This is the second part of a two part post. The first part was published on 14 May 2015.
Whilst the question of the liability of internet intermediaries for damages is very interesting, in the vast majority of cases, all claimants want is for the damaging material to be removed from the internet.
Unfortunately, the question of what steps an internet intermediary can be ordered to take to remove unlawful material from the internet gives rise to an even more complex set of questions and, again, there are inconsistencies anomalies as between defamation and Article 8 claims on the one hand and data protections claims on the other.
Blocking injunctions
So called “blocking injunctions” under English law have mainly been a feature of copyright law where well-resourced content owners have clubbed together to force internet service providers to the block internet access for pirate websites (See Twentieth Century Fox v BT [2011] EWHC 1981 (Ch) and [2011] EWHC 2714 (“Newzbin 2”) and Dramatico Entertainment & Others v BSkyB & Others [2012] EWHC 268 (Ch) and [2012] EWHC 1152 (Ch) (“Pirate Bay”)).
Such blocking injunctions are specifically catered for in copyright and trade mark law Article 8(3) of the Information Society Directive (Directive 2001/29/EC Of The European Parliament And Of The Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society), Article 11 of the Enforcement Directive (Directive 2004/48/EC Of The European Parliament And Of The Council Of 29 April 2004 On The Enforcement Of Intellectual Property Rights) and in the UK by section 97A of the Copyright Designs and Patents Act 1988. The key threshold to meet in asking a court to grant such injunctions is that they can prevent both existing infringement and future infringement provided they are “effective, proportionate and dissuasive” (L’Oreal v eBay (2011 ECJ Case C-324-09).
However, many commentators thought that such injunctions in relation to future infringement applied only to to intellectual property claims, as provided for specifically in statute, until the recent case of Cartier International and Others v BskyB and others ([2014] EWHC 3354 (Ch)). In Cartier, the defendant internet service providers in the UK resisted an injunction sought to protect the claimants’ trade mark rights in certain luxury brands. The defendants submitted that an injunction would only be granted
“(i) where one party to an action can show that the other party has invaded, or threatens to invade, a legal or equitable right of the former, for the enforcement of which the latter is amenable to the jurisdiction of the Court; and (ii) where one party to an action has behaved, or threatens to behave, in a manner which is unconscionable” [104]
Arnold J rejected that submission and held that there were no such limits on the court’s jurisdiction; the Court’s power to grant injunctions is “unlimited” and can be exercised in new ways.
This decision paves the way for more creative use of injunctions by claimants in libel, Article 8 and data protection claims, provided they can meet the requirements of necessity, proportionality and dissuasiveness established in the eBay case. Indeed, Arnold J helpfully sets out in that judgment the types of factors that will be taken into account in assessing the proportionality of ordering an internet service provider to undertake technical blocking measures:
i) “The comparative importance of the rights that are engaged and the justifications for interfering with those rights.
ii) The availability of alternative measures which are less onerous.
iii) The efficacy of the measures which the orders require to be adopted by by the ISPs, and in particular whether they will seriously discourage the ISPs’ subscribers from accessing Target Websites.
iv) The costs associated with those measures, and in particular the costs of implementing the measures.
v) The dissuasiveness of those measures.
vi) The impact of those measures on lawful users of the internet.” [189]
The other key factor which the court must take into account in granting a blocking injunction is that the injunction must not impose on information society service providers a general monitoring obligation contrary to Article 15 of the E-Commerce Directive, which provides as follows:
“No general obligation to monitor
1. Member States shall not impose a general obligation on providers, when providing services covered by Articles 12, 13, and 14, to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.”
In determining what a “general” as opposed to a specific obligation to monitor is, regard should be had to Recital (47) which provides:
“Member States are prevented from imposing a monitoring obligation on service providers only with respect to obligations of a general nature; this does not concern monitoring obligations in a specific case and, in particular, does not affect orders by national authorities in accordance with national legislation.”
The distinction between “general” and “specific” was considered by the CJEU in the eBay case and subsequently by the High Court in Twentieth Century Fox Film Corp v British Telecommunications Plc ([2011] EWHC 1981 (Ch)) in which Arnold J held that an order intended to block access by BT’s subscribers to a particular website involved in copyright infringement did not fall foul of Article 15. Note in contrast that in Scarlet Extended SA v Societe Belge des Auteurs, Compositeurs SCRL (SABAM) (C-70/10) [2011] ECDR 4 a filtering system that would have required the ISP to itself identify file-sharing websites and then imposing a blocking mechanism did fall fall of Article 15.
There is therefore now a reasonably clear body of law that applies to injunctions against internet intermediaries to prevent the publication of unlawful material, whether on grounds of defamation, copyright, or Article 8 privacy and whether the unlawful publication is in existence or in the future; such injunctions can be granted but they must be necessary, proportionate and dissuasive.
Data protection claims
But what happens if the claim for an injunction is brought under the DP Directive/DPA, which, as stated above, specifically excludes the E-Commerce Directive, including the Article 15 anti-general monitoring provision? Surely, if the European legislators considered it necessary to prevent Member States imposing general monitoring obligations on internet service providers, then they also would have intended for such obligations to apply to internet service providers who are also data controllers?
This issue did not need to be decided upon in CG v Facebook Ireland because the DPA was found not to apply. A decision on this issue was also narrowly avoided in the Hegglin case, which settled shortly before trial. However, it will now be considered in the Mosley case. It is worth comparing Hegglin and Mosley in a little more detail.
The Hegglin case
Daniel Hegglin is a former Morgan Stanley banker and successful international businessman. He is a family man and keeps a low profile. He discovered that an anonymous individual had posted false and grossly offensive allegations on over 5,000 websites, over half of which were operated by Google. When his name was typed into Google, the search results were flooded with the unlawful material, which was causing a great deal of distress and seriously disrupting his business activities. He did not want damages or any kind of notoriety from litigating against Google; he simply wanted to stop this material from being the first thing people saw when family, friends, and business associates Googled his name.
After his initial take-down requests went unanswered by Google, he eventually served a section 10 DPA notice on Google asking for it to prevent the offensive material appearing in Google’s search results in the UK. Whilst Mr Hegglin could have sought damages from Google for defamation, harassment, breach of privacy and unlawful data processing, he restricted his claim to an injunction under the DPA so as to try to simplify the claim and discourage Google from defending the case and/or appealing any finding against it. Google did eventually start removing the material from Google.co.uk search results for name searches when specific URLs were provided but the process was taking so long that this had minimal impact on the search results. The material removed from Google.co.uk also continued to be available to anyone who searched Mr Hegglin’s name on Google.com. Mr Hegglin was therefore engaged in a very expensive and ineffective game of “whack-a-mole” and wanted Google’s assistance to block the material either as the material was posted or shortly after notification.
Several months later, Google served a costs budget to trial in excess of £1.6m (for approximately five months of work) and Mr Hegglin himself served a costs budget of approximately £600,000, notwithstanding his attempts to simplify the claim. His request for a cost budgeting order was the subject of a reported judgment in which the Court expressed considerable surprise at the costs that had been budgeted by Google ([2014] EWHC 3793 (QB)). Fortunately for Mr Hegglin, he was able to settle the case on a confidential basis on the day before trial but not before having to accept considerable press coverage of his case.
From a legal perspective, there were a number of questions left unanswered by this case, in particular the extent to which the remedies being requested by Mr Hegglin would be contrary to the anti-general monitoring principles of Article 15 of the E-Commerce Directive. From a practical perspective, it demonstrates that whatever the correct interpretation of the law, the system is failing to achieve an appropriate balance.
The Mosley case
Hot on the heels of the Hegglin case was the Mosley case and a claimant who does not appear to be shy about the prospect of a lengthy legal battle.
The background facts of Mosley are well known and have been played out in libel and privacy courts as well as on thousands of websites all over the world. He originally brought a claim for breach of his Article 8 privacy rights against News of the World and successfully won £60,000 damages. He then went on to recover libel damages in France before focussing his efforts on Google to remove the links to still photographs of his sexual activities that were still on the internet.
Unlike Hegglin, Mosley is seeking damages from Google both under the DPA and Article 8. However, like Hegglin, Mosley is also seeking an injunction requiring Google to take appropriate technical steps to prevent the publication of the unlawful material (in Mosley’s case images of his sexual activity) via Google’s search engine.
There are essentially two court ordered options that could provide a solution to Mosley. The first involves a system of notice and take-down whereby once Google is notified of the unlawful material at specific URLs, it is required to block the URL from appearing in its search results. The second is to adopt a technical solution to identify the unlawful material and either prevent it from appearing in the search results at all or block it as soon as it does appear in the search results. Mosley will argue that the former may not happen quickly enough to provide him with an effective remedy and that Article 15 of the E-Commerce Directive has no application to data protection claims. Google will argue that the latter amounts to an impermissible general monitoring obligation under Article 15 (even if any court order only applies to searches of Mosley’s name), which should be read in harmony with the DP Directive (relying on the Italian Court of Cassation case of Milan Public Prosecutor’s Office v Drummond 12 December 2013, at para 7.4).
At the interim hearing on 15 January 2015 Mr Justice Mitting did not need to decide which of these two positions is correct (although he did express a provisional view preferring Google’s harmony argument). Nor did he need to decide whether Mosley was entitled to damages (an issue parked until after the Vidal-Hall Court of Appeal hearing). He only needed to decide whether the case had a real prospect of success. In the end, whilst substantially ducking the Article 15 issue, he decided in favour of Mosley on the basis that regardless of whether the E-Commerce Directive and DP Directive should be read in harmony, they both provided for injunctive relief in broad terms.
It is therefore likely that in the absence of suitable undertakings or a settlement, Google will be ordered to do something and it will be for the trial judge to decide whether what is “effective, proportionate, and dissuasive” in this case and whether such an order needs to be framed in such terms so as not to amount to general monitoring.
The EU Charter
If it is correct that the E-Commerce Directive and the DP Directive can be read in harmony, in interpreting the “general monitoring” principle, the Court is likely to have regard to Articles 7, 8, and 47 of the EU Charter of Fundamental Rights (the “Charter“). Article 7 of the Charter provides that “everyone has the right to respect of his or her private and family life, home and communications“. Article 8(1) provides that “everyone has the right to the protection of personal data concerning him or her“. Article 47 provides that “everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article…”.
The effect of these provisions was considered by the Court of Appeal in Benkharbouche and Janah v Embassy of Sudan and others ([2015] EWCA Civ 33 at [69] to [85]) which found, amongst other things, that where there is a breach of a right afforded under EU law, Article 47 of the Charter is engaged; that the right to an effective remedy for breach of EU law rights provided for by Article 47 embodies a general principle of EU law; and that, subject to certain exceptions, that general principle has horizontal effect. These principles were reaffirmed by the Court of Appeal in the Vidal-Hall when finding section 13(2) of the DPA was inconsistent with Article 47.
The direction of travel therefore appears to be that privacy rights are achieving some kind of elevated status under EU law and that EU citizens have a guaranteed right to an “effective remedy” to prevent breaches of privacy – even if that remedy strays dangerously close to a general monitoring obligation. This would be the case whether the privacy right is framed in Article 8 terms or in DPA terms. However, in my view, if this is correct, any such “effective” remedy must still also be proportionate and dissuasive.
Jurisdictional issues
Even if Mosley succeeds in obtaining a remedy against Google Inc. in the UK, the English courts can only grant a remedy in respect of publication via Google’s search engine in England & Wales. It cannot, for example, order Google to remove the unlawful material from appearing on Google.com (or any other version of Google) in the United States, notwithstanding some ambitious views expressed by the Article 29 Working Party that Google ought to apply the “right to be forgotten” worldwide. Given that Mosley has an international reputation, it may therefore be that he will have to go globe-trotting again and Google will be forced to consider all of these issues in multiple territories across the world.
If Mosley does bring such claims, he will need to consider first which causes of action are available in the territory in question (whilst data protections laws are at least harmonised in Europe, libel laws vary considerably across the world). He will then need to consider whether he can establish jurisdiction against Google Inc. and whether permission is required to serve Google Inc. in California. He will then need to consider the jurisdictional scope of the remedies he can ask for and whether such remedies can be enforced. In other words, it will all get very complicated and very expensive.
Go straight to the webmaster?
Given the complications of going after Google, it might be said that Mosley and other claimants seeking to rely on the “right to be forgotten” should cut out Google and try instead to seek removal of the unlawful material from the webmaster (i.e. the person who operates the website – not necessarily the same person/entity that hosts the website). Indeed, where the webmaster is a responsible organisation which does not wish to publish unlawful material, this may well be the most effective route; it is certainly the most effective way of ensuring that the material does not appear on any search engines in any jurisdiction.
However, there are numerous reasons as to why claimants are targeting Google directly rather than complaining to webmasters. First, many webmasters cannot be contacted, are unresponsive, or have a very liberal understanding of the law, particularly those website operators whose business is to ensure users can post material anonymously. Secondly, both media organisations and non-media organisations may be able to benefit from the journalism exemption under section 32 of the DPA.
The journalism exemption
The journalism exemption under section 32 of the DPA allows the processing of personal data where (a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material; (b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and (c) the data controller reasonably believes that, in all the circumstances, compliance is incompatible with journalism.
Detailed guidance on this provision is provided in Steinmetz and others v Global Witness ([2014] EWHC 1186 (Ch)) and the ICO’s recent guidance “Data Protection and Journalism: A Guide for the Media” [pdf]. In particular, whilst the concept of journalism must be considered broadly (See the ECJ judgment in the Satamedia case (C-73/07)), media organisations seeking to resist requests for the removal of inaccurate, out of date, or irrelevant personal data contained in news articles will have to demonstrate a reasonable belief that the processing is in the public interest not at the time of publication but at the time when the request is received. For articles that are many years old and are only accessible via search engines or a focussed search on the newspaper’s online archive, this may be a challenge.
Conclusion
It seems like I have only touched on some of the issues that have been thrown up thanks to the Costeja case and I am already on page 15. There are many more – and this is just having regard to English law. If the position was not complicated enough for internet intermediaries before Costeja, it has just got a whole lot worse. Some clarity and consistency is needed.
When the DP Directive was enacted in 1996 and the E-Commerce Directive was enacted shortly after in 2000, Google had not long been established and was a long way off being the dominant search provider that it is today, Facebook and Twitter were several years away from existence, and mobile phones (without internet connection) were just starting to take-off. We now inhabit a completely different world and the way we find information has completely changed. The laws therefore need to change too – without simply trying to interpret old laws to fit new surroundings.
The drivers of this changing media world have been the technology companies, including Google, Microsoft, Facebook and Twitter. Such companies need to be free to innovate without the uncertainty of legal liability for content that they do not themselves publish and without having to employ armies of lawyers and paralegals to monitor content laws and complaints from across the globe. But some balance is needed. If an internet intermediary is the only person who can stop an individual from suffering serious damage from the publication of unlawful material on the internet, it is only right that it ought to do something to help if asked to do so, provided that any measures that it is required to employ are effective, proportionate and dissuasive.
But is it right to expect the internet intermediaries themselves to be the arbiters of what is unlawful, in the public interest, proportionate, effective, and dissuasive in 27 different jurisdictions across Europe? Whilst Google may have the legal resources to fight all of these points and pay damages and costs if it gets them wrong, smaller internet intermediaries (for example, Mumsnet) do not have that luxury. The legal uncertainty and potential liability for damages facing such intermediaries (whether under libel or data privacy law) means that it is becoming all too easy for claimants to abuse data protection laws to remove material which is in the public interest whilst those with genuine claims often face delay and complexity.
There is no easy answer but, in my view, instead of concentrating on reconciling complex conflicts between national and international content laws, more thought needs to be given to legal procedure, particularly the injunction procedure. One possible solution would be to introduce a cheaper, paper-based preliminary ruling procedure that does not require the issue of proceedings or court hearings.
Consideration should also be given to providing immunity from damages to internet intermediaries unless they breach a court order. If internet intermediaries did not face the risk of damages in relation to third party publication and if an independent and authoritative adjudication could be obtained more cheaply and simply without the need to issue proceedings (including by the intermediaries themselves in appropriate cases), many of the difficult cases could be resolved quickly and cheaply and the simple cases would continue to be dealt with by the internet intermediaries in accordance with their terms of use and take-down procedures.
It is also important that English and other European legislators do not over-regulate in an attempt to deal with these problems. Global internet companies cannot adopt a country by country approach to notice and take-down and, regardless of legislative change, need to adopt systems that can be applied consistently across Europe and beyond. The enactment of section 5 of the Defamation Act 2013 demonstrates this perfectly. The new section 5 defence for website operators includes a complex procedure aimed at dealing with anonymous online libel. It is barely used in practice because it is overly complicated and inconsistent with other European laws so as to be of little use to large internet intermediaries. Even if laws are successfully enacted in the next few years, the tech players will be several steps ahead and the law will quickly become outdated.
The more likely source of a solution to the problem of internet libel and privacy will come from the technology industry itself as new tools are developed to protect privacy and to find and weed out unlawful material from search engines and other websites. But in the meantime, it’s good news for media and data privacy lawyers and bad news for the armies of Google paralegals trying to unpick a mess of conflicting laws.
Ashley Hurst is a partner at Olswang specialising in particular in media and internet-related disputes.
