CASE OF K.U. v. FINLAND
Violation of Art. 8;Non-pecuniary damage - award
Giovanni Bonello;Ján Šikuta;Lech Garlicki;Nicolas Bratza;Päivi Hirvelä
6. The applicant was born in 1986. 7. On 15 March 1999 an unidentified person or persons placed an advertisement on an Internet dating site in the name of the applicant, who was 12 years old at the time, without his knowledge. The advertisement mentioned his age and year of birth, gave a detailed description of his physical characteristics, a link to the web page he had at the time, which showed his picture, as well as his telephone number, which was accurate save for one digit. In the advertisement, it was claimed that he was looking for an intimate relationship with a boy of his age or older “to show him the way”. 8. The applicant became aware of the advertisement on the Internet when he received an e-mail from a man, offering to meet him and “then to see what you want”. 9. The applicant’s father requested the police to identify the person who had placed the advertisement in order to bring charges against that person. The service provider, however, refused to divulge the identity of the holder of the so-called dynamic Internet Protocol (IP) address in question, regarding itself bound by the confidentiality of telecommunications as defined by law. 10. The police then asked the Helsinki District Court (käräjäoikeus, tingsrätten) to oblige the service provider to divulge the said information pursuant to section 28 of the Criminal Investigations Act (esitutkintalaki, förundersökningslagen; Act no. 449/1987, as amended by Act no. 692/1997). 11. In a decision issued on 19 January 2001, the District Court refused since there was no explicit legal provision authorising it to order the service provider to disclose telecommunications identification data in breach of professional secrecy. The court noted that by virtue of Chapter 5a, section 3, of the Coercive Measures Act (pakkokeinolaki, tvångsmedelslagen; Act no. 450/1987) and section 18 of the Protection of Privacy and Data Security in Telecommunications Act (laki yksityisyydensuojasta televiestinnässä ja teletoiminnan tietoturvasta, lag om integritetsskydd vid telekommunikation och dataskydd inom televerksamhet; Act no. 565/1999) the police had the right to obtain telecommunications identification data in cases concerning certain offences, notwithstanding the obligation to observe secrecy. However, malicious misrepresentation was not such an offence. 12. On 14 March 2001 the Court of Appeal (hovioikeus, hovrätten) upheld the decision and on 31 August 2001 the Supreme Court (korkein oikeus, högsta domstolen) refused leave to appeal. 13. The person who had answered the dating advertisement and contacted the applicant was identified through his e-mail address. 14. The managing director of the company which provided the Internet service could not be charged, because in his decision of 2 April 2001 the prosecutor found that the alleged offence had become time-barred. The alleged offence was a violation of the Personal Data Act (henkilötietolaki, personuppgiftslagen; Act no. 523/99, which came into force on 1 June 1999). More specifically, the service provider had published a defamatory advertisement on its website without verifying the identity of the sender. 15. The Finnish Constitution Act (Suomen hallitusmuoto, Regeringsform för Finland; Act no. 94/1919, as amended by Act no. 969/1995) was in force until 1 March 2000. Its section 8 corresponded to Article 10 of the current Finnish Constitution (Suomen perustuslaki, Finlands grundlag; Act no. 731/1999), which provides that everyone’s right to private life is guaranteed. 16. At the material time, Chapter 27, Article 3, of the Penal Code (rikoslaki, strafflagen; Act no. 908/1974) provided: “A person who in a manner other than that stated above commits an act of malicious misrepresentation against another by a derogatory statement, threat or other degrading act shall be sentenced for malicious misrepresentation to a fine or to imprisonment for a maximum period of three months. If the malicious misrepresentation is committed in public or in print, writing or a graphic representation disseminated by the guilty party or which the guilty party causes, the person responsible shall be sentenced to a fine or to imprisonment for a maximum period of four months.” 17. At the material time, Chapter 5a, section 3 of the Coercive Measures Act provided: “Preconditions of telecommunications monitoring Where there is reason to suspect a person of (1) an offence punishable by not less than four months’ imprisonment; (2) an offence against a computer system using a terminal device, a narcotics offence; or (3) a punishable attempt to commit an offence referred to above in this section; the authority carrying out the criminal investigation may be authorised to monitor a telecommunications connection in the suspect’s possession or otherwise presumed to be in his use, or temporarily to disable such a connection, if the information obtained by the monitoring or the disabling of the connection can be assumed to be very important for the investigation of the offence ...” 18. Section 18, subsection 1(1) of the Protection of Privacy and Data Security in Telecommunications Act, which came into force on 1 July 1999 and was repealed on 1 September 2004, provided: “Notwithstanding the obligation of secrecy provided for in section 7, the police have the right to obtain: (1) identification data on transmissions to a particular transcriber connection, with the consent of the injured party and the owner of the subscriber connection, necessary for the purpose of investigating an offence referred to in Chapter 16, Article 9 (a), Chapter 17, Article 13 § 2 or Chapter 24, Article 3 (a) of the Penal Code (Act no. 39/1889) ...” 19. Section 48 of the Personal Data Act provides that the service provider is under criminal liability to verify the identity of the sender before publishing a defamatory advertisement on its website. Section 47 provides that the service provider is also liable in damages. 20. At the material time, processing and publishing sensitive information concerning sexual behaviour on an Internet server without the subject’s consent was criminalised as a data protection offence in section 43 of the Personal Files Act (Act no. 630/1995) and Chapter 38, Article 9 (Act no. 578/1995) of the Penal Code, and as a data protection violation in section 44 of the Personal Files Act. Furthermore, it could have caused liability in damages by virtue of section 42 (Act no. 471/1987) of the said Act. 21. Section 17 of the Exercise of Freedom of Expression in Mass Media Act (laki sanavapauden käyttämisestä joukkoviestinnässä, lagen om yttrandefrihet i masskommunikation; Act no. 460/2003), which came into force on 1 January 2004, provides: “Release of identifying information for a network message At the request of an official with the power of arrest, a public prosecutor or an injured party, a court may order the keeper of a transmitter, server or other similar device to release information required for the identification of the sender of a network message to the requester, provided that there are reasonable grounds to believe that the contents of the message are such that providing it to the public is a criminal offence. However, the release of the identifying information to the injured party may be ordered only in the event that he or she has the right to bring a private prosecution for the offence. The request shall be filed with the District Court of the domicile of the keeper of the device, or with the Helsinki District Court, within three months of the publication of the message in question. The court may reinforce the order by imposing a threat of a fine.” 22. The rapid development of telecommunications technologies in recent decades has led to the emergence of new types of crime and has also enabled the commission of traditional crimes by means of new technologies. The Council of Europe recognised the need to respond adequately and rapidly to this new challenge as far back as in 1989, when the Committee of Ministers adopted Recommendation No. R (89) 9 on computer-related crime. Resolved to ensure that the investigating authorities possessed appropriate special powers in investigating computer-related crimes, in 1995 the Committee of Ministers adopted Recommendation No. R (95) 13 concerning problems of criminal procedural law connected with information technology. In point 12 of the principles appended thereto, it recommended that: “Specific obligations should be imposed on service providers who offer telecommunication services to the public, either through public or private networks, to provide information to identify the user, when so ordered by the competent investigating authority.” 23. The other principles relating to the obligation to cooperate with the investigating authorities stated: “9. Subject to legal privileges or protection, most legal systems permit investigating authorities to order persons to hand over objects under their control that are required to serve as evidence. In a parallel fashion, provisions should be made for the power to order persons to submit any specified data under their control in a computer system in the form required by the investigating authority. 10. Subject to legal privileges or protection, investigating authorities should have the power to order persons who have data in a computer system under their control to provide all necessary information to enable access to a computer system and the data therein. Criminal procedural law should ensure that a similar order can be given to other persons who have knowledge about the functioning of the computer system or measures applied to secure the data therein.” 24. In 1996, the European Committee on Crime Problems set up a committee of experts to deal with cybercrime. It was felt that, although the previous two recommendations on substantive and procedural law had not gone unheeded, only a binding international instrument could ensure the necessary efficiency in the fight against cyberspace offences. The Convention on Cybercrime was opened for signature on 23 November 2001 and came into force on 1 July 2004. It is the first and only international treaty on crimes committed via the Internet and is open to all States. The Convention requires countries to establish as criminal offences the following acts: illegal access to a computer system, illegal interception of computer data, interference with data or a computer system, misuse of devices, computer-related forgery and fraud, child pornography, and the infringement of copyright and related rights. The additional protocol to the Convention on Cybercrime, adopted in 2003, further requires the criminalisation of hate speech, xenophobia and racism. The scope of the Convention’s procedural provisions goes beyond the offences defined in the Convention in that it applies to any offence committed by means of a computer system: “1. Each Party shall adopt such legislative and other measures as may be necessary to establish the powers and procedures provided for in this section for the purpose of specific criminal investigations or proceedings. 2. ... each Party shall apply the powers and procedures referred to in paragraph 1 of this Article to: (a) the criminal offences established in accordance with Articles 2 through 11 of this Convention; (b) other criminal offences committed by means of a computer system; and (c) the collection of evidence in electronic form of a criminal offence. 3. ...” 25. The procedural powers include the following: expedited preservation of stored data, expedited preservation and partial disclosure of traffic data, production order, search and seizure of computer data, real-time collection of traffic data and interception of content data. Of particular relevance is the power to order a service provider to submit subscriber information relating to its services; indeed, the explanatory report describes the difficulty in identifying the perpetrator as being one of the major challenges in combating crime in the networked environment: “1. Each Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to order: (a) a person in its territory to submit specified computer data in that person’s possession or control, which is stored in a computer system or a computer-data storage medium; and (b) a service provider offering its services in the territory of the Party to submit subscriber information relating to such services in that service provider’s possession or control. 2. The powers and procedures referred to in this Article shall be subject to Articles 14 and 15. 3. For the purpose of this Article the term ‘subscriber information’ means any information contained in the form of computer data or any other form that is held by a service provider, relating to subscribers of its services, other than traffic or content data and by which can be established: (a) the type of communication service used, the technical provisions taken thereto and the period of service; (b) the subscriber’s identity, postal or geographic address, telephone and other access number, billing and payment information, available on the basis of the service agreement or arrangement; (c) any other information on the site of the installation of communication equipment, available on the basis of the service agreement or arrangement.” 26. The explanatory report notes that, in the course of a criminal investigation, subscriber information may be needed mainly in two situations. Firstly, to identify which services and related technical measures have been used or are being used by a subscriber, such as the type of telephone service used, the type of other associated services used (for example, call forwarding, voicemail), or the telephone number or other technical address (for example, the e-mail address). Secondly, where a technical address is known, subscriber information is needed in order to assist in establishing the identity of the person concerned. A production order provides a less intrusive and less onerous measure which law enforcement authorities can apply instead of measures such as interception of content data and real-time collection of traffic data, which must or can be limited only to serious offences (Articles 20 and 21 of the Convention on Cybercrime). 27. A global conference, “Cooperation against Cybercrime”, held in Strasbourg on 1-2 April 2008 adopted the “Guidelines for the cooperation between law enforcement and Internet service providers against cybercrime”. The purpose of the Guidelines is to help law enforcement authorities and Internet service providers structure their interaction in relation to cybercrime issues. In order to enhance cybersecurity and minimise the use of services for illegal purposes, it was considered essential that the two parties cooperate with each other in an efficient manner. The Guidelines outline practical measures to be taken by law enforcement agencies and service providers, encouraging them to exchange information in order to strengthen their capacity to identify and combat emerging types of cybercrime. In particular, service providers are encouraged to cooperate with law enforcement agencies to help minimise the extent to which services are used for criminal activity as defined by law. 28. Out of a number of resolutions adopted in the field of cyberspace, the most pertinent for the purposes of the present case are General Assembly Resolutions 55/63 of 4 December 2000 and 56/121 of 19 December 2001 on combating the criminal misuse of information technologies. Among the measures to combat such misuse, it was recommended in Resolution 55/63 that: “(f) legal systems should permit the preservation of and quick access to electronic data pertaining to particular criminal investigations;” 29. The subsequent Resolution took note of the value of the various measures and again invited member States to take them into account. 30. On 15 March 2006 the European Parliament and the Council of the European Union adopted Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks, amending the previous data-retention Directive 2002/58/EC. The aim of the Directive is to harmonise member States’ provisions concerning the obligations of communications providers with respect to the retention of certain data, in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each member State in its national law. It applies to traffic and location data on both legal entities and natural persons and to the related data necessary to identify the subscriber or registered user. It does not apply to the content of electronic communications. The Directive requires member States to ensure that certain categories of data are retained for a period of between six months and two years. Article 5 specifies the data to be retained: “1. Member States shall ensure that the following categories of data are retained under this Directive: (a) data necessary to trace and identify the source of a communication: ... (2) concerning Internet access, Internet e-mail and Internet telephony: ... (iii) the name and address of the subscriber or registered user to whom an Internet Protocol (IP) address, user ID or telephone number was allocated at the time of the communication;” 31. Member States had until 15 September 2007 to implement the Directive. However, sixteen States, including Finland, made use of the right to postpone their application to Internet access, Internet telephony and Internet email until 15 March 2009. 32. A comparative review of the national legislation of the member States of the Council of Europe shows that in most countries there is a specific obligation on the part of telecommunications service providers to submit computer data, including subscriber information, in response to a request by the investigating or judicial authorities, regardless of the nature of a crime. Some countries have only general provisions on the production of documents and other data, which could in practice be extended to cover also the obligation to submit specified computer and subscriber data. Several countries have not yet implemented the provisions of Article 18 of the Council of Europe Convention on Cybercrime. 33. The Helsinki Foundation for Human Rights submitted that the present case raises the question of balancing the protection of privacy, honour and reputation on the one hand and the exercise of freedom of expression on the other. It took the view that the present case offers the Court an opportunity to define the State’s positive obligations in this sphere and thereby to promote common standards in the use of the Internet throughout the member States. 34. It pointed out that the Internet is a very special method of communication and one of the fundamental principles of its use is anonymity. The high level of anonymity encourages free speech and expression of various ideas. On the other hand, the Internet is a powerful tool for defaming or insulting people or violating their right to privacy. Due to the anonymity of the Internet, the victim of a violation is in a vulnerable position. Contrary to traditional media, the victim cannot easily identify the defaming person due to the fact that it is possible to hide behind a pseudonym or even to use a false identity.