Bryan McCarthy
and Sarah Slevin

Recent, high-profile controversies have thrown a pointed spotlight over social media/online multi-nationals and the extent to which their users should be protected from these companies’ ability to both monitor the behaviour of users and self-monitor content and access.

It is the usual suspects that have featured in these controversies and that have re-ignited the debate around self-regulation versus legislative intervention. Earlier this summer, Channel 4’s Dispatches programme highlighted severe failings in Facebook’s content review policies and in the implementation of these policies. This month Google has received severe criticism following revelations about its continued tracking of users’ locations and movements through certain apps even after Location History had been switched off on the device.

It had appeared, in Ireland at least, that decisions on the issue of regulation of online companies had reached a conclusion in the short to medium term, with the Government’s Action Plan for Online Safety, published in July last, opting for self-regulation despite Minister for Communications Denis Naughten’s earlier commitment to appoint a “Digital Safety Commissioner” with powers in the areas of review and decision-making. This change in approach was the subject of criticism and dismay from children’s rights organisations and opposition parties alike.

It seems, however, that the recent misfortunes of Facebook and Google have re-opened this debate. The chair of the Oireachtas Committee on Communications, Hildegarde Naughton, wrote to the Office of the Data Protection Commission calling for an investigation into Google’s location-tracking activities and has also promised to make contact with the Department of the Taoiseach regarding the need for regulation.

Digital Safety Commissioner

Significantly, the Committee has indicated that, rather than allow social media platforms continue to self-regulate, and despite the Government’s row-back on its promise of a Digital Safety Commissioner, it will prioritise a bill which looked to legislate for the creation of such a role. Originally introduced by Sinn Féin’s Donnchadh Ó Laoghaire, the Digital Safety Commissioner Bill 2017 (the “Bill”) followed on from a Law Reform Commission report on internet safety which suggested several reforms for the protection of persons in the digital environment, including the appointment of a Digital Safety Commissioner.

But what does the Bill, stretching to a mere 12 sections, propose, and how does it compare to international equivalents?

Importantly, it is proposed that the Digital Safety Commissioner would oversee and regulate a “take-down procedure” for the removal of harmful digital communications by digital service undertakings and would be tasked with ensuring that the take down procedure is made available to all affected individual persons by digital service providers free of charge.

The Digital Safety Commissioner would develop of a code of practice, in consultation with the public, government departments, public bodies and digital service undertakings, for the operation of this take down procedure, including steps and timelines.

The Bill also proposes “National Digital Safety Standards” with which digital service undertakings must comply, such as:

• including mandatory provisions for the undertakings’ terms of use on harmful communications;
• making a complaints scheme available to users; and
• appointing a “digital safety officer”.

Provision is made for an optional “Compliance Certificate” with the above code of practice and National Digital Safety Standards, as well as a facility for users to appeal to the Digital Safety Commissioner in the event of a request under a take-down procedure not being granted.

The Bill gives the Digital Safety Commissioner the power to apply to the Circuit Court for enforcement of a direction issued by him/her. Notably, it also grants any person who intends to bring civil proceedings regarding “harmful communications” the ability to apply for what is known as a “Norwich Pharmacal Order”, essentially a court order requiring the disclosure of the name and/or address of the person against whom the proceedings are to be brought. The intention behind this provision is likely to facilitate actions being brought against otherwise anonymous individuals who post harmful content online.

Furthermore, the proposed ‘soft’ functions of the Digital Safety Commissioner include promoting measures to improve digital safety, including the preparation of guidance material, co-ordinating the activities of government departments, analysing and sharing information and research and publishing reports. It is envisaged that the Ombudsman for Children would have a role in working with the Digital Safety Commissioner in preparing and publishing guidance material on digital safety and harmful digital communications for both children and parents.

Clearly, the key element of the Digital Safety Commissioner’s lies in receipt of users’ appeals on non-action by digital service providers when such users make complaints or request take-down of material. This means that the Bill does not merely contain a requirement for the establishment of a complaints and take-down facility by a digital service provider – it also gives the Commissioner direct powers to ensure the system is effective in practice.

What other countries are doing

The Bill was intended to replicate functions held by similar offices in certain other jurisdictions. In Australia, for instance, the eSafety Commissioner’s remit was recently expanded beyond its initial, child-specific, functions. As well as content moderation, the Australian Commissioner has investigative powers in respect of complaints of cyberbullying. It distinguishes between “Tier 1” media services, which participate on a co-operative basis, and large “Tier 2” services which are subject to more formal, and stringent, procedures. In New Zealand, “Netsafe”, the country’s “Approved Agency” for investigating harmful digital communications may, following receipt of a complaint from a website user, attempt to resolve not only through a take-down procedure but also though mediation, negotiation and persuasion. Courts in that jurisdiction are also empowered to make a wide variety of orders, including refraining from certain conduct, publication of a correction and giving a “right of reply” to affected persons (note, however, that these civil functions have not yet been commenced).

When compared with the (admittedly limited) number of international pre-cursors, Ireland’s current proposal appears less measured/specific, although the office, its functions and its scope will hopefully become more refined as the Bill progresses. Equally, enforcement is limited to the court actions set out above; the imposition of fines is not envisaged and the criminal offences considered by the LRC in its report do not feature. Of all the Bill’s current provisions, the “take-down procedure” would have the greatest practical impact – both the proposed “Digital Safety Standards” and the optional “Compliance Certificate” are unlikely to either adversely affect or concern the digital multi-nationals to whom the Bill is addressed.

Pushback

Nonetheless, and unsurprisingly, social media platforms have begun their pushback on the proposal. In a statement made directly before the Committee on Communications, Head of Policy at Facebook Ireland Niamh Sweeney said whilst it understood the reasoning for establishing a Digital Safety Commissioner, the fact that there was no definition of “harmful communication” in the draft legislation risked uncertainty, unpredictability and limiting freedom of expression.

The future?

Of course, the Bill remains its infancy, and there are likely to be many changes to its provisions before it finds its way to the President’s desk for signature, if, indeed, it becomes law at all. Nonetheless, the very fact of its revival demonstrates the strength of public outrage following high-profile online controversies, as well as the importance and power of committees, and the legislature more broadly, in the current Oireachtas. Facebook have already appeared before the Communications Committee, and Google are likely to follow. We will await its consideration and management of the Bill with a keen interest.

• Bryan McCarthy is a partner in Ronan Daly Jermyn’s Dublin office. Sarah Slevin is a solicitor in the firm’s Cork office.