The Constitutional Implications of the Google versus ViviDown Saga

Transcription

1 The Constitutional Implications of the Google versus ViviDown Saga Oreste Pollicino Associate Professor in Comparative Law Bocconi Oxford, 3 June 2013

2 Summary Reasons behind the investigation Legal framework (clash between contrasting constitutional visions) Facts of the case Decision of the first instance Judge Decision of the Appeals Court Discussion 2

3 Freedom of Expression I Amendment US Constitution Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.

4 Freedom of Expression European Constitutionalism Article 10 ECHR Freedom of expression 1. Everyone has the right to freedom of expression (..). 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

5 Privacy and data protection The right to privacy (Warren and Brandeis 1890, Harvard Law Review) That the individual shall have full protection in person and in property is a principle as old as the common law; but it has been found necessary from time to time to define anew the exact nature and extent of such protection. Peace of Mind : static dimension 2001: Patrioct Act

6 Privacy e data protection European Constitutionalism: from a static to dynamic vision Article 8 Right to respect for private and family life Everyone has the right to respect for his private and family life, his home and his correspondence (ECHR 1950) In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data (European Directive 95/46) Everyone has the right to the protection of personal data concerning him or her (European Charter of Fundamental Rights 2000)

7 ISP Liability USA DMCA 512 «Notice and Take Down» Europe Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce)

8 ISP Liability in Europe Article 14 Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.

9 Facts of the case 1/2 On September 8, 2006 the video showing a disabled student being bullied by three of his colleagues has been posted on Google-Video Video flagged by many users Video top ranked within the category funny videos Italian postal police notice on November 7, 2006 Removal of the video the same day 9

10 Facts of the case 2/2 The investigations started by the public prosecutor of Milan Charges : 1) co-participation in aggravated defamation 2) violations of data protection rules Google s management under investigation 10

11 The decision main features Innovativeness of the decision Too much ado about nothing? Drafting of the decision Procedural issues Merit issues 11

12 Procedural profile Application of the Italian Law 1/2 Art. No. 5 of the Italian Data Protection Code (Legislative decree of June 30, 2003 no. 196) application of the Italian law whether: 1) The processing of data is performed by an entity established in Italy, or 2) The processing of data is performed by an entity that is not established in the European Union, using instruments that are located in Italy, not only for the passage of the data in the EU territory. 12

13 Procedural profile Application of the Italian Law 2/2 Google s arguments Praxis of the Italian data protection Authority on the applicable law Reasoning of the decision and its possible effects: Processing of data as dynamic activity; extensive interpretation of the notion of instrument under data protection law 13

14 Merit profile Charge no. 1 Co-participation in aggravated defamation (Art. 40 Italian Criminal Code) Opinion of the Public Prosecutor Reasoning of the decision Google as hosting provider no duty of prior monitoring of the information stored or transmitted through its services no references to e-commerce Directive and implementing Decree 14

15 Merit profile Charge no. 2 (Art. 167 Italian Data Protection Code 2003) Unlawful processing of personal data (including sensitive data disclosing health issues) without his consent and with a view to gain via the Google Video service (in relation to which Google Italy s.r.l. makes an earning from the adverts inserted) processed personal data. 15

16 The First Istance Judge Decision (2010) The judge acquitted all the four executives of the charge of defamation, but convicted them of privacy violations. The executives found guilty were given 6-month jail terms, but the judge suspended the sentences because they were first-time offenders who had committed a minor crime. The judge also ordered the publication of the verdict in three important national newspapers: Corriere della Sera, la Repubblica, and la Stampa

17 Google s official statement We are deeply troubled by this conviction It attacks the very principles of freedom on which the Internet is built. Common sense dictates that only the person who films and uploads a video to a hosting platform could take the steps necessary to protect the privacy and obtain the consent of the people they are filming. European Union law was drafted specifically to give hosting providers a safe harbor from liability so long as they remove illegal content once they are notified of its existence 17

18 Two main issues before the Appeals Court (2012) 1. Data protection framework (Directive 95/46) Who is the controller and who is the processor? controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data processor shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller

19 ISP Liability How «passive» should be a ISP to benefit from the exemption? (Recital 42 directive 95/46 ) The exemptions from liability established in this Directive cover only cases where the activity of the information society service provider is limited to the technical process of operating and giving access to a communication network over which information made available by third parties is transmitted or temporarily stored, for the sole purpose of making the transmission more efficient; this activity is of a mere technical, automatic and passive nature, which implies that the information society service provider has neither knowledge of nor control over the information which is transmitted or stored.

20 The decision of the Appeals Court From being «much ado about nothing,» as quoted in the judgment following the original trial, we are in fact faced with an extremely complex matter because it has to do with the regulation of Internet.

21 How neutral should be the ISP? The figure of the simple service provider, which arrived on the scene at the time that the directive referred to was first introduced, was, as an operator and pursuant to its contracts with its service users, outlined as being wholly extraneous in relation to the information stored. This figure would appear to have been overtaken in practice, however, as a result of the way in which the worldwide computer network has evolved

22 How neutral should be the ISP? 2) In today s world, the services that an IP offers are not limited to the technical process that simply sets up and provides access to the network: as in the case of the content provider, they extend to make it possible for users to submit their own content and other people s content on the network. They cannot, therefore, escape the duty to comply with the standard regulations governing liability for data processing.

23 Which degree of activism is tolerated? It follows that all the elements considered in this case (the possibility of filtering, of take-down, of identifying content by using key words, of indexing content and any use for advertising purposes) lead to the view being formed that Google Video must be classified as active hosting at the very least. Given that it is able to organize and select the material sent by users, any possibility of Google Video being in a position to continue to insist with its claim that it is neutral can in fact be ruled out What does it mean in terms of liability regime?

24 Confirmation of the Acquittal from the Defamation Indictment In order to establish liability on the grounds of an omission on the part of a host or content provider, it has to be established whether there is a duty provided by law on the part of that provider to prevent the event. So what has to be established on the one part is the existence of a duty of care and on the other, the possibility, in practice, of carrying out prior screening. Art. 15 directive 31/2001: No general obligation to monitor

25 The Acquittal from the Charge of the Unlawful Processing of Personal Data It is challenged the background rationale which appears to have guided the reasoning of Tribunal of first instance according to which every entity who «handles» personal data should be considered as data controller or cocontroller

26 Three relevant relationships 1) Between the user/uploader and the bullied boy who was the data subject In this case Article 167 of the Italian Data Protection Code fully applied and the user became the «controller»

27 II relationship 2) Between Google and the girl who filmed the bullies and then uploaded the video. It was again the classic two-way relationship: hosting controller, on the one hand, and user data subject, on the other.

28 III relationship 3) The third relationship, was a «nonrelationship.» There was no connection between the provider of the Google Video service and the bullied boy. One was not aware of the other. With regard to the personal data comprising the bullied boy s image only, and not the video as a whole, the service provider (Google) made no autonomous decision regarding the purpose or use and the related procedures

29 Conclusion Advocate General C-131/12 "Processing of personal data is carried out in the context of the activities of an establishment of the controller within the meaning of Article 4(1)(a) of Directive 95/46/EC when the undertaking providing the internet search engine sets up in a Member State, for the purposes of promoting and selling advertising space on the search engine, an office or subsidiary which orientates its activity towards the inhabitants of that State."

30 30 Q&A