Schneier on Security

A blog covering security and security technology.

« Guide to Microsoft Police Forensic Services | Main | The Limits of Identity Cards »

March 9, 2010

Marc Rotenberg on Google's Italian Privacy Case

I don't think this is really a case about ISP liability at all. It is a case about the use of a person's image, without their consent, that generates commercial value for someone else. That is the essence of the Italian law at issue in this case. It is also how the right of privacy was first established in the United States.
The video at the center of this case was very popular in Italy and drove lots of users to the Google Video site. This boosted advertising and support for other Google services. As a consequence, Google actually had an incentive not to respond to the many requests it received before it actually took down the video.

Back in the U.S., here is the relevant history: after Brandeis and Warren published their famous article on the right to privacy in 1890, state courts struggled with its application. In a New York state case in 1902, a court rejected the newly proposed right. In a second case, a Georgia state court in 1905 endorsed it.

What is striking is that both cases involved the use of a person's image without their consent. In New York, it was a young girl, whose image was drawn and placed on an oatmeal box for advertising purposes. In Georgia, a man's image was placed in a newspaper, without his consent, to sell insurance.

Also important is the fact that the New York judge who rejected the privacy claim, suggested that the state assembly could simple pass a law to create the right. The New York legislature did exactly that and in 1903 New York enacted the first privacy law in the United States to protect a person's "name or likeness" for commercial use.

The whole thing is worth reading.

EDITED TO ADD (3/18): A rebuttal.

Posted on March 9, 2010 at 12:36 PM • 24 Comments

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.

Comments

savanik • March 9, 2010 2:46 PM

I would hope that one of the key arguments that comes up is whether or not the Google executives acted on the takedown notices for this video the same way as any other video. Yes, the video drove traffic to their website, but if they're not responsible for the content, why are they responsible for the consequences of that content, so long as they acted in a swift, responsible manner to make sure laws were being followed?

Googol • March 9, 2010 3:25 PM

@savanik: "I would hope that one of the key arguments that comes up is whether or not the Google executives acted on the takedown notices for this video the same way as any other video."

Is that sufficient? What if they unreasonably delay processing all takedown notices?

"so long as they acted in a swift, responsible manner to make sure laws were being followed"

That seems like a better test than the above.

Adam • March 9, 2010 3:41 PM

I have always wondered about a marketing company that uses my name, address, and email for distributions?

Isnt the difference between a tabloid making money on a picture and name and a marketing company making money on 100k names just a matter of scale?

Joseph Arpaia • March 9, 2010 3:42 PM

Maybe they should be responsible for the content. After all if I author a book, I have to take some responsibility for the content. I can't copy someone else's content, etc. without being held responsible. Why should an "ISP" be exempt from this, especially when Google is clearly not an ISP but rather an advertising company.

A Telco Security Dweeb • March 9, 2010 3:44 PM

Having read Rotenberg's article, I think that anyone who understands how the Internet (in general) and search engines like Google (in particular), work, would find his analysis of the situation highly counter-intuitive.

Consider, for example, Rotenberg's assertion that "this is about the ability of an individual to control the use of images of himself / herself, for purposes of personal privacy".

This SOUNDS innocuous enough, until one starts to think about the implications of enforcing it on the Net (world-wide), as the Italian courts seem to believe they have the right to do.

If accepted as a standard of Internet speech regulation, this concept would, for example, entitle any politician or movie star to demand the immediate removal of any image (or other content) that, in his or her unilateral judgment, "invades my privacy".

The possibilities for abuse of this kind of "right" are endless : for example, a politician could demand the removal of any picture that showed himself or herself in an unflattering situation.

And remember, this "right" could not be limited just to people who Western observers think are "responsible". What if, for example, the President of Iran were to start demanding the removal of uncomplimentary pictures or articles about himself, on the grounds that they "violated his privacy" or "insulted him"?

What if the Iranian courts then ordered Google executives to stand for trial? (Please explain to me the logical difference, if the original case is on these grounds, between an extradition order issued from Rome, and one issued from Tehran.)

The fact that YouTube may have indirectly profited by showing the images of the Italian teenager, is a red herring, in this case.

What it IS really all about, is whether authorities in one (small) jurisdiction, can attempt to enforce local standards - good, bad or indifferent - on Web-centric services that are by definition, global in orientation.

If the precedent is upheld, you can expect to see a flood of similar court actions, but from jurisdictions with quite different attitudes... say "hello" to demands from North Korea, for "unflattering" pictures or movies of Kim Jong Il, being arbitrarily removed from YouTube, on the grounds that these are "invading the Great Leader's privacy rights".

Sound good to you? Then root for the Italian courts, on this one.

smitier than the sword • March 9, 2010 3:56 PM

@ A Telco Security Dweeb: "(Please explain to me the logical difference, if the original case is on these grounds, between an extradition order issued from Rome, and one issued from Tehran.)"

If you ignore the one from Rome, then Yahweh will smite you. If you ignore the one from Tehran, then Allah will smite you.

jgreco • March 9, 2010 3:56 PM

@Joseph Arpaia

I'm not sure that is an accurate comparison. As I understand it, google is acting more as a publisher than an author here. Sure google is an advertising company, but in this circumstance their main involvment was hosting content for someone else.

DC • March 9, 2010 4:21 PM

@Telco security dweeb

We already have laws here (and so do most other places) that cover most of what you're worried about. People who are celebrities and who willingly put themselves in the public eye for a living (includes politicians) are presumed to have less "right of privacy" than a "normal person" in nearly all jurisdictions, because this wouldn't be the first time this kind of problem has arisen. No need to rush to new law when the old ones do fine.

So Obama say, can still sue you for libel or slander, but not for posting his picture if it was something he did in public. Ditto celebrities -- no bedroom pictures taken from across the street, but if they're outside, they are more or less fair game.

I'm not a lawyer, so YMMV, but that's the gist of it.

pdf23ds • March 9, 2010 7:48 PM

DC: The problem with that supposed difference in legal protection is that it requires judgement, and judgement opens up the system for abuse. Who's going to decide, for a given takedown request, whether the subject is a public figure, or in a public situation, or whether he/she has a reasonable expectation of privacy in the depicted situation?

Is it going to be the ISP or hosting company? Is it going to be a court?

I think you can see the abuse potential here. A simple, bright-line rule is much preferable.

jgreco • March 9, 2010 8:38 PM

@pdf23ds

Preferably, it should be handled by the courts. That is kind of the whole reason we have them. I really don't see why ISPs or hosting companies ever need to get involved. If someone has an issue with content another person is producing and happens to distribute over the internet, they can take them to court, just like they would take them to court if any other distribution method was involved.

As for poorly defined laws that can be interpreted in numerous ways: this is hardly a new issue. Judgement has always been present in the legal system, hence the whole "judge" thing.

Paeniteo • March 10, 2010 4:09 AM

@pdf23ds: "The problem with that supposed difference in legal protection is that it requires judgement, and judgement opens up the system for abuse."

The only other way would be "zero tolerance" policies and we have already seen on this blog that they produce absurd results:
http://www.schneier.com/blog/archives/2009/10/...
http://www.schneier.com/blog/archives/2009/11/...

cu, Paeniteo

Winter • March 10, 2010 4:54 AM

@pdf23ds: "The problem with that supposed difference in legal protection is that it requires judgement, and judgement opens up the system for abuse."

Read "The death of common sense" (http://www.scottlondon.com/reviews/howard.html) about about avoiding judgment.

You simply cannot act without human judgment. Period.

Transfer it to driving a car. The traffic code are unambiguous. Would you trust driving a bus to a machine? No, because it would need common sense in interpreting the rules. But a machine with common sense will be just like a human.

Winter

Steve • March 10, 2010 7:59 AM

The issue of privacy is a red herring, it was simply a case of something must be done, this is something therefore we will do it. he Italian political system is hilariously corrupt. Other European leaders get cream pies and eggs thrown at them, Berlusconi got a metal statue to the face. When you have such bad feeling towards the establishment as that protecting a child from the big bad foreign company is great PR.

casey • March 10, 2010 10:11 AM

I think that YouTube has the right to publish documents (videos etc) that are submitted to them in good faith. If the submitter does not have the legal right to post the document, then YouTube should be required to take it down. So far so good, right? The problem may be that YouTube is creating an environment where they profit from ignorant users who are unaware of their responsibility in publishing said document.

If YouTube required all submissions to have been vetted for legality, then they will not have as many videos and the public intrest in the sight decreases and so does their ad revenues. Since the business model requires dubious videos, they should bear some of the costs associated with open submission including lawsuits etc.

jgreco • March 10, 2010 10:45 AM

Last I checked, Google was running youtube massively in the red. Has this changed and I missed it? I'm going to agree with Steve here, I think the privacy issue is a red herring, and I think the "Google profits off this so they have an incentive to not respond" is too. The vast bulk of their billions comes from advertising on their search engine site, and I'm sure public opinion is worth far more to them than the advertising revenue from a few measly videos on an unprofitable website.

Nobody • March 10, 2010 12:39 PM

So it's just about the use of someones image?

That's a relief - I thought it might be a attempt by an Italian president that personally owns all the media outlets in his country to squash the only source of news and political comment outside his control.

But since it's only about protecting the children I don't need to worry.

Álvaro Del Hoyo • March 10, 2010 12:46 PM

Bruce,
There is a fundamental difference: Brandeis case was about companies taking pics for its editing business in a non Internet era, Google was not taken or uploading that video, but its platform was used to publish it, and safe harbors apply on Internet era.
It is a question of users accountability, but Internet service providers too and chances to monitor everything that happens on their platforms.
Un saludo

pdf23ds • March 10, 2010 8:15 PM

To people responding to me: "judgement" is, generally speaking, good in a judicial setting. Judgement is terrible when it's left up to faceless bureaucrats or anonymous private employees. Do you really want every single video that someone doesn't like to generate a lawsuit? Or do you think that privacy takedown requests will be any less horrible than DMCA takedown requests?

jgreco • March 10, 2010 11:24 PM

@pdf23ds

Things to note: These privacy laws which you seem to be implying are hypothetical already exist, and the proper (and current) place to handle them is in the courts, not involving faceless bureaucrats or private employees.

They are not as ripe for abuse as DMCA takedown notices because, unlike DMCA takedowns, there is a required initial investment involved. You can send frivolous DMCA takedowns for free with virtually no consequences but dragging someone off to court and suing them for privacy violations takes time and money.

Stefano • March 11, 2010 11:02 AM

Actually, Mr. Rotenberg has a lot of his information (I would almost say "FUD", if I didn't respect him as much as I do) upside down.

I clarified it a little here:
http://raistlin.soup.io/post/48082301/...

Joby • March 11, 2010 4:11 PM

All these "related" cases like a girl's image being used on a cereal box, or a man's image in an advertisement are *completely* different from posting a video on YouTube/Google Video. Unless of course said cereal company was printing the artwork of strangers on its boxes willy-nilly with no review process.

YouTube and other community oriented sites aren't like a newspaper or a cereal box. They're more like a bulletin board that anyone can post something to.

If you saw something offensive posted to a bulletin board in a mall would you blame the mall? Not unless you're looking for some publicity or money when the media picks up on it.

pdf23ds • March 11, 2010 11:16 PM

So I guess the people responding to me don't have a problem with the Italian case? From you guys' perspective, I don't see what's wrong with the case.

pdf23ds • March 11, 2010 11:17 PM

Or perhaps you would say that they should be suing the people that posted the video, not Google. Would you have a problem with a subpoena to google to get the user's personal info (like an IP address)?

Stefano • March 18, 2010 5:29 PM

@pdf23ds,

you seem to be working under some misunderstandings:
- the parents of the person portrayed in the video DID NOT sue Google; actually, no one sued anyone, this was a criminal trial, not a civil lawsuit
- the person who posted the video already went under trial and was sentenced in a separate case

Post a comment

Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.

Subscribe via Kindle

Blog Menu

Search

Powered by DuckDuckGo

Blog Home Page
100 Latest Comments

Archives by Date

2013 J F M A M
2012 J F M A M J J A S O N D
2011 J F M A M J J A S O N D
2010 J F M A M J J A S O N D
2009 J F M A M J J A S O N D
2008 J F M A M J J A S O N D
2007 J F M A M J J A S O N D
2006 J F M A M J J A S O N D
2005 J F M A M J J A S O N D
2004 J F M A M J J A S O N D