What kind of liability do hosting service providers face if it turns out that their customers’ data happens to violate other parties’ rights?
What if, for example, an employee who is about to leave a company transfers emails containing the business secrets of his employer from his company mailbox to his private mailbox without the employer’s prior knowledge and consent? Once the employer becomes aware of this, it may request the hosting service provider to block the employee’s access to these specific e-mails. Can the hosting service provider fulfil the employer’s request without knowing for sure whether or not they actually infringe the employer’s business? If the hosting service provider does not deny the access and the employee discloses the concerned emails to third parties, the hosting service provider contributes to the injury caused by the employee.
Pursuant to the Hungarian e-commerce Act, the hosting service provider is not obliged to monitor the contents of the information that it stores on behalf of its customers, or to actively seek facts or circumstances indicating illegal activity by its users. The hosting service provider may be held liable only if the service provider has knowledge that the information stored at the request of a customer is illegal or violates the right or legitimate interest of a third party.
But when can the hosting service provider be entirely sure that stored information is unlawful or infringes someone’s right? If intellectual property rights are concerned, the Act is clear that upon notice of the third party stating that his rights are infringed, the service provider must remove the content. In all other cases, the Act is silent.
In our example, the hosting service provider may not be required to examine the arguments of the parties and determine whether or not the requested emails actually affect the employer’s right to business secrets. This needs a complex evaluation in light of the employment relationship between the employee and the company, the Act on business secrets and the employee’s privacy rights by a court. Thus, the hosting service provider is advised to await a court’s official decision or an interim injunction. Once such an injunction is delivered, the hosting service provider must remove the content. Moreover, it could be required to remove not just the original content of the infringement but, also any content having an equivalent meaning to the original content.
This was established in a recent decision by the European Court of Justice: In the case of Eva Glawischnig-Piesczek (the applicant) vs. Facebook Ireland Limited, a Facebook user shared an article (Greens: Minimum Income for Refugees Should Stay) from an Austrian online news magazine on Facebook and added a comment below the post. The respective Austrian court established that the comment of the Facebook user harmed the reputation of Glawischnig-Piesczek and insulted and defamed her. Therefore, the court ordered an interim injunction and required Facebook to cease and desist from publishing and/or disseminating photographs showing the applicant if the accompanying text contained the assertions either verbatim or used words having an equivalent meaning to those of the original comment. Thus, the court may not only bring an end to an illegal act but also prevent it being repeated in a similar form.
The ECJ highlighted that the injunction may not lead to the hosting service provider being required to carry out an independent assessment of whether the content has an equivalent meaning. The court must rather specify in the injunction which are the specific elements based on which a content with equivalent meaning must also be removed (e.g. the name of the person concerned by the infringement and/or the circumstance of establishing the infringement). Thus, the hosting service provider should be able to filter out the concerned equivalent content with automated search tools and technologies.
Based on the above decision of the ECJ, it remains to be seen whether hosting service providers will actually be able to filter out the concerned equivalent content without human intervention and avoid infringing the principle of freedom of expression.