Italy

[IT] The Italian Google Verdict

IRIS 2010-6:1/35

Valentina Moscon

Max Planck Institute for Intellectual Property and Competition Law. Trento Law and Technology Research Group, University of Trento

The Court of Milan has made public the decision in the criminal trial against four Google executives, charged of defamation and illegal personal data handling in relation to the publication on the video-sharing platform Google Video of a video containing an act of bullying against a person suffering from Down’s syndrome. The Court acquitted all the defendants on the charge of defamation, but found two managers and a former executive of Google Inc. liable for the illegal personal data handling.

The case concerned a teenage boy with autism who was bullied by some classmates at a school in Turin in 2006. The incident was filmed by the perpetrators and uploaded to Google Video, where it was seen by thousands of viewers over a period of nearly two months. The video was removed after Vivi Down, an Italian association representing people with Down’s syndrome whose name was mentioned in the video, complained to the police. Google removed the video once it was notified.

The prosecution argued that the accused had failed to handle correctly the processing of the personal and sensitive data of the boy affected by Down’s syndrome by allowing the upload of the video file and for failing to remove it subsequently from the site video.google.it, in order to pursue profit. Google Italy, in fact, a subsidiary of Google Inc., enables uploading and using home videos without complying with the rules relating to the concrete protection of personal data. This behavior, where for-profit, according to the prosecution, results in an intentional disregard of company policies relating to issues of personal data.

Prosecutors said that recording data entered into the Google Video system necessarily involves their processing by the company. This would suggest that Google Italy should be understood as being not a mere intermediary subject (host provider), but a content provider that manages material and is responsible for this activity.

The defendants deny these allegations by noting that Google Video is a hosting provider and therefore not responsible for uploaded content: there is no obligation to control the information that the site transmits and stores. The obligation to check the data contained in the video is placed on those who uploaded it. The provider is required to indicate in the terms of contract the requirements imposed on the user, including those relating to privacy law, although compliance with these is the sole responsibility of the user. Consequently, Google argued that it is the person who uploaded the video without obtaining the consent of the boy who was filmed who is solely responsible for the unlawful use of data.

Moreover, Google defended itself by alleging a complete absence of profit: the company does not draw profit from the Google Video service, which is free.

The issue that the Italian court had to assess was complex: first the Italian judge needed to check if there was a violation of privacy law; then the court had to determine whether such violation is attributable to Google and if there is a profit purpose.

The court answered the first question in the affirmative: the video constitutes personal and sensitive data, within the meaning of Article 167 of the Italian Privacy Code (Italian Privacy Law No. 196 of 2003) and in this case there was no consent to the disclosure of the video in question.

The court stated that there is no doubt that the obligation to ask for the boy’s consent was incumbent on the person who uploaded the video onto the Google Video website. However, the judge also considered whether this requirement was attributable to the person who has managed and distributed the video via the Internet as well. In other words, the court questioned: is there an obligation for the owner or operator of a website to check the data previously entered onto the site or else to correctly inform users about the site’s privacy policy?

According to the court, the ISP that provides users with a simple interconnection service and properly informs them of their legal obligations relating to privacy cannot be considered punishable if it does not monitor users’ prior compliance with these obligations. The court relied on the principle of ad impossibilia nemo tenetur; it would be impossible to expect an ISP to verify that all the thousands of videos uploaded to the website comply with the privacy rights of all the individuals represented. It is incumbent on the ISP, however, to provide users with all the necessary information for them to respect privacy rules. Accordingly, there is no requirement for prior review of data entered into the system, but for correct and timely provision of information to third parties who deliver the information.

Therefore, according to the Italian judge, on the one hand there is no requirement for ISPs to control information, on the other, however, the Internet is not an “unlimited prairie where everything is permitted and nothing can be prohibited.” In fact, there are laws that impose conduct obligations which, if not met, lead to criminal liability.

From this perspective, therefore, Google Inc. was held responsible because, during user account activation, files loading the information about privacy obligation were either lacking or hidden in the general conditions of contract and therefore likely to be ineffective.

It is not sufficient to hide the information on the obligations arising from compliance with privacy laws within the "general conditions of service." The content of these seems incomprehensible. The only reference to obligations relating to privacy was contained in section 9 of Google’s general conditions of contract. This asks the user to ensure that the content being uploaded does not violate the rights or obligations of any person, including those related to privacy. The court, however, considered that these warnings are too generic and abstract, as well as hidden and anonymous. This behaviour, said the judge, shows little willingness to communicate and would therefore warrant a negative assessment of Google’s conduct.

According to the Italian court, Google, moreover, through the Google Video service, clearly pursues the purpose of profit, which is related to advertising. Google Italy has, in fact, the ability of connecting advertising to Google Video.

Ultimately, Google, according to the court, knowingly accepted the risk of introducing and disseminating sensitive data that should have been given special protection. The acceptance of this risk is linked to the pursuit of economic interest.