Friday, June 21, 2013

Liability for Algorithm Design & Big Data (Google Auto-complete)

The sixth senate of the German Federal Supreme Court (BGH) in March decided a case against Google (VI ZR 269/12) involving a question of its liability for Autocomplete Tool. The case was widely reported around various websites (IPKat, DW, BBC, etc.) as 'Germany tells Google to tidy up auto-complete'. Few weeks ago, the decision full-text became available and provoked interesting discussions among some German bloggers (e.g. Adrian Schneider, Niko Härting, Thomas Stadler). Kay Oberbeck from Google reacted that "We fail to understand the federal court's ruling - that Google should be responsible for the search terms used by its users".

So what did the court say and what are the implications for the future of Big Data analysis and liability of companies for their algorithm designs?

The commentators generally share certain feeling of confusion over the decision. It might be because the decision was handed by the sixth senate, which uses certain crucial terms (e.g. Störerhaftung) in a slightly different context/meaning and/or less clearly than a first BGH senate, which is focusing on the intellectual property issues. Plus it is true that it is sometimes not entirely clear how the court arrived at the end result. I also have feeling that the court sometimes contradicts itself (e.g. § 26 last two sentences).

First of all, this case is not about secondary, but direct liability. Court is very explicit about the fact that auto-complete is to be treated as own content of Google. The court says:

DE:  Diese Beeinträchtigung des Persönlichkeitsrechts der Kläger ist der Beklagten auch unmittelbar zuzurechnen. Sie hat mit dem von ihr geschaffenen Computerprogramm das Nutzerverhalten ausgewertet und den Benutzern der Suchmaschine die entsprechenden Vorschläge unterbreitet. Die Verknüpfungen der Begriffe werden von der Suchmaschine der Beklagten und nicht von einem Dritten hergestellt. Sie werden von der Beklagten im Netz zum Abruf bereitgehalten und stammen deshalb unmittelbar von ihr.

EN [edited Google Translate]: 'This interference with the personal rights of the plaintiff is also directly attributable to the defendant. He has analyzed the user behavior using a self created computer program and presented the suggestions to the users of the search engine.  The linkage of the terms are made by the search engine of the defendant and not by a third party. They are provided for retrieval on network by the defendant and therefore come directly from him.'
And then further that:
'Zwar ist die Beklagte nicht bereits nach § 10 Telemediengesetz (künftig: TMG) von der Verantwortlichkeit für den Inhalt der von ihr betriebenen Website befreit. Das Berufungsgericht hat die Beklagte zutreffend als Diensteanbieter (§ 2 Satz 1 Nr. 1 TMG) qualifiziert, der eigene Informationen zur Nutzung bereit hält und deshalb gemäß § 7 Abs. 1 TMG nach den allgemeinen Gesetzen - mithin auch nach §§ 823 Abs. 1, 1004 BGB - verantwortlich ist (vgl. Senatsurteil vom 23. Juni 2009 - VI ZR 196/08, BGHZ 181, 328 Rn. 13 f. s. auch Heckmann, aaO; a.A. Brosch, aaO). Die Kläger nehmen die Beklagte nicht wegen der Durchleitung, Zwischenspeicherung oder Speicherung fremder Informationen, sondern wegen einer eigenen Information in Anspruch, konkret wegen der als Ergebnisse ihres Autocomplete-Hilfsprogramms dem Nutzer ihrer Internet-Suchmaschine angezeigten Suchwortergänzungsvorschläge. Es geht mithin um einen von der Suchmaschine der Beklagten angebotenen "eigenen" Inhalt und nicht um das Zugänglichmachen und/oder Präsentieren von Fremdinhalten, für die der Diensteanbieter gemäß §§ 8 bis 10 TMG nur eingeschränkt verantwortlich ist.'
The BGH here confirms that auto-compete constitutes own content of Google and that mere conduit, caching or hosting safe harbor therefore can not apply. This is of course one very important point. If you analyze the behavior data from your users and then present them further, according to BGH, those data are your own content. The very fact of processing of data using your own algorithm thus turns presented results into your own. Quite far reaching consequence, which BGH is trying to mitigate by other means later on (see below). The court further argues that hosting safe harbor can not apply also because the activity of auto-complete is not mere technical, automatic and of passive nature (yes, the unfortunate misreading of eCommerce Directive from § 114, Google France).

Having said that, the court stresses that from the fact that it is own content of Google, it does not automatically follow that Google is liable for all personality rights infringements ('Daraus folgt allerdings noch nicht, dass die Beklagte für jede Persönlichkeitsrechtsbeeinträchtigung durch Suchvorschläge haftet'). It is important to note that court discusses here not a liability for damages, but obligation to serve injunctions. In German law, as explained in my paper here, it is possible that injunctions are to be served also by persons that are innocent from the tort law perspective. But this case is about own content, so it logically should be about obligation to serve injunctions as a wrongdoer. Is that really the case?

Well, the sixth senate discusses legal basis of injunctions (§ 1004 BGB) and the concept of 'Störerhaftung' (liability as a disturber), which is little bit misleading for IP lawyers, who hear this term mostly in it's reduced meaning from the first senate, in cases where narrow German intent-based secondary liability standard (Teilnehmerschaft) can not be established. However in it's original sense, the term defines all persons (disturbers) who have to serve injunctions, thus including both tort feasors and innocent parties. The BGH in my reading of the decision deals with obligation of Google to serve injunctions as a direct tort feasor. At the same time the court eventually arrives at the conclusion that Google has to serve injunction as a rule only upon receipt of knowledge about infringing terms in its Auto-complete Tool (as an exception the court mentions possible prevention obligation in respect to certain fields such as child pornography). How is that possible?

It seems that BGH does not put equation between own content and own acts. The court literary says that Google should not be blamed for development and use of the suggestion tool software. It explains it's position as follows:

Das Entwickeln und die Verwendung der die Suchvorschläge erarbeitenden Software ist der Beklagten nicht vorzuwerfen; hierbei handelt es sich vielmehr um eine durch Artt. 2, 14 GG geschützte wirtschaftliche Tätigkeit. Das Suchmaschinenangebot der Beklagten zielt auch nicht von vornherein auf eine Rechtsverletzung durch eine gegen eine bestimmte Person gerichtete unwahre Tatsachenbehauptung ab. Nur durch das Hinzutreten eines bestimmten Nutzerverhaltens können ehrverletzende Begriffsverbindungen entstehen. Die Tätigkeit der Beklagten ist andererseits aber nicht nur rein technischer, automatischer und passiver Art.
Bei Beeinträchtigungen, die eine pflichtwidrige Unterlassung als (Mit-)Ursache haben, ist zur Vermeidung einer zu weitgehenden Haftung eine fallweise wertende Betrachtung erforderlich. Die Verantwortlichkeit des Unterlassenden wird durch die Kriterien der Möglichkeit und Zumutbarkeit der Erfolgsverhinderung begrenzt.
The court here basically says that because Google's liability is dependent on searching behavior of its users, Google may only co-cause infringement of personality rights by it's wrongful omission. To assess whether the omission is wrongful, one has to take into account all the circumstances of the case, including criteria of feasibility and reasonableness of the success of prevention. My reading is therefore as follows.  

Own content does not automatically establish own acts of data processor. Own acts in respect to own content that is a result of processing of third party data will arise only if the processor omitted to act where he should have acted.

This is rather interesting development when one considers the case-law of the first senate of the BGH. This senate seemed to be saying to us that direct liability arises when intermediaries act as own-content providers. And that intermediaries are not only directly liable for content which they have created but are for the content they have adopted. Direct liability for adopted content is based on § 7 TMG, which distinguishes between content providers as providers of their “own contents” and intermediaries as providers of “contents of third parties”. This distinction led to a court praxis according to which an intermediary can adopt the contents of third parties and become an own-content provider itself (German Federal Supreme Court, marions-kochbuch.de, 12.11.2009, Case No. I ZR 166/07). Now it seems that there are there possible types of third party content

a) submitted third party content within safe harbors,
b) submitted and adopted third party content (own content = own acts)
c) submitted and processed third party content (own content = own acts only upon wrongful omission)

What is however interesting is that arguably different jurisdictions might have different opinions on whether such algorithm-processed-data are already own content/acts of the processor. Also, Union law might have different opinion on what constitutes own content. Let's assume for the sake of argument that hosting safe harbor would otherwise apply to Google auto-complete tool. If national law can deny safe harbor by saying that Google itself acts and thus its service does not 'consists of the storage of information provided by a recipient of the service' as a consequence of the national law, then safe harbors are deeply flawed. It is exactly for this reason, why I believe that difference between own content and submitted content must be an issue of the Union law. Of course, German law can still keep viewing auto-complete results as own content of Google for personality rights analyzes, but for the purposes of applying hosting safe harbors, it has to rely on Union meaning. This further shows that safe harbor can in fact shield also from direct liability.

Let me demonstrate my point on some other example. Arguably, something similar could have happened also in the context of trade mark law not that long time ago. If CJEU in Google France would consider enabling of keywords registration within AdWords system a trade mark use by Google, then hosting safe harbor could potentially shield Google from direct liability as well. Because if Google would be trade mark user (hence potentially directly liable) and hosting service (hence having safe harbor) at the same time, it would be shielded from damages liability until it learns about the infringing keywords (and looses safe harbor), despite being direct infringer. Injunctions would be possible regardless of such knowledge of course.

I think the case shows an interesting trend. It is getting more and more difficult for courts to distinguish between own content and submitted content. The safe harbors we have today foresee only services that are rather passive in respect to third party content (e.g. passive hosting). The things get more and more complicated when the content is processed via various algorithms and only then served to users. This BGH case shows that courts may vis-à-vis own content arrive at similar conclusions as if they would apply the hosting safe harbor. But it also shows that more sophisticated services can not really rely on some Union law framework, because current reading of 'information provided by a recipient of the service' (art. 14 of eCommerce Directive) is arguably narrow one. Maybe it's time to reconsider our safe harbors and especially focus on the role of injunctions that today operate outside of this "harboring" system.

4 comments:

Cédric said...

Thanks Martin, very useful post (in particular for someone in my position: I do not read German and was unable to understand the ruling!).

FYI, the French supreme court has issued a very important ruling over Google Suggest two days ago.
It finds Google cannot be found liable for the predictions that appear when users type words, as they do not reflect the will of the search tool. Without any intent from the search tool to express contentious sentences or to give a meaning to them, there cannot be any violation of French press law (note there was no reference to hosting liability).

Huťko said...

Dear Cédric,

many thanks for your comment. That's very interesting. May I ask why did the Cour de Cassation require intent?

If you have any more detailed comment on the case, I would be interested in reading it.

Best,
Martin

Miquel said...

Hi Martin, very useful post!
I’m not sure whether the notion of hosting “information provided by a recipient of the service” is being narrowly construed. In any event, though, it is interesting to see that in some instances, even rejecting the applicability of the safe harbour, courts still find it necessary some kind of knowledge on the part of the provider for liability to arise, which leads to a somewhat equivalent result. I’m thinking for instance of the Italian case Mediaset v. Yahoo! Video (Sentenza del Tribunale di Milano 19 May 2011). There the court held that the safe harbor didn't apply because Yahoo! Video was carrying out a so-called “active hosting” (instead of a passive one), but still it held that Yahoo could not be obliged to monitor its content, as this would jeopardize other rights (including freedom of expression). Yahoo was eventually held liable because it was notified of the infringing content and didn’t remove it. But it would have been held not liable in the absence of such a notification, which ends up being a similar result than if the safe harbour would have been considered applicable.
Thanks again for this great post!
Miquel

Huťko said...

Hi Miquel,

thanks for taking time to comment.

I agree that is very interesting to see how courts construe different solutions based on their domestic tort law similarly to safe harbors.

What I meant by narrow interpretation of “information provided by a recipient of the service” is that if you think of autocompete as a separate piece of activity of Google, you can argue that search terms that appear in search suggestions are provided and stored by users, who did previous searches. And hence that this stored information per se are hosting activity, of course under broader reading of first part of Art. 14 eCommerce Directive ("an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service"). By activity I mean not the entire algorithm, but only appearance of third party information within such algorithm. Think of Google Adwords that are also mixed in nature, but one substantial part of activity can be seen as hosting.

Sure, one can then argue that harbor benefit would not help Google because of more than mere technical, automatic and of passive nature of autocomplete or because a recipient of the service is acting under the control of the provider. I don't dispute that. But I feel that there are much more cases that could fall under “information provided by a recipient of the service” as we currently apply it to.

I think that distinctive feature of Mediaset v. Yahoo! when compared to this case is that in Mediaset v. Yahoo! Italian court still treated those videos as third party content (although outside of safe harbor), rather than own content.

What do you think?

Best,
Martin