DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION Balancing Fundamental Rights on the Internet. Service Providers as Quasi-‐Constitutional Actors? Marco Bassini University of Verona
[email protected]
The paper aims at exploring how, as result of recent judicial achievements, private actors are playing a more and more significant role when it comes to balancing fundamental rights on the Internet. Notably, in the European scenario most of Internet operators are nowadays far from being considered merely service providers, also in light of the constitutional implications deriving from the nature of the activities carried out by the same. Against the background of the Directive 2000/31/EC, several issues have emerged pushing for more constitutional relevance of the role played by service providers. The Google Spain judgment, for instance, has revealed that Internet search engine service providers may be tasked with significant responsibilities with respect to the protection of personal data in their capacity as controller pursuant to the Directive 95/46/EC. While attaching such new liabilities to operators, however, the decision at the same time makes Internet service providers’ role crucial with regard to the protection of freedom of expression. This way, a new constitutional relevance emerges, since functions which are assumed to pertain to public authorities (judges and lawmakers) are now de facto exercised by private operators. It has therefore to be questioned whether this approach is appropriate at least in two respects. First of all, it is at issue whether the constitutional protection of values which enter into conflict on the Internet is likely to satisfactorily pass through functions performed by private operators. Balancing fundamental rights, in fact, should prima face rely on a public authority and the involvement of private actors is likely, as said above, to trigger a constitutional or quasi-‐constitutional relevance of the same. Secondly, the point is whether burdening Internet providers with new liabilities only reflects the crucial nature of their services for the protection of fundamental rights or, in a purely market view, is an option that is likely to discourage operators from targeting European residents when offering their services. In light of these remarks, the idea comes through that any process concerning the governance of the Internet lato sensu is unlikely to achieve far-‐reaching results when not properly considering the (whether undesirable or not) quasi-‐constitutional relevance of certain private actors.
1. Introduction. Internet providers towards ‘more’ responsibility? One of the most significant consequences of the digital (r)evolution of the last twenty years is that several legal categories have become obsolete. Regardless of the opportunity to introduce new legal instruments (or to adapt the existing ones) when it comes to facing the developments brought to light by the new technologies, sometimes legal regimes modeled on the basis of the characteristics of certain phenomena turns out to be ineffective. The steady evolution of the new technologies is posing several issues with respect to the degree of appropriateness of certain (even) recent pieces of legislation1. These changes may also
1
An example is provided by the Directive 95/46/EC (“Data Protection Directive”): even if this act is quite recent, it has proved to be ineffective vis-‐a-‐vis the challenges of the new digital technologies. The EU
1
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION reflect, to a certain extent, the complexity of the legal relationships taking place by virtue of the new technologies, most notable via the Internet. Against the prevailing technological-‐oriented view, also some constitutional nuances are involved in this process. An example that serves to make things clearer is offered by the legal regime concerning Internet service providers in the European Union, which is the subject of this paper2. The relevant legal framework has been set out by the so called ‘E-‐Commerce Directive’, which dates back to 20003. The provisions set forth in the Directive define the legal regime for operators providing Internet services in a way that mirrors the complexity of the role played by these actors in the information society, albeit at its very beginning in Europe. Two are the distinguishing features of this regime4. On the one hand, the absence of any general monitoring obligation on the shoulders of Internet providers. On the other hand, the Directive has laid downs a set of exemptions from liability which applies under condition that the provider has no actual knowledge or awareness of unlawful activities or information. This legal regime is clearly inspired by the purpose of limiting intermediaries’ liability for any unlawful activity or information transmitted or stored via their services. As noted, this legal regime has key implications also from a constitutional point of view, as it aims at reaching the widest possible circulation of contents. However, this legal framework is nowadays more and more called into question, and also its constitutional implications seems to be relevant. The purpose of the present paper is to describe the main trends that are affecting the regime of Internet service providers as result of recent judicial achievements, in order to highlight the quasi-‐ constitutional relevance that these actors have assumed in the information society. Two main trends will be now discussed. First, the attempts made by various domestic courts to reduce the scope of the liability exemptions by interpreting restrictively the relevant provisions of the E-‐Commerce Directive on the basis of the difference between ‘active’ and ‘passive’ providers. Second, the paper will more in detail focus on the recent decision of the Court of Justice in the Google Spain case and on the consequences of qualifying search engine providers as data controller pursuant to the Data Protection Directive (Directive 95/46/EC). Having explored the above, some remarks concerning the critical points posed by these trends will be drawn.
institutions have then started to consider a proposal to reform this legal framework which aims at replacing the Directive with a new Regulation on data protection. 2 See O. Pollicino and E. Apa, Modeling the Liability of Internet Services Providers: Google vs. Vivi Down. A Constitutional Perspective, Milan, 2013. 3 Directive 2000/31/EC (“E-‐Commerce Directive”). 4 See P. Von Eecke, ‘Online service providers and liability: a plea for a balanced approach’, 48 CML Review (2011) 1455.
2
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION 2. Internet service providers: active versus passive? (passim) The Court of Justice of the European Union and a number of domestic courts of Member States are interpreting the legal provisions applying to Internet service providers under EU law in light of the evolution of the respective services over the time. More in details, it has to be noted that behind the liability exemptions set forth by the E-‐ Commerce Directive was the assumption that Internet providers acted in a purely passive manner, without exercising any control over the content transmitted5. This was the main reason why the approach adopted by the E-‐Commerce Directive was to hold providers immune from liability on the assumption they had no control over contents. However, these services have reached a high level of complexity since the Directive came into force. While at the time the relevant legal framework was set out there were no difficulties to determine whether an Internet service provider was acting or not in a passive way, to date the growing complexity of these services has led to a number of cases where it is disputable that a provider enjoys exemptions from liability. Therefore, it is for courts to determine whether the exemptions established by the Directive shall apply. Depending on the circumstances of the case, courts have assessed whether the conditions for the liability exemptions were met or not6. Some domestic courts, such as the Italian ones, have provided a peculiar construction of these provisions. Most notably, as far as hosting providers are concerned, the Italian courts have created a kind of hybrid by carving out the legal paradigm of the ‘active hosting provider’ in the wake of the decisions of the Court of Justice of the European Union in the Google/Louis Vuitton 7 and eBay/L’Oréal 8 cases. This notion, in the construction given by several judgments by Italian courts9, includes those service providers that do not operate in a purely passive way and, thus, could not benefit of the liability exemptions in case unlawful information or contents are transmitted or stored10.
5
This view is reflected by the Recital 42 of the Directive, which reads as follows: ‘The exemptions from liability established in this Directive cover only cases where the activity of the information society service provider is limited to the technical process of operating and giving access to a communication network over which information made available by third parties is transmitted or temporarily stored, for the sole purpose of making the transmission more efficient; this activity is of a mere technical, automatic and passive nature, which implies that the information society service provider has neither knowledge of nor control over the information which is transmitted or stored’. 6 In particular, the courts have taken into account that some Internet service providers were no longer operating as mere intermediaries by reason of certain features that were not essential for their functioning. The applicability of the liability exemptions is questioned, for instance, when it comes to search engine providers which ‘suggest’ how to complete the keyword in the queries or to the so called ‘user-‐generated-‐ content’ platforms where the contents posted by users are classified into different categories or coupled with advertising messages mirroring the type of content visited or researched by the user. 7 CJEU, 23 March 2010, C-‐236/08 to 238/08, Google France SARL and Google Inc. 8 CJEU, 12 July 2011, C-‐324/09, L’Oréal and others. 9 See Court of Rome, 20 October 2011; Court of Milan, 9 September 2011; Court of Milan, 20 January 2011; Court of Appeals of Milan, 21 December 2012; Court of Turin, 5 May 2014; Court of Turin, 23 June 2014; Court of Appeals of Milan, 7 January 2015. 10 According to the Italian case law, a provider may qualify as active hosting provider, for instance, when the terms and conditions entered into by the parties provides the exercise of control on the information, when advertising messages related to the contents are displayed or when unlawful contents have been uploaded directly by the provider. It is disputed whether such qualification occurs when contents are indexed or selected, or when the provider has established a notice-‐and-‐take down procedure.
3
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION These operators are not ipso facto treated in the same way as content providers, but having something plus (‘quid iuris’) than passive providers may most likely face liability for unlawful activities such as copyright infringements or defamatory comments: they are supposed, in other terms, to have ‘actual knowledge’ of the unlawful contents and supposed to remove the same without a prior notice by the competent authority (as required by the Directive in the case of passive providers). Then, the model of liability foreseen in the E-‐Commerce Directive, as interpreted by some domestic courts, seems to be revisited as a consequence of the growing up of Internet services. This view of Internet providers, most notably of the hosting providers, as actors which are no longer to be regarded as mere intermediaries impacts also on the protection of certain fundamental rights: freedom of expression is of course the crucial value at stake when the role of Internet providers is affected by these interpretative trends. 3. Google Spain: more than an Internet search engine service provider The very constitutional relevance of the role of Internet providers emerges when it comes to consider different legal regimes which may apply to the same operator. In this respect, the Google Spain11 judgment delivered by the Court of Justice of the European Union has marked a point of no return while clarifying that search engine providers do also meet the definition of ‘data controllers’ pursuant to the Data Protection Directive. Then, the judgment rendered by the Court in this case constitutes a useful case-‐study to bring to light the constitutional implications which are now related to the role played by Internet service providers12. Here, the view expressed by the Court is not based on a different application of the provisions concerning Internet service providers, but rather rests on the complexity of the role that the Internet providers play nowadays in the information society. The ruling, which has given rise to a number of comments, marked a very significant turning point since, on one hand, it boosted a renewed interpretation of the EU data protection legislation while, on the other, it significantly affected, although indirectly, on the regime of liability of Internet service providers. Labeled as an explicit and long-‐awaited statement of the right to be forgotten, the judgment has a very broad subject but impacts especially on the position of the operators of search engines. Indeed, referring to the ‘right to be forgotten’ as such sounds perhaps improper, as long as this expression is meant as the claim of an individual to obtain the removal from the Internet of news or piece of information that he/she considers outdated or no longer of public interest. The Court of Justice, in fact, focused exclusively on the role of search engines and on the responsibilities that they bear as data controllers with respect to the indexing of news contained on web pages or websites operated by third parties. By supporting an interpretation of the relevant provisions of the Data Protection Directive contrary to the view expressed by the Advocate General in his Opinion13, the Court of Luxembourg
CJEU, C-‐131/12, 13 May 2014, Google Spain, Google Inc. See O. Pollicino and M. Bassini, ‘Reconciling Right to be Forgotten and Freedom of Information in the Digital Age. Past and Future of Persona Data Protection in the EU’, 2 Diritto pubblico comparator ed europeo (2014), 640. 13 Opinion of the Advocate General Jääskinen, 25 June 2013, C-‐131/12, Google Spain, Google Inc. 11 12
4
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION has considerably (even though indirectly) expanded the scope of liability of the Internet search engine service providers. The key assumption of the Court is that these operators do actually qualify as data controllers pursuant to the Data Protection Directive. According to Article 2(d) the Directive 95/45/EC, in fact, the data controller is defined as ‘the natural or legal person … which alone or jointly with others determines the purposes and means of the processing of personal data’. Thus, if Internet search engine service providers meet the definition of ‘data controller’, this leads significant implications for this category of operators. Most notably, the same are bound by the obligations which are established by the Data Protection Directive with respect to the data controller, including the obligations to comply with the data subject’s requests with respect to their personal data. So, while on one hand a search engine provider can enjoy ‘as such’ the liability exemptions laid down by the E-‐Commerce Directive, on the other one may face additional obligations set forth by the Data Protection Directive, to the extent the operator is found to match the definition of data controller. The preliminary ruling that gave rise to the decision of the Court of Justice concerned a point which ranks among the most debated in several Member States: the possibility for the concerned individuals to obtain the removal of the results generated by search engines relating to news considered no longer of public interest, without prior consulting the owner of the website being indexed. As noted, this claim sounds slightly different from a proper right to be forgotten meant as a right to ‘disappear’ from the Internet. However, providing individuals with such an instrument is supposed to allow individuals to protect themselves from the main source of harm for the protection of personal identity and reputation when it comes to the Internet, namely the search engines. The same search engine on the shoulders of which the protection of some constitutional interests relies. The very critical point lies with the Court of Justice choice to place in the hands of private actors, such as Internet search engine service providers, the power to handle individual requests to obtain the removal of personal data. Said decision, in fact, is supposed to entrust search engine operators with the function of balancing the right to data protection with the other fundamental rights at stake, namely freedom of expression and freedom to conduct business. According to some scholars, this could attach a quasi-‐constitutional status to Internet providers14. The reasoning of the Court which led to this conclusion has followed gradual steps. First, the Court has stated that the activity carried out by a search engine, consisting of the indexing and display as search results of the content of third parties websites constitutes a processing of personal data pursuant to the Data Protection Directive. This notion, under Article 2, lit. b) of the Directive 95/46/ EC, is very broadly defined, so this first point is not disputed and does not raise critical issues. The crucial point is rather the following step taken by the Court of Justice, when it comes to answering the question whether a search engine qualifies as data controller. Here the line of reasoning of the Court of Justice diverges from that of the Advocate General. The latter, in fact, had concluded that only under exceptional circumstances a search engine provider could qualify as data controller. In Jääskinen’s view, in fact, the mechanical and automated indexing of information (not necessarily containing personal data) retrieved from third parties web
See O. Pollicino, ‘Google rischia di «vestire» un ruolo para-‐costituzionale’, Il Sole 24 Ore, 15 May 2014.
14
5
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION sites was such to exclude that the search engine was determining means and purposes of the processing and thus qualifying as data controller15. The Court of Justice, on the contrary, has found that an Internet search engine provider acts as data controller: to hold differently, according to the Court, would be contrary not only to the wording of the provision but also to its purpose, which is to provide a notion sufficiently wide of controller in order to grant effective protection to individuals and their personal data16. In this step the judges seem to fall into a clear excusatio non petita: the Court seeks a broad definition of data controller for the sake of a comprehensive protection of the data subjects. However, this assumption is not free of consequences for Internet search engine service providers, as it triggers significant consequences in term of legal obligations, the same obligations that in the view of the Advocate General the search engine ‘cannot in in or in fact fulfill’. This way, in fact, the Court makes the same provisions concerning the data controller under the Data Protection Directive applicable to the Internet search engine service providers. In particular, among others, the provisions applying to Google in the case were Article 12, lit. b), allowing individuals to ask the controller for the erasure, blocking or rectification of personal data and Article 14, par. 1, lit. b), which establishes the right of data subjects to object to the processing of personal data. By coupling these provisions with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, the Court of Justice provides the right to be forgotten in this peculiar ‘right to delisting’ version with legal grounds, making the claim to the removal of personal data enforceable against Internet search engine service providers. Making, thus, the right to data protection enforceable against the freedom to impart and search information. It is worth remarking some critical aspects which bring to light the nature of quasi-‐ constitutional actors of Internet service providers . First, the Court has failed to laid down at all any criteria on the basis of which the search engine provider is required to carry out a balance between the protection of personal data and the protection of other interests such as freedom of expression. In particular, the Court has not even mentioned Article 11 of the Charter in the judgment. The impact on freedom of expression is even more clear if one considers that the removal from the search results is possible without a prior consultation of the web site owner. If a right of the web site owner to have its site ‘indexed’ has probably no legal grounds, there is a competing general interest of individuals to find and research information, which constitutes essential profiles of the freedom of information. Additionally, the threat to the protection of freedom of speech is even more serious if one considers that restrictions on fundamental rights do generally rest in the hands of judges, as any limitations should be grounded on an order by the judicial authority. This is not the case, as the restriction on the possibility for users to access information only depends on the discretionary assessment of the individual complaint by the search engine.
15
Opinion, p. 89: ‘the internet search engine service provider cannot in law or in fact fulfill the obligations of controller provided in Articles 6, 7 and 8 of the Directive in relation to the personal data on source web pages hosted on third-‐party servers. Therefore a reasonable interpretation of the Directive requires that the service provider is not generally considered as having that position’. 16 CJEU, C-‐131/12, p. 34: ‘it would be contrary not only to the clear wording of that provision but also to its objective — which is to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects — to exclude the operator of a search engine from that definition on the ground that it does not exercise control over the personal data published on the web pages of third parties’.
6
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION It has to be pointed out that the judgment of the Court of Justice does not prevent individuals from bringing their claims before the competent judicial and administrative authority, either directly or in case the request is rejected by the search engine. However, the lack of a judicial review still constitutes a critical point of the decision. The Court of Luxembourg has correctly underlined that the processing of personal data carried out by the search engine is autonomous and separate from that of the owner of the web site where the retrieved news were originally published. Notwithstanding, the judgment has set out no criteria for the balance between opposite interests at stake. And also, nothing is said with respect to the purposes for which the processing by the search engine is carried out. The Court of Justice has only clarified that the Internet search engine service provider does not enjoy the exemptions laid down with regard to the processing for journalistic purposes by Article 9 of the Data Protection Directive from the obligations, among others, to obtain the consent of the data subjects. Also, the Court has paid no regard to the freedom to conduct business which enjoys likewise protection under Article 16 of the Charter of Fundamental Rights of the European Union. As detailed below, the decision seems to go against the business model that is mirrored by the legal regime of Internet service providers outlined by the E-‐Commerce Directive, at least as long as the category of the search engines is concerned. In the reasoning, however, the Court has underestimated the consequences for the operators, which may thus encounter obstacles while doing their business. Having said that, against this background Article 1(5)(b) of the E-‐Commerce Directive itself states that the Directive shall not apply to questions relating to information society services covered by Directive 95/46/EC. Relying on this provision to exclude any debate concerning the evolution of the role of Internet service providers, however, would seem to me too much simplistic. Furthermore, the exact meaning of this provision, as well as its scope, still remain unclear: some domestic courts have tried to enforce this safe harbor but these attempts, as in the Italian Google Vivi Down case, did not lead to significant results. In any cases, should one assume that the liability exemptions do not apply when it comes to data protection issues, this interpretation would not affect the idea that Internet service providers are moving towards a new legal model, reflecting the constitutional relevance of their role. Then, regardless of the application of the liability exemptions laid down by the E-‐Commerce Directive, the Internet search engine service providers are now bound by the obligation stemming from the role of ‘data controller’. The Court of Justice, then, has acknowledged that different legal regimes may apply to operators which match different status. Internet search engine service providers, in light of the foregoing will continue to benefit from the exemptions from liability established by the E-‐Commerce Directive with respect to the unlawful activities carried out by its services. While, in their capacity as data controllers, will be bound by the obligations provided by the Directive 95/46/EC. It goes without saying that, as a consequence of the judgment of the Court, the favor behind the legal regime of Internet service providers has been undermined. Conversely, the scope of liability of the same has been extended. Said extension is an effect, first of all, of having made enforceable against search engine operators the rights that data subjects are entitled to under the Data Protection Directive. A few weeks after the judgment, Google has implemented a web site to allow individuals to ask the search engine to remove results for queries that include their name.
7
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION If, on one hand, the activity carried out by a private operator like Google mirrors the relationship between data subjects and data controller, on the other one the removal of search results arises out of a balance between the right to data protection and the freedom of expression. Then, the power to restrict the exercise of a fundamental right rests in the hands of private actors instead of a public authority. Not all the relationships between data subjects and data controllers are such as to assume public relevance: it is by virtue of the nature of search engine of the data controller that the removal (or the reject) of personal data acquires the nature of a restriction on freedom of expression for the sake of protection of personal data. This confirms, more than other factors, the quasi-‐constitutional status of the search engine providers. 4. The aftermath of the judgment Google Spain. Concluding remarks As a reaction to the questions left unanswered by the decision of the Court of Justice, both the Google Advisory Council on the Right to Be Forgotten and the Article 29 Data Protection Working Party have handed down respectively a report17 and an opinion18 focusing on the criteria for the removal of search results. Nothing can explain better than that the overlap between private and public functions. Two bodies, i.e. the independent committee appointed by the leading private operator in the market of search engines and the entity where the national data protection authorities of the Member States are represented, have taken similar steps in order to resolve the uncertainties of the decision of the Court of Justice. Without entering into the merits of these documents, it seems that the report adopted by the private actor (Google) would most likely have more significant effects than the resolution of the institutional body where the European data protection authorities sit. The latter, in fact, is intended to provide data protection authorities and judges with some guidelines as to the interpretation of the relevant provisions of the Data Protection Directive. The report issued by the Advisory Committee to Google, instead, reflects the point of view (even though through the eyes of an independent body) of the leading worldwide Internet search engine provider, which was concerned as party of the proceedings before the Court of Justice and is the first (although not exclusive) addressee of the most part of the requests of removal filed by individuals. However, the criteria set forth in the report of the Google committee are of course tailored to the nature of private operator of the search engine provider. Private powers vs. public powers? Here, the contrast between the power of the market and the power of public authorities is even more clear. Thus one could question whether the rules laid down in this respect do actually fulfill the general interest of the public to a sound balance between the protection of personal data and other competing rights. The criteria set forth by a private actor, indeed, are likely to be more ‘business-‐ oriented’ than ‘fundamental rights oriented’: in other terms, Google will take into account the value of freedom to conduct business when counterweighing the balance with the right to be forgotten. At the same time, the judgment of the Court has exposed any Internet search engine service provider to the risk to face claims of ‘censorship’ or undue restrictions on freedom of expression by the
17
The Advisory Council to Google on the Right to Be Forgotten, 6 February 2015. Article 29 Data Protection Working Party, Guidelines on the Implementation of the Court of Justice of the European Union Judgment on "Google Spain and Inc. v. Agencia Española de Protección de Datos(AEPD)and Mario Costeja González” C-‐131/12, 26 November 2014, WP 225 14/EN.
18
8
DRAFT VERSION – PLEASE DO NOT CITE WITHOUT PERMISSION concerned web sites’ owners in the cases where the right to data protection is found to prevail over freedom of expression. In light of the foregoing, may a trend toward ‘more responsibility’ be justified? While it would be easy to rely on the assumption ‘the more one enjoys freedom, the more the same faces responsibility’ (very similar to the principle ‘ubi commoda, ibi et incommoda’ derived from the Roman Law), this conclusion should be rejected. It is not by burdening private operators which perform functions having constitutional relevance with more liability that the protection of the fundamental rights at issue is strengthened. Rather, it is the switch from a purely ‘business-‐oriented’ view to a ‘fundamental rights sensitive’ approach that may lead to a reasonable balance among the competing interests involved, whose protection nowadays necessarily pass through the role even (but not limited to) of private operators.
9
