Posts Tagged Internet
Swamdi Ramdev v Facebook, Google, Youtube et al at the Delhi High Court: Worldwide removal ordered without much hesitation.
Update 14 November 2019 the judgment is, unsuprisingly, being appealed.
‘The race between technology and the law could be termed as a hare and tortoise race – As technology gallops, the law tries to keep pace.’ (see further below).
Thank you Daphne Keller for flagging CS (OS) 27/2019 Swami Ramdev et al v Facebook et al at the Delhi High Court on 23 October. Defendants are Facebook Inc, Google Inc, YouTube LLC, Twitter etc. The allegation of Plaintiffs is that various defamatory remarks and information including videos, found earlier to have been defamatory (a judgment currently before the Supreme Court without having been stayed), are being disseminated over the Defendants’ platforms.
At 6 Prathiba M Singh J summarises the parties’ position: None of the Defendants have any objection to blocking the URLs and disabling the same, insofar as access in India is concerned. However, all the Defendant platforms have raised objections to removal/blocking/disabling the impugned content on a global basis. On the other hand, the Plaintiffs argued that blocking merely for the Indian territory alone is not sufficient as the content would be accessible through international websites, which can be accessed in India. Thus, according to the Plaintiffs, for the remedy to be effective, a global blocking order ought to be passed.
Particularly in the review of plaintiff’s submission at 8 ff, the parallel is clear with the discussions on the role of intermediaries in Eva Glawischnig-Piesczek v Facebook. Reference of course is also made to Equustek and, at 64, to the CJEU in Google v CNIL. Facebook refers to the material difference between defamation laws across the globe: at 10: ‘Defamation laws differs from jurisdiction to jurisdiction, and therefore, passing of a global disabling order would be contrary to the principle of comity of Courts and would result in conflict of laws.’
At 44 ff Prathiba M Singh J extensively reviews global precedent, and, at 69, to Eva Glawischnig-Piesczek v Facebook. At 88 ff this leads justice Singh
Firstly, to uphold fairly straightforwardly the court’s power to order global delisting given the origin in India of the original act of uploading: ‘The act of uploading vests jurisdiction in the Courts where the uploading takes place. If any information or data has been uploaded from India on to a computer resource which has resulted in residing of the data on the network and global dissemination of the said information or data, then the platforms are liable to remove or disable access to the said information and data from that very computer resource. The removal or disabling cannot be restricted to a part of that resource, serving a geographical location.’
>>>Clearly the authority of the finding (likely to be appealed) may therefore be limited to situations of content uploading from inside the jurisdiction.
Further, at 99, to make an effectiveness argument: ‘it is clear that any order passed by the Court has to be effective. The parties before this Court i.e. the platforms are sufficiently capable to enforce an order of global blocking. Further, it is not disputed that the platforms are subject to in personam jurisdiction of this Court.’
>>>The latter element, again, may limit the authority of the judgment. I am not au fait with the ground for jurisdiction in the case at issue.
Finally, at 91: ‘The race between technology and the law could be termed as a hare and tortoise race – As technology gallops, the law tries to keep pace’. This does not imply the law simply laying down to have its belly rubbed. Exactly my sentiment in my post on the UK AI case.
(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 126.96.36.199, Heading 188.8.131.52.5
Steady now. Eva Glawischnig-Piesczek v Facebook. The CJEU on jurisdiction and removal of hate speech.
My interest in C-18/18 Eva Glawischnig-Piesczek v Facebook as I noted in my short first review of the case, concerns mostly the territorial reach of any measures taken by data protection authorities against hosting providers. The Court held last week and o boy did it provoke a lot of comment.
The case to a large degree illustrates the relationship between secondary and primary law, and the art of reading EU secondary law. Here: Article 15 of the e-commerce Directive 2001/31 which limits what can be imposed upon a provider; and the recitals of the Directive which seem to leave more leeway to the Member States. Scant harmonisation of tort law in the EU does not assist the Institutions in their attempts to impose a co-ordinated approach.
The crucial issue in the case was whether Article 15 prohibits the imposition on a hosting provider (Facebook, in this case) of an obligation to remove not only notified illegal content, but also identical and similar content, at a national or worldwide level? The Court held the Directive does not as such preclude such order, and that as to the worldwide injunctive issue, EU law has not harmonised and that it is up to the Member States to direct in any such orders in compliance with public international law.
The judgment to a large degree concerns statutory interpretation on filtering content, which Daphne Keller has already reviewed pre the judgment succinctly here, Dan Svantesson post the judgment here, as did Lorna Woods, and a frenzied Twitter on the day of the judgment e.g. in this thread. A most balanced analysis is provided by Andrej Savin here. e-Commerce law is not the focus of this blog, neither my professed area of expertise (choices, choices). I do want to emphasise though
- that as always it pays to bear in mind the CJEU’s judicial economy. Here: the need to interpret its judgment in line with the circumstances of the case. As Steve Peers noted, the Austrian court had ruled that the post was defamatory, which is a recognised basis for limiting freedom of expression; see also at 40: ‘In that regard, it should be made clear that the illegality of the content of information does not in itself stem from the use of certain terms combined in a certain way, but from the fact that the message conveyed by that content is held to be illegal, when, as in the present case, it concerns defamatory statements made against a specific person.‘ Nota bene, the same need to read the judgment in context goes for the earlier Google v CNIL case, applying Directive 95/46 and the GDPR, which I review here.
- that speaking strictly as a member of the public who has seen the devastating effect of ‘social’ media on people close to me, the technical discussions on filtering (‘what filter does the CJEU think might possibly ever be available to FB to remove content in the way the Court wishes’) are emphatically beside the point. The public justifiably are not interested in the how. A service is offered which clearly has negative effects on EU citisens. Remedy those effects, or remove the service from those citisens. That is true for the negative impacts of goods (in 25 years of regulatory Bar practice I have seen plenty of that). There is no reason it should be any less true for services.
The jurisdictional issues are what interest me more from the blog’s point of view: the territorial scope of any removal or filtering obligation. In Google viz the GDPR and the data protection Directive, the Court confirmed my reading, against that of most others’, of Szpunar AG’s Opinion. EU law does not harmonise the worldwide removal issue. Reasons of personal indemnification may argue in specific circumstances for universal jurisdiction and ditto reach of injunctive relief on ‘right to be forgotten’ issues. Public international law and EU primary law are the ultimate benchmark (Google V CNIL). It is little surprise the Court held similarly in Eva Glawischnig-Piesczek, even if unlike in Google, it did not flag the arguments that might speak against such order. As I noted in my review of Google, for the GDPR and the data protection Directive, it is not entirely clear whether the Court suggests EU secondary law simply did not address extraterritoriality or decided against it. For the e-commerce Directive in Eva Glawischnig-Piesczek the Court notes at 50-52
Directive 2000/31 does not preclude those injunction measures from producing effects worldwide. However, it is apparent from recitals 58 and 60 of that directive that, in view of the global dimension of electronic commerce, the EU legislature considered it necessary to ensure that EU rules in that area are consistent with the rules applicable at international level. It is up to Member States to ensure that the measures which they adopt and which produce effects worldwide take due account of those rules.
In conclusion, Member States may order a host provider to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law. To my knowledge, the Brussels Court of Appeal is the only national court so far to consider public international law extensively viz the issue of jurisdiction, and decided against it, nota bene in a case against Facebook Inc.
Any suggestion that the floodgates are open underestimates the sophisticated engagement of national courts with public international law.
In general, the CJEU’s approach is very much aligned with the US (SCOTUS in particular) judicial approach in similar extraterritoriality issues (sanctions law; export controls; ATS;…). There is no madness to the CJEU’s approach. Incomplete: sure (see deference to national courts and the clear lack of EU law-making up its legislative mind on the issues). Challenging and work in progress: undoubtedly. But far from mad.
(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 184.108.40.206, Heading 220.127.116.11.5.
BVC v EWF. The High Court on personality rights, internet and centre of interests in echoes of Bolagsupplysningen and e-Date. Suggests court with full jurisdiction is required for orders restraining further publication.
In BVC v EWF  EWHC 2506 (QB) claimant applied for summary judgment in a claim for misuse of private information and harassment. The privacy claim arises from internet publication, on a website created by the defendant, of his account of his relationship with claimant. The harassment claim arises from a series of email communications from the defendant to claimant over a period of some two years, and from publication of the website itself.
An ex parte injunction had been granted earlier. The Defendant was restrained from contacting or harassing claimant, from publishing the website or any of its contents to the world at large, and from publishing any of the information set out in a confidential schedule, or any information which was liable to or might identify the claimant as a party to the proceedings or as the subject of the confidential information
In current proceedings defendant (a UK national) submits he is domiciled in Switserland. This triggers the Lugano Convention.
Parkes J clearly had to consider Article 5(3) Lugano’s special jurisdictional rule for tort (the BIa equivalent of course is now Article 7(2), hence also applying e-Date and Bolagsupplysningen. Steyn DJ had earlier rejected defendant’s arguments. At 33: ‘She held, in short, that the Claimant had a good arguable case that this jurisdiction was the state in which he had the centre of his interests, and that in any event a real and substantial tort (namely misuse of private information) had been committed within the jurisdiction. She also ordered that the steps already taken to bring the Claim Form and orders of 27 June and 4 July 2018 to the Defendant’s attention (namely, service by email) constituted good service on him, notwithstanding that he claimed he was domiciled in Switzerland at the date of receipt of the documents, not (as had been believed) in this jurisdiction.’
Defendant (praised nb by Parkes J for his ‘brief but enlightening written submissions’) however continues to challenge the jurisdiction, jumping at the chance to bring it up again when claimant referred to his centre of interests in his PoC (Particulars of Claim), and employing the distinction which the CPR makes between challenges to existence and exercise of jurisdiction (notwithstanding authority (see at 39) that despite the distinction claims viz the two need to be brought concurrently).
He essentially (at 43) posits the court reconsider
‘whether Article 7(2) RJR is ‘to be interpreted as meaning that a natural person who alleges that his personality rights have been infringed by the publication of information concerning him on the internet may have his centre of interests in a Member of State where he is not habitually resident, where he has no ongoing professional connections or employment, no home, no income and no immediate family’. In his letter to the court of 18 June 2019, the Defendant puts it this way: ‘… with no permission to appeal the judgment of Karen Steyn QC, if the court continues to accept the Claimant’s centre of interests is in England and Wales despite very clear evidence to the contrary then it is necessary to refer the question of interpretation to the ECJ pursuant to Article 267 of the TFEU’.
At 44 Parkes J dismisses the suggestion of preliminary review to Luxembourg. That route is ‘not designed to provide a route of appeal against judicial evaluation of evidence of fact.’ In conclusion, re-opening of the discussion on jurisdiction is rejected, referring finally to Lord Green in Kaefer:”it would not be right to adjourn the jurisdiction dispute to the full trial on the merits since this would defeat the purpose of jurisdiction being determined early and definitively to create legal certainty and to avoid the risk that the parties devote time and cost to preparing and fighting the merits only to be told that the court lacked jurisdiction“.
Arguments on submission to the jurisdiction where not entertained: whether service of a defence, and the making of an application to strike out qualify as ‘submission’ becomes otiose when that jurisdiction has already been unsuccessfully challenged.
Then follows extensive discussion of the factual substance of the matter, which is less relevant for the purposes of this blog. Hence fast forward to 150 ff where the issue of jurisdiction to issue an injunction prohibiting re-publication of the material is discussed (in case: re-offering of the website on WordPress or elsewhere). At 158 ff this leads to a re-discussion of Bolagsupplysningen where the Court held that where a claimant seeks an injunction to rectify or remove damaging material from the internet, he can only do so only in a State with full jurisdiction. Parkes J at 160 suggests this is only in the state where the defendant is domiciled (the general rule, as stated by Art 2(1) Lugano and Art 4(1) RJR), or (by virtue of the special jurisdiction: Art 5(3) Lugano and Art 7(2) RJR) in the state where he has his centre of interests, and not before the courts of each member state in which the information is accessible.
I believe Parkes J on that point omits locus delicti commissi. At the time of my review of Bolagsupplysningen I suggested the judgment was bound to create a need for further clarification: Shevill and e-Date confirm full jurisdiction for the courts of the domicile of the defendant, and of the locus delicti commissi, and of the centre of interests of the complainant. These evidently do not necessarily coincide. With more than one court having such full jurisdiction positive conflicts might arise.
Of more importance here is that Parkes J (obiter) at 163 suggests that the requirement of full jurisdiction, also applies to orders restraining any further publication and not just as the Grand Chamber held limited by the facts in Bolagsupplysningen, to orders for rectification and removal. In doing so he follows the in my view correct suggestion made by Dr Tobias Lutzi (‘Shevill is dead, long live Shevill!’, L.Q.R. 2018, 134 (Apr), 208-213) viz divisible cq indivisible remedies – update 28 September 2019 although the issue is not free of discussion. Graham Smith for instance suggests the potential for geo-blocking as a valid argument to grant jurisdiction for restraining further publication on an Article 7(2) locus damni basis.
Note also the cross-reference to Saïd v L’Express on the limitation of Bolagsupplysningen to injunctive relief: for damages, the full mosaic implications remain.
Conclusion: Claimant is entitled to summary judgment for a final injunction to restrain further misuse of his private information
(Handbook of) European Private International Law, 2nd ed. 2016, Chapter 2, Heading 18.104.22.168.
Court of Justice in Google v CNIL sees no objection in principle to EU ‘Right to be forgotten’ leading to worldwide delisting orders. Holds that as EU law stands, however, it is limited to EU-wide application, leaves the door open to national authorities holding otherwise.
Many commentators were wrong-footed on reading Advocate-General Szpunar’s Opinion in C-505/17 Google Inc v Commission nationale de l’informatique et des libertés (CNIL), concerning the territorial limits to right to have search results delisted, more popularly referred to as ‘the right to erasure’ or the ‘right to be forgotten’ (‘RTBF’ – a product of the CJEU in Google Spain). Far from ruling out ‘extraterritorial’ or worldwide force of the right, the AG saw no objection to it in principle, even if he suggested non-application to the case at issue (he did so again in his Opinion in C-18/18 Eva Glawischnig-Piesczek v Facebook, which I review here and on which judgment is forthcoming next week).
The Court yesterday held (the Twitter storm it created was later somewhat drowned by the UK Supreme Court’s decision in the prorogation case) and overall confirmed the AG’s views. As with the AG’s Opinion, it is important to read the Judgment for what it actually says, not just how the headlines saw it. For immediate analysis, readers may also want to read Daphne Keller’s and Michèle Finck’s threads and Dan Svantesson’s impromptu assessment.
It is again important to point out that the French data protection authority’s (CNIL) decision at issue, 2016/054 is a general CNIL instruction to Google to carry out global delisting in instances where natural persons request removal; not a case-specific one.
I have a case-note on the case and on C-137/17 (judgment also yesterday) forthcoming with Yuliya Miadzvetskaya, but here are my initial thoughts on what I think is of particular note.
1. The Court of Justice (in Grand Chamber) first of all, unusually, examines the questions in the light of both Directive 95/46, applicable to the facts at issue, and the GDPR Regulation ‘in order to ensure that its answers will be of use to the referring court in any event’ (at 41).
2. Next, at 52, the Court dismisses a fanciful distributive approach towards the computing reality of data processing:
Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing. The referring court considers that (and the CJEU clearly agrees, GAVC), in those circumstances, that act of processing is carried out within the framework of Google’s establishment in French territory.
3. At 55, the Court points out that de-referencing carried out on all the versions of a search engine would meet the objective of data protection in full, particularly (at 56) given the fact that ‘(t)he internet is a global network without borders and search engines render the information and links contained in a list of results displayed following a search conducted on the basis of an individual’s name ubiquitous (the Court restating here its finding in both Google Spain and Bolagsupplysningen).
At 58 the Court employs that finding of ubiquitousness to ‘justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.’ No grand statements on public international law’s views on adjudicative extraterritoriality /universality. Just a simple observation.
The Court subsequently however (at 59-60) notes other States’ absence of a right to de-referencing and their different views on the balancing act between privacy and freedom of speech in particular. At 61-62 it then notes
While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679, struck a balance between that right and that freedom so far as the Union is concerned (see, to that effect, today’s judgment, GC and Others (De-referencing of sensitive data), C‑136/17, paragraph 59), it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.
In particular, it is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of Regulation 2016/679 that the EU legislature would, for the purposes of ensuring that the objective referred to in paragraph 54 above is met, have chosen to confer a scope on the rights enshrined in those provisions which would go beyond the territory of the Member States and that it would have intended to impose on an operator which, like Google, falls within the scope of that directive or that regulation a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States.
In other words the Court has adopted the same approach as the United States Supreme Court has done in Morrison v. National Australia Bank; and Kiobel: there is a presumption against extraterritoriality, however it is not excluded. In the absence of indications of the legislator wish to extend the right to delisting extraterritorially it does not so exist in the current state of the law.
4. At 63 the Court hints at what might be required as part of such future potential extraterritorial extension: EU law does not currently provide for cooperation instruments and mechanisms as regards the scope of a de-referencing outside the Union – in contrast with the regime it has intra-EU. This also hints at the CJEU taking a more multilateral approach to the issue than its SCOTUS counterpart.
5. At 69 the Court then adds that intra-EU, a delisting order covering all of the search engine’s EU extensions is both possible and may be appropriate: co-operation between authorities may lead to ‘where appropriate, a de-referencing decision which covers all searches conducted from the territory of the Union on the basis of that data subject’s name.’
6. A final twist then follows at 72:
Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (references to CJEU authority omitted, GAVC), a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.
Here I do not follow the Court: one could argue that the harmonised EU’s approach is currently not to extend the right to delisting extraterritorially. The Court on the other hand seems to be suggesting that the extraterritoriality issue was not discussed in the Directive or Regulation, that EU law does not occupy (‘pre-empt’) that regulatory space and consequently leaves it up to the Member States to regulate that right. (Update 27 September 2019: Other interpretations are collated here).
I shall need more detailed reading of the GDPR’s preparatory works to form a view as to whether the extraterritorial element was considered, and rejected, or simply not discussed. However I also want to already point out that if the decision is left to the Member States, the case-law and theory of pre-emption clarifies that such national action has to be taken in full compatibility with EU law. including free movement of services, say, which Google may rightfully invoke should there be a disproportionate impact on the Internal Market.
(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 22.214.171.124, Heading 126.96.36.199.5.