The Center for Internet and Society just wrapped up its Law, Borders, and Speech Conference. We had an amazing line-up of speakers and a great set of topics -- the event was a blast, and we are getting enthusiastic feedback from newly minted Internet jurisdiction nerds and old hands alike.
The hypothetical exercises I wrote about real-life Internet platforms and cross-border content removal requests proved popular, so I'm sharing them more widely. These are based on real life, but they include significant simplifications and changed or invented facts for the purpose of the exercise. Don’t take them as true stories. Do feel free to use them in teaching or otherwise, with attribution.
Internet Platforms Exercise
Stanford Center for Internet and Society
This exercise puts you in the shoes of online platforms confronted with difficult cross-border content removal demands. It uses examples based on real life, but with facts simplified for sake of discussion.
Please discuss and decide what action the company should take in response to the particular demand. That could include compliance, partial compliance, litigation, changing business models, changing product design, ceasing operations in a country, negotiating with the government or person seeking removal, asking NGOs or governments for help, or anything else that you think of. If you need to make assumptions about the facts of the case (e.g. whether the company has an office in a particular country, where its servers are located) please do so.
Hypo 1: Anne Frank and Wikipedia
Wikimedia receives a DMCA removal request from the US copyright holders for The Diary of Anne Frank, demanding that Wikipedia remove all links to, or hosted copies of, the original Dutch-language version of the diary. The diary is in the public domain under Dutch copyright law, but still protected by US copyright law. Wikimedia is legally established in the US, and its employees and servers are all here. It has separate Dutch and English-language pages about the diary, and allows users to navigate to either one. Both the Dutch and English pages have links to a Wikimedia-hosted copy of the diary at the time the DMCA request arrives. What should it do in response to the request?*
Hypo 2: Reddit and Russia
In 2013, Russian regulator Roskomnadzor ordered Russian ISPs to block a page on reddit.com where Russian users discussed illegal drugs. Because Reddit encrypts traffic using HTTPS, the ISPs could only block the entire site -- not individual pages. Russia later agreed to lift the ban, and Reddit agreed to block traffic at its end by preventing users with Russian IP addresses from accessing pages that violate Russian law. This allowed the rest of Reddit to remain accessible in Russia.**
Suppose that Roskomnadzor notifies Reddit that another page violates Russian law. This one offers psychological support for gay and transgender teenagers in Russia. Russian regulators say, and local counsel in Russia confirms, that the page violates Russia’s “gay propaganda” laws. What should Reddit do now?
Hypo 3: DuckDuckGo and the EU
DuckDuckGo is a search engine company based in Pennsylvania. It prides itself on protecting users’ privacy by not tracking them.
The company has no offices, employees, or servers outside the US, and it does not deposit cookies on users’ machines. It does sell advertising space in search results, including to advertisers in the EU. It allows ad campaigns to target users in particular countries or regions, presumably based on the user’s IP address. It also lets users create accounts in order to participate in discussion forums, including forums for open source developers who contribute code to the search engine. It supports informal in-person “Quack & Hack” meetings for these developers, including in the EU. The Strasbourg Quack & Hack group, for example, has 98 members. According to alexa.com, at least 23% of DuckDuckGo’s traffic comes from users in the EU.
The EU’s pending General Data Protection Regulation, which goes into effect in 2018, arguably applies to DuckDuckGo because of the accounts it maintains for EU users. French Counsel has advised the company that the law is unclear, but she thinks there is a 40% chance that regulators and courts would find jurisdiction to apply the law to the company. If that happens, DuckDuckGo would face some expensive legal and technical compliance work, and also have to honor “Right to Be Forgotten” requests for search results. French regulators maintain that such de-listings must apply globally, not just to results seen by European users. The search engine currently does not honor such requests, which means that European users can use DuckDuckGo to find results that Google has de-listed.***
Suppose that in October 2018, the CEO of a French shipping company threatens to sue DuckDuckGo if it does not de-list search results linking to allegations that he cheated on his taxes ten years ago. The French Data Protection Authority agrees that he has a right to de-list the results. What should DuckDuckGo do now?