The BBC's report mentions the case of Nicola Brookes, who appears to have been the victim of vicious trolling on facebook. It is reported that she obtained a court order forcing facebook to reveal the IP addresses of its users who harassed her anonymously using the site. I have no further details of that case, but it would seem to be an entirely conventional Norwich Pharmacal order used by Nicola Brookes in order to bring a prosecution for breach of the Protection from Harassment Act 1997. Her case has nothing (much) to do with defamation which is not a crime as implied by the BBC.
Her case is an illustration of the fact that there is already a fairly well tested power to force intermediaries, including social networking sites, to reveal the identity of wrongdoers (criminal or civil) by court order. There is no new power to do this under the defamation bill.
What the defamation bill has done is introduce a new defence for some intermediaries - "website operators". In the current draft of the bill, clause 5 applies where "an action for defamation is brought against the operator of a website in respect of a statement posted on the website." The operator has a defence is they are able to show that it was not them that posted the statement on the website.
I'm not exactly sure what "posted" means in this context. Does it include (say) the FOI responses of public authorities on www.whatdotheyknow.com? The public authority is the immediate cause of the appearance of a statement on the site, but the actual transfer from incoming email to web page is done by the site's own software. This does matter. It would be great if sites like whatdotheyknow had a defence against material they manage, but they are unlikely to want to test the matter in court.
In my experience these kinds of semantic difficulties are often sharpened up later on in a bill's passage. I hope that happens in this case.
The defence is not an absolute one. It an be defeated if three conditions hold:
- the claimant could not identify the person making the complaint
- the claimant gave the operator a notice of complaint relating to the statement
- the operator failed to respond to the notice of complaint in time
Where the content of the notice, what is "in time" and what an operator is required to do in response are to be specified in a regulations made later with an inevitably reduced level of parliamentary scrutiny, although the notice will be required to specifically point to "where on the website the statement was posted". Surprisingly many "take down" requests my clients receive don't even go this far.
So, lets be clear, there's nothing here that requires the website owner to do anything unless they want to. The sanction for non-compliance is that they lose a defence to a libel claim. But website owners already have a number of common law and statutory defences. In particular they are protected by Article 14 of the e-commerce directive. This is an absolute defence against almost any liability a website owner might have for information supplied by a third party provided that either:
- they don't know about the illegality or
- once they do know they act "expeditiously" to remove the information
This has never been a very good defence since the host has to make up their mind whether or not they know about the illegality, but of course, how can they know? If it is information supplied by a third party they may have no idea. The European Court of Justice has been relatively generous about "knowledge" in this context - being well aware of the difficulties the host may have - but in the context of defamation it is always going to be a tough call. The fact that something looks defamatory ought to be obvious in most cases just by reading it.
So the proposals in clause 5 might have the effect of persuading website owners to give up the identity of anonymous users of their site as a result of general fear, uncertainty and doubt. On the other hand there will be nothing to stop them removing the material if they prefer to do so.
My views of the bill roughly echo those of the Inform Blog. Some of the "reforms" may even make things worse since they copy (into statute) things the courts are doing already, but none of us will be entirely sure whether that copy was, or was intended to be, perfect, so there may be yet more litigation to sort that out. Why we need to enact reforms the courts have already worked out for themselves seems puzzling to me, but I am not a politician.
As things stand the proposed clause 5 has a number of oddities.
First, there's nothing that penalises false use of a notice of complaint, nor is there anything allowing the regulations to impose sanctions on a claimant who misuses the procedure. In my view that should be fixed.
Second, if the claimant can already find out the identity of an anonymous troll (via the Norwich Pharmacal procedure), why do we need to qualify the website owner's defence at all? Sure, a Norwich Pharmacal order is expensive, but then so is a libel claim.
Third, and most odd of all, the new clause 5 would give an absolute defence for any comment which was from an identifiable individual. As it stands if I, under my own name, post the most unpleasant libel to a website hosted in the UK, the victim of the libel can sue me but cannot sue the website. But suing me may not be what the victim wants - I might be dead, have no money or have run away to another country where they cannot catch me.
What a victim will often want in such cases is for the libel to go away and/or be corrected. They want some way of having the libel taken down. As it stands clause 5 may take away the victims power to do that since the website owner will have no liability in defamation at all. In some cases (eg blog comments) even I may not be able to remove a publication I have made, so a court order against me (the guilty party) may also be useless.
I am not sure that is what intended and expect that the wording will be tidied up considerably if the clause goes forward but I still doubt very much that it is the right approach.