LILIAN EDWARDS AND ANDREAS RÜHMKORFUNIVERSITY OF SHEFFIELD

LILIAN.EDWARDS@SHEFFIELD.AC.UKA.RUHMKORF@SHEFFIELD.AC.UK

BILETA, VIENNA, MARCH 2010

Ratemylegalrisk.com ?: legal issues around online

rating sites

Types of rating websites

Closed-rating-sites open-rating-sites

Product ratings ratings of individuals

1. Product ratings

2. Rating websites related to individuals

• Rating of services (related to performance and ability)

• Rating of character/personality

• A mixture of the two

Rating of services: qype.com (Germany)

Rating of character: Dontdatehimgirl.com

A mixture of the two: Ratemyteachers.com (USA)

Ratemylecturer.com (UK)

Spickmich.de (Germany)

The “spickmich.de“ decision

• The teacher-claimant filed for deletion of her personal data (sec 35 (2) 2 Nr. 1 BDSG) as well as for injunctive relief (secs 823 (2), 1004 BDSG analogous with sec 4 (1) BDSG) against the internet portal operator to stop publishing her personal data

• Both claims were rejected

• The ruling was primarily based on an application of provisions of the German Federal Data Protection Act; expressions of opinion are personal data; but no media privilege applied

• The Court held that the teacher does not have a legitimate interest in excluding the collection, storage or modification (sec 29). The collection and storage was therefore admissible.

The “spickmich.de“ decision

• The Court interpreted "legitimate interest” by balancing the basic (human) rights of freedom of expression and the right to privacy or informational self-determination due to the indirect effect of basic rights in private law

• Differentiation between the right to informational self-determination as to the sphere affected (private sphere, social sphere)

• Section 29 (2) Transfer of the data admissible if 1) the third party to whom the data are transferred credibly proves a justified interest in knowledge of the data or 2) there is no reason to assume that the data subject has a legitimate interest in his data being excluded from transfer.

Comments on spickmich.de decision

• Only the first decision regarding one particular rating website

• Significance of the judgment:1. Rating portals may be allowed to use personal data without the consent of the persons affected2. Expressions of opinion and ratings “which refer to a defined or definable person affected” are subject to the Federal Data Protection Act

• It is likely that the legality of other rating sites depends on the characteristics which are rated (sensitive personal data would need explicit consent) and on the group rated (e.g. entrepreneur, employee)

• Spickmich.de has put several restrictions in place to limit access

note2be.com (France)

Teacher rating website note2be.com

Tribunal de Grande Instance de Paris (TGI) issued an injunction against the rating website to delete all names of teachers within two days with a penalty of 1.000 Euros per day in the event of noncompliance

This judgment was based on the argument that the website would endanger the functioning of the educational system

The French data protection authority (CNIL) concluded that the website would breach French data protection laws

Beyond the German case: UK, EU and US perspectives

German and French cases involve: Website being sued, not rater – remedy of DS to take down

ratings, plus prevent further ratings being added Data protection law

Alternative strategies: Sue rater, not site? Sue for libel not privacy? (eg williseemytutor.com). Approp

remedy for vindicating reputation – right of correction? Damages! Are “opinions” personal data in UK? Yes – s 1(1) DPA “includes

any expression of opinion about individual” – intended to cover eg employer’s assessments affecting promotion (Carey) (Not DPD wide)

Means DS consent necessary to publish? Mitigated by defences - journalism rejected in German case; “literary or artistic”? (s 32 DPA); no “fair comment”. Also “legitimate purpose of DC”, but trumped by privacy in German case.

Libel/defamation: rater liability

Libel unlike privacy requires falsehood for remedy – “opinions” may not be caught - dodgy

English courts have tried to restrict growth in libel suits re UGC as “mere vulgar abuse” or “fair comment” Smith v Adven; Sheffield Wednesday v Hargreaves Typical comments: "This guy sucks" and "Right up there

with George W". “ (ratemyprofessor.com)

Anonymity of rater? Norwich Pharmacal order for site to disclose possible – but not if no registration? (ratemyMD.com (US) cf. ratemylecturer.com (UK)) and spickmich.de (Ge))

Libel: site liability

In principle, liable as host/publisher (?)But liability of EU online hosts mitigated by art 14 ECD

(in UK, ECD regs r 19).Means easiest remedy by far will be to ask site for NTD

(empirical evidence host site tends to take down, even where illegality questionable – Oxford, Multitali etc)

And NB – ECD art 1(5) – art 14 immunities don’t apply re DP liability (little known – why?)

Interesting comparison to USA: CDA s 230(c) appears to give site total immunity. even on notice (Zeran v AOL, etc). Explains prominence of US sites. Although see Roommates/ case cf Craigslist cases – room for doubt?

=>Just put your site in US? But libel jurisdiction in place of publication still applicable – DP also.

Policy issues

Should we encourage such sites by reducing legal risk? Currently law not harmonised across EU & doubtful. Cf USA total immunity. US sites likely to pick up slack if EU sites restrained by fears of liability.

Pro such sites: consumer knowledge; freedom of speech; may incentivise improvements (cf league tables); is it invasion of “privacy” if about your job?

Anti: bad effects on those rated (promotion, tenure, bullying, stress, blackmail?); lack of accountability of those rating (cf student questionnaires); dignity of profession; non personal alternatives (rate school, dept, surgery).

Ways forward?

Legal Extend immunity of ECD art 14 to DPD liability Even NTD paradigm will make sites less useful (criticisms will go!).

Allow total immunity as per USA, but with ADR/Ombudsman/ICO supervision system built in for speedy redress?

Consider if DP law needs a balance not just between privacy and freedom of expression, but privacy and aggregate consumer/social gain? Cf Google Street View.

“Good practice” Make raters more accountable – demand either names or at least

registration. Likely to destroy sites take up (and ad revenue) though. Kite marks for sites with minimum “due process” safeguards eg only

rated if 10 raters, etc (tho spickmich.de had most of these!) . Ethical

Ban sites rating individuals, and promote non personal data sites eg as in US, making more info about professors assessments, etc, public, to allow “informed” choice.

General issue for web 2.0: Consider where balance of DS privacy, and public interest in speech/community, should lie in UGC, SNS world.