The European Data Protection Supervisor (EDPS), Peter Hustinx, recently published a response to a European Commission consultation on reform of the “notice-and-action” (“N&A”) procedure rules — i.e., the legal regime that requires Internet intermediaries to remove hosted content when they are notified that such content is illegal.  As set out in more detail below, the EDPS response draws attention to the impact of N&A procedures on data protection and privacy rights, and voices support for a variety of measures, including harmonising the definition of “illegal content”, clarifying the definition of “hosting” and the extent to which hosting providers should take proactive steps to remove illegal content.

The EDPS’s views will be added to those of other stakeholders including rightholders, many of whom have called for a transparent and user-friendly procedure that includes an accessible appeals process and sanctions against abusive notices.  Rightholders also see value in intermediaries providing APIs that enable rightholders to remove infringing content directly, as some online platforms already do today.

Key points raised by the EDPS include:

• Harmonising the definition of ‘illegal content’ across Europe for the purpose of N&A procedures.  The EDPS highlights that additional safeguards may be necessary when sensitive personal data is processed, and suggests that, in certain cases, it may be more appropriate for illegal content to be reported to a regulatory authority rather than to a hosting provider for removal.
• Clarifying the definition of ‘hosting’ to take account of the current digital environment.  The EDPS emphasizes that online social networks are ‘data controllers’ in respect of personal information uploaded to their sites, as well as content hosts under European data protection law.
• Developing harmonised procedures and forms for notifications to hosts of illegal content.  The EDPS adds that harmonised forms and procedures would need to take full account of European data protection law — for example, by developing “privacy by design” compliant notification forms that only require the minimum necessary amount of personal data about senders of notices and of the other persons involved (e.g. complainant, suspect, witnesses, etc.). 
• Clarifying the proactive measures to be taken by hosting providers.  The EDPS refers to questions over the scope of Article 15 of the E-Commerce Directive (Directive 2000/31/EC), which states that hosting providers have no ‘general obligation to monitor’ users’ illegal activity on their networks. This provision has been thrown into sharper relief following the CJEU decision in Scarlet Extended SA v SABAM (C‑70/10), decided in 2011.  In that case, partially to protect fundamental rights of privacy, the CJEU ruled against broad-based proactive filtering by ISPs for the purpose of protecting against copyright infringement.  The EDPS has commented several times in the past on this issue.

The consultation period for answering the European Commission’s questionnaire is now closed.