What Does It Matter Who is Browsing? ISP Liability and the Right to Anonymity

Abstract

Disputes concatenating privacy, speech and security through the right to anonymity are particularly hard cases to adjudicate. The traditional paradigm, according to which anonymity plays a double role – protecting fundamental rights, as well as potentially threatening them – continues to drive policies that, in turn, emphasise the risks and downplay the opportunities of anonymity in the online world. The content/metadata distinction is a residue of such ambiguous views, persistent in the Court of Justice of the European Union’s (CJEU) approach towards the right to anonymity in ISP liability cases. The article initially explores the argumentative grounds behind the CJEU’s recent McFadden judgment (part 2.). Against the backdrop of the theory of balancing of interests, this paper critically examines the Court’s reductionist position. Our critique suggests a method of avoiding the disproportionately narrow scope of analysis that accompanies this position. For this purpose, we establish the right to anonymity at the periphery of both the freedom of expression and information, and the right to private life and data protection, while contesting the right to anonymity as a right sui generis. We proceed with three key points. By inspecting the nature of the right to anonymity, we unveil the interconnectedness between the right to freedom of expression and information and the right to private life and data protection (part 3.). Chilling effects represent an often understated evidence of this relationship. In addition, we see that affecting certain means of exercising a particular fundamental right, such as is its anonymous exercise, brings forward important extra-legal considerations, facilitating the discernment of chilling effects in any analysis of human rights. It is argued that regulating anonymity could pose a significant obstacle to the exercise of a fundamental right as a whole, and consequently impact upon the core of that right (part 4.). Harmonisation-driven attempts to develop human rights guarantees, framed in seemingly robust procedures established by the CJEU, at the level of data collection or retention as well as data disclosure by an ISP, have the potential to be derailed by nation-specific considerations. Taking such considerations seriously can reverse the imminent impact upon the core of the fundamental rights in question, which the narrow scope of traditional human rights analysis easily discounts. This requires diverting from the “targeting by dissuasion” argument as a mere technical exercise, and acknowledging the subtle subterranean relationship of the fundamental rights being considered (part 5.).