Facebook’s liability for defamatory posts: the CJEU interprets the e-commerce Directive

Lorna Woods, Professor of Internet Law, University of Essex

The last couple of weeks have seen a number of judgments relating to the control of information on the internet by the subject of the information.  The cases of GC et al (Case C-136/17) and Google v CNIL (Case C-507/17) concern the interpretation of General Data Protection Regulation (GDPR), looking at the obligations of search engines. The most recent case, Glawischnig-Piesczek v Facebook (Case C-18/18) concerned the impact of the e-Commerce Directive (Directive 2000/31/EC), specifically the prohibition on general monitoring found in Article 15 of that Directive, on ‘stay down’ notices. The focus of this post is on Glawischnig-Piesczek, but there is a question that reaches beyond the impact of that case on the e-Commerce Direcitve: to what extent is there a coherent approach to issues arising from the Internet across the various legal measures that intersect with it. This may go beyond the e-Commerce Directive and the GDPR to include measures related to intellectual property (notably the recent controversial Directive on Copyright in the Digital Single Market (Directive 2019/790/EU) and the Enforcement Directive (Directive 2004/48/EC)) and the combating of child exploitation (Directive on combatting the sexual abuse and sexual exploitation of children and child pornography (Directive 2011/93/EU)) and terrorism (Terrorism Directive (Directive 2017/541/EU)).

The Judgment

The facts giving rise to this reference are simple.  Glawischnig-Piesczek complained to Facebook about some defamatory posts. Facebook did not remove the posts so Glawischnig-Piesczek obtained a court order requiring Facebook to stop publishing the impugned content. The precise scope of the order gave rise to further litigation and the Austrian Supreme Court referred a number of questions to the CJEU, asking:

-          Are “stay down” notices in relation to identically worded content compatible with Article 15 of the e-commerce Directive?

-          Are there geographic limitations to the obligation?

-          Are such notices in relation to content with equivalent content to that which has been found unacceptable which does not use the same words but conveys the same meaning acceptable?

-          In relation to posts with equivalent meaning, does the obligation accrue when the intermediary becomes aware of the content?

The Court started its analysis by making clear that the immunity from suit granted by Article 14 of the Directive is not a general immunity from every legal obligation. Specifically the national authorities remain competent to require a host to terminate access to or remove illegal information. The Court also noted that Article 18 of the e-Commerce Directive requires Member States to have in place appropriate court actions to deal with illegal content. It states:

Member States shall ensure that court actions available under national law concerning information society services’ activities allow for the rapid adoption of measures, including interim measures, designed to terminate any alleged infringement and to prevent any further impairment of the interests involved.

The Court held that no limitation on the scope of such national measures can be inferred from the text of the e-Commerce Directive [para 30]. 

It then turned to the impact of Article 15. It highlighted the fact that while Article 15 prohibited general monitoring as recital 47 in the preamble of the Directive makes clear, monitoring ‘in a specific case’ does not fall within that prohibition. It then held that

[s]uch a specific case may, in particular, be found, as in the main proceedings, in a particular piece of information stored by the host provider concerned at the request of a certain user of its social network ….. [35].

Given the nature of information flows there is a risk that any such information may be re-posted, so

‘.. in order to ensure that the host provider at issue prevents any further impairment of the interests involved, it is legitimate for the court having jurisdiction to be able to require that host provider to block access to the information stored, the content of which is identical to the content previously declared to be illegal, or to remove that information, irrespective of who requested the storage of that information. In particular, in view of the identical content of the information concerned, the injunction granted for that purpose cannot be regarded as imposing on the host provider an obligation to monitor generally the information which it stores, or a general obligation actively to seek facts or circumstances indicating illegal activity, as provided for in Article 15(1) of Directive 2000/31 [37].

The Court determined “equivalent meaning” to be about the message the information posted conveys and which was “essentially unchanged”. Given the focus on meaning not form, the Court held that an injunction could extend to non-identical posts as otherwise the effects of an injunction could easily be circumvented.  The Court then considered the balance between the competing interests. The Court commented that the “equivalent information” identified by court order should contain specific elements to identify the offending content and in particular must not require the host to carry out its own independent assessment. In terms of assessing the burden on the host, the court noted that the host would have recourse to “automated search tools and technologies” [para 46].

The court concluded that the injunctions would not constitute a general obligation to monitor all content and specifically no obligation to seek facts or circumstances indicating illegal activity.

The Court also noted that Article 18 of the Directive makes no provision for territorial limitations on what measures Member States may make available. In principle, world-wide effects would be permissible [para 50], but this is subject to the proviso that EU rules must be consistent with the international law framework.

The court felt it unnecessary to respond to the third question without elaborating further.

Comment

There are a number of comments that could be made about this judgment. This post comments on three: the approach of the Court to general monitoring; non-identical content; and the issue of territorial scope. It also discusses freedom of expression issues.

General Monitoring

In this judgment there is a clear confirmation that searching for specific pieces of information/types of content does not constitute general monitoring. The Court makes it clear, at para 35, that the searching for individual pieces of content constitutes a ‘specific case’ within recital 47.  The Court gives the searching for specific information as an example of a ‘specific case’; presumably the searching of a targeted user’s stored date could be another such.  This is the first time the approach has been adopted in regards to defamation.  Perhaps the fact that the case concerns defamation rather than, for example, intellectual property explains the dearth of previous case law cited in the court’s judgment.

The statement of the Court that searching for an individual item of content does not constitute general monitoring does not address the fact that such a search would presumably involve search all content held. Yet in McFadden (Case C-484/14), the Court described the scope of Article 15 thus:

As regards, first, monitoring all of the information transmitted, such a measure must be excluded from the outset as contrary to Article 15(1) of Directive 2000/31, which excludes the imposition of a general obligation on, inter alia, communication network access providers to monitor the information that they transmit. [McFadden, 87]

This is broadly similar to the approach in the early case of L’Oreal (Case C-324/09) which referred to Article 15 precluding ‘an active monitoring of all the data of each of its customers in order to prevent any future infringement ...’ [para 139].  The prevention of future infringements in the context of L’Oreal could be achieved – in the view of the Court – however by the suspension of the perpetrator.  Yet monitoring of the data of all customers seems to be what would be required to find the specific case of content. The matter remains unacknowledged in the Court’s analysis in Glawischnig-Piesczek.  Perhaps the assumption is (a) that the concern underpinning the prohibition in Article 15 derives from privacy; and (b) that when we look for one thing we do not really see the other things that we look at during our search – and that this might particularly be so when the searching is automated.  Of course, arguments that automated review of communications data does not constituted an invasion of privacy have not been accepted by the Court (e.g. Watson/Tele2).  In any event, further support for the distinction between searching for an identified piece of content and searching in a less targeted fashion is found in the context of the fight against child sexual abuse and exploitation and in the context of enforcement of intellectual property.

Non-identical content

The clarification that an injunction may also extend to non-identical content raises a number of issues.  While the Court states that a host should not be required to make its own judgment on these matters it is not clear how similar the content needs to be.  It is also unclear whether the Court is concerned here with the wording or the message conveyed. At [40] it refers to the ‘message conveyed’, which could refer to the idea in issue rather than its precise expression. The Court then referred to ‘information, the content of which, whilst essentially conveying the same message, is worded slightly differently …’ [41]. An approach based on wording (or presumably identifiable items of content such as images) has the benefit of being more easily described by order. It is probably easier to circumvent.  There seems to be an assumption in the judgment that technological means are available to implement this sort of requirement, though whether that is the case is another question.

Territorial Scope

The territorial scope of the order is also worth mentioning.  Like its Advocate General, Szpunar, the Court does not envisage any territorial limitation of the removal/blocking as a result of EU law.  It is important to note that the Court does not say that injunctions must have such extraterritorial effect. Rather the question is about the interplay between each national legal system’s own way of dealing with these issues (and area the Court noted gave Member States wide discretion) and the fact that Article 18 is silent as to any limitations. The silence of EU law allows Member States freedom to take action.  A further issue is that the Court noted the impact of international law without however elaborating what it meant – are we talking fundamental human rights (this seems unlikely given the existence of the EU Charter) or international comity, for example?. 

This is one of a number of cases in which the Court has had to consider the territorial scope of EU law in the context of the Internet – the most recent being the Right to be Forgotten case: Google v CNIL (Case C-507/17). There the Court held that

Where a search engine operator grants a request for de-referencing …, that operator is not required to carry out that de-referencing on all version of its search engine, but on the version of that search engine corresponding to all the Member States. [73]

It seems then that the opposite conclusion has been reached. This is overstating the point.  While the fact that EU law does not require extraterritoriality, the GDPR’s silence on the point gives space to a national court to make an order with extra-territorial effect, a point the Court makes express in para 72. A national could then, within the constraints of its own national rules, make such an order. In such a situation the position would seem similar to that under Article 18 e-Commerce Directive as understood in Glawischnig-Piesczek. A contrast to the silence of the EU legislature on extraterritoriality of blocking/de-listing can be seen in the Terrorism Directive. There Article 21 imposes an obligation on Member States to obtain the removal of terrorist content hosted outside their territory, but it also recognises that that may not be possible.

In Google v CNIL, while the Court recognised the possibility for national courts to make orders for de-referencing with extra-territorial effect, it expressly noted that in doing so they must weigh up the competing interests of the data subjects  and the right of others to freedom of information [para 72]. It is noticeable that in Glawischnig-Piesczek the balancing is different. The Court notes the interest of the subject of the information and also the need not to impose an excessive burden on the host provider [para 45, para 46]. The existence of other rights: the right of the host to carry on a business and the rights of those posting the material and those wishing to receive it – both aspects of freedom of expression - are not expressly mentioned. To some extent the issue of rights will be covered through the national courts, which will be the bodies to carry out that balancing within their own national frameworks and within the limits of EU law. By contrast to Google v CNIL, however, there is no instruction from the Court that these are matters to be considered, nor any express recognition that the balance between the right to private life (including the protection of reputation) and freedom of expression differs between territories. What might be seen as the legitimate protection of private life in one place is an infringement of speech in another.  So, while the matter was not directly the Court’s concern in this case, it is somewhat surprising that the issues were not directly considered.

Barnard & Peers: chapter 9

Photo credit: Department of Defense, via Wikicommons

Uber: a taxi service or an app? Analysis of an ECJ Advocate-General’s view

Lorna Woods, Professor of Internet Law, University of Essex

Case C-434/15 Asociación Profesional Elite Taxi v. Uber Systems Spain SL, Opinion of the Advocate General, 11 May 2017

This case is the first before the Court of Justice specifically on the sharing economy and the extent to which coordination via platform should be treated as removing unnecessary red-tape, or as seeking to avoid regulation in the public interest (in the form of concerns about passenger safety) as well as permitting unfair competition.  While the Commission seems in favour of the (unequal) sharing economy, Advocate General Szpunar sees the position a little differently.

FACTS

Spanish law envisaged that taxi firms, and transport intermediaries, should hold a licence.  Asociación Profesional Elite Taxi (APET) sought to challenge the use Uberpop, an app which allows non-professional private drivers to transport passengers using the drivers’ own cars, where neither Uber nor the drivers have the requisite licences.   Passenger users download the app from Uber and provide their bank details to Uber.  On receiving a request for a car, the app notifies drivers and calculates the fare (this latter based on distance but also demand for taxi services at that time).  The payment is made to Uber, which deducts a percentage and then pays the remainder to the driver.  To use the app as a driver, an individual must comply with Uber’s terms and conditions. APET sought a cease and desist order and a prohibition of future similar behaviour on the basis of unfair competition.  Uber resisted APET’s claims on the basis that it was not providing transport/taxi services but was rather a digital intermediary. 

QUESTION REFERRED

The national court referred the questions of how to classify Uber’s services to the Court of Justice. The answer would affect with EU derived legal regime would be applied to Uber, with the corollary that the State’s freedom to impose licensing requirements would correspondingly vary depending on which regime was held to be applicable.  In essence, the question was whether Uber fell within the provisions of the e-Commerce Directive (Directive 2000/31) as an information society service provider, or whether the Services Directive (Directive 2006/123) or the TFEU itself applied in this context.  Here, there is a distinction between a service general and a service in the field of transportation.

OPINION

The first phase of the opinion comprises some general remarks about the significance of the ruling and the impact of different types of competence on the outcome.  The Advocate General also assumed that the respondent in the case should be the Dutch company (Uber BV), which operates the app in the EU, rather than the Spanish company, Uber Spain, which is responsible for advertising.

The Advocate-General then moved on to consider the scope of the e-Commerce Directive, specifically the meaning of ‘information society services’ as defined in Article 2(a) of that Directive by reference to Article 1(2) of Directive 98/34 (the Directive on notifying new technical barriers to trade). Under Article 1(2), an information society must be a service provided for remuneration, at a distance, by electronic means and at the individual request of a recipient. In the view of the Advocate-General, the questions of whether there is a service provided for remuneration and at individual request appeared unproblematic [para 27], but questions arose as to the test of whether the service is provided at a distance by electronic means.  In the eyes of the Advocate General the problem related to the fact that what was in issue was a ‘composite service’ [para 28].

The Advocate-General emphasised that the definition concerned services “’entirely transmitted, conveyed and received by wire, by radio, by optical means or by other electromagnetic means’” [para 29, quoting 2nd indent of 2nd subparagraph of Article 1(2), Directive 98/34, emphasis in Opinion].  So, services not delivered by electronic means did not fall within the scope of the e-Commerce Directive; services which were incidental to such services would likewise not be liberalised by the e-Commerce Directive. Assuming that they did would undermine the perceived effectiveness of EU law [para 31]. Thus:

… an interpretation of the notion of information society services which brings online activities with no self-standing economic value within its scope would be ineffective in terms of the attainment of the objective pursued by Directive 2000/31. [para 32]

The Advocate General suggested that a composite service would be treated as an information society service in two circumstances:

-          where the two elements could be seen as economically independent of one another they would be treated separately for regulatory purposes – the electronic element likely falling with the eCommerce Directive; and

-          where the service  provided was substantially or predominantly provided by electronic means.

A common example of the first case would be a three party situation where an intermediary service provider facilitates a transaction between a user and an independent service provider/seller.  While the intermediary provides added value, the trader here pursues an independent business.  In a two party situation – where the intermediary provider is also the provider of a service not provided by electronic means, the two elements cannot be seen as separable; rather, they ‘form an inseparable whole’ [para 35]. 

In that instance, it will be necessary to see if the composite service falls within the second category; that is, whether the bundle falls within the eCommerce Directive or outside it. For determining the answer to this second question, the key element is where the economic value lies. So where the main component is performed online that service should be classified as an information society service (assuming the other elements of the test are met); conversely, where it is not then the service does not fall within the eCommerce Directive. The Advocate General, citing Ker-Optika (Case C-108/09) suggests that this test would be satisfied in the case of online sales (via the seller’s own website).  Delivery of goods is ‘simply the performance of a contractual obligation’ [para 36]. 

Applying these tests here, the Advocate General noted that Uber provided more than a matching service of passengers to taxi drivers. It sets down the essential characteristics of the service to be provided (eg quality and age of vehicle; drivers to have licences and no criminal record), it informs drivers where and when there are likely to be a high volume of trips and/or preferential fares, and it sets the prices.  Uber maintains indirect control over drivers through its ratings function.  Thus, in the view of the Advocate General,

‘… Uber exerts control over all the relevant aspects of an urban transport service ….  (…) Uber therefore controls the economically significant aspects of the transport service offered through its platform’ [para 51].

 While the Advocate General sought to distinguish this case from the cases concerning whether drivers are employees of Uber, on the basis of this indirect control the Advocate General concluded that:

 ‘Uber’s activity comprises a single supply of transport in a vehicle located and booked by means of the smartphone application and this service is provided, from an economic standpoint, [citations omitted] by Uber or on its behalf’ [para 53]. 

The Advocate General sought to distinguish the activity of Uber from intermediary services on the basis that Uber drivers do not carry out an independent activity. Instead, their activity exists solely because of the existence of the platform.  By contrast, flight or hotel booking systems are separate from the independent services operated by the hotels and airlines and for whom the websites are just one mechanism of advertising their services. Furthermore, it is the hotels and airlines which control the prices and the conditions on which their services are offered. Finally, a choice is offered to the user between hotels/airlines. 

In opposition to the Commission’s views on the sharing economy, the Advocate General did not think that the fact that Uber did not own the cars was determinative. Uber is more than a ‘mere taxi booking application’ [para 64].  Because of the extent of the innovation on the transport sector caused by the way the apps links drivers and passenger and the conditions on which it does this, ‘it is undoubtedly the supply of transport which is the main supply and which gives the services the economic meaning’ [para 64].  The supply of connection services is ancillary to this.

Having determined that Uber’s services do not fall within the eCommerce Directive, the Advocate General considered the Services Directive: Article 2(2)(d) specifies that the Services Directive does not apply to transport services.  The Advocate General confirmed that Uber’s taxi services were transport services in the context of Article 2(2)(d) Services Directive as recital 21 refers to ‘urban transport [and] taxis’ [cited para 68].  The service likewise falls within the exception to the Treaty rules on free movement of services (Article 58(1) TFEU) and therefore subject to the specific transport sector rules in Article 90 TFEU et seq.

The Advocate-General concluded by considering the position should Uber’s app be deemed to fall within the eCommerce Directive.  He noted that Member States would then be limited in terms of the conditions that they could apply to such a service; drivers however would still be subject to any relevant national regulation. The Advocate General argued that Uber nonetheless could be penalised for unfair competition as ‘it is responsible not only for the supply whereby passengers and drivers are connected with one another, but also for the activity of those drivers’ [para 86], whether or not the booking app were seen to be separate from the transportation service or not.  The Advocate General therefore proposed that the eCommerce Directive

‘does not preclude requirements relating to the activity of transport in the strict sense being established in national law or the imposition of penalties on Uber for failing to comply with those requirements, including by means of an injunction ordering it to discontinue the service’ [para 88].

Comment

This opinion will be grabbing the headline news because of the headline fact that – shock, horror- Uber is a taxi company.  The reasoning used is worth a little more attention, because our understanding of that reasoning, if the Court of Justice follows the same lines, will affect any wider ramifications for the ‘sharing’ economy more generally.  So while the Advocate-General starts his opinion by suggesting that the subject matter of the case is ‘narrow’ (para 2), the repercussions are potentially a little broader.  A recognition of this fact can be inferred by the approach of the Advocate General to the question of scope of the eCommerce Directive and the insistence that the eCommerce Directive regulates services that are entirely delivered by electronic means – the emphasis is that of the Advocate General (para 29), with the result that it cannot be said

That any trade-related online activity, be it merely incidental, secondary or preparatory in nature, which is not economically independent is, per se, an information society service (para 37).

The opinion re-iterates this point when considering the app as an information society service (see below). The significance of this is that the eCommerce Directive cannot be used to avoid regulation of the main service, at least to the extent that such regulation is not a barrier to trade unacceptable to EU law more generally and as exemplified by the Services Directive, just because some aspect of the business is on-line.  This leads to a second general point: the Opinion is noteworthy for the way it manoeuvred the circumstances of the case around to the twin obstacles to national regulation of the eCommerce Directive and the Services Directive, especially given that the Commission, in its Communication on the Collaborative Economy (COM(2016)356) seem to view the Services Directive in particular providing a basis for such services. 

The tests identified by the Advocate-General will not seem unusual – talking about whether the different elements of a composite service are severable or preponderantly one thing or another can be seen elsewhere, for example in the case of goods and services (an example of which is given by Advocate General Szpunar in his reference to Ker-Optika, para 36), or even questions of competence. 

A couple of points can be made here.  The first is that in some of the factors to be taken into account in determining independence, the Advocate General comes close to eliding the question of what is the nature of the service with the question of who is providing it. Many of the factors the Advocate General considered reflect the Commission’s Communication from last year. Of potentially more consequence is the impact considering as a factor the question of whether the service would exist without the app.  This can be seen by contrasting the position of Airbnb with Uber.  If we look at control, Uber is caught because of its control over key aspects such as access to passengers, and price (detailed in paras 43-51); on these considerations Airbnb which does not set price might not be caught. However, if the test is that ‘the activity exists solely because of the platform’ (para 56), for Airbnb as for Uber, the answer might well be ‘yes’.  Of course, Uber and Airbnb are different in that transport does not fall within the Services Directive but rather is dealt with by specific provisions within the TFEU.  Nonetheless, the recitals to the Services Directive specify that:

it does not apply to requirements, such as road traffic rules, rules concerning the development or use of land, town and country planning, building standards (Rec 9),

some of which may affect the running of hotels or B&Bs. Further, the directive does not apply to taxation (Article 2(3)), so for example, taxes on short term lets may be unaffected by the Services Directive (though dealt with under the TFEU).

A further point that is worthy of note is the consequence of seeing Uber and the drivers as providing separate services.  The requirement to have a licence to provide a connection service in the context of transportation would fall within the scope of the eCommerce Directive and would be caught be the prohibition on authorisations set out in Article 2(h)(i); the Advocate General was of the opinion that is was unlikely that any restriction on the electronic aspect of the service could be justified by considerations of public interest.  The prohibition does not, however, extend to the regulation of transport services - they are not provided by electronic means.  So the regulation of taxi services remains possible and, as noted, Uber remains responsible for the drivers’ activities (para 86).  Arguing Uber’s activity as whole should benefit from the liberalising principles in the eCommerce Directive would run the risk of undercutting any form of regulation ‘because all traders are currently in a position to offer services by electronic means….’ (para 87).  Could a similar argument be put forward in other sectors of the sharing economy?  In principle, yes, but presumably only where the platform has exerted Uber-like control over the actual provision of the services.

Even when the Grand Chamber Court of Justice has handed down its ruling, this will not be the end of the Uber saga.  Currently pending before the Court is a reference from France concerning the imposition of penalties on Uber for running an unlicensed taxi service: Case C-320/16 Criminal Proceedings against Uber France, which raises the question of whether France should have notified its rules as a technical regulation under Directive 98/34.

Barnard & Peers: chapter 14

Photo credit: boing boing

When is Facebook liable for illegal content under the E-commerce Directive? CG v. Facebook in the Northern Ireland courts

Lorna Woods, Professor of Internet Law, University of Essex

Introduction

The ubiquity of social media platforms and their significance in disseminating information (true or false) to potentially wide groups of people was highly unlikely to have been in the minds of the European legislators when they agreed, in 2000, the e-Commerce Directive (Directive 2000/31/EC) (ECD). Facebook itself was launched only in 2004. Despite the changing times and technological capabilities, the Commission has decided not to revise the ECD, specifically its safe harbour provisions for intermediaries, in its current single digital market programme.  Although the ECD seems set to remain unchanged, the application of the safe harbour provisions raises many difficult questions which have not yet been fully answered at EU level by the Court of Justice. CG v. Facebook ([2016] NICA 54), a decision of the Northern Irish Court of Appeal, illustrates some of these difficulties and certainly raises questions about the proper interpretation of the ECD and its relationship with the Data Protection Directive.

Intermediary Immunity - Legal Framework

The ECD provides immunity from liability for certain ‘information society service providers’ (ISS providers) on certain conditions.  To gain immunity, the ISS provider must

-          be an ISS provider within the terms of the ECD; and

-          one of the following applies:

-          the provider is a ‘mere conduit’ (Art. 12 ECD);

-          provides caching services (Art. 13 ECD); or

-          provides hosting services (Art. 14 ECD).

Each one of these three categories provides for a different level of immunity, which seems connected with the level of knowledge the ISS provider is assumed to have of the problematic content. Here Article 14, which deals with hosting, is the relevant provision. It provides:

1. Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:

(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or

(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.

2. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.

3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.

The recitals to the ECD give more detail as to the scope of services protected by Article 14 and there is a certain amount of case law on this point, notably Google Adwords (Case C-236/08) and the Grand Chamber decision in L’Oreal v. eBay (Case C-324/09). Recital 42 has been pointed to by the Court in these cases as relevant for understanding the sorts of activities protected by the immunity. Recital 42 refers to services of a

mere technical, automatic and passive nature, which implies that the information society service provider has neither knowledge of nor control over the information which is transmitted or stored.

The ECJ in Google Adwords referred to this as being ‘neutral’ (para 113-4). The Grand Chamber in its subsequent L’Oreal decision suggested that advice in optimising presentation would mean a provider was no longer neutral (para 114).

The provision protects relevant ISS providers from liability in relation to illegal content, provided they have no knowledge (actual or constructive) of the illegal activity or information, and that if they have such knowledge, they have acted expeditiously to remove it. In L'Oreal v eBay the Court of Justice provided a standard or test by which one can measure whether or not a website operator could be said to have acquired an 'awareness' of an illegal activity of illegal information in connection with its services, that is whether "a diligent economic operator would have identified the illegality and acted expeditiously".   The CJEU also held that an awareness of illegal activities or information may become apparent as the result of an investigation by the operator itself or where the operator receives notification of such activity.  Article 14 does not protect ISS providers from injunctions, or the costs associated with any such injunctions (see Recital 45).

Additionally, Article 15 specifies that, for those falling within Articles 12-14, Member States cannot impose a ‘general obligation’ to monitor content to determine whether content is illegal. There has been a considerable amount of dispute as to the relationship between this provision and the scope of immunity, especially given the requirements in L’Oreal.  Recital 40 notes that ‘service providers have a duty to act, under certain circumstances, with a view to preventing or stopping illegal activities’ and that the immunity provisions ‘should not preclude the development and effective operation, by the different interested parties, of technical systems of protection and identification and of technical surveillance instruments made possible by digital technology’. The Recitals also state:

(47) Member States are prevented from imposing a monitoring obligation on service providers only with respect to obligations of a general nature; this does not concern monitoring obligations in a specific case and, in particular, does not affect orders by national authorities in accordance with national legislation.

(48) This Directive does not affect the possibility for Member States of requiring service providers, who host information provided by recipients of their service, to apply duties of care, which can reasonably be expected from them and which are specified by national law, in order to detect and prevent certain types of illegal activities.

The distinction between general monitoring and specific monitoring has yet to be fully elaborated, and is an issued much discussed in the context of intellectual property enforcement, especially as regards keeping pirated copies of materials down after taking it down in the first place.

Facts of CG

McCloskey opened a Facebook page in August 2012 entitled ‘Keeping Our Kids Safe from Predators’ in which he published details of individuals who had criminal convictions relating to sexual offences involving children.  This page was not subject to any privacy settings.  One individual who was so named brought action against Facebook and an interim injunction was issued requiring Facebook to remove the page and related comments, on the basis that the comments responding to the posting were threatening, intimidatory, inflammatory, provocative, reckless and irresponsible. This was the XY litigation. Immediately after the page was removed, McCloskey set up a new page, Predators 2. CG was identified on this page on 22 April 2013; his photograph was published and there were discussions about where he lived. Comments included abusive language, violent language – including support for those who would commit violence against CG and for the exclusion of CG from the community in which he lived.  The disclosure of CG’s residence was contrary to the position taken by the Public Protection Arrangements in Northern Ireland (PPANI), which took the view that such disclosure interferes with the rehabilitation process.

On 26th April 2013, CG’s solicitors wrote to Facebook and its solicitors in Northern Ireland, claiming the material was defamatory and that CG’s life was at risk. A hardcopy of Predators 2 page was enclosed. Facebook’s response was that CG should use the online reporting tool, but CG expressed a desire not to have to engage with Facebook. By 22 May 2013 Facebook removed all postings on Predators 2, but on 28 May, CG issued proceedings. Subsequently, CG’s solicitors wrote to Facebook complaining that the photograph had been shared 1622 times and that other Facebook users had included comments threatening violence. They identified the main URL, but not all such instances which Facebook then requested. This information was provided on 3rd and 4th December and removed on 4th or 5th December. A further reposting of the photographed by RS occurred on 23 December, stating that this was what a “pedo” looked like. A letter of claim was send to Facebook on 8th January 2014, identifying the relevant URLs and the page was taken down on 22 January 2014.  While CG accepted that the defamation claim was without merit, it was accepted that he was extremely concerned about potential violence as well as the effect on his family.

Judgment at First Instance

The trial judge had to deal with claims against McCloskey, as well as claims against Facebook.  The trial judge, having reviewed the evidence, concluded that McCloskey’s conduct constituted harassment of CG. The case against Facebook was based on the tort of misuse of private information. To find that there had been such misuse, there had to be a reasonable expectation of privacy in relation to the relevant information  which should take into account all the circumstances (relying on JR38 [2015] UKSC 42 and Murray v. Express Newspapers [2008] EWCA Civ 446). The judge also accepted the submission that the Data Protection Act, and specifically the category of ‘sensitive data’, provided a useful touchstone as to what information could be seen as private (see Green Corns Ltd v. Claverly Group Limited [2005] EWHC 958). The judge concluded that the use of a photograph or name in conjunction with information which could identify where CG lived and any information about his family members were private information. The judge considered that Facebook was put on notice of the problematic nature of the material by the XY litigation (which mentioned the Predator 2 page) and that simple searches would reveal the page, as it had an almost identical name with identical purposes. The trial judge concluded that it was apparent on the face of the posts that consideration of the lawfulness of the posts was needed. As regards the Electronic Commerce (EC Directive) Regulations 2002, which implement the ECD in the UK, the judge rejected the contention that there was an obligation to give Facebook notice in a particular form. So, neither the ECD nor the 2002 Regulations protected Facebook from the claim of misuse of private information.

A further claim under the Data Protection Act was added late in the day. The judge concluded that –in the absence of relevant discovery - CG had not established this proposition. Facebook appealed. CG also appealed as regards the data protection point, but did not pursue this point.

Court of Appeal Judgment

The Court noted that there was agreement that McCloskey’s behaviour was unreasonable conduct sufficient to give rise to criminal liability (R v Curtis [2010] EWCA 123), and that the 2002 Regulations do not cover injunctions. The Court agreed that this was an appropriate case in which to make an order taking to down the material to protect CG from continued intimidation [para 40]. The Court noted that the tort of misuse of private information and harassment, while complementary, are not the same and that a finding of harassment did not automatically mean that there had been a misuse of private information.

As regards the tort, the Court noted that there was no dispute between the parties that this case was about an intrusion, but that the tort would come into play only if there was a reasonable expectation of privacy in the information, which is a fact sensitive determination.  The Court of Appeal noted the public interest in knowing about criminal convictions; it also disagreed with the trial court judge about the reading across of the categories of sensitive information in the DPA. It held:

The fact that the information is regulated for that purpose does not necessarily make it private’ [para 45].

Reviewing the material, the Court held that the context of harassment was determinative to the finding that CG has a reasonable expectation of privacy in the material [para 49]. By contrast, RS was protected by principles of open justice which allow citizens ‘to communicate the decisions of the criminal justice systems to others’ and therefore CG did not have a reasonable expectation of privacy in relation to that posting [para 51].

The Court then considered whether Facebook could rely on the safe harbour provisions of the ECD and the 2002 Regulations. It held that the 2002 Regulations need to be understood in the light of Art 15 ECD even though it is not formally implemented in the UK. According to the Court, Article 15 ‘clearly’ applied to Facebook [para 52]. While not expressly stated, the Court’s approach is based on the assumption that Article 14 (safe harbour provisions for those providing hosting services) and Regulation 19 of the 2002 Regulations, which implement it, also apply.

The Court then considered the issue of notice. Facebook argued that CG had not given proper notice, on the basis that CG had not used Facebook’s online submission process. The Court of Appeal agreed with the trial court’s dismissal of this argument, stating, ‘[a]ctual knowledge is sufficient however acquired’ [para 58]. Facebook challenged the approach taken at first instance, that Facebook had the resources to find the material and assess it [High Court, para 61].  It was also argued that the way the High Court approached the question of constructive knowledge also implied a monitoring obligation. The trial judge referred to the XY litigation; that litigation plus the letters of CG’s solicitors; and the litigation together with some elementary investigation of the profile. The Court of Appeal agreed with these concerns.  It stated the question as being:

Whether Facebook had actual knowledge of the misuse of private information … or knowledge of facts and circumstances which made it apparent that the publication of the information was private

before commenting that

[t]he task would, of course, have been different if there had been a viable claim in harassment made against Facebook [para 62].

It did not elaborate the basis or extent of the difference.

The Court concluded that the XY litigation did not fix Facebook with sufficient notice; that it only could do so if Facebook was subject to a monitoring obligation. In any event, knowledge of a propensity to harass did not fix Facebook with notice about the private information. As regards the correspondence, the Court held that this too was insufficient to fix Facebook with notice. While it referred to the problematic content, it did not refer to misuse of privacy. ‘The correspondence did not, therefore, provide actual notice of the basis of claim which is now advanced’ [para 64]. The Court also considered that there was nothing in the letters to indicate that the information was private. So, while ‘the omission of the correct form of legal characterisation of the claim ought not to be determinative of the knowledge and facts and circumstances which fix social networking sites such as Facebook with liability’, it is necessary to identify ‘a substantive complaint in respect of which the relevant unlawful activity is apparent’. 

Here, since there was no indication in the letter of claim that the address was the issue, the Court did not ‘consider that the correspondence raised any question of privacy in respect of the material published’. [para 69] By contrast, in the letter of 26th November, CG referred to the general identification of where CG was living and the threat from paramilitaries. This was sufficient to establish knowledge of facts and circumstances in relation to that particular post. Referring to the Court of Justice in L’Oreal, the Court noted that Facebook is obliged to act as a diligent economic operator. This point was not argued; Facebook was found to be liable in respect of that post for the period 26th November-4/5 December.

The burden of proof is in the first instance on the claimant to show knowledge; thereafter the ISS must prove it did not.

As regards the DPA, it was agreed that Predators contained personal data and sensitive personal data, the issue was whether Facebook Ireland could be seen as subject to the UK DPA.  The ECJ rulings in Google Spain (Case C-131/12) and Weltimmo (Case C-230/14) were argued before the Court. The Court did not accept the submission that Google Spain was limited to its particular facts and the concern that the protection offered by the Data Protection Directive would be undermined if it excluded out of EU data controllers. The Court here noted that Weltimmo in fact built on the approach in GoogleSpain. It concluded that Facebook is a data controller established in the UK for the purposes of the DPA.  Although the Court accepted that the ECD does not cover data protection, and this is reflected in Regulation 3 of the 2002 Regulations, the Court held at para 95:

The starting point has to be the matter covered by the e-Commerce Directive which is the exemption for information society services from the liability to pay damages in certain circumstances …We do not consider that this is a question relating to information society services covered by the earlier Data Protection Directive and accordingly do not accept that the scope of the exemption from damages is affected by those Directives.’

Comment

This case is one of a number coming through the Northern Irish court system regarding different types of problematic content and the responsibility of social media platforms to take action against such content.  Shortly before this case was handed down, the High Court handed down its decision in J20 v Facebook Ireland Ltd ([2016] NIQB 98). Other cases are working their way through the system: AY v Facebook (Ireland) Ltd ([2016] NIQB 76), concerning naked images of a school girl on a ‘shame page’; MM v BC, RS and Facebook ([2016] NIQB 60), concerning revenge porn; and Galloway v Frazer and Google t/a YouTube ([2016] NIQB 7) concerning defamatory and harassing videos.  While this case is based in the particular cultural and legal context of Northern Ireland, and raises questions on the meaning of private information, it also leads of questions about the interpretation of EU laws, notably the ECD and DPD.

The first point to note is that the Court does not directly address the question of the applicability of Articles 14 and 15 ECD, beyond stating the Article 15 clearly applies. Article 15 is dependent on the ISS provider providing services that fall within one of Article 12, 13 or 14 ECD, with Article 14 being relevant here. So the question is whether Article 14 ECD (and consequently Regulation 19 of the 2002 Regulations) applies here. While the text of Article 14 ECD refers to ‘the storage of information provided by a recipient of the service’, the case law makes it clear that not any storage will do. Rather, the service provider must be neutral as regards the content, technical and passive.  In this regard, services Facebook provide regarding information of interest to Facebook users (News Feed algorithm and content recommendation algorithm, as well as Ad Match services), may mean that the question of neutrality and passivity here is at least worthy of investigation, in that Facebook may promote certain content (in the term of L’Oreal, para 114). Of course in Netlog (Case C-360/10), the Court of Justice held that a social media platform could benefit from Article 14, but this does not mean that all will – much will depend on the facts (see eg Commission 2012 Working Paper on trust in the digital single market (SEC(2011) 1641 final, accompanying COM(2011) 942 final).

Assuming Article 14 (and its UK equivalent, Regulation 19) applies, the next question is whether Facebook was on notice.  The ECD is silent on the nature of any formalities, leaving it to Member States and industry (via self-regulation per Recital 40) to fill in the detail.  In its 2012 Working Paper, the Commission acknowledged that there were diverging views as to what notice required, ranging from those who argued that nothing less than a court order should be accepted (seemingly thereby focussing on just actual knowledge) through to those who suggested that general awareness of the use of the site for illegal content was sufficient (which covers constructive knowledge) (p. 33-34). It seems there are three main issues here:

- Whether notice has to be given in any particular format;

- Whether notice has to identify the illegality or whether identifying the problematic content will do; and

- The relationship between constructive notice and Article 15, also bearing in mind the obligations of the diligent economic operator.

Facebook argued of course that a person complaining about content should use the tools provided by Facebook and provide rather precise information.  The Court, rightly, held that to require a particular format to be used but run counter to the aim (particularly with reference to the 2002 Regulations) of facilitating the ability of users to make complaints. It is less clear the position of the Court with regard to the need to provide URLs. The need to provide specific URLs makes it difficult for claimants especially those who seek orders for content to be taken down and to stay down (seen particularly in the field of intellectual property enforcement, for example even in L’Oreal). In this case, where the Court found Facebook liable CG had provided specific URLs, but the Court is silent on whether the lack of specific URLs was a determinative factor in the other instances.  It is submitted that, provided sufficient identifying information about the content is provided, precise URLs should not be required especially for a diligent economic operator (discussed below).

The Court focussed on the question of whether CG sufficiently identified the reason why the content is illegal. In this, the Court observes that the omission of the correct legal characterisation is not determinative; to have held to the contrary would undermine the ability of claimants without lawyers to have material taken down. The Court moves on to suggest that the relevant unlawful activity has to be apparent. It does not consider to whom such unlawfulness must be apparent, or indeed the prior question of whether the ECD requires just notification of content or activity perceived as illegal by the complainant, rather than a justification of why the complainant thinks that. While on the facts of this case there are concerns that CG referred to causes of action that were clearly wrong (e.g, defamation), it is arguable that the Court’s position needs further refinement. Certainly the Court’s approach on this aspect seems generous to Facebook in terms of what it needs to be told.

In this regard a number of comments can be made.  While, an operator would need to make an assessment about the legitimacy of a take down request, that is a separate issue from the fact of being notified that someone thinks some content is problematic. Further, there may a world of difference between what a man on the street might so recognise and that which the diligent economic operator should recognise and the detail required for that. Indeed, in L’Oreal, the ECJ held:

although  such  a  notification  admittedly  cannot  automatically  preclude  the  exemption  from  liability  provided  for  in  Article  14  of  Directive  2000/31,  given  that  notifications  of  allegedly  illegal  activities  or  information  may  turn out to be insufficiently precise or inadequately substantiated, the fact remains that such notification  represents,  as  a  general  rule,  a  factor  of  which  the  national  court  must  take  account  when  determining,  in  the  light  of  the  information  so  transmitted  to  the  operator,  whether  the  latter  was  actually  aware  of  facts  or  circumstances  on  the  basis  of  which  a  diligent economic operator should have identified the illegality (para 121-2).

This suggests that a diligent economic operator may not just rely on what a complainant said, but may have to take steps to fill in the blanks.  As the Commission reported in 2012, it has been suggested by some that the degree to which it is obvious that the activity or information is illegal should play a role in this assessment.  Some content is more obviously problematic than others. This position is not incompatible with the approach of the Court here: the problem for CG is that an address is not usually that problematic in privacy terms, it was the context (not apparent on the face of it) that made it so [para 69].  This distinction may have relevance for the AY litigation, if not the revenge porn case – depending on the nature of the images.

The final point of concern relates to general monitoring. The rejection by the Court of the possibility becoming aware of a particular type of content (as from the XY litigation) and being on notice as a consequence deserves further examination. This depends on what is meant by ‘general monitoring’ as opposed to a ‘specific’ monitoring obligation, accepted by recital 47 ECD, and recognised by the Commission in its 2012 Working Paper (p. 26).  It is unfortunate that the Court did not give this more attention. While case law has made clear that filtering of all content, for example, constitutes general monitoring (SABAM v Scarlet (Case C-70/10)), it has been argued- principally in the context of IP enforcement -that searching for a particular instance of content (re-occurring) is not.  Such a broad view of general monitoring as the Court here adopted also seems to decrease the space in which the diligent economic operator acts, raising questions about the meaning of L’Oreal.  Note also that the Commission in its recent review noted ‘there are important areas such as incitement to terrorism, child sexual abuse and hate speech on which all types of online platforms must be encouraged to take more effective voluntary action to curtail exposure to illegal or harmful content’ (COM/2016/0288 final).  This suggests that the Commission may expect such platforms to be proactive and not merely reactive. 

Perhaps the most significant point, and one on which a reference should perhaps have been made, is the relationship between the ECD and DPD, a point yet not dealt with in English law (see Mosley v Google [2015] EWHC 59 (QB)).  The Court accepted fairly readily that Facebook (Ireland) falls under the UK DPA, but then insists that despite the fact that data protection is excluded from the field of application of the ECD, that Facebook pages and comments fell within the “matter covered by the e-Commerce Directive” which provide a “tailored solution for the liability of [ISS providers] in the particular circumstances” set out in the ECD. It did not explain why, beyond asserting that the ECD safe harbour provisions do ‘not interfere with any of the principles in relation to the processing of personal data, the protection individuals ... or the free movement of data’ [para 95]. In this assessment, the Court overlooked the fact that under the DPD a remedy must be provided to individuals, so as to make effective their rights and, that the protection awarded to data subjects should not vary depending on the mechanism used for that processing.  Furthermore, Recital 14 to the ECD elaborates that

The protection of individuals with regard to the processing of personal data is solely governed by Directive 95/46/EC …..the implementation and application of this Directive should be made in full compliance with the principles relating to the protection of personal data.

Whilst a Member State was free to provide more far-reaching to protection to intermediaries, this freedom reaches its limit when it conflicts with another harmonised area of EU law, such as data protection. The Court’s position on this point, and especially its reasoning, in the light of the terms of both directives, is not convincing.

In sum, the outcome – liability for Facebook on one aspect of the content posted – sounds on the face of it a narrowing of immunity.  The reality points in a different direction. While there are a number of problematic issues with which the court had to deal, the impact of this judgment lies in the statements of general principle which the Court made. Significantly, these fell into areas ultimately governed by EU law, rather than purely domestic matters.  It is far from certain that those issues are clearly determined at EU level, nor that the Court’s assessment here is free from doubt.

Photo credit: 

Civil liability for Internet publishing: the CJEU clarifies the law

Professor Lorna Woods, co-author of Steiner & Woods, EU Law

Introduction

Yesterday’s CJEU judgment in Papasavvas is the most recent in a line of cases seeking to trace the edges of the concept of ‘intermediary’ for the purposes of EU information technology law, a question that has become rather more problematic than when the eCommerce Directive was first drafted in 2000. Then, the role of intermediaries was much more technical and related to transmission and technical access. Since then the market has moved on with the development of many services that are now viewed as important for the access and use of content on the Internet. Many of these services blur the boundaries between transmission services and content services. To what extent are those services neutral intermediaries? While in many respects this case could be seen as quite straightforward, it hints at still yet unresolved questions and highlights difficulties about reliance on EU law in national courts.

Facts

Mr Papasavvas (‘P’) brought an action for defamation in respect of articles published in the daily national newspaper O Fileleftheros, on 7 November 2010, which were published online on two websites. He sought damages and an injunction. The national court referred the following questions:

(1)      Bearing in mind that the laws of the Member States on defamation affect the capacity to provide information services by electronic means both at national level and within the European Union, might those laws be regarded as restrictions on the provision of information services for the purposes of applying Directive 2000/31 …?

(2)      If the answer to Question 1 is in the affirmative, do the provisions of Articles 12, 13 and 14 of Directive 2000/31 …, on the question of liability, apply to private civil matters, such as civil liability for defamation, or are they limited to civil liability in matters concerning business to consumer transactions?

(3)      Bearing in mind the purpose of Articles 12, 13 and 14 of Directive 2000/31 … relating to the liability of information society service providers and the fact that, in many Member States, an action must exist in order for a prohibitory injunction to be granted which will remain in force pending full completion of the proceedings, do those articles create individual rights which may be pleaded as defences in law in a civil action for defamation, or must they operate as an obstacle in law to the bringing of such actions?

(4)      Do the definitions of “information society service” and “service provider” in Article 2 of Directive 2000/31 … and Article 1(2) of Directive 98/34 … cover online information services the remuneration for which is provided not directly by the recipient, but indirectly by means of commercial advertisements posted on the website?

(5)      Bearing in mind the definition of “information service provider”, laid down in Article 2 of Directive 2000/31/EC and Article 1(2) of Directive 98/34 … could the following, or any of them, be regarded as a “mere conduit” or “caching” or “hosting” for the purposes of Articles 12, 13 and 14 of Directive 2000/31:

(a)      a newspaper that operates a free website on which the online version of the printed newspaper, with all its articles and advertisements, is posted in pdf format or another similar electronic format;

(b)      an online newspaper which is freely accessible but the provider obtains money from commercial advertisements posted on the website, where the information contained in the online newspaper comes from the newspaper’s staff and/or freelance journalists;

(c)      a website which provides (a) or (b) above for a subscription?’

Judgment

The Court dealt first with queries raised regarding admissibility.  P raised questions about timing: the proceedings at national level are at an early stage, to the point that the defendants in the national action have not yet filed a defence.  On this basis, P argued that the questions referred must be hypothetical as the nature of the dispute had not yet been defined. The Court did not address this argument directly but instead stated that ‘the description of the legal and factual framework of the proceedings in the order for reference seems to suffice so as to permit the Court to make a ruling’. 

P had also argued that the defendants did not fall within the scope of the e-Commerce directive and therefore questions relating to its interpretation were unnecessary. This is of course a little circular and the Court rejected the argument, pointing out that the scope of the Directive and the applicability to the defendants was one of the main issues that needed to be resolved. Having determined that, the Court re-ordered the questions referred and started with question 4 on the application of the Directive.

The Court reformulated the question, asking whether ‘information society services’ (ISS) as defined in the directive ‘covers the provision of online information services for which the service provider is remunerated not by the recipient, but by income generated by advertisements posted on a website (para 26).’ The Court re-iterated that the definition of ISS has four elements:

·         ‘normally provided for remuneration’;

·         at a distance;

·         by electronic means; and

·         at the individual request of a recipient of services.

The final three seemed non-contentious, but what concerned the national court was the issue of remuneration, as the user did not pay to access the website.  The Court then referred to recital 18 of the Directive, which expressly excludes the possibility that a service will fall outside the directive merely because payment is indirect.  In this there is a similarity to the CJEU’s reasoning in Bond van Adverteerders and Others (paragraph 16).

Having determined that the directive could apply to information services such as those in issue here, the Court then considered question 1 in which the referring court is effectively asking whether the directive precludes the application of rules of civil liability for defamation to ISS providers.  The directive applies the principle of home country rule to service providers, with the corollary that Member States should not impose additional rules on services coming from other Member States.  Given that the defendants in the domestic proceedings were based in the same Member State as P, the issue of whether the civil defamation rules constituted a restriction did not apply, though the Court noted that such rules fall within the scope of the directive (at Article 2(h)).

The Court then went on to consider whether the defendants could benefit from the intermediary immunity provisions in Articles 12-14 of the Directive. The Court considered the role of these provisions, and relying on its reasoning in Google France and Google  (paragraph 113) and L’Oréal and Others (paragraph 113) stated that they applied to intermediaries and activities which are of ‘a merely technical, automatic and passive nature’, that the ISS provider has neither knowledge of nor control over the information which is transmitted or stored and takes a neutral approach to content. The Court highlighted factors such as assisting clients in drafting commercial messages, or in optimising presentation of content.  It concluded:

Consequently, since a newspaper publishing company which posts an online version of a newspaper on its website has, in principle, knowledge about the information which it posts and exercises control over that information, it cannot be considered to be an ‘intermediary service provider’ within the meaning of Articles 12 to 14 of Directive 2000/31, whether or not access to that website is free of charge. [45]

So, in such a circumstance, a newspaper cannot claim exemption from civil liability.  Given this answer, it was not apparent that the Court needed to address question (2). Nonetheless, it confirmed that it made no difference whether the case involved business to consumer or consumer to consumer cases. [50]

The final issues dealt with were those raised by question (3), though again the Court noted that answers to this question might not be necessary given that Articles 12-14 did not apply.  The Court summarised this question as asking whether Articles 12-14 preclude the adoption of interim measures (such as the injunction prohibiting publication) or whether those articles create individual rights which the ISS provider may plead as defences in law in the context of legal proceedings such as those in the main proceedings. As regards the first element, the Court noted that – subject to the principles of equivalence and effectiveness, matters as to conditions under which remedies might be available were matters for national law. [53]

The second element effectively concerns the direct effect of the immunity provisions: can they be relied on in the context of a dispute between private parties. The Court returned to the general case law on horizontal direct effect of directives, arguing that ‘with regard to proceedings between individuals, such as those at issue in the main proceedings, the Court has consistently held that a directive cannot of itself impose obligations on an individual and cannot therefore be relied on as such against an individual’ [54] but that indirect effect/doctrine of consistent interpretation from Von Colson would apply. [56]

Comment

While this case at the headline level came to the right answer - people who write or (first) publish content on the Internet are not intermediaries - the case raises a couple of issues worth pondering further.

First off, there was no Advocate-General’s opinion.  Querying this might seem churlish, given that I’ve just said the Court got to the right answer, and on the facts the judgment is a straightforward application of the Court’s existing law on Articles 12-14 in Google and L’Oreal.  It is, however, a sensitive area: currently a case, Delphi, concerning a news site and the self-same provisions is awaiting a judgment from the Grand Chamber of the European Court of Human Rights on whether there was a breach of freedom of expression in finding the journalists liable for defamation (see the Chamber judgment here).  While there is a crucial factual difference between the two cases (Delphi concerns liability for user generated content, not journalism), it is noteworthy that although Recital 9 recognises the significance of ISS for freedom of expression, Papsavvas did not even consider whether there was a freedom of expression argument in issue.

To some extent most of the questions referred by the national court seem to reflect a lack of familiarity with the internal market system generally. So, the application of the rules in this case might seem straightforward, but they might not always be so.  While it should come as no surprise that national rules imposing civil liability on a service ‘import’ could be a restriction, nor that ‘home’ regulation should not be circumvented by reliance on provisions aimed at cross-border services, the determination of the place of establishment may in itself be problematic, as cases on cross-border television services have shown.  The eCommerce Directive seems to refer to the Court’s general case law on this point (Article 2(c), Recital 19): the Court accept the establishment point as proven here in Papasavvas. 

There is a risk of forum shopping and, by contrast to the Audiovisual Media Services Directive (which deals with television), the eCommerce Directive has no ‘anti-abuse’ clause, although Member States may derogate on limited grounds (article 3(4), Recital 24). In this case, the Court did not address the question of whether rules relating to defamation could be seen as being justified under the protection of human dignity in Article 3(4)(a)(i).  Of course, a system which allows or even encourages delocalisation to another Member State has the consequence of adversely affecting would be plaintiffs under the national rules, especially private persons and small businesses. Even in rules of conflicts allow action in the injured party’s home state, there may be questions as to applicable law in the light of the home country regulatory principle (see eDate and Martinez). So, while the eCommerce Directive claimed not to affect rules on conflicts of law (Article 1(4)), there is an interrelationship there and one which may affect the effectiveness of remedies for users. 

Similarly, and as the Court itself noted, remuneration has typically been widely interpreted.  The Court referred to Bond van Adverteerders, a case concerning free-to-air commercial television – a set-up which has clear parallels with free to user internet services.  In its case law on Article 56 TFEU (freedom to provide services), the Court has gone further, even suggesting (in Deliege) that an amateur judoka was remunerated because she took part in competitions which carried advertising and which were televised.  Essentially the Court seemed to be saying, ‘there’s money there somewhere….’. Of course, there will be hard questions in some cases- ‘amateur’ content available freely: is that an ISS, and does the answer to the question change if the platform carries advertising entirely separately? In Delphi, it was the user generated content that was problematic. This question did not arise, however, as it was the underlying website that was sued, and it clearly was a commercial entity for the same reason that the newspaper in Papasavvas was.

Perhaps the interesting questions are those which deal with the interface between the immunity provisions and national law.  The purpose of these provisions is to encourage the development of the digital environment, particularly cross border services (recital 40). It should therefore make no difference if the service the intermediary carries is between businesses, or business to consumer, as indeed the Court ruled. The national court also questioned whether injunctions were permissible. The Court handed this one off to national procedural autonomy, but it is arguable that the terms of the directive suggest that injunctions are in principle permissible: each of the intermediary exceptions state that the exemption from liability does not affect the possibility of the Member State’s legal system requiring the intermediary to terminate the offending activity.

Finally, we come to the question of whether intermediaries can rely on the exemption directly before national courts: in effect, do these provisions have horizontal direct effect? The Court dealt with this by returning to basic principles precluding such an effect, but in doing so it argued that Union law precludes the imposition of an obligation on an individual. Of course, in this case the directive is not imposing an obligation on an individual but rather removing it. In this sense, although for different reasons, the position is closer to that in cases such as CIA Security International or even Wells, where a national obligation is disapplied. This area of law is problematic generally. Suffice it to note here that this approach knocks a potentially large hole in the protection of intermediaries if the Member State has not implemented, or not implemented correctly, indirect effect notwithstanding.

Barnard & Peers: chapter 6, chapter 14