India's New Cyber Law Goes Live: Subtracts Safe Harbor Protections, Adds Compelled Assistance Demands For Intermediaries

from the out-with-the-good,-in-with-the-bad dept

New rules for social media companies and other hosts of third-party content have just gone into effect in India. The proposed changes to India's 2018 Intermediary Guidelines are now live, allowing the government to insert itself into content moderation efforts and make demands of tech companies some simply won't be able to comply with.

Now, under the threat of fines and jail time, platforms like Twitter (itself a recent combatant of the Indian government over its attempts to silence people protesting yet another bad law) can be held directly responsible for any "illegal" content it hosts, even as the government attempts to pay lip service to honoring long-standing intermediary protections that immunized them from the actions of their users.

Here's a really bland and misleading summary of the new requirements from the Economic Times, India's most popular business newspaper:

The guidelines propose additional responsibilities on social media companies. These include verifying users through mobile numbers, tracing origin of messages required by a court order and building automated tools to identify child pornography and terror-related content. All these requirements come under the ambit of under due diligence.

This sounds like pretty reasonable stuff. But it isn't because it goes much farther than what's summarized here and turns a whole lot of online discourse into potentially illegal content.

(a) belongs to another person and to which the user does not have any right to;
(b) is grossly harmful, harassing, blasphemous, defamatory, obscene, pornographic, paedophilic, libellous, invasive of another's privacy, hateful, or racially, ethnically objectionable, disparaging, relating or encouraging money laundering or gambling, or otherwise unlawful in any manner whatever;
(c) harm minors in any way;
(d) infringes any patent, trademark, copyright or other proprietary rights;
(e) violates any law for the time being in force;
(f) deceives or misleads the addressee about the origin of such messages or communicates any information which is grossly offensive or menacing in nature;
(g) impersonates another person;
(h) contains software viruses or any other computer code, files or programs designed to interrupt, destroy or limit the functionality of any computer resource;
(i) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign states, or public order, or causes incitement to the commission of any cognisable offence or prevents investigation of any offence or is insulting any other nation.
(j) threatens public health or safety; promotion of cigarettes or any other tobacco products or consumption of intoxicant including alcohol and Electronic Nicotine Delivery System (ENDS) & like products that enable nicotine delivery except for the purpose & in the manner and to the extent, as may be approved under the Drugs and Cosmetics Act, 1940 and Rules made thereunder;
(k) threatens critical information infrastructure.

The new mandates demand platforms operating in India proactively scan all uploaded content to ensure it complies with India's laws.

The Intermediary shall deploy technology based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content.

This obligation is not only impossible to comply with (and is prohibitively expensive for smaller platforms and sites/online forums that don't have access to AI tools), it opens up platforms to prosecution simply for being unable to do the impossible. And complying with this directive to implement this demand undercuts the Safe Harbour protections granted to intermediaries by the Indian government.

If you're moderating all content prior to it going "live," it's no longer possible to claim you're not acting as an editor or curator. The Indian government grants Safe Harbour to "passive" conduits of information. The new law pretty much abolishes those because complying with the law turns intermediaries from "passive" to "active."

Broader and broader it gets, with the Indian government rewriting its "national security only" demands to cover "investigation or detection or prosecution or prevention of offence(s)." In other words, the Indian government can force platforms and services to provide information and assistance within 72 hours of notification to almost any government agency for almost any reason.

This assistance includes "tracing the origin" of illegal content -- something that may be impossible to comply with since some platforms don't collect enough personal information to make identification possible. Any information dug up by intermediaries in support of government action must be retained for 180 days whether or not the government makes use of it.

More burdens: any intermediary with more than 5 million users must establish permanent residence in India and provide on-call service 24/7. Takedown compliance has been accelerated from 36 hours of notification to 24 hours.

Very few companies will be able to comply with most of these directives. No company will be able to comply with them completely. And with the government insisting on adding more "eye of the beholder" content to the illegal list, the law encourages pre-censorship of any questionable content and invites regulators and other government agencies to get into the moderation business.

Filed Under: censorship, content moderation, filters, free speech, general monitoring, india, intermediary liability, social media

The Lies Told About The EU Copyright Directive's Upload Filters May Help Get Them Thrown Out In Court

from the freedom-to-conduct-business dept

Although the main fight over the EU's Copyright Directive was lost back in March 2019, there are plenty of local battles underway. That's a consequence of the fact that an EU Directive has to be implemented by separate national laws in each of the region's 27 member states. Drawing up the local legislation is mostly straightforward, except for the controversial Article 17, which effectively brings in a requirement to filter all uploads. Trying to come up with a text that meets the contradictory obligations of the Directive is proving difficult. For example, although the law is supposed to stop unauthorized uploads, this must not be through "general monitoring", which is not permitted in the EU because of the e-Commerce Directive.

As the various countries struggle to resolve these problems, it is no surprise that they are coming up with very different approaches. These are usefully summed up in a new post on the Kluwer Copyright blog. For example, France is implementing the Copyright Directive by decree, rather than via ordinary legislative procedures. As Techdirt reported, the French government is pushing through an extreme interpretation that ignores requirements for user protections. Germany, by contrast, is bringing in wide-ranging new law that contains a number of positive ideas:

a new "minor use" exception that would legalise minor uses of third party works on online platforms.

In addition, the proposal also introduced the ability for uploaders to "pre-flag" any uploads as legitimate, protecting them from automated blocking.

It limited the scope of the requirement for platforms to obtain licences to "works that users typically upload". Platforms can meet their best efforts obligation to obtain authorisation by approaching collective management organisations and by responding to licence offers from rightsholders with a representative repertoire.

There is an irony here. One of the main reasons for introducing the Copyright Directive was to make copyright law more consistent across the EU. Article 17 is causing copyright law there to diverge even more.

The Kluwer Copyright blog has two more recent posts about Article 17, written by Julia Reda and Joschka Selinger. They look at an aspect of upload filters that could be of crucial importance in the case brought before the Court of Justice of the European Union (CJEU) by Poland, which seeks to have upload filters removed from the Copyright Directive.

On several occasions, the CJEU has thrown out blocking injunctions for violating the service providers' freedom to conduct a business. In a recently published study on behalf of German fundamental rights litigation organization Gesellschaft für Freiheitsrechte e.V., the authors of this blog post argue that when ruling on the request for annulment of Article 17, the CJEU will have to balance all relevant fundamental rights, including the freedom to conduct a business. In this blog post, we will put the spotlight on this under-examined fundamental right. In part 1, we will discuss its relevance for the court case pending before the CJEU. We will examine the ways in which Article 17 places new burdens on online platforms that are fundamentally different from the voluntary copyright enforcement schemes employed by some of the larger platforms today. In part 2, we analyse those new platform obligations in light of the CJEU case law on the freedom to conduct a business and discuss the role of the proportionality mechanism included in Article 17 (5). We find that the legislator may have grossly underestimated the impact of Article 17 on the freedom to conduct a business.

The basic argument is simple. During the debate on the Copyright Directive, its supporters were deeply dishonest about how it would work in practice. They repeatedly claimed that it would not require upload filters, and denied that it would be hard to implement in a way that was compatible with existing EU laws. Unfortunately, the politicians in the European Parliament were taken in by these claims, and passed what became Article 17 without amendments.

But the case before the CJEU gives another chance to point out the truth about upload filters. The fact that they only exist for things like music and video, not all copyrightable material as Article 17 requires; that those don't work well; and that even these flawed systems can only be afforded by Internet giants like Google. In practical terms, this means that smaller companies that allow user uploads will be unable to comply with Article 17, since it would require the use of technology that would be expensive to develop or license, and which wouldn't even work properly. As such, a key argument in the CJEU case will be that upload filters represent an unjustified interference in the freedom to conduct a business in the EU, and should be thrown out. Let's hope the CJEU agrees.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: article 17, copyright, eu, eu copyright directive, france, general monitoring, germany, upload filters, user protections

EU Looking To Regulate Everything Online, And To Make Sites Proactively Remove Material

from the if-you-thought-Copyright-Directive-was-bad,-just-wait-for-Digital-Services-Act dept

One of the reasons that Techdirt and many others fought so hard against the worst ideas of the EU Copyright Directive is that it was clearly the thin end of the wedge. If things like upload filters and the imposition of intermediary liability become widely implemented as the result of legal requirements in the field of copyright, it would only be a matter of time before they were extended to other domains. Netzpolitik has obtained a seven-page European Commission paper sketching ideas for a new EU Digital Services Act (pdf) that suggests doing exactly that. The Act's reach is extremely wide:

The scope would cover all digital services, and in particular online platforms. This means the clarification would address all services across the internet stack from mere conduits such as ISPs to cloud hosting services; while a special emphasis in the assessment would be dedicated to updated rules for online platforms such as social media, search engines, or collaborative economy services, as well as for online advertising services.

A core aim is to replace the e-Commerce Directive, passed in 2000. This is presented as "outdated", but the suggestions in the paper are clearly a continuation of attacks on the fundamental principles underlying the open Internet that began with the Copyright Directive.

One of the problems for the EU when pushing through the upload filters of Article 13/17 in the Copyright Directive is that Article 15 of the e-Commerce Directive explicitly states that there is "No general obligation to monitor". Constant surveillance is the only way that upload filters can work -- if you don't monitor all the time, you can't be sure you block everything that the law requires. Furthermore, Article 14 of the e-Commerce Directive emphasizes that "the service provider is not liable for the information stored at the request of a recipient of the service". That's subject to certain conditions, such as being required to remove material that infringes on copyright, but only after being informed of its presence on their servers. The new Digital Services Act wants to force Internet companies to move beyond reactive behavior:

a binding "Good Samaritan provision" would encourage and incentivise proactive measures, by clarifying the lack of liability as a result of Such measures

The paper goes on to repeat the EU's earlier attempts to pretend that upload filters are not a glaring example of general monitoring -- something that EU courts may well be asked to rule on. The leaked document says:

While the prohibition of general monitoring obligations should be maintained as another foundational cornerstone of Internet regulation, specific provisions governing algorithms for automated filtering technologies -- where these are used -- should be considered, to provide the necessary transparency and accountability of automated content moderation Systems.

That's a classic: affirming that general monitoring is prohibited, while bringing in rules for proactive automated filtering technologies -- aka general monitoring. It would tilt the playing field even more in favor of big, mostly US companies, and would guarantee that the EU never produces its own digital giants like Google or Facebook. The other main proposal of the paper is to bring in mandatory pan-European rules for tackling online hate speech and disinformation, drawing on ideas in national laws:

Uniform rules for the removal of illegal content such as illegal hate speech would be made binding across the EU, building on the Recommendation on illegal content and case-law, and include a robust set of fundamental rights safeguards. Such notice-and-action rules could be tailored to the types of services, e.g. whether the service is a social network, a mere conduit, or a collaborative economy service, and where necessary to the types of content in question, while maintaining the maximum simplicity of rules.

Simplicity? - hardly. This all sounds like a recipe for a completely unworkable set of complex requirements that once again will favor big companies with deep pockets and big legal departments. The authors of the leaked note have managed to come up with an option for making these plans even worse: creating a "central regulator" for the whole EU to enforce this locked down, permissioned Internet they want to create. Although this is only an internal paper, not a formal proposal from the EU, it shows the kind of really bad ideas that are already floating around the European Commission, and being seriously considered there. If you thought the EU Copyright Directive was bad, just wait until you see the new EU Digital Services Act.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: copyright directive, digital services act, e-commerce directive, eu, filters, general monitoring, intermediary liability, notice and action, open internet, takedowns

EU Quietly Ramps Up Preparations To Re-introduce Blanket Data Retention After Top Court Threw It Out In 2014

from the let's-protect-article-13-while-we-are-at-it dept

One of the biggest wins for the general public in recent years was when the Court of Justice of the EU (CJEU), the region's highest court, ruled in 2014 that the 2006 Data Retention Directive was "invalid". That naturally didn't go down too well with many of the governments in the EU, who were keen to keep it for surveillance of their populations. Almost immediately, the European Commission began to "examine the best options for the way forward as regards the retention of telecommunications data", as Erich Möchel reported in 2015. More recently, Statewatch published a draft of an internal document from the Council of the EU (pdf), outlining the EU's plans to re-instate obligatory data retention, while an updated version was obtained and released by ORF.at (pdf). The differences between the two versions give a hint of how the EU might try to play this. The earlier one says:

The rulings of the European Court of Justice in the cases Digital Rights Ireland and Tele 2, which set out the criteria for the lawful retention of data and access thereof are of fundamental importance in this context. It should also be noted that it has been argued that the findings of the Court in those cases apply only to traffic and location data, and not to subscriber data.

In the second version, the Council of the EU is much more assertive:

The rulings of the European Court of Justice in the cases Digital Rights Ireland and Tele 2, which set out the criteria for the lawful retention of data and access thereof are of fundamental importance in this context. In this context, Member States expressed their view that the findings of the European Court of Justice in Digital Rights Ireland and Tele 2 do not apply to subscriber data, but only to traffic and location data.

So maybe the line will be that the big 2014 defeat in the courts only applied to "traffic and location data", not to subscriber data. The hope seems to be that new legislation might specify that only data about the latter should be retained, thus avoiding the EU court's restriction.

The document also provides important information about another key piece of proposed EU legislation. The e-Privacy Regulation is designed to complement the General Data Protection Regulation. Where the latter essentially protects personal data at rest -- in databases, for example -- the e-Privacy Regulation will restrict how personal data can be transferred. Even though it is close to completion, the e-Privacy Regulation has essentially been put on the back burner, with no prospect of it being passed soon. Thanks to the latest document leak, now we know at least one reason why:

Legislative reforms at national or European level, including the new e-Privacy Regulation, should maintain the legal possibility for schemes for retention of data at EU and national level that take into account future developments and that are compliant with the requirements set out by the European Court of Justice.

This exposes a fear on the part of the EU politicians that the e-Privacy Regulation might place new obstacles in the way of a re-vamped Data Retention Directive. The comment above is a reflection of the fact that the e-Privacy Regulation will only be set on the path to final approval if it allows governments to collect and store personal data as they wish.

Finally, Erich Möchel's analysis of the latest version of the document from the Council of the EU notes a troubling possibility. While the EU is smoothing the way for data retention to return, it might get rid of another pesky directive that tries to limit surveillance of online users. Article 15 of the EU's e-Commerce Directive, passed in 2000, says:

Member States shall not impose a general obligation on providers ... to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.

Techdirt pointed out recently that Article 13 (now renumbered as Article 17) of the EU's Copyright Directive imposes exactly this kind of general obligation. It is therefore quite possible that the CJEU could rule that Article 13/17 of the Copyright Directive is invalid, just as it did for general data retention. Möchel suggests that as the EU tries to bring back data retention, it might also take the opportunity to get rid of that ban on general monitoring to head off any legal challenges to Article 13/17 as well.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, data privacy, data protection, data retention, data retention directive, eu, general monitoring, privacy, surveillance