French Legal Experts Say YouTube Ruling
Shows Need for Clarification of Host's Duties
PARIS—A recent French court opinion that Internet hosts must collect identifying information on content uploaders is an early court assertion of a significant legal obligation for hosts, although specific technical details remain murky because the government has lagged on enacting essential decrees, Paris-based practitioners and a data privacy official told BNA.
In its Nov. 14 decision, Jean-Yves L. v. YouTube et al (13 ECLR 1512, 12/10/08), the Paris Court of first instance (Tribunal de Grand Instance de Paris, TGI) ordered YouTube.com to pay the French comedian Jean-Yves Lafesse and his producers 84,500 euros ($117,563) for failing to remove clips of his performances promptly after he repeatedly complained by registered mail, according to court papers.
The court also determined that YouTube is a hosting provider, not a content editor, which experts, host services, and other companies hailed as a major victory.
Within the ruling, the court declared that French law requires hosting providers like YouTube to collect and retain the content providers' name, address, and phone number so that posters of pirated or otherwise illegal content can be identified. The court based its ruling on the law to establish confidence in the digital economy (Loi sur la Confiance dans l'Economie Numérique, n°2004-575 June 21, 2004, LCEN), which transposed the EU electronic commerce directive (2000/31/EC) into French law. Among other things, the LCEN set out rules on the responsibility of the site host for content.
IP Address Could Be Adequate.
In Benetton v. Google, a 2007 case, an appellate court in Paris affirmatively required Google to retain and provide specifically enumerated data on users.
David Taylor, a Paris-based partner at Lovells LLP specializing in intellectual property, media, and technology, told BNA that, despite this decision, he is not convinced a clear legal obligation for hosts to collect name, address, and phone number exists yet.
“At present, French statute does not, in my view, oblige hosting providers to provide the specific data such as the name, address and phone number of the content provider,” Taylor said.
“Indeed … the provision of an IP address could be sufficient to identify the content providers in some cases,” he said.
Taylor noted that LCEN Article 6.II sets out a Web host's obligation to collect personal data, but it does not specify which types of data the host must collect.
“Instead, [the LCEN] provides that a decree will determine the type of data to be collected and the details relating to the retention of this data,” Taylor said. “French Courts have specified what the nature of the data should be to allow identification, thereby preempting the decree yet to be enacted.”
Obligations Not Clear Without Decree.
Lack of a decree leads to lack of clarity on what Web hosts' specific data-collection obligations are under the LCEN, Taylor and others said.
Jean-Frederic Gaultier, a Paris-based lawyer specializing in intellectual property at Clifford Chance, noted that the TGI did not penalize YouTube for failing to collect what it called required information, because case law on the subject is not yet consistent. “Since there have been no decrees yet, the [TGI] court based its decision [in the YouTube case] on the general principles of the LCEN.”
“The court is saying it intends to punish this in the future, when it becomes consistent case law,” Gaultier said.
Gwendal Legrand, head of the IT experts department of the French data protection authority CNIL, told BNA that the YouTube opinion reveals a lack of legal clarity on LCEN's requirements, which he also attributed to lack of a government decree.
“There is a legal gray area on this subject,” Legrand said.
France's law on information and liberties (78-17 of 1978, updated in 2004 to bring it in line with the EU Data Privacy Directive 95/46) imposes some of the world's strictest data-privacy protection requirements on Web hosts and other entities that collect private data.
Does this pose a conflict with the LCEN's requirements for hosts to collect data?
Victoriano Melero, a Paris-based specialist in IT and telecoms law at Clifford Chance, said he saw no conflict. “Companies will keep the information in separate databases. It should not be a problem,” he said.
Legrand, on the other hand, said it is too early to say. He said the CNIL realizes that authorities have legitimate reasons for requiring hosts to collect information on users to fight crime and terrorism.
“The CNIL is waiting for a decree in order to issue an advisory on whatever new data collection requirements [the government] imposes on companies,” Legrand said. “As with any type of personal-data collection, we want to know if the means are proportionate to the purpose.”
The CNIL has yet to issue an advisory on these requirements under the LCEN. A lot of questions remain, he said.
“For example, with a video site like YouTube, how long is the company required to store the uploader's personal data once a video is erased? If it's a year, say, that might exceed the length of time really necessary to meet the requirement of identifying uploaders,” Legrand said.
An example of technical detail would be how the users' IP addresses would be treated, he said.
“Without a decree, we don't have the necessary technical details to issue an advisory on this very complicated subject,” he said.
Taylor said a draft decree has been reviewed by the CNIL and should be adopted soon.
“This is certainly something that the CNIL will have considered,” he said.
Taylor said hosting providers are already required by French data protection laws to declare data collection they conduct to comply with obligations imposed by the LCEN.
“Measures will also have to be taken by hosting providers to ensure that users are sufficiently informed of the purposes for the processing of their data as required by French data protection law,” Taylor said.
They're also required to inform content providers of the processing and use of their data and not to use the data for other purposes, Taylor said.
No additional obligations should be imposed on hosting providers by the decree, he said.
A ‘Huge' Award, but Still ‘Favorable.'
Melero noted that, at the heart of the YouTube ruling, the TGI sought to contribute to settling the thorny legal debate in France, and in the European Union, over what is an Internet host and what is a publisher.
Even though it ruled for plaintiffs, the court rejected their contention that YouTube is a publisher and thus strictly liable for content on its site. Citing the LCEN, it found that YouTube is a host, Melero said.
Consequently, the ruling that YouTube is not a publisher is “very favorable for YouTube and similar companies, despite the large award amount,” he said.
Gaultier said that the court had written that, despite being warned by plaintiffs, “YouTube failed to take necessary steps to remove illegal content. So the court was probably a bit angry and aiming to send a message [with the big award] to Web hosts, that, although you [hosts] have limited liability you'd still better be careful.”
French rulings on the host/publisher questions have been “somewhat erratic,” Gaultier noted.
Two Diverging Trends.
Taylor remarked that French decisions on this issue have diverged into two lines of authority. One view holds that hosting providers are obliged to meet the same responsibilities as content editors, in view of the fact that they offer other services in addition to Web hosting—such as online auction services, services allowing creation of personal pages, and advertising.
He cited recent cases involving Yahoo!, Google, MySpace, and Tiscali.
“The second [view] refuses to consider hosting providers as editors of content simply because they provide another type of service but nonetheless imposes monitoring obligations on them,” Taylor said.
He cited the Paris TGI's ruling in the DailyMotion case, in which the court said that the French video-sharing site's systemic failure to act against illegal posting of a film offered Internet users “the means to violate copyright,” making DailyMotion partly liable for the resulting damages (12 ECLR 679, 7/25/07).
Taylor also cited the court's ruling imposing on Google an obligation to ensure that any source of access to illicit content is permanently removed.
Also, in July 2008, the Paris Court of Appeal ruled that eBay was under an obligation to ensure that its Web site was not used for any reprehensible activity (13 ECLR 1026, 7/23/08), Taylor said.
“The Lafesse v. YouTube decision is part of the second trend and hence this is why the decision has been welcomed by hosting providers and platform providers in particular,” Taylor said.
“Indeed, the TGI held that YouTube is a hosting provider and not an editor even if it also develops advertising activities on its platform, which confirms the most recent case law concerning this type of platform,” he said.
“However, and importantly, the TGI imposes an obligation on YouTube to ensure that the illicit content was not only removed but also not posted again in the future,” he said.
Directive Out of Touch.
Gaultier said that, due to technical evolution of the Internet, the EU e-commerce directive's definition of host and publisher are no longer relevant. “[The directive] says that you're a [host] only if you store information,” Gaultier said. “With the Web nowadays storing by third parties doesn't correspond to anything [in the directive]. It doesn't address the question of reformatting, prior control, reuse and hyperlinks, for example.”
By Rick Mitchell