The Brazilian approach to internet intermediary liability: blueprint for a global regime?

Introduction: the need for a global framework for internet intermediary liability

Internet intermediaries are, in the most generic form, those entities providing services that enable individuals to receive or impart information on the internet. Given their instrumental role for individuals’ speech, intermediaries are a frequent target of legal actions aimed at preventing or stopping the publication of allegedly illegal material, even where such material was not produced or edited in any way by the intermediary. Whether and to what extent these entities have indeed a justiciable obligation to do so (and a consequent liability for failing to honour that obligation) depends on the applicable legal regime, which varies from country to country. Yet, unlike other areas of global internet governance which are subject to a specific forum of discussion,1 this field currently lacks an overarching framework for the development of a common understanding on the role of intermediaries.

Internet intermediary liability is a wide-ranging topic, stretching into many different areas of law, from defamation and privacy to trademark and copyright infringement - just to name a few. Given the substantial differences between the issues at stake in these areas, legislators in many countries adopted domain-specific solutions, with the aim to appropriately account for the tension between different rights and interests at stake. However, in an increasingly interdependent digital environment, with an internet dominated by multinational corporations providing their services across the entire world, this uncoordinated heterogeneity risks generating significant problems of compliance and friction across different regimes. The recognition by the European Union of a so called “right to be forgotten”, seen in contrast with the reactions by US commentators (e.g., Zittrain, 2014 and 2014b; Bridy, 2014; Farrell, 2014; Farrell and Newman, 2014; Ambrose, 2014) and the proposals for the adoption of a similar yet significantly different right in Brazil,2 Japan, Korea, and most notably, Russia (where it was signed into law in July 2015), offers one notable example of such friction. Differences of culture, approaches and underlying values are exposed and accentuated, rather than mediated, in the absence of a dedicated global governance forum defining guiding principles for the involvement of internet intermediaries in the enforcement of the rights of their users. While a civil society initiative was launched just last year to define guiding principles for intermediary liability worldwide, a forum of discussion of these crucially important issues is conspicuously missing in internet governance processes. This article suggests that the model chosen by Brazil in the adoption of its civil framework for the internet (Marco Civil da Internet) could be seen as an inspiration for the definition of principles underlying such global mechanism. In particular, the Brazilian model distinguishes itself on the basis of: (1) the multistakeholder nature of the process that led to the definition of the existing legal framework; and (2) the aspiration to give a “constitutional” dimension to such framework, by recognising a number of fundamental rights and principles as founding pillars of internet regulation.

Section 1 briefly illustrates the clashes of interests that underlie the discussions on intermediary liability, including distinctions of the role of such parties under different scenarios. Section 2 describes the remarkable achievements of the Brazilian Marco Civil, signed into law in April 2014, and explains the tensions underlying some of its key provisions. Finally, Section 3 sets the foundations for a “global Marco Civil” by identifying key baseline principles, and recommends the creation of a global forum for the discussion of intermediary liability.

1. The dilemma of internet intermediary liability: exposing the clashes of interests

In essence, internet intermediary liability is concerned with one fundamental question: what are reasonable normative expectations of involvement by intermediaries in the enforcement of different laws and regulations? If on the one hand, the protection of rights in cyberspace may be deprived of its effectiveness without the ability to rely on intermediaries for immediate enforcement, on the other hand imposing on intermediaries the duty to monitor the activity of their customers and/or prevent the publication of any potentially infringing content constitutes a serious restraint on speech, which can only be permitted under stringent conditions according to international human rights law.3 Moreover, imposing a duty to monitor or police content leads to the risk of having the intermediary holding back the emergence of new services with even the slightest infringing potential, and generates a “culture of permission” which is ill-suited for the development of innovative products and services in a knowledge-intensive economy.

To obviate these concerns, legal systems generally define some “comfort zones”, also known as “safe harbours”, where intermediaries can operate without being held responsible for the conduct of their users. However, the scope and depth of these safe harbours vary across jurisdictions, thereby generating conflicting standards which are in tension with the transnational nature of the internet. The elaboration of common standards faces two distinct challenges: first, the conceptual challenge of defining the boundaries of the notion of “internet intermediaries”; second, the practical challenge of designing a regime that is fair and effective in securing the protection of individual rights, whilst encouraging responsible behaviour by the intermediaries. Admittedly, answering these questions is not a binary exercise, and will depend on the perspective one adopts. For this reason, understanding the needs and concerns of the various actors involved, in relation to different regimes, is crucial to the identification of appropriate rules.

One size does not fit all: distinguishing actors in intermediary liability regimes

A first striking divergence of interests exists between (1) content producers, whose business model depends on the publication of “quality” content; and (2) infrastructure providers, who merely provide a technical service, and for this reason aspire being treated as “dumb pipes”, not expected to either detect or remove potentially illegal material. This distinction indeed informs virtually any intermediary liability frameworks, providing at a minimum two different safe harbours for these categories. Less visible or widely acknowledged are the tensions and differences within these two categories: for example, big content producers place great importance on proactive and automated enforcement by intermediaries; in contrast, small and independent producers tend to promote greater ability to make transformative uses of content (as this increases visibility of their work), and are therefore opposed to a system of automatic takedown, pointing out the risks of collateral censorship. Similarly, within the group of infrastructure providers one can distinguish mere conduits (who simply provide connectivity to the internet) from those who provide more advanced or “special” services,4 which require the application of traffic or content management techniques for the distinction between types of transmitted or selected content. The latter entities have the technical ability to detect at least some illegal material and take enforcement action against it, though it is debatable how far this technical ability should translate into a duty of care towards the government (as it has occurred, for example, in the case of prevention of malware or child-pornographic material). At the same time, it should be noted that the ability of selecting or discriminating content places these intermediaries outside the “mere conduit” safe harbour, which requires the conduit not to initiate the transmission and not to select the receiver, nor select or modify content. Although some of these activities (for example, search) can be protected under different safe harbours (such as those for hosting and caching), other advanced services may fall outside the protection defined by the existing intermediary liability regimes.

Another important point to be made with regard to infrastructure providers is that their interests on the scope of intermediary liability legislation are usually in direct tension with those of copyright owners, making it difficult to reach compromises other than of bilateral nature. This difficulty can be ascertained, for example, in the failure of the long process of negotiation which followed the approval of the Digital Economy Act (in 2010) in the UK, where the communication regulator (Ofcom) was entrusted with the task to implement general principles by brokering a multistakeholder consensus on the splitting of costs for the filtering imposed to internet service providers (ISPs) in order to prevent copyright infringement. After negotiations under Ofcom’s auspices protracted for over three years without bearing fruit, an agreement on voluntary copyright alert measures was achieved between ISPs and copyright owners, thereby bypassing the multistakeholder character of the consensus that the procedure was supposed to follow. While the failure of the institutional mechanism was arguably due to the complexity of reaching multistakeholder consensus in an area of such intense conflict, it also provided clear evidence that the relative weight of copyright in the discussions of intermediary liability should not be underestimated.

2. A case study in the governance of online intermediaries: the Brazilian approach

A. The birth of the Marco Civil da Internet

The situation in Brazil regarding intermediary liability was until 2014 one of complete absence of specific rules; and this led courts to treat it on the basis of general principles of civil and consumer protection law, which imposed a very high standard of care5 sometimes comparable to strict liability. It also led to a series of private agreements between copyright holders, ISPs and other internet services and to the affirmation of a set of informal norms around notice and takedown that proved “very compliant with industry demands” (Nicoletti Mizukami et al., 2011, p. 263).

Despite the effectiveness of this system for prompt removal of copyright infringing material, copyright owners were still uneasy about the possibility for users to play “whack-a-mole” with copyrighted content, uploading it swiftly and with impunity shortly after removal. In their view, absence of a procedure for obliging ISPs to hand over or even retain subscriber data manifested itself as a key challenge to the effectiveness of copyright protection vis-à-vis repeated infringers. For this reason, a bill (the “Azeredo Bill”) was introduced in 2008 proposing a 3-year mandatory period of data retention, and requiring ISPs to collaborate in the disclosure of the identity of infringers. The Azeredo Bill also criminalised access to data “without authorization of the legitimate owner”, by imposing a sanction of two to four years of jail, thereby turning into a felony overnight (Saldias, 2015, p. 3) the conduct of approximately 60% of Brazilians. Inspired by the Council of Europe Convention on Cybercrime, the bill was an attempt to enact a criminal statute without even having in place a civil framework for the internet - which was the case for the great majority of the other states parties to the convention.

This is the background from which the Marco Civil da Internet (Federal Law No. 12965/2014, previously Bill No. 2126/2011), gradually came into being: civil society, firmly rejecting the measures put forward in the Azeredo Bill, launched a campaign of fierce opposition (which became known as “Mega Não”) and generated consensus over the need to develop a civil framework in respect of the civil rights and liberties of Brazilian citizens. This led to a partnership between the federal government and the Center for Technology and Society of the Law School at the Fundação Getúlio Vargas (CTS/FGV), resulting in a joint proposal and relying on an innovative platform for online public consultation which allowed everyone to comment and to contribute to the drafting of the bill.

Between 2009 and 2010 the public consultation gathered approximately 2,000 comments (respectively 800 and 1,180 in each of its two phases); contributions were also collected via other channels, including receiving direct submissions and scanning social media for dedicated commentary (Nicoletti Mizukami, 2015). In 2011, the bill was signed by the executive and sent to Parliament, where Alessandro Molon was appointed as its rapporteur. Having organised a series of events and a further consultation for the proposed text, Molon cleared the bill for voting on July 2012; however, the approval was repeatedly delayed (until March 2014) due to strong pressures on particular provisions, including: (1) on intermediary liability, with the clash between telecommunications companies and Rede Globo, a powerful media group representing a significant player in the copyright industry in Brazil; (2) on data retention, with the clash between civil society, the federal police and other sectors engaged in the fight against cybercrime; and finally (3) on network neutrality, with the clash between telecommunication companies and content providers.

The Marco Civil is also known as “constitution for the internet” because it revolves the whole regulatory framework around a number of guarantees for civil liberties, such as the privacy and freedom of expression of users. Freedom of expression is explicitly erected as the main pillar for the discipline of internet use in Brazil, along with others listed in article 2.6 Furthermore, article 3 explicitly recognises, among other things, the guarantees of freedom of expression, privacy and liability of the agents according to their activities (i.e., not for the conduct of others) pursuant to the law; and the freedom of business models on the internet is subordinated to the aforementioned principles. Finally, article 8 establishes that any contractual clause in breach of the rights to privacy and freedom of speech (including in particular the inviolability and secrecy of communication)7 will be considered null and void.

While the battle over net neutrality was settled with the need to define the appropriate regulation at a later (upcoming) stage, the fight over data retention resulted in a steep decrease of the mandatory period of three years proposed in Azeredo Bill, imposing one year for the storing of connection data and six months for the records of access to internet applications (so called “logs”). In comparison, the solution found to the controversy over intermediary liability strikes as being much more complex and articulated.

B. Intermediary liability provisions in the Marco Civil

The intermediary liability package of the Marco Civil consists of four main rules. The first is laid out in article 18, which establishes that the provider of connection to the internet shall not be liable for civil damages resulting from content generated by third parties: this is a strong version of the “mere conduit” principle, without any circumstantiations (found in other jurisdictions) concerning the initiation or modification of the transmission, or the technological means used to accomplish transmission. Secondly, article 19 limits the possible liability for internet application providers (broadly analogous to “content hosts”)8 to cases where they fail to remove illegal content upon specific judicial order. It also enables judges to issue injunctions anticipating the effects of the request, upon fulfillment of the requisites of likelihood of success and irreparable damage (or damage that is difficult to repair). Third, article 21 establishes a special provision for breach of privacy arising from the disclosure of images, videos and other materials containing nudity or sexual activities of private nature, without the authorisation of participants: this is known as the “revenge porn” exception, which imposes liability to internet application providers for lack of “due diligence” whenever they fail to promptly remove content after receiving a specific request in this sense,9 either by the interested party or by his/her legal representative. Finally, article 31 makes a specific exemption for the liability of internet application providers in case of copyright or related rights: the applicable procedure in force will remain that of the existing copyright law, at least up and until the entering into force of the copyright regulation which is currently under discussion at the Parliament (since 2010). Given intense industry pressure, this was considered too sensitive of an issue to be dealt with under the same golden standards applicable to other categories of intermediary liability; in fact, this exception was reportedly crafted to prevent the blocking of the bill by the cultural production industry, spearheaded by Globo.

In particular, the introduction of the exception was considered by civil society a better option than the abandonment of the requirement of prior judicial order, which had emerged strongly from the multistakeholder process of the consultation. Unwilling to give up the “notice and takedown” procedure already utilised by a variety of intermediaries, representatives of the copyright industry interceded with Rapporteur Molon before the clearing of the bill for voting, in an attempt to generalise the application of the notice and takedown regime. Following an amendment of the proposed bill in this sense and the subsequent pushback by civil society, the final bill re-incorporated the judicial order requirement and included the aforementioned exception for copyright (Nicoletti Mizukami, 2015). This late addition was coupled with the revenge porn exception, which resulted from the demands of government and public prosecutors prevailing over the opposing forces in civil society (Lemos et al., 2015). All in all, it is apparent that the Marco Civil was the result of a compromise between different constituencies. Nevertheless, the opening to multistakeholder participation at various stages of drafting and consultation of the bill did not prevent it from achieving quite far-reaching positions of entitlement for individual rights, particularly on privacy and freedom of expression. In this context, the enunciation of two important principles of intermediary liability (that such liability is excluded for conduits, regardless of the means of operation; and that the same applies to content hosts, as long as they have not received a judicial order to remove content) is a remarkable achievement which reinforces the guarantees enshrined in this document. Both this substantive achievement and the participatory process giving rise to it provide important lessons for legislators around the globe.

C. Multistakeholder processes and differentiated regimes

One of the added values of the participatory process followed in the drafting of the Marco Civil was to bring to the fore the interests of a variety of constituencies, in the attempt to achieve a balanced outcome. However, while the immediate outcome of such process satisfied the majority of participants, it became clear that the produced draft left a number of key stakeholders at discontent. This dissatisfaction prompted pressures to re-calibrate the rules in line with the peculiarity of those interests that were insufficiently considered. Despite the criticism towards these late amendments of the draft, it is arguable that these pressures were not a bug, but an unavoidable feature of the multistakeholder process: democracy is also based on the idea of contestation (Dahl, 1971), implying the ability for affected stakeholders to voice their concerns in an attempt to influence the shaping of norms.

From a substantive perspective, the added value of this process was the identification of key neglected elements in the design of the rules for intermediary liability. Uncalibrated intermediary liability regimes can have a significant impact on the effectiveness of the operation of other such regimes: the failure to account for the divergence of actors and interests can generate negative externalities not only between the regimes established in specific cognate areas, but also across the laws and policies pursued in different countries. Thus, in addition to minimising friction across regimes, well calibrated principles of intermediary liability may contribute to preventing the proliferation of private agreements for area-specific enforcement efforts, which arise precisely in response to the unsatisfactory treatment of some of the particular interests at stake. For example, what past experience has shown is that, in the absence of a copyright-specific regulatory solution, representatives of the intellectual property constituency tend to prevail over other stakeholders and skew the balance of the whole process – conceivably as a result of greater subject-matter expertise, rhetoric and coordination - at the expense of a more dispersed and less resourceful representation of users and civil society.

This came out clearly in the latest attempt to establish global provisions on intermediary liability within a charter of “Principles” of internet governance: the Global Multistakeholder Meeting on Internet Governance (NETmundial). While the original text which resulted from a call for online contributions had no specific provision on intermediary liability, the new text which was drafted on the basis of the inputs received at the NETmundial meeting included the principle that “Intermediary liability limitations should be implemented in a way that respects and promotes economic growth, innovation, creativity and free flow of information. In this regard, cooperation among all stakeholders should be encouraged to address and deter illegal activity, consistent with fair process.” As noted elsewhere, this formulation is problematic to the eye of civil society because the focus on economic aspects prevails over the protection of human rights - precisely the opposite of what Marco Civil suggests. Those who were present at the meeting witnessed that this compromise was the result of intense lobbying from the copyright industry; in other words, the sole existing model for intermediary liability in global internet governance processes appears to be designed to accommodate the needs of copyright (and perhaps trademark) owners.

3. The pillars of a human rights compliant model for intermediary liability

As noted, the Marco Civil is known as a “constitution for the internet” in light of its focus on fundamental rights: heralding those rights as pillars for the discipline of internet use in Brazil, the Marco Civil subordinates the freedom to conduct business and the legitimacy of contractual arrangements to the respect of those fundamental values. While the prioritisation of fundamental rights is not enshrined in a document with force superior to that of ordinary legislation, as it is usually the case for national constitutions, the fact that the amendment of the Marco Civil does not require a reinforced procedure is of secondary importance for our purposes: the symbolic value of this law is enormous, as it illuminates the road ahead for the development of a “global constitution” for intermediary liability. The form that such international document may take is, in this context, less relevant than the model that it offers, and the potential that this has in breaking the global deadlock (and reducing the friction) of contrasting positions advanced by different countries in the regulation of internet intermediaries.

In order to achieve a balanced framework for the regulation of intermediary liability, it is wise to proceed on the basis of a number of pillars, which, much like in the Marco Civil, can serve as guidepost for the drafting of more specific provisions, including those concerning the conduct expected from intermediaries. Modeling an appropriate regime requires an acceptance of the essential rule of law requirements which are at the basis of our understanding of the internet as an enabler of economic and social development. To that end, the following list proposes five principles which most clearly enshrine these ideals, and which can thus be fruitfully erected as pillars for future discussions on global intermediary liability.

(1) Freedom of expression. At its core, the development of human beings and societies in an interconnected information economy is founded on the engine of the internet as a way to connect people and let information flow between them, which is conceptually anchored on the idea of a global, unrestricted ability to impart and receive information. Accordingly, appropriate principles should be developed to frame the extent to which intermediaries may legitimately interfere with this fundamental right.

(2) Access. Without equal and effective access to the internet, the ability of “netizens” to receive and impart ideas is undermined at its root, thereby compromising the series of benefits that such “flow of information” can bring about. In this sense, access is a prerequisite for the enjoyment of individual rights and freedoms on the internet. A full embracement of this concept would require the creation of a level playing field (for instance, through some form of “net neutrality” regulation) where all individuals have the same opportunity to engage in communication without discrimination, and the compliance with minimum standards of quality of service to ensure that such opportunity is not impaired in practical terms.

(3) Privacy and data protection. This is a concept that is intrinsically connected to the idea of free expression, in at least two different ways: first, the respect for a sphere of intimacy of individuals serves as a limitation on the scope of the right to freely express oneself. Second, the possibility to exercise some form of control over the information of oneself, which is made available to the public, enabling oneself to communicate more freely in the first place. As a result, intermediary liability regimes should duly acknowledge and account for the interaction between these interests and freedom of expression.

(4) Due process. This is a notion that is also used in a variety of contexts, and which can therefore give rise to confusion. It represents the foundation of a democratic society on the rule of law, as opposed to rule by law (Ginsburg and Moustafa, 2008), which in the words of the legal scholar who is considered to have founded this concept, is grounded on the notions of equality before the law, absolute supremacy of the law over arbitrary power; and interpretation and enforcement of the law by the courts (Dicey, 1959). Putting this in more concrete terms, due process refers to those procedural rights which a state “owes” to members of the legal system that are subject to specific individual determinations, specifically imposing the existence of the following minimum requirements to enable any potentially affected party to present its case: (a) a form of legal process which respects the guarantees of independence and impartiality; (b) the right to be informed about the law and to receive notice of the allegations against oneself, and respond to them to the extent that not doing so may prejudice the outcome of the dispute; and (c) the right to a reasoned decision, addressing every essential claim in the matter under dispute. The fulfilment of these requirements should be demanded to intermediaries in any dispute resolution system they set up, and should be ensured through any further remedies offered to individuals against adverse decisions taken by intermediaries which concern them.

(5) Free and open internet. This is a principle from which emanate important consequences for the free flow of information and ideas - although not necessarily of the same rank as that of the fundamental rights and freedoms mentioned above. Perhaps the best way to define internet freedom is to focus on the concepts of “openness” and “permissionless innovation” (Van Schewick, 2012), both alluding to a collaborative environment where users are to a meaningful extent free to develop new ideas, without being “held up” by proprietary technologies or other rigid legal or technical mechanisms of protection. The implication for intermediary liability is that any designated governance mechanism should strive to preserve these characteristics, so as not to undermine the “generative” nature of the internet (Zittrain, 2006).

In accordance with the above principles, a very useful departure point in the search for a global regime for intermediary liability is the dedicated section of the 2011 Joint Declaration of the four Special Rapporteurs on Freedom of Expression of the United Nations (UN), the Organization of American States’ Interamerican Commission on Human Rights (IACHR) the African Commission on Human and Peoples’ Rights (ACHPR) and the Organization for Security and Cooperation in Europe (OSCE). The declaration restates the traditional "conduit principle" (applicable in virtually every regime of intermediary liability) and suggests considering the possibility of limiting the liability of other intermediaries under the same conditions: in other words, treating intermediaries uniformly by exempting them from liability to the extent that they do not initiate the transmission or select its receiver, or modify the information contained in the transmission. This enables automatic services provided upon request to develop without the threat of potential litigation, simultaneously enabling speech and maintaining the incentives for the creation of innovative business models.

The other side of the coin, however, is that immunity may also generate perverse incentives on some of the rights at stake, such as privacy, due process, and even the very same freedom of speech that the qualified immunity is meant to serve. As a result, while this principle is useful to define a minimum standard, it is insufficient to identify a framework for responsible engagement by online intermediaries. On this aspect, the Rapporteurs’ message holds back in order to leave space for creative solutions in the definition of the applicable regime. At the same time, however, it calls against the imposition of duties to monitor the [legality of] the activity taking place within the intermediaries’ services; and against the adoption of extrajudicial content takedown rules which (as is the case under several regimes) fail to provide sufficient protection for freedom of expression.

Furthermore, while the Rapporteurs encourage the adoption of self-regulatory solutions for the management of rights online, this should be read in conjunction with the importance of minimum safeguards for individual liberties. Such safeguards would imply, for example, the need for stringent conditions for disclosure of the identity of suspected infringers – an aspect on which national laws differ, and which is traditionally left unaddressed by the agreements stipulated between ISPs and the copyright industry. The creation of a dedicated forum for substantive discussion on these topics, ideally of multistakeholder nature, would provide the opportunity to define minimum safeguards for the protection of the fundamental rights of individuals, and for preserving the incentives for responsible innovation. The values of privacy, freedom of expression, due process, access and free and open internet should be institutionally embedded into intermediary liability regimes of any form and dimension.

Conclusion

The Brazilian experience provides at least three lessons for the development of intermediary liability regimes: first, it identified the “constitutional ground” upon which an intermediary liability regime should be founded, circumscribed by a number of principles safeguarding fundamental rights while encouraging private enterprises. Second, it offered a practical example of the feasibility of achieving consensus over basic intermediary liability principles not only among a variety of stakeholders, but strikingly, through a participatory multistakeholder drafting procedure. At the same time, the multistakeholder process exposed the need for a differentiated intermediary liability regime, in particular for copyright and “revenge porn”, by defining specific exceptions to those principles. Besides illustrating the unsuitability of a “one size fits all” approach, this raises important questions concerning the appropriate scope for differential treatment in intermediary liability legislations, an aspect which should be at the core of future intermediary liability discussions. Now that the Marco Civil has shed light on the promises and challenges of this path, it is up to participants in internet governance processes to seize the opportunity and elevate the intermediary liability discussion from localised parochialism to the global stage it deserves.

Disclaimer

The author is a co-founder and co-chair of the Internet Governance Forum’s Dynamic Coalition on Platform Responsibility (DCPR), a multistakeholder group focused on the definition of standards of “responsible conduct” for online platforms. The DCPR recently produced a set of Recommendations on Terms of Service and Human Rights, the main ideas of which are under consultation at the following link.