The European Data Protection Supervisor (EDPS), Peter Hustinx, recently published a response to a European Commission consultation on reform of the “notice-and-action” (“N&A”) procedure rules — i.e., the legal regime that requires Internet intermediaries to remove hosted content when they are notified that such content is illegal.  As set out in more detail below, the EDPS response draws attention to the impact of N&A procedures on data protection and privacy rights, and voices support for a variety of measures, including harmonising the definition of “illegal content”, clarifying the definition of “hosting” and the extent to which hosting providers should take proactive steps to remove illegal content.

The EDPS’s views will be added to those of other stakeholders including rightholders, many of whom have called for a transparent and user-friendly procedure that includes an accessible appeals process and sanctions against abusive notices.  Rightholders also see value in intermediaries providing APIs that enable rightholders to remove infringing content directly, as some online platforms already do today.

Key points raised by the EDPS include:

  • Harmonising the definition of ‘illegal content’ across Europe for the purpose of N&A procedures.  The EDPS highlights that additional safeguards may be necessary when sensitive personal data is processed, and suggests that, in certain cases, it may be more appropriate for illegal content to be reported to a regulatory authority rather than to a hosting provider for removal.
  • Clarifying the definition of ‘hosting’ to take account of the current digital environment.  The EDPS emphasizes that online social networks are ‘data controllers’ in respect of personal information uploaded to their sites, as well as content hosts under European data protection law.
  • Developing harmonised procedures and forms for notifications to hosts of illegal content.  The EDPS adds that harmonised forms and procedures would need to take full account of European data protection law — for example, by developing “privacy by design” compliant notification forms that only require the minimum necessary amount of personal data about senders of notices and of the other persons involved (e.g. complainant, suspect, witnesses, etc.). 
  • Clarifying the proactive measures to be taken by hosting providers.  The EDPS refers to questions over the scope of Article 15 of the E-Commerce Directive (Directive 2000/31/EC), which states that hosting providers have no ‘general obligation to monitor’ users’ illegal activity on their networks. This provision has been thrown into sharper relief following the CJEU decision in Scarlet Extended SA v SABAM (C‑70/10), decided in 2011.  In that case, partially to protect fundamental rights of privacy, the CJEU ruled against broad-based proactive filtering by ISPs for the purpose of protecting against copyright infringement.  The EDPS has commented several times in the past on this issue.

The consultation period for answering the European Commission’s questionnaire is now closed.

Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.