Rulings from the Court of Justice of the European Union (CJEU) are like buses - you wait ages for one, then three come along in short succession.
The CJEU - Europe’s highest court - has issued three rulings over the past two weeks that have enormous implications for the global digital economy and for how social media platforms in particular are regulated, for better or worse.
Last week, Google won a rare victory in Europe when the court determined that the EU’s Right to be Forgotten - which enables EU citizens to have inaccurate or just inconvenient/embarrassing information about themselves to be erased - only applies to EU domains, such as google.co.uk or google.fr. It cannot be applied to non-EU domains, such as google.com, as the France’s data protection authority CNIL had demanded.
The court came to the conclusion that:
The right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.
Score one for social media giants.
The other two rulings from the court aren’t such good news for the platform providers. Earlier this week, it ruled that pre-checked cookie consent buttons on websites do not count as the required legal active opt-in consent from users that EU privacy law demands. In addition, website owners are obliged to provide tracking information, including how long the cookies will operate for and whether third parties will have access to gathered data. In addition, cookie consent cannot be bundled for other purposes.
That last point is important as it was a bundling issue that was at the heart of the court’s deliberations in a case brought by the Bundesgerichtshof (Federal Court of Justice, Germany) against lottery website Planet49, which asked users to give consent for cookies in order for them to play a promotional game.
The likes of Facebook and Twitter currently operate on an implicit cookie consent model where it assumed that using the site means that consent is deemed to have been given. That’s not going to work in the EU anymore.
The court determined:
The Court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre- checked checkbox which that user must deselect to refuse his or her consent.
That decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.
The Court notes that consent must be specific so that the fact that a user selects the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies.
Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.
Score one for privacy activists.
Finally, the court yesterday inflicted a heavy blow on Facebook - and depending on your point of view, freedom of speech - by deciding that the firm must remove defamatory comments worldwide if said comments are deemed illegal by individual EU states. It stated:
EU law does not preclude a host provider such as Facebook from being ordered to remove identical and, in certain circumstances, equivalent comments previously declared to be illegal. In addition EU law does not preclude such an injunction from producing effects worldwide, within the framework of the relevant international law which it is for Member States to take into account.
The ruling stems from an action by Austrian politician Eva Glawischnig-Piesczek who wanted Facebook to remove a reputationally harmful comment published by another Facebook user. Austrian courts ruled in her favor.
The determination of the court has triggered concerns about its potential impact on freedom of speech given that definitions of defamation are context-specific and not universally-held. The fear is that an EU national court can now try to order the removal of social media posts in other countries, even if the content is not considered unlawful there, thus creating a scenario whereby a third party country can attempt to control or censor what users in another country can see. That has serious implications when dealing with regimes with poor human rights records, for example.
It’s also unlikely to go down well in the US. The Computer & Communications Industry Association’s Europe Senior Manager Victoria de Posson warned:
The ruling essentially allows one country or region to decide what Internet users around the world can say and what information they can access. What might be considered defamatory comments about someone in one country will likely be considered constitutional free speech in another. Few hosting platforms, especially startups, will have the resources to implement elaborate monitoring systems.
At Facebook, we already have Community Standards which outline what people can and cannot share on our platform, and we have a process in place to restrict content if and when it violates local laws.
This ruling goes much further. It undermines the long-standing principle that one country does not have the right to impose its laws on speech on another country. It also opens the door to obligations being imposed on internet companies to proactively monitor content and then interpret if it is ‘equivalent’ to content that has been found to be illegal.
In order to get this right, national courts will have to set out very clear definitions on what ‘identical’ and ‘equivalent’ means in practice. We hope the courts take a proportionate and measured approach, to avoid having a chilling effect on freedom of expression.
Score one for…who knows? There are genuine freedom of speech implications here that make me very uncomfortable. There's also no way that the US or China or a host of other nations are going to toe the EU line here. There will be trouble ahead.
Overall though, a busy couple of weeks for the CJEU. And whatever your view of the rulings, it is worth noting that at least the EU authorities are taking action to regulate where others - that’s you I’m looking at, Washington - continue to talk themselves into lethargy as strategy.