Data Retention is still here to stay, for now…

Matthew White, Ph.D candidate, Sheffield Hallam University.

Introduction

On 30 January 2018, human rights NGO Liberty tweeted that the:

Court of Appeal has ruled the Government IS breaking the law by collecting the nation's internet activity and phone records and letting public bodies grant themselves access with no suspicion of serious crime and no independent sign-off.

This was in reference to the Court of Appeal’s (CoA) judgment in Tom Watson and Others v Secretary of State for the Home Department [2018] EWCA Civ 70 with regards to access to communications data under the Data Retention and Investigatory Power Act 2014 (DRIPA 2014). Many regard this as a ruling the Snoopers Charter or mass surveillance as unlawful. This post critically analyses the CoA’s judgment with regards to general data retention, access to communications data on the basis of prior review by a court or an independent administrative body and notifications.

Background

The background to this case dates from 2014 in which the Court of Justice of the European Union (CJEU) in Joined Cases C‑293/12 and C‑594/12, Digital Rights Ireland (analysis here) invalidated Directive 2006/24/EC (the Data Retention Directive (DRD)) for its incompatibility with Articles 7 (privacy) and 8 (data protection) of the Charter of Fundamental Rights (CFR). This led to the introduction of DRIPA 2014, and subsequent challenges in the High Court (HC) and CoA on its compatibility with Digital Rights Ireland, which ultimately led to a preliminary reference (joined by a reference in Tele2 from a Swedish Court) to the CJEU for clarification (analysis here). In Joined Cases C-203/15 and C-698/15, Tele2 and Watson the CJEU ruled that Articles 7, 8, 11 (freedom of expression) and 52(1) (limitations of rights) preclude Member States from adopting laws which permit the general and indiscriminate retention ‘of all traffic and location data of all subscribers and registered users relating to all means of electronic communication’ [134(1)]. The CJEU also ruled that the access to retained communications data should be subject to prior review by a court or an independent administrative body and only on the basis of fighting serious crime [134(2)].

Court of Appeal’s judgment

In the leading judgment, Lord Lloyd-Jones summarises the background to this case [1-3] (also see above), and quickly distinguishes between the Swedish reference and its own in highlighting that the CJEU’s answers in paragraph 134(2) and (3) reflect their reference. His Lordship does so by highlighting the difference between UK and Swedish legislation [4]. His Lordship also highlighted several developments since Tele2 and Watson, namely that DRIPA 2014 had been repealed and replaced by the Investigatory Powers Act 2016 (IPA 2016), which is also subject to challenge, with Privacy International seeking to clarify the extent in which the CJEU’s ruling applies in the national security context (analysis here) and the UK Government seeking to amend the IPA 2016 to conform with the CJEU’s ruling with regards to serious crime and prior review for access by a court/independent administrative body [6].

The question before the CoA was again DRIPA 2014’s compatibility with the CJEU’s rulings on data retention [7]. Both parties and the CoA agreed that the CJEU’s jurisprudence establishes access to retained communications data is restricted to the objective of fighting serious crime and that access should be subject to prior review by a court/independent administrative body [9]. The CoA declined to grant any declaratory relief with regards the CJEU’s rulings in the national security context as this was already subject to a preliminary reference by the Investigatory Powers Tribunal (IPT) [10-12]. The CoA, did however, grant declaratory relief with regards to DRIPA 2014 for being inconsistent with European Union (EU) law with regards to serious crime and access to communications data [13].

With regards to data being retained within the EU, the CoA declined to make a definitive statement on the hope that the CJEU will clarify the matter with regards to the IPT’s reference [14-19]. Watson et al urged the CoA to declare that DRIPA 2014 had failed to make provisions for ex post facto notifications [20]. The CoA, however, declined for three reasons: a) it was not previously an issue in the national proceedings; b) it was not in the CJEU’s ratio in Tele2 and Watson; and c) the CJEU will in any event consider this based on the IPT’s reference.

On the issue of the relationship between data to be retained, and the threat to public security, Lord Lloyd-Jones initially intended to grant declaratory relief on the grounds that DRIPA 2014 did not contain any limitations to comply with the CJEU’s ruling, but declined to do so [22-24]. Lord Lloyd-Jones recalled three reasons as to why this was justified:

First, it was not argued that DRIPA 2014 was unlawful because it did not require there to be an identifiable public whose data was likely to reveal direct or indirect links to serious crimes. The CJEU’s ruling on general data retention was in response to the Swedish legislation. The High Court in Davis and Others v Secretary of State for the Home Department and Others [2015] EWHC 2092 felt that the CJEU (in Digital Rights Ireland) could not have meant general data retention was unlawful, only that adequate safeguards had to be in place for access.

Second, the CJEU’s reasoning on general data retention reflects Swedish law’s catch all (all services, data and users) data retention, and the analysis and conclusions cannot be automatically applied to DRIPA 2014. Third, this is a live issue which is pending for a February hearing.

Thus, the CoA unanimously held that DRIPA 2014 was inconsistent with EU law for not limiting data retention for the purposes of fighting serious crime and access to said data was not subject to prior review by an independent administrative body [27].  

Was the Swedish Court’s question on blanket indiscriminate data retention not applicable in the UK context?

This post has highlighted how throughout this judgment, the CoA consistently held that the prohibition of general data retention does not automatically apply to DRIPA 2014, because the answer from the CJEU was in response to a reference from a Swedish court asking about Swedish legislation. This premise acts on the assumption that DRIPA 2014 could not permit general data retention. This requires closer scrutiny. It must first be noted, that when the CJEU made its ruling, it highlighted its ruling applied to national legislation, thus, contrary to what the CoA seem to suggest, this does not directly apply only to Sweden, but to all EU Member States implementing data retention legislation.

When the CJEU ruled that blanket indiscriminate data retention of all services, all users and all data (catch all) was not permissible under EU law, I highlighted that this would have made a power found within cl.1 of the draft Communications Data Bill (dCDB) unlawful (Matthew White, ‘Protection by Judicial Oversight, or an Oversight in Protection?’ (2017) Journal of Information Rights, Policy, and Practice 2:1, 24). This was due to the fact that cl.1 contained the same power that the Swedish reference was seeking to clarify, a catch all power.

Section 1(2)(a) and (b) of DRIPA 2014 and s.87(a) and (b) of the IPA 2016 must be considered together. Both sets of powers allowed or allows retention notices to be issued on a (public) telecommunications operator or any description of operators to retain all data or any description of data. I had previously argued that Tele2 and Watson may prove unproblematic for such powers because there was discretion on which telecommunications operators could be obligated to retain and what data they could retain (26). I further pointed out, due to the CJEU’s insistence on geographical data retention in Tele2 and Watson [111] (which in and of itself is problematic for human rights protection (36, 37)) it could be argued, the ability to require retention would not be based on operator, but by location and therefore, could require a variety of operators to retain in a given area (26). These are the sorts of arguments I would assume could be invoked by the Home Secretary if need be.

However, I also noted that ‘it is still theoretically possible for all operators in the UK to be required to retain all data of users and subscribers’ (26) because retention notices apply to any description of operators to retain all or any description of data. This could be considered a general obligation because it could affect all telecommunications operators and then be classed as a general obligation. Lord Kerr in his dissenting opinion in Beghal v Director of Public Prosecutions [2015] UKSC 49 noted that it ‘is the potential reach of the power rather than its actual use by which its legality must be judged [102].’ Instead of a catch all power like cl.1 of the dCDB or Swedish law, the powers in DRIPA 2014 and the IPA 2016 would be a power that can catch all. When considering DRIPA 2014, the HC in Davis and Others came to the same conclusion where they noted that:

Mr Eadie accepted that the consequence of this policy stance is that we should test the validity of DRIPA on the assumption that the retention notices issued under it may be as broad in scope as the statute permits, namely a direction to each CSP to retain all communications data for a period of 12 months. The case was argued on both sides on that basis. We shall refer in this judgment to a system under which the State may require CSPs to retain all communications data for a period as a "general retention regime" [65].

One could challenge this reasoning on account of it matters not whether the contents of a retention notice are known because it’s the power in question that is tested. This is precisely the position of the European Court of Human Rights (ECtHR) with regards to secret surveillance. In Roman Zakharov v Russia (ECHR, 4 December 2015) the ECtHR’s Grand Chamber (GC) clarified its position on when an individual can claim to be a victim of a violation under Article 8 (private and family life, home and correspondence) of the European Convention of Human Rights (ECHR). The GC maintained that an applicant can claim to be a victim by the mere existence of secret surveillance measures for example, where ‘legislation directly affects all users of communication services by instituting a system where any person can have his or her communications intercepted’ [171]. The GC continued that, when such surveillance cannot be verified, the menace of surveillance itself can interfere with the Article 8 rights of all users and potential users [ibid]. In summary, the GC clarified its jurisprudence where it has been consistently ruled that it is what the law permits that can be subject to challenge, not the actual use of the law (unless argued by the applicants).

For the reasons highlighted above, it is argued that the CoA are playing semantics with the powers found within Swedish legislation, and the powers found within DRIPA 2014, as they permit the same thing, namely all operators, data and users can be affected by data retention. Therefore, the CoA’s reliance on the CJEU’s position on general data retention only applied to and reflected Swedish law is untenable.

The CoA also relied upon the HC’s interpretation of Digital Rights Ireland in Davis and Others that the CJEU ruled that general data retention would only be lawful if appropriate safeguards were in place. This is ironic considering the CoA disagreed with this position in Secretary of State for the Home Department v Davis MP and Others [2015] EWCA Civ 1185 [90]. What is also striking, is that, unless the CoA have invented a TARDIS to prevent the CJEU’s judgment in Tele2 and Watson from occurring, they seem to rely on the HC’s position prior to Tele2 and Watson. Simply put, in 2015, the HC did not believe the CJEU meant general data retention was unlawful in and of itself, in 2016, the CJEU said, ‘Yes, we did, so we shall say it again.’ Thus, for the CoA to rely on what is best described as an outdated HC position is at best, ignorant and at worst, disingenuous.

The final reason on part of the CoA is also unconvincing. They declined on the basis that Part 4 of the IPA 2016 is under challenge and thus would not be privy to evidence of both sides. This is despite the operational case for data retention being in the public domain, and the counter arguments relatively easy to find. The position the CoA took allowed it to sidestep the real issue, whether general data retention is compatible with human rights. General data retention has never been compatible with human rights since at least 2008 when the ECtHR GC in S and Marper App nos. 30562/04 and 30566/04 (ECHR, 4 December 2008) ruled that general data retention, even on a specific group of individuals (suspects and convicts) violated Article 8. Tele2 and Watson (despite its many flaws 24, 34-41) is just the next logical step with regards to communications data.

Prior Review by a Court or Independent Administrative Body

The finding that DRIPA 2014 was inconsistent with EU law for not prescribing prior review by a court or an independent administrative body for access to communications data is to be welcomed. This is not a criticism of the CoA’s finding per se, but a criticism of the idea that this safeguard remedies the problems caused by data retention. Part 4 of the IPA 2016 allows retention notices to be approved by Judicial Commissioners (JC) under s.89. This mechanism has already been criticised because JC will only act based on the Secretary of State’s conclusions, there is no obligation for the Secretary of State to make a full and frank disclosure of their evidence for retention (thus can be misled), they can only make an assessment on judicial review principles (thus not a merit based or human rights review), nor are they institutionally independent from the Investigatory Powers Commission (IPC) (28-32).

Another problem is that the JC can authorise data retention that can catch all. As the GC in Roman Zakharov noted:

[T]he implementation in practice of measures of secret surveillance of communications is not open to scrutiny by the individuals concerned or the public at large, it would be contrary to the rule of law for the legal discretion granted to the executive or to a judge to be expressed in terms of an unfettered power [230].  

The power to retain in DRIPA 2014 and IPA 2016 are virtually unfettered, even if it applies to a single telecommunications operator, and even if this power was authorised by a judge (37-39). Essentially, giving a judge the power to authorise retention or access would only be sufficient based on what they can authorise to be retained or accessed. If this power is unfettered, it matters not if the judge increases the independence of the authorisation process. Thus, despite the CoA’s finding, DRIPA 2014 would still be in violation of fundamental rights.

Lack of notification was already incompatible with the European Convention on Human Rights

In declining to grant declaratory relief with regards to notification, it can be argued that the CoA have failed under their obligations under s.6 of the Human Rights Act 1998 (HRA 1998) to act in a way that is compatible with the ECHR. With regards to notifications, the ECtHR in Association for European Integration and Human Rights and Ekimdzhiev v Bulgaria App no. 62540/00 (ECHR, 28 June 2007) found that Bulgarian law violated Article 8 and 13 (effective remedy) for not having a notification system. The ECtHR noted that ‘as soon as notification can be made without jeopardising the purpose of the surveillance after its termination, information should be provided to the persons concerned’ [90]. Boeham and de Hert note that the ‘clear recognition of an (active) notification duty after surveillance measures have ended in the Ekimdzhiev v. Bulgaria case constitutes a remarkable development in the framework of the safeguards against abuse which are necessary in surveillance cases’ (Franziska Boehm and Paul de Hert, ‘Notification, an important safeguard against the improper use of surveillance - finally recognized in case law and EU law’ (2012) 3:3 European Journal of Law and Technology).

The position of the ECtHR was reaffirmed in Roman Zakharov [287], but reference was made to UK law in that there is an alternative to notification i.e. IPT jurisdiction [234, 288], however, I have previously referred to doubts raised by Boehm and de Hert which is worth quoting in full. Boehm and de Hert questioned whether UK law was ‘capable of responding to the challenges arising out of the use of new surveillance techniques’ (Franziska Boehm and Paul de Hert, The rights of notification after surveillance is over: ready for recognition? (Yearbook of the Digital Enlightenment Forum, IOS Press 2012), pp. 19-39, 37).

Boehm and de Hert continue that in light of powers such as data retention and ‘fishing expeditions’ that target a greater number of people without suspicion, a notification duty appears to be an effective tool to prevent abuse (ibid, 37-8). Finally, Boehm and de Hert note that the Belgian Constitutional Court has now adopted the notification principle as a requirement to comply with Article 8 (ibid, 38).

Thus, whether or not CJEU requires notification, this justification can be found within the jurisprudence of the ECHR. Boehm and de Hert’s approach would be consistent with this jurisprudence of the ECHR in terms of it being a living instrument ‘which must be interpreted in the light of present-day conditions and of the ideas prevailing in democratic [73]’ in that mass surveillance would deprive the:

[S]ubject of an opportunity to seek redress for unlawful interferences with his or her Article 8 rights and rendered the remedies available under the national law theoretical and illusory rather than practical and effective [288].

The IPA 2016 does contain a notification process under s.231, but this is wholly inadequate as it quite plainly admits, that a violation of the ECHR is not sufficient in and of itself to justify a notification. This could be any ECHR right, not just a breach of privacy, data protection or freedom of expression, but the right to life (Article 2), freedom from torture (Article 3) etc. This would render s.231 at the very least, in violation of Article 8 and 13 (39-40). Granted, this was not argued before the CoA, it remains that this was an opportunity where the CoA could have used existing case law to find that DRIPA 2014 had in fact breached human rights, with or without any consideration for EU law and the principles set out in Tele2 and Watson.

Conclusions

In an amazing display of legal gymnastics, the CoA avoided the most central issue in the data retention debate, the compatibility of general data retention with fundamental rights. The CoA did so by not acknowledging that DRIPA 2014 did and the IPA 2016 now allows general data retention. Instead, the CoA relied upon the semantics of distinguishing a catch all power, and a power that can catch all, which of course, in any event, amount to the same thing. In finding that DRIPA 2014 was only unlawful insofar as it lacked prior review by a court/independent administrative body to access communications data and that this was not restricted to serious crime overlooks the central issue of this data being retained the first place. It is one thing the ensure greater independence with regards to the authorisation of surveillance measures, but is another thing to overlook what those authorisations allow, whether it be the retention or access of communications data. To do so would simply polish a turd, rather than flush it, as general data retention has always been a turd that has needed flushing since at least 2008. Although the question of data retention within the IPA 2016 is subject to judicial review before the HC, the CoA had the opportunity to faithfully apply Tele2 and Watson to DRIPA 2014, but instead of addressing the issue, it acted as though the issue did not exist.

Barnard & Peers: chapter II:7

Art credit: Lightning Broadband 

Minimum Alcohol Pricing is Appropriate & Necessary: Scotch Whisky Association v Lord Advocate [2017] UKSC 76

Angus MacCulloch, Law School, Lancaster University (@AngusMacCulloch)

Lord Mance has handed down the long awaited judgment in SWA v Lord Advocate in the UK Supreme Court finally dismissing the SWA’s appeal, and permitting the Scottish Government to implement its Minimum Unit Pricing (MUP) policy in relation to retail alcohol sales. The scheme to introduce a MUP of £0.50 per unit, under the Alcohol (Minimum Pricing)(Scotland) Act 2012, has been delayed for 5 years by this legal challenge which characterised the scheme as being contrary to EU law; in that it was contrary to both Article 34 TFEU, as it was a measure having equivalent effect to a quantitative restriction on trade, and that it was contrary to the bar on price fixing under the Single CMO Regulation EU/1308/2013 covering wine.  

This is the fourth, and final, substantive judgment in this litigation. At first instance the Outer House of the Court of Session found MUP to be lawful, [2013] CSOH 70, and after receiving a response to a preliminary ruling from the Court of Justice of the EU, Case C-333/14 EU:C:2015:845, the Inner House, [2016] CSIH 77, also upheld the lawfulness of MUP. The SWA’s appeal was perhaps inevitable, but after a hearing in July 2017, the final judgment has largely confirmed the findings of both Scottish courts that the policy could be justified on the basis of the protection of public health.

By the time the case reached the Supreme Court it was largely settled that MUP could be characterised as a measure having equivalent effect to a quantitative restriction under Art 34 TFEU, and would be contrary to the Single CMO Regulation, but any restriction contrary to those provisions could be justified on the basis of public health protection. The majority of the discussion in the Supreme Court surrounded the proportionality of MUP; was there an alternate measure which could achieve MUP’s aim but which be less restrictive of trade or competition?

The Aim and Assessment of the Measure

Much of the Supreme Court judgment contains an, at times detailed, analysis of the public health evidence presented to justify the introduction of MUP. The CJEU addressed the appropriate time frame for the assessment of a measure and Lord Mance similarly adopted a permissive attitude to the question. Flexibility was given to allow the consideration of the most recent health studies, and the respondent, the Scottish Government, was permitted, at [28], to:

‘refine the aims advanced and to demonstrate that, on the material now available, the proposed measure is justified, even if it only meets an aim which is narrower than, but still falls within the scope of those originally advanced’.

Both the AG and the CJEU drew attention to the ‘two fold objective’ (CJEU [34]) of MUP, in relation to problem drinking and the general consumption of alcohol, but this flexibility allowed the Scottish Government to refocus their argument on what the new evidence showed to be the most important benefits of MUP, in relation to problem drinking, and away from the issues of general consumption. That was to their advantage when as it was seeking to justify a more targeted measure - MUP - over a more general one - increased excise duty.

The Test of Proportionality

Lord Mance opened with a consideration of the guidance set out by both AG Bot and the CJEU in relation to justification and the proportionality of restrictions under EU Law. After setting out sections of the AG’s Opinion Lord Mance characterised his approach as being a three part test: is the measure i) appropriate, ii) necessary, and iii) a balancing of the restrictive effects of the measure as opposed to possible alternatives [14]. In his assessment of the CJEU’s ruling on the question of proportionality Lord Mance found the CJEU’s test to be somewhat narrower, only relying on the first two limbs, although he did recognised that the CJEU considered some aspects of third limb within ‘necessity’. On this question of the third limb, or ‘proportionality stricto sensu’, Lord Mance posed the following rhetorical question, at [47]:

‘can it be that, provided an objective is reasonable and can only be achieved in one way, it is irrelevant how much damage results to the ordinary operation of the EU market?’

This task was described as being a comparison, ‘between two essentially incomparable values’ – health and the market [48]. It was also stressed that, ‘it was not for any court to second-guess the value which a domestic legislator may decide to put on health’ [48]. This rejection of a ‘balancing’ approach between the competing values of health and the market was important. It reduced the need for the Scottish Government to produce compelling economic evidence of the impact of MUP on future markets, but, more importantly, because it did not compel the court to weigh up, ‘the number of deaths or hospitalisations … [which were] “proportionate to” the degree of EU market interference’ [48].

The final decision on proportionality – after consideration of the new evidence and argument before the Supreme Court – was clear.

‘A critical issue is, as the Lord Ordinary indicated, whether taxation would achieve the same objectives as minimum pricing. … [T]he main point stands, that taxation would impose an unintended and unacceptable burden on sectors of the drinking population, whose drinking habits and health do not represent a significant problem in societal terms in the same way as the drinking habits and health of in particular the deprived, whose use and abuse of cheap alcohol the Scottish Parliament and Government wish to target. In contrast, minimum alcohol pricing will much better target the really problematic drinking to which the Government’s objectives were always directed and the nature of which has become even more clearly identified by the material more recently available’ [63].

This conclusive finding that MUP is the most effective way of targeting a particular pattern of problem drinking in Scotland reflects the same analysis of the evidence by the Lord Ordinary and Lord President in the Court of Session.

The other key point that Lord Mance went on to make concerned the respective roles of the Scottish Parliament, in setting health policy priorities, and the court, in assessing the proportionality of a measure. As the ‘balancing’ approach, suggested by AG Bot, had ready been rejected it is perhaps not surprising that Lord Mance restricted the role of the court.

‘the Scottish Parliament and Government have as a matter of general policy decided to put very great weight on combatting alcohol-related mortality and hospitalisation and other forms of alcohol-related harm. That was a judgment which it was for them to make, and their right to make it militates strongly against intrusive review by a domestic court’ [63].

But in perhaps the most important passage Lord Mance continued:

‘That minimum pricing will involve a market distortion, including of EU trade and competition, is accepted. However, I find it impossible, even if it is appropriate to undertake the exercise at all in this context, to conclude that this can or should be regarded as outweighing the health benefits which are intended by minimum pricing’ [63].

Given the strength of that conclusion it is difficult to see a circumstance in which a UK court presented with clear evidence of prospective health benefits from an intended public health intervention, which is predicted to prevent mortality and hospitalisations, would decide that such a measure is a disproportionate intervention.

On Evidence

The Supreme Court’s heavily reliance on the evidence base behind the adoption of MUP is unsurprising. The CJEU stressed the importance of evidence to justify a measure in both the SWA reference and Case C-148/15 DPV. There is, however, no better example of the extent to which evidence can become important, but also a significant burden (as indicated at 411) to a court, than BAT v Dept of Health [2016] EWHC 1169 (Admin).

Although the Supreme Court was heavily reliant on the wealth of modelling evidence presented to it, it did recognise that much of the evidence was, as the AG described it, ‘somewhat experimental’, and that it would difficult ‘predicting the precise reactions of markets and consumers to minimum pricing’ [62]. In that regard the Lord Mance appears to have taken comfort that the proportionality of the measure in the longer term would be assured as the Scottish Government had built a sunset clause into the Act, and that a formal review of the actual effects of the legislation would be required or it would cease to be in force after six years.

Conclusions

I have been following this case for a very long time and my initial reaction is that it is a good conclusion. The Supreme Court has made it clear, much more so than the CJEU did, that a convincing and well evidenced public health argument should, and hopefully now will, win out over trade or competition concerns. The proportionality test still has teeth. A Member State seeking to justify a measure must be clear about its aim, and it must have a good evidence base to explain and justify the effectiveness of the intervention it has chosen. But it now appears that the courts, in the UK at least, will now give some deference to the policy choices of the legislature if they stand up to that scrutiny.

It is not the courts role to second-guess policy in these areas, but I am sure that we will see new challenges if other jurisdictions attempt to introduce similar policies. Other administrations may see this case as clearing the way, but they should be careful as the decision in this case was tied to a detailed analysis of a particular Scottish problem. It is not the case that the same intervention will be appropriate or necessary everywhere else.

Barnard & Peers: chapter 15, chapter 16

Photo credit: Sky News

A Vanishing Breed? Walker v Innospec Ltd - The UK Supreme Court Disapplies a Statutory Provision on the Grounds of Incompatibility with EU Equality Law

Colm O’Cinneide, Professor of Law, UCL

Last week’s decision of the UK Supreme Court (UKSC) in the same-sex pension rights case of Walker v Innospec Ltd [2017] UKSC 47 generated plenty of excited commentary in the UK media. This mainly focused on the UKSC’s finding that it constitutes direct discrimination on the basis of sexual orientation – and thus a breach of EU law - for the rules of a employer’s contributory benefit scheme to deny payment of a ‘spouse’s pension’ to a surviving member of a same-sex married couple, in circumstances where such a pension would be paid to the surviving member of an opposite-sex married couple. This finding is obviously significant, both for its application at national level of the prohibition on direct discrimination on the basis of sexual orientation set out in Article 2 of the Framework Equality Directive 2000/78/EC, and also its concrete impact on the acquired pension rights of same-sex married couples in the UK. However, the media coverage glossed over two other important elements of the judgment, which are of especial interest from the perspective of EU law.

One of those elements relates to the complex issue of the temporal effects of a finding that national law is incompatible with EU legal requirements – namely the Court’s conclusion that, in Lord Kerr’s words at para. 56, ‘the point of unequal treatment occurs at the time that the pension falls to be paid’ and not when the benefit in question was accrued, and that no basis existed for limiting the retrospective effect of the judgment in line with the ECJ’s approach in Case C-262/88, Barber v Guardian Royal Exchange Assurance Group [1990] ECR I-1889.

The other neglected dimension to the case is of more general interest, especially in the run-up to Brexit – namely how the case resulted in the Supreme Court disapplying the provisions of Schedule 9 para. 18 of the UK Equality Act 2010, insofar as they permitted the type of discriminatory treatment at issue in the circumstances. In other words, in Walker, the obligation on national courts to give direct effect to the requirements of EU anti-discrimination legislation resulted in incompatible national legislation being set aside – perhaps one of the last times this happens before Brexit insulates UK parliamentary legislation from legal challenges based on EU law or other fundamental rights standards.

The case involved a legal challenge by a former employer of Innospec Ltd against their refusal to agree to pay a survivor’s pension to his same-sex spouse if he died first, even though such a benefit would have been paid out to Mr Walker’s spouse had she been a woman. Innospec Ltd justified this exclusion in part by reference to the provisions of Schedule 9 para. 18 of the 2010 Act, which permitted employers to restrict access to occupational benefits where the right to that benefit accrued before 5 December 2005 (the date same-sex couples became legally entitled to enter into civil partnerships).

At first instance, Mr Walker won his claim that he had been subject to direct and indirect discrimination on the grounds of sexual orientation, with the Employment Tribunal concluding that Schedule 9 para. 18 could be applied in a manner compatible with the relevant requirements of Directive 2000/78/EC. Subsequently, however, Innospec appealed successfully against that decision, with the Court of Appeal concluding that Mr Walker had been subject to direct discrimination on the basis of his sexual orientation but that the principles of ‘non-retroactivity’ and ‘future effect’ as developed in the case-law of the CJEU meant that the prohibition on discrimination applied only to benefits accruing after the transposition of the Directive in December 2003. (Mr Walker had taken early retirement in March 2003.)

This conclusion was criticised by Robert Wintemute amongst others, in particular in a case-note in the Industrial Law Journal in 2016 (‘Unequal Same-Sex Survivor’s Pensions: The EWCA Refuses to Apply CJEU Precedents or Refer’ (2016) 45(1) Ind Law J 89-100), and his criticisms were subsequently explicitly cited by Lord Kerr in giving the judgment of the majority of the Supreme Court reversing the decision of the lower court.

In brief, the Supreme Court initially applied the established case-law of the CJEU in cases such as Case C-267/06, Maruko [2008] 2 CMLR 32 and Case C-147/08, Römer [2011] ECR I-3591, and confirmed that less favorable treatment by an employer of same-sex partners as compared to opposite-sex partners who have entered into the same or equivalent type of legally recognised relationship will constitute direct discrimination on the grounds of sexual orientation.

Turning to the question of the remedy and by extension the legal effect of Schedule 9 para. 18, the UKSC went on to survey the relevant case-law of the CJEU dealing with issues of the retrospective effect of judgments. It concluded that the ECJ’s decision to restrict the temporal effect of its finding of sex discrimination in the occupational benefits case of Barber was a judicial technique that should only be applied ‘in the most exceptional circumstances and where the impact [of a judgment] would be truly “catastrophic”’ (para. 44).

The Supreme Court further concluded that the CJEU case-law established that the discriminatory treatment in question should be viewed as taking effect at the time when the pension was due to be paid, in part because it was only at that point of time that the spousal obligations at issue crystallised into tangible form. In so doing, they rejected suggestions by counsel based on views expressed by AG Van Gerven in Case C-109/91, Ten Oever [1993] ECR I-4879 that pension entitlements accrued as they were earned, and therefore that any discrimination occurring would have predated the date of transposition of the Directive. The UKSC therefore concluded that the provisions of Schedule 9 para. 18 of the 2010 Act could not be applied insofar as they precluded liability arising for the discriminatory behaviour in question, which was incompatible with the requirements of Directive 2000/78/EC and the general principle of equal treatment as confirmed to exist by the CJEU in case C-555/07, Kücükdeveci [2010] 2 CMLR 33.

The Walker judgment is thus particularly interesting for three reasons: (i) the faithful application by the UKSC of the case-law of the CJEU in relation to discrimination against same-sex partners; (ii) the Supreme Court’s interpretation of the relevant CJEU case-law relating to the temporal effect of findings of discrimination in the context of occupational benefits, which gives strong effect to the principle of non-discrimination; and (iii) the way in which it illustrates how parliamentary legislation can be disapplied if its conflicts with fundamental rights secured under EU law, in particular the right to non-discrimination.

After the process of Brexit is complete, this form of legal protection of equality is likely to fall away, along with the supremacy of EU law in general. Walker may thus mark one of the last instances where EU law takes effect as a trump card within the British legal system; as such, it is striking that its effect was to disapply a statutory provision designed to limit liability for discriminatory behaviour.

Photo credit: BBC.co.uk
Barnard & Peers: chapter 27, chapter 20, chapter 6

When is Facebook liable for illegal content under the E-commerce Directive? CG v. Facebook in the Northern Ireland courts

Lorna Woods, Professor of Internet Law, University of Essex

Introduction

The ubiquity of social media platforms and their significance in disseminating information (true or false) to potentially wide groups of people was highly unlikely to have been in the minds of the European legislators when they agreed, in 2000, the e-Commerce Directive (Directive 2000/31/EC) (ECD). Facebook itself was launched only in 2004. Despite the changing times and technological capabilities, the Commission has decided not to revise the ECD, specifically its safe harbour provisions for intermediaries, in its current single digital market programme.  Although the ECD seems set to remain unchanged, the application of the safe harbour provisions raises many difficult questions which have not yet been fully answered at EU level by the Court of Justice. CG v. Facebook ([2016] NICA 54), a decision of the Northern Irish Court of Appeal, illustrates some of these difficulties and certainly raises questions about the proper interpretation of the ECD and its relationship with the Data Protection Directive.

Intermediary Immunity - Legal Framework

The ECD provides immunity from liability for certain ‘information society service providers’ (ISS providers) on certain conditions.  To gain immunity, the ISS provider must

-          be an ISS provider within the terms of the ECD; and

-          one of the following applies:

-          the provider is a ‘mere conduit’ (Art. 12 ECD);

-          provides caching services (Art. 13 ECD); or

-          provides hosting services (Art. 14 ECD).

Each one of these three categories provides for a different level of immunity, which seems connected with the level of knowledge the ISS provider is assumed to have of the problematic content. Here Article 14, which deals with hosting, is the relevant provision. It provides:

1. Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:

(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or

(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.

2. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.

3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.

The recitals to the ECD give more detail as to the scope of services protected by Article 14 and there is a certain amount of case law on this point, notably Google Adwords (Case C-236/08) and the Grand Chamber decision in L’Oreal v. eBay (Case C-324/09). Recital 42 has been pointed to by the Court in these cases as relevant for understanding the sorts of activities protected by the immunity. Recital 42 refers to services of a

mere technical, automatic and passive nature, which implies that the information society service provider has neither knowledge of nor control over the information which is transmitted or stored.

The ECJ in Google Adwords referred to this as being ‘neutral’ (para 113-4). The Grand Chamber in its subsequent L’Oreal decision suggested that advice in optimising presentation would mean a provider was no longer neutral (para 114).

The provision protects relevant ISS providers from liability in relation to illegal content, provided they have no knowledge (actual or constructive) of the illegal activity or information, and that if they have such knowledge, they have acted expeditiously to remove it. In L'Oreal v eBay the Court of Justice provided a standard or test by which one can measure whether or not a website operator could be said to have acquired an 'awareness' of an illegal activity of illegal information in connection with its services, that is whether "a diligent economic operator would have identified the illegality and acted expeditiously".   The CJEU also held that an awareness of illegal activities or information may become apparent as the result of an investigation by the operator itself or where the operator receives notification of such activity.  Article 14 does not protect ISS providers from injunctions, or the costs associated with any such injunctions (see Recital 45).

Additionally, Article 15 specifies that, for those falling within Articles 12-14, Member States cannot impose a ‘general obligation’ to monitor content to determine whether content is illegal. There has been a considerable amount of dispute as to the relationship between this provision and the scope of immunity, especially given the requirements in L’Oreal.  Recital 40 notes that ‘service providers have a duty to act, under certain circumstances, with a view to preventing or stopping illegal activities’ and that the immunity provisions ‘should not preclude the development and effective operation, by the different interested parties, of technical systems of protection and identification and of technical surveillance instruments made possible by digital technology’. The Recitals also state:

(47) Member States are prevented from imposing a monitoring obligation on service providers only with respect to obligations of a general nature; this does not concern monitoring obligations in a specific case and, in particular, does not affect orders by national authorities in accordance with national legislation.

(48) This Directive does not affect the possibility for Member States of requiring service providers, who host information provided by recipients of their service, to apply duties of care, which can reasonably be expected from them and which are specified by national law, in order to detect and prevent certain types of illegal activities.

The distinction between general monitoring and specific monitoring has yet to be fully elaborated, and is an issued much discussed in the context of intellectual property enforcement, especially as regards keeping pirated copies of materials down after taking it down in the first place.

Facts of CG

McCloskey opened a Facebook page in August 2012 entitled ‘Keeping Our Kids Safe from Predators’ in which he published details of individuals who had criminal convictions relating to sexual offences involving children.  This page was not subject to any privacy settings.  One individual who was so named brought action against Facebook and an interim injunction was issued requiring Facebook to remove the page and related comments, on the basis that the comments responding to the posting were threatening, intimidatory, inflammatory, provocative, reckless and irresponsible. This was the XY litigation. Immediately after the page was removed, McCloskey set up a new page, Predators 2. CG was identified on this page on 22 April 2013; his photograph was published and there were discussions about where he lived. Comments included abusive language, violent language – including support for those who would commit violence against CG and for the exclusion of CG from the community in which he lived.  The disclosure of CG’s residence was contrary to the position taken by the Public Protection Arrangements in Northern Ireland (PPANI), which took the view that such disclosure interferes with the rehabilitation process.

On 26th April 2013, CG’s solicitors wrote to Facebook and its solicitors in Northern Ireland, claiming the material was defamatory and that CG’s life was at risk. A hardcopy of Predators 2 page was enclosed. Facebook’s response was that CG should use the online reporting tool, but CG expressed a desire not to have to engage with Facebook. By 22 May 2013 Facebook removed all postings on Predators 2, but on 28 May, CG issued proceedings. Subsequently, CG’s solicitors wrote to Facebook complaining that the photograph had been shared 1622 times and that other Facebook users had included comments threatening violence. They identified the main URL, but not all such instances which Facebook then requested. This information was provided on 3rd and 4th December and removed on 4th or 5th December. A further reposting of the photographed by RS occurred on 23 December, stating that this was what a “pedo” looked like. A letter of claim was send to Facebook on 8th January 2014, identifying the relevant URLs and the page was taken down on 22 January 2014.  While CG accepted that the defamation claim was without merit, it was accepted that he was extremely concerned about potential violence as well as the effect on his family.

Judgment at First Instance

The trial judge had to deal with claims against McCloskey, as well as claims against Facebook.  The trial judge, having reviewed the evidence, concluded that McCloskey’s conduct constituted harassment of CG. The case against Facebook was based on the tort of misuse of private information. To find that there had been such misuse, there had to be a reasonable expectation of privacy in relation to the relevant information  which should take into account all the circumstances (relying on JR38 [2015] UKSC 42 and Murray v. Express Newspapers [2008] EWCA Civ 446). The judge also accepted the submission that the Data Protection Act, and specifically the category of ‘sensitive data’, provided a useful touchstone as to what information could be seen as private (see Green Corns Ltd v. Claverly Group Limited [2005] EWHC 958). The judge concluded that the use of a photograph or name in conjunction with information which could identify where CG lived and any information about his family members were private information. The judge considered that Facebook was put on notice of the problematic nature of the material by the XY litigation (which mentioned the Predator 2 page) and that simple searches would reveal the page, as it had an almost identical name with identical purposes. The trial judge concluded that it was apparent on the face of the posts that consideration of the lawfulness of the posts was needed. As regards the Electronic Commerce (EC Directive) Regulations 2002, which implement the ECD in the UK, the judge rejected the contention that there was an obligation to give Facebook notice in a particular form. So, neither the ECD nor the 2002 Regulations protected Facebook from the claim of misuse of private information.

A further claim under the Data Protection Act was added late in the day. The judge concluded that –in the absence of relevant discovery - CG had not established this proposition. Facebook appealed. CG also appealed as regards the data protection point, but did not pursue this point.

Court of Appeal Judgment

The Court noted that there was agreement that McCloskey’s behaviour was unreasonable conduct sufficient to give rise to criminal liability (R v Curtis [2010] EWCA 123), and that the 2002 Regulations do not cover injunctions. The Court agreed that this was an appropriate case in which to make an order taking to down the material to protect CG from continued intimidation [para 40]. The Court noted that the tort of misuse of private information and harassment, while complementary, are not the same and that a finding of harassment did not automatically mean that there had been a misuse of private information.

As regards the tort, the Court noted that there was no dispute between the parties that this case was about an intrusion, but that the tort would come into play only if there was a reasonable expectation of privacy in the information, which is a fact sensitive determination.  The Court of Appeal noted the public interest in knowing about criminal convictions; it also disagreed with the trial court judge about the reading across of the categories of sensitive information in the DPA. It held:

The fact that the information is regulated for that purpose does not necessarily make it private’ [para 45].

Reviewing the material, the Court held that the context of harassment was determinative to the finding that CG has a reasonable expectation of privacy in the material [para 49]. By contrast, RS was protected by principles of open justice which allow citizens ‘to communicate the decisions of the criminal justice systems to others’ and therefore CG did not have a reasonable expectation of privacy in relation to that posting [para 51].

The Court then considered whether Facebook could rely on the safe harbour provisions of the ECD and the 2002 Regulations. It held that the 2002 Regulations need to be understood in the light of Art 15 ECD even though it is not formally implemented in the UK. According to the Court, Article 15 ‘clearly’ applied to Facebook [para 52]. While not expressly stated, the Court’s approach is based on the assumption that Article 14 (safe harbour provisions for those providing hosting services) and Regulation 19 of the 2002 Regulations, which implement it, also apply.

The Court then considered the issue of notice. Facebook argued that CG had not given proper notice, on the basis that CG had not used Facebook’s online submission process. The Court of Appeal agreed with the trial court’s dismissal of this argument, stating, ‘[a]ctual knowledge is sufficient however acquired’ [para 58]. Facebook challenged the approach taken at first instance, that Facebook had the resources to find the material and assess it [High Court, para 61].  It was also argued that the way the High Court approached the question of constructive knowledge also implied a monitoring obligation. The trial judge referred to the XY litigation; that litigation plus the letters of CG’s solicitors; and the litigation together with some elementary investigation of the profile. The Court of Appeal agreed with these concerns.  It stated the question as being:

Whether Facebook had actual knowledge of the misuse of private information … or knowledge of facts and circumstances which made it apparent that the publication of the information was private

before commenting that

[t]he task would, of course, have been different if there had been a viable claim in harassment made against Facebook [para 62].

It did not elaborate the basis or extent of the difference.

The Court concluded that the XY litigation did not fix Facebook with sufficient notice; that it only could do so if Facebook was subject to a monitoring obligation. In any event, knowledge of a propensity to harass did not fix Facebook with notice about the private information. As regards the correspondence, the Court held that this too was insufficient to fix Facebook with notice. While it referred to the problematic content, it did not refer to misuse of privacy. ‘The correspondence did not, therefore, provide actual notice of the basis of claim which is now advanced’ [para 64]. The Court also considered that there was nothing in the letters to indicate that the information was private. So, while ‘the omission of the correct form of legal characterisation of the claim ought not to be determinative of the knowledge and facts and circumstances which fix social networking sites such as Facebook with liability’, it is necessary to identify ‘a substantive complaint in respect of which the relevant unlawful activity is apparent’. 

Here, since there was no indication in the letter of claim that the address was the issue, the Court did not ‘consider that the correspondence raised any question of privacy in respect of the material published’. [para 69] By contrast, in the letter of 26th November, CG referred to the general identification of where CG was living and the threat from paramilitaries. This was sufficient to establish knowledge of facts and circumstances in relation to that particular post. Referring to the Court of Justice in L’Oreal, the Court noted that Facebook is obliged to act as a diligent economic operator. This point was not argued; Facebook was found to be liable in respect of that post for the period 26th November-4/5 December.

The burden of proof is in the first instance on the claimant to show knowledge; thereafter the ISS must prove it did not.

As regards the DPA, it was agreed that Predators contained personal data and sensitive personal data, the issue was whether Facebook Ireland could be seen as subject to the UK DPA.  The ECJ rulings in Google Spain (Case C-131/12) and Weltimmo (Case C-230/14) were argued before the Court. The Court did not accept the submission that Google Spain was limited to its particular facts and the concern that the protection offered by the Data Protection Directive would be undermined if it excluded out of EU data controllers. The Court here noted that Weltimmo in fact built on the approach in GoogleSpain. It concluded that Facebook is a data controller established in the UK for the purposes of the DPA.  Although the Court accepted that the ECD does not cover data protection, and this is reflected in Regulation 3 of the 2002 Regulations, the Court held at para 95:

The starting point has to be the matter covered by the e-Commerce Directive which is the exemption for information society services from the liability to pay damages in certain circumstances …We do not consider that this is a question relating to information society services covered by the earlier Data Protection Directive and accordingly do not accept that the scope of the exemption from damages is affected by those Directives.’

Comment

This case is one of a number coming through the Northern Irish court system regarding different types of problematic content and the responsibility of social media platforms to take action against such content.  Shortly before this case was handed down, the High Court handed down its decision in J20 v Facebook Ireland Ltd ([2016] NIQB 98). Other cases are working their way through the system: AY v Facebook (Ireland) Ltd ([2016] NIQB 76), concerning naked images of a school girl on a ‘shame page’; MM v BC, RS and Facebook ([2016] NIQB 60), concerning revenge porn; and Galloway v Frazer and Google t/a YouTube ([2016] NIQB 7) concerning defamatory and harassing videos.  While this case is based in the particular cultural and legal context of Northern Ireland, and raises questions on the meaning of private information, it also leads of questions about the interpretation of EU laws, notably the ECD and DPD.

The first point to note is that the Court does not directly address the question of the applicability of Articles 14 and 15 ECD, beyond stating the Article 15 clearly applies. Article 15 is dependent on the ISS provider providing services that fall within one of Article 12, 13 or 14 ECD, with Article 14 being relevant here. So the question is whether Article 14 ECD (and consequently Regulation 19 of the 2002 Regulations) applies here. While the text of Article 14 ECD refers to ‘the storage of information provided by a recipient of the service’, the case law makes it clear that not any storage will do. Rather, the service provider must be neutral as regards the content, technical and passive.  In this regard, services Facebook provide regarding information of interest to Facebook users (News Feed algorithm and content recommendation algorithm, as well as Ad Match services), may mean that the question of neutrality and passivity here is at least worthy of investigation, in that Facebook may promote certain content (in the term of L’Oreal, para 114). Of course in Netlog (Case C-360/10), the Court of Justice held that a social media platform could benefit from Article 14, but this does not mean that all will – much will depend on the facts (see eg Commission 2012 Working Paper on trust in the digital single market (SEC(2011) 1641 final, accompanying COM(2011) 942 final).

Assuming Article 14 (and its UK equivalent, Regulation 19) applies, the next question is whether Facebook was on notice.  The ECD is silent on the nature of any formalities, leaving it to Member States and industry (via self-regulation per Recital 40) to fill in the detail.  In its 2012 Working Paper, the Commission acknowledged that there were diverging views as to what notice required, ranging from those who argued that nothing less than a court order should be accepted (seemingly thereby focussing on just actual knowledge) through to those who suggested that general awareness of the use of the site for illegal content was sufficient (which covers constructive knowledge) (p. 33-34). It seems there are three main issues here:

- Whether notice has to be given in any particular format;

- Whether notice has to identify the illegality or whether identifying the problematic content will do; and

- The relationship between constructive notice and Article 15, also bearing in mind the obligations of the diligent economic operator.

Facebook argued of course that a person complaining about content should use the tools provided by Facebook and provide rather precise information.  The Court, rightly, held that to require a particular format to be used but run counter to the aim (particularly with reference to the 2002 Regulations) of facilitating the ability of users to make complaints. It is less clear the position of the Court with regard to the need to provide URLs. The need to provide specific URLs makes it difficult for claimants especially those who seek orders for content to be taken down and to stay down (seen particularly in the field of intellectual property enforcement, for example even in L’Oreal). In this case, where the Court found Facebook liable CG had provided specific URLs, but the Court is silent on whether the lack of specific URLs was a determinative factor in the other instances.  It is submitted that, provided sufficient identifying information about the content is provided, precise URLs should not be required especially for a diligent economic operator (discussed below).

The Court focussed on the question of whether CG sufficiently identified the reason why the content is illegal. In this, the Court observes that the omission of the correct legal characterisation is not determinative; to have held to the contrary would undermine the ability of claimants without lawyers to have material taken down. The Court moves on to suggest that the relevant unlawful activity has to be apparent. It does not consider to whom such unlawfulness must be apparent, or indeed the prior question of whether the ECD requires just notification of content or activity perceived as illegal by the complainant, rather than a justification of why the complainant thinks that. While on the facts of this case there are concerns that CG referred to causes of action that were clearly wrong (e.g, defamation), it is arguable that the Court’s position needs further refinement. Certainly the Court’s approach on this aspect seems generous to Facebook in terms of what it needs to be told.

In this regard a number of comments can be made.  While, an operator would need to make an assessment about the legitimacy of a take down request, that is a separate issue from the fact of being notified that someone thinks some content is problematic. Further, there may a world of difference between what a man on the street might so recognise and that which the diligent economic operator should recognise and the detail required for that. Indeed, in L’Oreal, the ECJ held:

although  such  a  notification  admittedly  cannot  automatically  preclude  the  exemption  from  liability  provided  for  in  Article  14  of  Directive  2000/31,  given  that  notifications  of  allegedly  illegal  activities  or  information  may  turn out to be insufficiently precise or inadequately substantiated, the fact remains that such notification  represents,  as  a  general  rule,  a  factor  of  which  the  national  court  must  take  account  when  determining,  in  the  light  of  the  information  so  transmitted  to  the  operator,  whether  the  latter  was  actually  aware  of  facts  or  circumstances  on  the  basis  of  which  a  diligent economic operator should have identified the illegality (para 121-2).

This suggests that a diligent economic operator may not just rely on what a complainant said, but may have to take steps to fill in the blanks.  As the Commission reported in 2012, it has been suggested by some that the degree to which it is obvious that the activity or information is illegal should play a role in this assessment.  Some content is more obviously problematic than others. This position is not incompatible with the approach of the Court here: the problem for CG is that an address is not usually that problematic in privacy terms, it was the context (not apparent on the face of it) that made it so [para 69].  This distinction may have relevance for the AY litigation, if not the revenge porn case – depending on the nature of the images.

The final point of concern relates to general monitoring. The rejection by the Court of the possibility becoming aware of a particular type of content (as from the XY litigation) and being on notice as a consequence deserves further examination. This depends on what is meant by ‘general monitoring’ as opposed to a ‘specific’ monitoring obligation, accepted by recital 47 ECD, and recognised by the Commission in its 2012 Working Paper (p. 26).  It is unfortunate that the Court did not give this more attention. While case law has made clear that filtering of all content, for example, constitutes general monitoring (SABAM v Scarlet (Case C-70/10)), it has been argued- principally in the context of IP enforcement -that searching for a particular instance of content (re-occurring) is not.  Such a broad view of general monitoring as the Court here adopted also seems to decrease the space in which the diligent economic operator acts, raising questions about the meaning of L’Oreal.  Note also that the Commission in its recent review noted ‘there are important areas such as incitement to terrorism, child sexual abuse and hate speech on which all types of online platforms must be encouraged to take more effective voluntary action to curtail exposure to illegal or harmful content’ (COM/2016/0288 final).  This suggests that the Commission may expect such platforms to be proactive and not merely reactive. 

Perhaps the most significant point, and one on which a reference should perhaps have been made, is the relationship between the ECD and DPD, a point yet not dealt with in English law (see Mosley v Google [2015] EWHC 59 (QB)).  The Court accepted fairly readily that Facebook (Ireland) falls under the UK DPA, but then insists that despite the fact that data protection is excluded from the field of application of the ECD, that Facebook pages and comments fell within the “matter covered by the e-Commerce Directive” which provide a “tailored solution for the liability of [ISS providers] in the particular circumstances” set out in the ECD. It did not explain why, beyond asserting that the ECD safe harbour provisions do ‘not interfere with any of the principles in relation to the processing of personal data, the protection individuals ... or the free movement of data’ [para 95]. In this assessment, the Court overlooked the fact that under the DPD a remedy must be provided to individuals, so as to make effective their rights and, that the protection awarded to data subjects should not vary depending on the mechanism used for that processing.  Furthermore, Recital 14 to the ECD elaborates that

The protection of individuals with regard to the processing of personal data is solely governed by Directive 95/46/EC …..the implementation and application of this Directive should be made in full compliance with the principles relating to the protection of personal data.

Whilst a Member State was free to provide more far-reaching to protection to intermediaries, this freedom reaches its limit when it conflicts with another harmonised area of EU law, such as data protection. The Court’s position on this point, and especially its reasoning, in the light of the terms of both directives, is not convincing.

In sum, the outcome – liability for Facebook on one aspect of the content posted – sounds on the face of it a narrowing of immunity.  The reality points in a different direction. While there are a number of problematic issues with which the court had to deal, the impact of this judgment lies in the statements of general principle which the Court made. Significantly, these fell into areas ultimately governed by EU law, rather than purely domestic matters.  It is far from certain that those issues are clearly determined at EU level, nor that the Court’s assessment here is free from doubt.

Photo credit: