Law and technology

The row in Britain over the naming of footballer Ryan Giggs online (and subsequently in Parliament),  in contravention of a “super-injunction”, raises the same issues as New Zealand has experienced recently: can injunctions and other forms of name suppression work in the age of social networking?

British PM David Cameron appears to have accepted the reality of the situation:

“It’s not fair on the newspapers if all the social media can report this and the newspapers can’t,” he said. “So the law and the practice has got to catch up with how people consume media today.”

This is a strong indication that the UK will change its law (or least its policy) on injunctions. In New Zealand, the Government and officials have not yet grasped the nettle. In 2009, the New Zealand Law Commission published a detailed report on name suppression in this country. It noted:

Where information as to the identity of someone appearing before a court is already in the public domain, it will not generally be appropriate to grant name suppression. The law will not undertake an exercise in futility, which would bring its own authority and processes into disrepute. [3.65]

However, the Commission did not really address the issue of internet publication. As I wrote at the time:

Yet in many recent cases involving name suppression, that is precisely what has occurred. Twitter, Facebook and other local and international web sites are routinely used to blithely report (or more often, speculate on) the identity of the individual… There is every reason to think this phenomenon will become more and more common… If the law is not to permit exercises in futility, this issue may need to be revisited again before long.

There can be very good reasons for name suppression and other forms of injunctions. But it is not a question of right or wrong anymore. The fact is that such orders can (and therefore will) be made a mockery of, with relative impunity online. An English judge’s issuing of an injunction against Twitter users, and Ryan Gigg’s now-futile attempt to sue anonymous Twitter users, seem distinctly King Canute-esque.

A defamation lawsuit against an eBay buyer who left negative feedback has received comment from New Zealand defamation experts:

“The law is no different if someone writes it online or in a newspaper” – William Akel of law firm Simpson Grierson.

“People get away with an awful lot online and it’s been going on for a while but I haven’t seen a flood of complaints. We don’t live in a litigious environment.” – David Campbell of Campbell Law.

Victoria University defamation expert Professor Bill Atkin said the online community should remember “the wisest course is often the cautious one”.

This is good advice, although people should not be afraid to state (non-recklessly) their genuine honest opinions. Free speech is protected in New Zealand via two laws. First, section 14 of the Bill of Rights 1990 (an unsatisfactory piece of legislation) states:

Freedom of expression: Everyone has the right to freedom of expression, including the freedom to seek, receive, and impart information and opinions of any kind in any form.

Second, section 10 of the Defamation Act 1992 allows a defence of honest opinion. However, this is not completely unrestricted and generally requires that:

• The opinion is based on true facts;
• The comments must be reconisable as opinion; and
• The opinion is genuinely held.

Two important facts about the eBay lawsuit are:

1. The alleged defamatory comment was: “Bad seller, he has the ethics of a used car salesman“.
2. The buyer’s listing said “We cannot give you any guarantees and must offer it on an as-is, where-is basis only”.

It will remain to be seen whether the claim succeed, bearing in mind that defamation law in the US is relatively restricted.

Possibly the buyer’s mistake was to comment too broadly on the seller’s ethics. It can be safely assumed he is expressing his opinion on that point, but such a broad statement is open to allegations of defamation. Of course feedback comments are supposed to be very brief, but if the buyer had taken a little more care the situation would likely have been avoided. For example, the buyer could have said “I was very misled by this seller’s listing.”  That would be much more difficult to attack because it is a comment on the buyer’s own feelings, not a sweeping accusation of dodgy ethics.

In the case of Trade Me / eBay feedback, it will also be interesting to see whether a defence of consent (section 22 Defamation Act 1992) could protect (or limit) otherwise defamatory feedback. When users buy or sell on auction sites, they know that feedback will almost always be given. Users know the purpose of the feedback is to share trading experiences – good, bad or neutral. A user could not reasonably claim that they never expected an upset trader to post critical feedback as “their side of the story”, whether based on correct or incorrect facts. Responding to critical comments is also provided for and expected.

It is also worth noting, in the eBay case, that the plaintiff (the seller) is a Miami lawyer, and the defendant claims to have spent USD$7,000 fighting the $15,000 suit. In the highly litigious United States (where even a dry-cleaned pair of trousers can turn into a $67 million lawsuit) this is relatively small. In New Zealand, which is not litigious, in most cases it would probably be completely uneconomic for an occasional, sole trader to make a defamation claim. The best first step in the case of unfair or defamatory conduct would be to contact the website in the first instance. Trade Me has policies on feedback on its website.

The global reach of the internet sometimes creates practical difficulties for law enforcement and, for private litigants, in “getting a remedy”. In essence, one country’s laws do not have (without special arrangements) “extraterritorial” effect in another country. But that does not mean that just because something or someone is located overseas, a court in another country cannot claim jurisdiction.

This issue has arisen several times in defamation proceedings, where a person complains that they have been defamed in another country, even though they would not be able to sue for defamation in that second country. A few years back, an Australian court ruled that an article posted on the internet is considered published wherever it is downloaded. So an article written in the United States by a US citizen, and not actionable in the US, could be actionable in Australia if it is defamatory under Australian law.

Another example, this time involving criminal law, is currently underway with the Australian Human Rights Commission threatening to lay charges against the US-based operator of Encyclopedia Dramatica over an offensive entry on Aborigines.

Similarly, a UK court recently confirmed that English criminal law can apply to internet content accessible in the UK, regardless of where in the world it is hosted. Meanwhile, three US-based Google managers were convicted in absentia by an Italian court for “allowing”  disturbing footage of an Italian boy being bullied to be posted online, and not removing it.

In other cases, specific legislation (e.g. section 7A of the Crimes Act) or public policy may compel or be used to justify a court exercising jurisdiction. For example, in New Zealand the Commerce Commission has successfully prosecuted overseas residents for breaches (in New Zealand) of the Fair Trading Act.

In summary, it does not typically matter that a server, or a person, is located outside of the jurisdiction. The fact that conduct occurs in a jurisdiction (e.g. material can be accessed in a jurisdiction in the same manner as if the server or material were located there; conduct by an overseas person is “aimed” at the local jurisdiction)  is often sufficient.

The BBC reports on how the expanding use of online social networking is redefining “reasonable expectations” of privacy for everyone. It cites Dr Kieron O’Hara of the University of Southhampton:

“As more private lives are exported online, reasonable expectations are diminishing. When our reasonable expectations diminish, as they have, by necessity our legal protection diminishes”.

The reason is that the law attempts to balance the “reasonable expectations” of privacy with other considerations, such as freedom of information and free speech. In New Zealand, the Bill of Rights Act 1990, section 14, enshrines this freedom (as best it can, given the unsatisfactory state of that Act):

“14. Freedom of expression: Everyone has the right to freedom of expression, including the freedom to seek, receive, and impart information and opinions of any kind in any form”.

That right remains strong, but there is no doubt that “reasonable expectations” of privacy are rapidly shifting. In the article Dr O’Hara gives the example of an embarrassing photo taken at a party:

“A decade ago, he said, there would have been an assumption that it might be circulated among friends. But now the assumption is that it may well end up on the internet and be viewed by strangers.”

Another prime example is Google’s Street View. A decade or two ago there may have been some expectation of privacy when walking in the street (although as Katrine Evans of the University of Wellington, now Assistant Privacy Commissioner, notes there is a “considerable body of [precedent] which states that innocuous photographs of people in public places will not attract the protection of the common law”).

Today, Street View routinely photographs people in the streets; there is no doubt that this sort of occurrence will be a permanent part of our lives in some shape or form. Street View has various privacy measures in place (e.g. blurring faces) but there have been cases of people caught in compromising situations and a number of court cases have been fought or are pending.

A while ago I blogged (Don’t expect privacy in cyberspace) about a US case where a girl’s public MySpace rant – ostensibly intended only for her friends – was republished in a newspaper. She claimed a breach of privacy. The Court said:

“[The student's] affirmative act [of publishing her post on MySpace] made her article available to any person with a computer and thus opened it to the public eye. Under these circumstances, no reasonable person would have had an expectation of privacy regarding the published material”.

The US Court’s ruling was quite sensible, however it highlights the point that not only are expectations of privacy rapidly changing, but the avenues for disseminating private information (and thereby possibly redefining what constitutes reasonable expectations) are also expanding. This is happening at the same time that the law in many common law jurisdictions (e.g. UK, US, Canada, Australia & New Zealand) is still relatively unsettled and developing. The societal changes of “the Facebook generation” has already been recognised in data loss / information security incidents, and is equally relevant in privacy law.

It is worth noting that in New Zealand’s current leading case on privacy (Hosking v Runting [2005] 1 NZLR 1) the actual existence of a tort of privacy was only accepted by a 3-2 decision. Since that time, other jurisdictions have expanded their privacy laws more liberally than the Hosking case’s relatively narrow scope. Most recently the 2008 Max Mosley case in the UK (argued on the basis of breach of confidence and “unauthorised disclosure of personal information”) has thrown up a number of related issues likely to be explored in a future New Zealand case.

Due to reasons of cost, substantial court cases involving breaches of privacy are rare. It seems likely that, whatever currently a “reasonable expectation” of privacy is, it will have changed again by the time the next case is argued.

The Law Commission has published its report on name suppression. On the issue of name suppression on the internet it makes one recommendation:

Where an Internet service provider or content host becomes aware that they are carrying or hosting information that they know is in breach of a suppression order, it should be an offence for them to fail to remove the information or to fail to block access to it as soon as reasonably practicable. [7.16]

With regards to hosts, this is largely the status quo. It is less clear what an ISP that is “carrying” suppressed information is supposed to do. It would be impractical and ineffective, for example, to require ISPs to block access to sites it didn’t host. Of course, once a suppressed name has been communicated beyond our shores, any restrictions imposed by New Zealand law ceases to have any effect. If a major sports star had name suppression in New Zealand, and it was reported by Australian newspapers, would every ISP in New Zealand be expected to block access to those Australian websites?

The report’s findings on internet issues are brief, and don’t quite grasp the essential difficulties that the internet presents to the name suppression regime.  It states:

Where information as to the identity of someone appearing before a court is already in the public domain, it will not generally be appropriate to grant name suppression. The law will not undertake an exercise in futility, which would bring its own authority and processes into disrepute. [3.65]

Yet in many recent cases involving name suppression, that is precisely what has occurred. Twitter, Facebook and other local and international web sites are routinely used to blithely report (or more often, speculate on) the identity of the individual. An invariable side effect is the gross defamation of innocent persons unlucky enough to fit some “non-identifying” criteria not covered by the suppression order. There is every reason to think this phenomenon will become more and more common. In fact, the application of a suppression order, in many cases, simply has the effect of causing more speculation and breaches of the order – a manifestation of the Streisand effect.

The report noted that name suppression is generally more readily available in New Zealand than in Australia or the United Kingdom. One interesting statistic which the report did not appear to have considered, however, is how effective name suppression orders (in high profile cases) have been. Anecdotal evidence as well as personal experience suggests they are increasingly ineffective.

If the law is not to permit exercises in futility, this issue may need to be revisited again before long.

A recent case in the UK (MIS Limited v Google) found Google not liable for defamatory statements in its search results (see link to full article below).

The judgment is a pragmatic and well-reasoned one that will reassure website operators. It backs up a similarly pragmatic decision in the New Zealand High Court last year (Sadiq v Baycorp, albeit only a “procedural” decision).

The risk of liability for third-party defamation can be one that lurks at the back of the mind for many website owners. It is certainly an issue to be aware of. On blogs and forums, the risk of someone posting a defamatory comment is probably the main legal risk present. This risk cannot be limited by terms and conditions.

The importance of the Google case is the pragmatic, realistic appoach taken by the UK High Court. It said:

“It is fundamentally important to have in mind that [Google] has no role to play in formulating the search terms. Accordingly, it could not prevent the snippet appearing in response to the user’s request unless it has taken some positive step in advance.”

What the judge is saying is that there is no reasonable way, within its existing website functionality and operational/business model, that Google could prevent the defamation from appearing in its search terms. In contrast, had the judge been so inclined, there are plenty of “unreasonable ways” that Google could have prevented/mitigated the defamation, such as:

• Having an employee check every search snippet
• Disable search snippets
• Allow users to delete a search snippet, etc.

These are clearly unreasonable, disproportionate and would harm Google considerably. The Court found nothing wrong with Google saying, in effect, “this is how our system works, yes it will repeat defamation where it exists, but we cannot help that without significantly changing our technology and business model.”

The Court took a similarly pragmatic approach to the notice-and-takedown process:

“It may well be that [Google's] ‘notice and take down’ procedure has not operated as rapidly as [the plaintiff] would wish, but it does not follow as a matter of law that between notification and ‘take down’ [Google] becomes or remains liable as a publisher of the offending material. While efforts are being made to achieve a ‘take down’ in relation to a particular URL, it is hardly possible to fix [Google] with liability on the basis of authorisation, approval or acquiescence.”

A very useful statement to have on the judicial record. This compares with the implied demand by the plaintiff that, in effect, any allegation of defamation should be met by an immediate, no-questions-asked take-down by Google, followed by a fuller review.

Full article:

Avoiding defamation for third party web content