Digital Expression - News

CIPPIC and the Harvard Cyberlaw Clinic are excited to release a report today on the impact of the new United States-Mexico-Canada Agreement (USMCA) on intermediary liability laws in North America. Click here to download the report.

Article 19.17 of the new USMCA contains provisions modeled on Section 230 of the U.S. Communications Decency Act that protect platforms like Facebook and Google from being held liable for harmful or unlawful content posted by their users. While the liability shield the USMCA provides is quite similar to CDA § 230, the provisions differ in that the USMCA permits courts to order injunctions requiring platforms to take down content.

Given the ongoing debate in the U.S. regarding the future of CDA § 230, our report suggests that the USMCA’s approach to intermediary liability could serve as a model for amending CDA § 230, given the balance the USMCA strikes between addressing online harms and protecting platforms.

Our report also outlines how current Canadian intermediary liability laws are inconsistent with the USMCA, as are some recent proposals advanced in Canada to hold social media companies liable for the content they host. Correspondingly, we recommend that careful consideration be given by federal and provincial parliamentarians to introducing legislation to align Canadian law with the USMCA, and that clarifies whether Canadian and third-country intermediaries are entitled to the protections provided by the USMCA.

Our report is the product of an unprecedented cross-border collaboration between technology law clinics in Canada and the United States on a legal issue of significance to citizens of both countries. We hope to expand the coverage of our report to include Mexico in the near future.

The Electronic Frontier Foundation (EFF) released a timely white paper this week examining the negative implications and chilling effects that various cybercrime provisions throughout the Americas can have on coder's rights and specifically on security researchers. Entitled "Protecting Security Researcher's Rights in the Americas", the analysis explores a range of cybercrime regimes nominally intended in principle to criminalize unauthorized access to or disruption of computer systems. However, these laws have been framed so broadly as to impose a serious chilling effect on vital activity of security researchers. Drawing on the Inter-American human rights framework (of which Canada is a partial adherent), some national jurisprudence, and principles of criminal law, the paper argues for cybercrime regimes that accommodate beneficial security work. There must be latitude for non-malicious security testing, for the dissemination of critical security tools and for the responsible publication of discovered security breaches.

Sadly, current laws are framed so broadly that they have had a serious chilling effect on socially beneficial security work. Those who discover security breaches face severe legal threats and sometimes even criminal consequences for attempting to bring these to host organization's attention. The result is that security breaches are increasingly likely to remain unresolved until they are discovered by someone seeking to exploit, rather than to merely expose. The paper, to which CIPPIC provided substantive contributions, calls for clearer standards to remedy this situation.

CIPPIC joined in an intervention (FR) which highlights the negative impact on freedom of expression that can result if the Court of Justice of the European Union endorses global content de-referencing orders. The regulatory action under appeal in C-507/17, Google Inc v Commission Nationale de l'Informatique et des Libertés (CNIL), arise from an order issued by the French data protection authority (CNIL) which would compel Google to extend its de-referencing of content to protect the privacy of Spanish citizens beyond google.fr. Content removal or de-referencing orders of this nature have the effect of leveraging the global reach of central online intermediaries such as Google in order to apply one nation's laws to the entire world. As a result, other states lose the ability to establish their own standards with respect to critical questions such as, in this instance, addressing the balance between the right to privacy and to freedom of expression.

The specific type of content de-referencing order at issue in Google v CNIL seeks to protect the privacy of individuals by de-referencing their names from certain online articles: when someone searches for 'Alice Dubois', the first search hit that results will no longer be an account of Ms Duboius' 14 year old debt security proceedings. Ms Dubouis can retain some measure of control over how she represents herself to her employers, colleagues, friends—the world. However, in formulating such a right, great caution must be taken to ensure the right balance is struck between the need to protect individual's privacy and the public's right to receive information. Can professionals use this right to remove negative reviews of their products or services? Can those repeatedly convicted of fraud shield their convictions from future perspective customers? Does this right of de-referencing apply to all types of content or just prominently referenced articles that display sensitive information (an individual's sensitive financial information or health condition, for example)? The intervention (which was led by Article 19 and draws on the experience of co-interveners from Canada, Korea, Latin America, the United States, and Member States of the EU) argues that states must be allowed to balancing the important constitutionally protected interests at stake in such questions for themselves, rather than having the question determined by globally applicable content de-referencing orders.

Image credit: Tyler Menezes, "The worst thing about censorship", June 27, 2008, CC-BY-SA 2.0, Flickr

CIPPIC contributed to Citizen Lab's submission to the United Nations Special Rapporteur on violence against women, its causes and consequences, Dubravka Šimonović, who is seeking best practices for addressing technology-facilitated violence, harassment and abuse against women. The submission highlights the need to acknowledge the real-world harms that flow from technology-facilitated abuse—harms which are too often disregarded or trivialized. The atmosphere created by such abusive conduct operates at to exclude women and girls from critical digital spaces, can have professional consequences and can leverage technical capabilities to wage long-ranging and persistent harassment campaigns. Often, technology-facilitated abuse does not, however, fall neatly within existing causes of action or criminal prohibition, which poses a challenge for those seeking to leverage legal powers to find relief from such abuse. The online platforms on which technology-facilitated abuse too often plays out present an equally challenging landscape for women and girls facing online abuse. Voluntary mechanisms adopted by these platforms to address online abuse are opaque, highly inconsistent, and continue to fail those who attempt to rely on them. Other private actors compound technology-facilitated abuse of women by actively feeding a robust commercial stalkerware market that facilitates violent and harassing conduct and allows for pervasive surveillance of women by abusive partners. Citizen Lab's submission can be read at: https://citizenlab.ca/2017/11/submission-un-special-rapporteur-violence-women-causes-consequences/