"Voluntary enforcement" vs legal restrictions – what rules apply?

Sometimes, watching the Commission make up its mind on a controversial topic is like watching a sports match. One of these topics is the question of whether it is legal for governments to encourage internet service providers (ISPs) to restrict fundamental rights “voluntarily” or whether they would need a legal basis. The European Home Affairs Commissioner, Cecilia Malmström is certain… that they do, that they don’t and that they might… possibly. Observing her positions on the issue makes it seem that she is in some sort of debating competition with herself – a “team Malmström” that supports the concept that restrictions must be provided for by law against a “team Malmström” that does not.

In early November, EDRi sent a letter to Commissioner Malmström to see how she deals with an inconsistency in Directive 2011/92/EU on combating child pornography. In its impact assessment for the Directive, the Commission services said that if ISPs blocked content, this would infringe on freedom of expression and information, and would therefore need to be based on law, in accordance with the European Convention on Human Rights. 1:0 for the “provided for by law” team Malmström – “yes, they need a legal basis”.

Nevertheless, the final Directive states that while States can implement such blocking by law, the Directive should not restrict ISPs blocking such content on their own initiative and that Member States should be free to support such measures. The arbitrary restrictions team Malmström strikes back to level the score at 1:1.

The situation is obvious. According to the Commission’s own impact assessment, if blocking has to be based on law, then such self-regulatory measures without any legal basis are unlawful. States shouldn’t support it, they should stop it or, if they feel it is appropriate, adopt a law mandating it. So, EDRi wrote to Commissioner Malmström asking her to explain the legal anomaly.

After about a month, the Commission replied, basically saying that the European Charter of Fundamental Rights is a nice text, but irrelevant here; the reason being that the Charter does not apply to private entities, as it is only addressed to the EU and the Member States – even though an EU Directive instructs Member States as to what private companies may be allowed to do in this case. So, the arbitrary restrictions team strikes back, taking the lead 2:1. Based on this analysis from the European Commission, Member States can circumvent the Charter and the European Convention on Human Rights by coercing private companies into breaching the rights that the Member States themselves are legally prevented from breaching.

This analysis is not entirely incorrect. Traditionally, bills of rights, constitutional protections and so on served to protect the individual against the state. However, a good case can be made – and has been made by some constitutional courts – that these rights are not just a list of rights of individuals to defend themselves against the state, but also set out a legal order that at least indirectly applies to everyone: the state shouldn’t be able to listen to your phone calls just because it wants to – but neither should your phone company. The State shouldn’t infringe on the right to assembly – neither should employers hinder their workers when they want to unionise. This has also been highlighted in the UN “Protect, Respect and Remedy” Framework which stresses that it is the duty of the State “to protect against human rights abuses by third parties, including business enterprises, through appropriate policies, regulation, and adjudication.” However, while the State would need a law to tell ISPs that they shall block content, the Commission seems to be fine with ISPs doing it on their own without a legal basis. Or does it?

Just one week before replying to our letter, the Commission also replied to a parliamentary question on the CleanIT project from Josef Weidenholzer MEP (S&D, Austria). This project is assessing what private companies could do voluntarily to stop “terrorist use of the internet”, including many measures which would interfere with fundamental rights protected by the Charter and the Convention on Human Rights. According to the Commission, this decidedly non-legislative project was a response to calls from the European Council to “develop measures to combat the misuse of the Internet for terrorist purposes while respecting fundamental rights and principles” and to draft “a European agreement model for co-operation between law enforcement agencies and private operators”. So here, although no legislation was expected and it was about private companies acting “voluntarily”, “fundamental rights and principles” (presumably those embodied in the Charter) would need to be respected by private actors for such actions. Goal for the “prescribed by law” team!

So the current score in the match between the “provided for by law” team Malmström against the “arbitrary restrictions” team Malmström is 2:2 and the match is far from over.

To conclude and to come back to the Commission’s answer to EDRi’s letter: their second point, saying that even if the Charter was applicable here, the protection of children would justify this restriction of freedom of expression and information, misses the main point. If a policy aim is important enough to justify restrictions on fundamental rights, then it cannot simultaneously be so trivial that it can be left to private companies to impose such restrictions in an arbitrary manner.

Of course there are cases in which fundamental rights can be restricted, that was never the point. Whether this case is one of them is up for debate, given that such blocking of content is nowhere near as effective as its proponents claim. But more importantly, even if restrictions are justified, they must be based on law. This applies if States do it themselves, and it should also apply when it is done by private actors, particularly those that are “encouraged” by States to impose them. Otherwise, States could just (and increasingly do) outsource their wishes for restrictions on fundamental rights without any legal control – and that this should not happen is the entire point of this debate.

Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

European Charter of Fundamental Rights, Article 52.1

UN Framework: UN Protect, Respect and Remedy Framework, Ruggie Guiding Principles http://www.business-humanrights.org/SpecialRepPortal/Home/Protect-Respect-Remedy-Framework/GuidingPrinciples

Parliamentary question: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-%2f%2fEP%2f%2fTEXT%2bWQ%2bP-2012-008386%2b0%2bDOC%2bXML%2bV0%2f%2fEN&language=EN P-008386/2012

EDRi’s letter on this topic: https://edri.org/files/blocking_20121102.pdf

European Commission response: https://edri.org/files/priebe_response.pdf

European charter of fundamental rights: http://www.europarl.europa.eu/charter/pdf/text_en.pdf

European Commission impact assessment: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=SEC:2009:0355:FIN:EN:PDF

Child exploitation Directive: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2011:335:0001:0014:EN:PDF