Notes

Internet Service Providers - The Italian Legislation In Italy there is a division of providers in three categories:

• Mere Conduit
• Caching
• Hosting And no general obligation to monitor.

Internet Service Providers - Notice-and-takedown procedure in Italy When on notice of illegal content or activities, including by receiving service of a take-down order properly issued by the competent Administrative or Judicial Authority... ... hosting providers shall promptly remove access to the relevant infringing content. What does "being on notice" (having actual knowledge) of illegal conduct/content mean for an ISP?

• Being served with an order of the competent authority specifiying the URL of the content to be taken down?
• Being served with an ex parte notice and takedown request regarding specific content identified by the relevant URL?
• Being served with an ex parte notice and takedown request concerning allegedly illegal content uploaded by third parties on the relevant platform (with no mention of URLs or mention of an URL as example)? According to certain courts, when it comes to an active service provider there is no need to mention specifically the URLs of every piece of illegal content/information. The assumption behind this reasoning is that being more "active", these providers have more control (then, knowledge). Other courts, however, challenged this assumption and required specific indication of illegal content/information to consider the ISP "on notice".

In 2019, the Italian Supreme Court ruled that active providers cannot benefit from the liability exemptions. The Court referred to some signs suggesting that the hosting provider has an active role (not all of these must be present): (i) filtering, (ii) selection, (iii) indexing, (iv) organization, (v)cataloging, (vi) aggregation, (vii) evaluation, (viii) use, (ix) modification, (x) extraction, or (xi) promotion of content. If made in the context of a business-oriented management of the service. The Supreme Court held that, for a provider to become aware, it is not required that the rightholder send a formal cease-and-desist letter: a simple communication suffices. Also, it did not exclude that simple indication of the title of the work could be enough. A URL is required only when "indispensable" to identify the infringing content. The Court also ruled that a notice-and-takedown request imposes on the relevant provider an obligation of 'stay-down', ie to prevent the re-uploading of the same infringing content: it has nothing to do with imposing a general monitoring obligation.

The Google vs Vivi Down Case Factual Background On September 8, 2006 a video showing a disabled student being bullied by three of his schoolmates was posted on Google Video; The video was flagged by many users; Video top ranked within the "funny videos" category; Italian postal police sent a removal notice on November 7, 2006; Removal of the video occurred on the same day. The Public Prosecutor of Milan started the investigations for two charges:

• Co-participation in aggravated defamation;
• Violations of Data Protection Rules (in particular, Section 167 of Privacy Code);

Google's management was placed under investigation. First Instance Court of Milan The judge acquitted all the four executives from the charge of defamation. They had no legal obligation to prevent the defamation by exercising a preventive control over content loaded on Google-video site. The executives were found guilty for privacy violations, given 6-months jail terms. The judge suspended the sentences because they were first-time offenders who had committed a minor crime.

First Instance Court of Milan - Reactions "[] we are deeply troubled by this conviction for another equally important reason. It attacks the very principles of freedom on which the Internet is built. Common sense dictates that only the person who films and uploads a video to a hosting platform could take the steps necessary to protect the privacy and obtain the consent of the people they are filming. European Union law was drafted specifically to give hosting providers a safe harbor from liability so long as they remove illegal content once they are notified of its existence."

Court of Appeals of Milan Two Issues at the Court of Appeals of Milan:

• Data Protection Framework, Who is the controller? Who is the processor?

Three relevant relationship to take into account:

• Between uploading user (Data Controller) and bullied boy (Data Subject)
• Between Google (Hosting - Data Controller) and uploading user (Data Subject)
• Between Google and the bullied boy, No Relationship, Google makes no autonomous determination with regard to the purpose of use and the related procedures of data subject's personal data.

  Therefore it followed the acquittal from data protection law infringement.

• ISP Liability, How "passive" should be an ISP to benefit from the liability exemption? "In today's world, the services that an ISP offers are not limited to the technical process that simply sets up and provides access to the network: as in the case of the content provider, they extend to make it possible for users to submit their own content and other people's content on the network. They cannot, therefore, escape the duty to comply with the standard regulations governing liability for data processing." "[] It follows that all the elements considered in this case (the possibility of filtering, of take-down, of identifying content by using key words, of indexing content and any use for advertising purposes) lead to the view being formed that Google Video must be classified as active hosting at the very least." "[] Given that it is able to organize and select the material sent by users, any possibility of Google Video being in a position to continue to insist with its claim that it is neutral can in fact be ruled out." "[] In order to establish liability on the grounds of an omission on the part of a host or content provider, it has to be established whether there is a duty provided by law on the part of that provider to prevent the event. So what has to be established on the one part is the existence of a duty of care and on the other, the possibility, in practice, of carrying out prior screening." Therefore it followed the acquittal from the defamation charges.

The Supreme Court of Cassation Supreme Court of Cassation entirely confirmed the Court of Appeals of Milan's decision. Google as a hosting provider:

• Does not have to supervise data uploaded by a third party.
• Does not have to inform the third party about the personal data processing rules.

The Court declared that Google is merely an Internet Host Provider. It simply provides an online platform where users can uploadvideos, of which content the users are exclusively in charge (of privacy concerns). Nevertheless, it has to immediately remove unlawful contents in case the authority orders to do so.