In a decision receiving considerable international attention since three senior Google executives were convicted by a Milan trial court for privacy violations in 2010 associated with the uploading of a video to a Google Video (a Google YouTube predecessor), the Court of Appeals of Milan on 21 December 2012 ruled that “no crime has been committed” and exonerated the three executives. The convictions of Peter Fleischer (Chief Privacy Counsel), David Drummond (General Counsel) and George Reyes (former Chief Financial Officer) stemmed from a video taken by a student with a mobile phone and uploaded on Google Video that showed a group of students bullying an autistic schoolmate. The video was uploaded in September 2006 and then removed by Google in November 2006 immediately after it received a warning from Vivi Down (a Down Syndrome advocacy group). The criminal proceeding started in 2008 when the father of the bullied boy and the advocacy group Vivi Down filed a criminal complaint in the Court of Milan.
In February 2010, the Court of Milan found all three Google executives guilty, and sentenced them to a six-month jail sentence for violation of data protection laws. The decision has been subject to fierce international criticism because, as the the New YorkTimes noted, it “turned upside down the freedom principles on which internet is grounded.” The former Italian Data Protection President Francesco Pizzetti decried such decision as “wrong” and based on a “technical mistake.”
Google appealed and the Court of Appeals overturned it, exonerating the three executives.
In so doing, the Court of Appeals drew a distinction between the processing of the video itself and the processing of the personal data depicted or contained in the uploaded video. According to the Court, such processing activities, and the respective “data controllers” should not be confused. With regard to the processing of the bullied boy’s personal data, only the uploader (the classmate of the bullied child who actually uploaded the video to the Google sharing site) was obliged to obtain the consent from the video’s subject (or from his parents). On the contrary, Google is only the “data controller” with regard to the uploader’s personal data, but not with regard to the personal data of the individuals displayed in the video.
The court stressed that Google did not create the video, had no knowledge of the presence of it until it was notified of its existence by Vivi Down, and, most important here, was not able to verify the possibility that unlawfully processed sensitive data was contained in the video. In this respect, the Court also stated that data protection and e-commerce regulations are part of the same complete and coherent legal framework that, when read together, do not impose on the hosting provider a duty to monitor and assess the lawfulness of content uploaded by third parties. The Court of Appeal of Milan expressly referred to the ECJ decisions in the Sabam [1] and Netlog [2] cases, stressing that filtering systems could potentially undermine freedom of information, since they could not distinguish adequately between lawful and unlawful content.
[1] Case C‑70/10 Scarlet Extended v SABAM
[2] Case C-360/10 SABAM v Netlog