normative provisions introducing law enforcement measures with such a sweeping potential of interference with individual rights must contain adequate safeguards against abuse, and lay out with clarity the conditions on which interference with the right to private life and personal data would be allowed. In fact, the CJEU found problematic the fact that the retention obligations of the Directive applied even in the absence of evidence of any serious crime  [73] and without requiring any relationship between the data and a threat to public security  [74] , but also that it provided no objective criterion to determine the limits and conditions of access and subsequent use of data by national authorities for the purpose of prevention, detection or criminal prosecutions of serious offences – a notion left for national member States to decide  [75] . This decision shows a clear path for measures introducing technological solutions to rights adjudication, pointing to the need to specify conditions and limitations for the interference with fundamental rights, require end-means proportionality, and provide adequate safeguards against abuse.

The law at issue in the Delfi case, that was interpreted to apply to news publishers in the same way for user comments as for articles, would be unlikely to pass muster under this test. This is because such law shifts the responsibility for defamatory comments to a third party who is neither the author nor the publisher (since it does not edit the content), and does not clarify the conditions for such interference with freedom of expression. The rationale for the existence of such provision is, in the words of the ECtHR, the greater likelihood that an Internet news operator possesses the resources for continual monitoring of the Internet and an adequate financial situation for ensuring redress of the victim, compared to the little chances that a victim would have to be effectively compensated if it was required to address his or her claims to the original poster  [76] . However, as pointed out earlier, the Internet has made it possible for everyone to become a publisher and run, for example, a news portal, therefore rendering the foundations of the argument of financial solvency that was traditionally applied to media somewhat shaky. In addition, the web offers also tools that enable users to easily monitor the Internet for the appearance of content regarding themselves or any information that they are particularly interested in, through search engine alert notifications.  [77] In contrast, requiring a news portal to be the guardian of potential interests of anyone who might be affected by comments published by third parties in a news article amounts to a serious interference, both with the right to freedom of expression of the potential commenters and the right to property (protected by Article 1 of Protocol 1 of the Convention) of the portal operator. For these reasons, it appears that the shift of responsibility to the news publisher is more restrictive than would be necessary to achieve its aim, i.e. to ensure the ability of the victim to become aware of a violation of their privacy, obtain prompt removal and recover from it.

Furthermore, the way such law has been interpreted by the ECtHR adds another layer to the problem, in suggesting that the news portal assumes a certain responsibility over comments when it allows for anonymous speech. As a matter of fact, the ruling of the court puts the measure in a light that sets the incentive for future content hosts to restrain anonymity –that is, to prevent content creation by unregistered users- and offers member States a (dangerous) opportunity to impose technological mandates for monitoring purposes, which is in direct conflict with the letter of the EU E-Commerce Directive. As noted, this would have serious consequences on the privacy and freedom of expression of users, both immediately and in the long run, by affecting competition in the market for news portals and, more generally, content hosting.

Given all the above, it is submitted that the Court should have verified whether such interpretation of the law, resulting in an interference with the desire for anonymity of its users, was legitimate and proportionate in ensuring the effectiveness of redress of civil claims. Had it done so, it would have found already quite a consolidated jurisprudence in the EU providing a negative answer to that question, the general understanding being not only that monitoring obligations are explicitly excluded, but also that the law doesn’t allow judges to force third parties to disclose identifying information of their customers. For example, as it was clear from the fact pattern from which a Spanish court raised a preliminary question to the CJEU in Promusicae, Spain does not allow the disclosure of identifying data for purposes of civil proceedings. A similar standard applies in Germany, where the ISPs can only be forced to disclose identifying information in serious criminal investigations  [78] and in the case of alleged infringers of copyright on a commercial scale,  [79] or otherwise obvious infringement of copyright  [80] ; and in Italy, where it is settled that a subscriber’s information can only be disclosed by ISPs “in exchange for the protection of superior values protected by criminal law”  [81] . In some jurisdictions, the possibility of obtaining such information is not foreclosed but is subject to a strict balancing of criteria that ensures the well-foundedness of the alleged victim and prevent potential abuse of the process: this is the case, for example, of the Netherlands, where the Supreme Court ruled that disclosure for civil proceedings is not prohibited by data protection law, provided that certain restrictive conditions are met  [82] . Similarly, in Sweden an order for disclosure of this kind can be made if there is clear evidence of an infringement of an intellectual property right, if the information sought can be regarded as facilitating the investigation into an infringement of copyright or impairment of such a right, and if the reasons for the measure outweigh the nuisance or other harm which the measure may entail for the person affected by it or for some other conflicting interest  [83] . Likewise, in United Kingdom the procedure of Norwich Pharmacal order can be used to require third parties involved in any kind of wrongdoing to disclose certain documents or information about the wrongdoer, but the granting of such requests is contingent on the weighing of a variety of factors which focus prominently on the balance of inconvenience  [84] . One notable difference is France, where the system of injunctions seems to provide no explicit consideration for “equities” and rests entirely on the likelihood of success on the merit and irreparable harm  [85] , although it has been argued that balancing is increasingly conducted in intellectual property cases  [86] .

Instead, the Court should have clarified that the right to anonymity can be vital to ensuring the ability for users of a platform to engage in free speech while maintaining adequate protection for other Convention rights that can be adversely affected by the identification of the speaker. Accordingly, it should have been recognized that restrictions to anonymity must be done in accordance with the law and must be necessary in a democratic society for achieving an aim that is explicitly recognized by the Convention in relation to the article that is invoked for the protection of anonymity.

In the author’s view, the fact that the restriction would occur, in the case at hand, through self-regulation by the intermediary in response to the incentives set up by the standard of liability imposed by the legislation, should not have exonerated the Court from reviewing the necessity and proportionality of the mechanisms of liability generated by that legislation, as interpreted by the courts and perceived by platforms in the market. In doing so, the Court could have, at least implicitly, defined the conditions under which such intermediary would be permitted to restrict anonymity without implicating the liability of the State for failure to comply with its positive human rights obligations. In particular, the Court could have established that a system of balancing operated by the intermediary and triggered by user notification would be compatible with the Convention, as long as it incorporates the standard of procedural and substantial due process that the Court has elaborated in its jurisprudence. Although going into detail as to what those standards imply would be beyond of the limited purview of the Court in a specific case, a roadmap on the major factors to be taken into account and the procedural devices to be used for such balancing would be a significant step ahead towards clear and administrable responsibility of Internet intermediaries.

Incidentally, this framework would be largely transposable to the situation envisaged by the recent Google Spain judgment of the CJEU  [87] , which allows for the submission of notification to search engines for the erasure of links appearing in relation to one’s personal name, and thereby attributes adjudicative powers to this particular intermediary. As a result, the clarification that could be provided by the Grand Chamber of the ECtHR is potentially of great relevance for the future of privacy and freedom of expression in the EU, not only with regard to disclosure of the identity of anonymous (or pseudonymous) commenters, but also in relation to the criteria that should be used by search engines to respond to requests of removal –and more generally, by intermediaries receiving takedown requests.

These criteria may be, concretely, topics that deserve, in and of themselves, another article, or perhaps an entire book, to be dealt with. My suggestion in that respect is that the definition of an overarching framework would allow intermediaries to offer in the market effective and viable solutions to anonymity conflicts, with a balancing methodology that duly takes into account all of the relevant factors. To go back to the title of this article and the question posed therein, the real answer lies not so much in choosing between the affirmative and the negative but in identifying the circumstances under which intermediaries and/or States should be held responsible for not having set an adequate framework for the evaluation of conflicting rights claims. Clear and predictable boundaries on the operating space for an intermediary in evaluating such claims would allow us to answer that question, at least succinctly, and set the seeds for a market of technological solutions to rights adjudication in accordance with the rule of law. Specifically, enabling platforms to set presumptions in favor or against anonymity disclosure in specific circumstances  [88] would go a long way towards ensuring the quick resolution of those requests, avoiding an excessive hindrance to the freedom of expression of the content generators and ensuring the viability of the business model of many Internet intermediaries.