Three Google executives have been convicted for failing to comply with Italian data protection laws. The criminal convictions relate to a video which appeared on a Google Video site in 2006 depicting a child with Down’s syndrome being bullied by fellow pupils in a Turin school. Google’s Chief Legal Officer, its Global Privacy Counsel and its former Chief Financial Officer received six month suspended prison sentences.
The ruling is a troubling precedent for internet service providers and other online intermediaries in Europe. The court’s decision (not yet available in English) is believed to have focused on the website’s notice and takedown procedures. Some reports suggested that the video had been online for two months despite comments posted asking for it to be taken down. Google said that it took the video down within hours of being contacted by Italian police.
Google said that it would appeal the Court’s decision, stating: “In essence this ruling means that employees of hosting platforms like Google Video are criminally responsible for content that users upload. We will appeal this astonishing decision because the Google employees on trial had nothing to do with the video in question.”
European law protects service providers from liability for material that they neither create nor monitor but simply store, host or pass on to users of their service. However, this “safe harbour” exemption is not absolute and can be lost if service providers do not act quickly to remove illegal content once it is brought to their attention. In addition, this exemption does not apply to data protection rules. Irish businesses need to be aware of the risks of publishing user generated content online and to take legal, practical and technical measures to minimise those risks.
In a separate development, the Irish Data Protection Commissioner has co-signed a letter to Google along with a number of other data protection authorities highlighting data protection concerns in relation to the launch of the Google Buzz social networking service. Although Google has since taken corrective action, the Commissioner expressed disappointment that privacy issues were not adequately addressed prior to launch. The Commissioner has repeatedly advised Irish businesses to take account of data protection issues at an early stage in the development of new services which involve the processing of personal information.
