Page
Hibernian Law Journal 2020, 19(1), 82-109
Hibernian Law Journal
2020
*82 Defamation Online – Defamation, Intermediary Liability and
the Threat of Data Protection Law
Shay Buckley*
Subject: Defamation. Other related subjects: European Union. Information
technology
Keywords: Data protection; Defamation; EU law; Freedom of expression; Ireland;
Social media;
A. Introduction
A perennial issue with data protection is its scope, with ‘the assumption that data
protection law should be comprehensive, stretching data protection to the point of
breaking, and making it meaningless law in the books’.1 By consistently increasing
the scope of both definitions and the data subject rights, data protection risks
becoming redundant as the obligations become near impossible to comply with. The
increased scope of data protection, particularly in light of the General Data
Protection Regulation (‘GDPR’)2, also risks rendering certain aspects of the
defamation framework redundant. As data protection and defamation law both
broadly seek to protect the same thing – informational self-determination – there is
a certain crossover between the two in relation to the protection of reputation. The
expansion of data protection into the area of reputational protection, however,
presents significant dangers to freedom of expression online, without the protections
and defences offered by defamation law.
The focus of this article will be on defamation and data protection liability in relation
to comments and posts on social networking services – but sits in this broader
framework, where defamation is challenged in its dominance of reputational
protection by the emergence of stringent data protection regulations.3 Defamation
law has struggled to stay abreast of technological developments, with Binchy J
commenting in Muwema v Facebook Ireland that it was a matter of ‘grave concern’
that the Defamation Act 2009 did not permit an injunction to be taken against the
defendant to remove allegedly defamatory posts, with persons ‘whose reputations
are seriously damaged by anonymous and untrue internet postings … left without
any legal remedy against the site hosting the publication’. 4 This leaves potential
, Page
lacunae for data protection to step in and provide effective remedies for the wronged
party. However, while perhaps being beneficial from the perspective *83 of the
defamed party, serious questions are raised about the risk to freedom of expression
caused by the use of data protection in this way. This article will seek to examine
whether data protection can be used in this way, and whether this is a development
that should be welcomed or warned against.
The article will begin with an examination of how the internet has impacted upon
reputational protection. Against this background, the possibility, and difficulty, of
using defamation law to protect one's reputation when defamed on a social media
service will be examined – focussing on the practicability of seeking redress against
the individual, and the liability that could be imposed on the intermediary. UK law
will be utilised to assist in this analysis, given the more recent legislation and the
similar nature of the regimes. Faced with significant difficulties, the article will turn
to data protection and the GDPR in order to assess how that framework could be
utilised in such a scenario and the impact such a development could have on free
speech on the internet.
Data protection will be shown to have the unfortunate potential to radically alter
speech on the internet, by simple application of its central goal of informational self-
determination to defamatory (or even just harmful) speech of others on the internet.
However, while a textual possibility, this article will contend that in both practical
and legal reality, there remains considerable uncertainty about whether data
protection will take on such a speech moderation role, based upon the freedom of
expression provisions in the GDPR and recent decisions by the Court of Justice of the
European Union (‘CJEU’). This does not alleviate the concerns raised, as until
further clarity is provided, the spectre of data protection and its heavy fines will hang
over a social media service and threatens to encourage the over-removal and chilling
of legitimate speech.
B. Reputation and Online Speech
Online internet speech is vastly different to the forms of speech that defamation law
developed around controlling. A single post on a popular social media platform can
traverse the globe immediately, existing in permanent and potentially untraceable
form and destroy the reputation of an individual instantaneously. The internet has
created an ‘architecture of perfect memory’5 meaning that false and defamatory
statements will no longer be buried under a deluge of other salacious news of public
interest but will forever remain linked to the person's name, accessible by an easy
internet search. To paint the above as entirely negative aspects of the internet would
be disingenuous – anonymity, rapidity and accessibility of information are all part of
what makes the internet essential to modern freedom of expression. 6
*84 The internet has not altered the fundamental importance that we grant to the
protection of reputation, as individuals or as a society. Reputation still remains an
integral part of the dignity of every person, 7 and also operates as a ‘quintessential
public good’, allowing society to order itself using complex informational networks
about each individual and ultimately, to create a genuine community identity. 8 It
serves as an important individual good, allowing us to create social bonds and
, Page
communicate complex social information, 9 and also allows the formation and
cohesion of social units. However, the internet has changed how information about
us is transmitted and how it can be controlled. Howarth notes that the internet
(combined with mobile devices) ‘threatens to become the most dangerous tool of
ostracism and humiliation in human history’. 10
Our reputations have become ‘more enduring and yet more ephemeral’ – in the
sense that there is more information about us than ever, with the potential to
continuously impact our reputation, and yet existing in a more permanent fashion,
easily and conveniently accessible to anyone who wishes to type our names into a
search engine.11 Speech can be anonymous or pseudonymous, can traverse
jurisdictional boundaries in the blink of an eye and rebukes the comparatively simple
control that existed when someone was defamed through a major newspaper. Thus,
it can be seen that the protection of reputation on the internet is of fundamental
importance.
C. The Defamation Framework and the Internet
A number of issues have led to some predicting the ‘extinction’ of defamation law. 12
While this is perhaps premature, there is no doubt that certain peculiar issues arise
with the application of defamation law to the internet, most pressingly, in the
ubiquity of private intermediaries in online speech. This section will begin with a brief
outline of some general issues with the defamation framework as applied to internet
communication, before engaging with the issue of defamatory comments on social
media platforms, focussing on the application of defamation law to the individual
poster and to the social media intermediary. The purpose of this section *85 is to
highlight the approach that defamation law has taken towards speech online, and the
difficulties this approach has for reputational protection – thereby raising the
possibility that litigants will turn elsewhere.
The disaggregation of the ‘community’ and the struggle to find applicable values
against which to judge the defamatory statement,13 the introduction in the UK of the
‘serious harm threshold’ (which has been interpreted as requiring a threshold higher
than the common law standard plus requiring the words to cause or have caused
serious harm in terms of the impact and consequences of publication, as opposed to
the publication itself) 14 and liberally applied defences have all raised the concern
that defamation law has excluded a large portion of reputational damaging material
from its remit, reducing its applicability and attractiveness to those victim of online
defamation. 15 Defamation law has also failed to take advantage of technological
possibilities of the internet in remedying reputational harm. Mullis and Scott criticise
the UK Government for failing to implement mandatory discursive remedies for
online defamation such as corrections, appending of notices or rights of reply 16 and
Ardia believes defamation law has failed to integrate itself with the networked
society, providing quick methods of retraction and correction, embedded in the
networks themselves and that focus on information reliability. 17
While the above may point to doctrinal limitations with the current law of
defamation, and reform may be desirable on a number of these issues, of perhaps
more importance are the practical hurdles that any litigant will have to face in
Hibernian Law Journal 2020, 19(1), 82-109
Hibernian Law Journal
2020
*82 Defamation Online – Defamation, Intermediary Liability and
the Threat of Data Protection Law
Shay Buckley*
Subject: Defamation. Other related subjects: European Union. Information
technology
Keywords: Data protection; Defamation; EU law; Freedom of expression; Ireland;
Social media;
A. Introduction
A perennial issue with data protection is its scope, with ‘the assumption that data
protection law should be comprehensive, stretching data protection to the point of
breaking, and making it meaningless law in the books’.1 By consistently increasing
the scope of both definitions and the data subject rights, data protection risks
becoming redundant as the obligations become near impossible to comply with. The
increased scope of data protection, particularly in light of the General Data
Protection Regulation (‘GDPR’)2, also risks rendering certain aspects of the
defamation framework redundant. As data protection and defamation law both
broadly seek to protect the same thing – informational self-determination – there is
a certain crossover between the two in relation to the protection of reputation. The
expansion of data protection into the area of reputational protection, however,
presents significant dangers to freedom of expression online, without the protections
and defences offered by defamation law.
The focus of this article will be on defamation and data protection liability in relation
to comments and posts on social networking services – but sits in this broader
framework, where defamation is challenged in its dominance of reputational
protection by the emergence of stringent data protection regulations.3 Defamation
law has struggled to stay abreast of technological developments, with Binchy J
commenting in Muwema v Facebook Ireland that it was a matter of ‘grave concern’
that the Defamation Act 2009 did not permit an injunction to be taken against the
defendant to remove allegedly defamatory posts, with persons ‘whose reputations
are seriously damaged by anonymous and untrue internet postings … left without
any legal remedy against the site hosting the publication’. 4 This leaves potential
, Page
lacunae for data protection to step in and provide effective remedies for the wronged
party. However, while perhaps being beneficial from the perspective *83 of the
defamed party, serious questions are raised about the risk to freedom of expression
caused by the use of data protection in this way. This article will seek to examine
whether data protection can be used in this way, and whether this is a development
that should be welcomed or warned against.
The article will begin with an examination of how the internet has impacted upon
reputational protection. Against this background, the possibility, and difficulty, of
using defamation law to protect one's reputation when defamed on a social media
service will be examined – focussing on the practicability of seeking redress against
the individual, and the liability that could be imposed on the intermediary. UK law
will be utilised to assist in this analysis, given the more recent legislation and the
similar nature of the regimes. Faced with significant difficulties, the article will turn
to data protection and the GDPR in order to assess how that framework could be
utilised in such a scenario and the impact such a development could have on free
speech on the internet.
Data protection will be shown to have the unfortunate potential to radically alter
speech on the internet, by simple application of its central goal of informational self-
determination to defamatory (or even just harmful) speech of others on the internet.
However, while a textual possibility, this article will contend that in both practical
and legal reality, there remains considerable uncertainty about whether data
protection will take on such a speech moderation role, based upon the freedom of
expression provisions in the GDPR and recent decisions by the Court of Justice of the
European Union (‘CJEU’). This does not alleviate the concerns raised, as until
further clarity is provided, the spectre of data protection and its heavy fines will hang
over a social media service and threatens to encourage the over-removal and chilling
of legitimate speech.
B. Reputation and Online Speech
Online internet speech is vastly different to the forms of speech that defamation law
developed around controlling. A single post on a popular social media platform can
traverse the globe immediately, existing in permanent and potentially untraceable
form and destroy the reputation of an individual instantaneously. The internet has
created an ‘architecture of perfect memory’5 meaning that false and defamatory
statements will no longer be buried under a deluge of other salacious news of public
interest but will forever remain linked to the person's name, accessible by an easy
internet search. To paint the above as entirely negative aspects of the internet would
be disingenuous – anonymity, rapidity and accessibility of information are all part of
what makes the internet essential to modern freedom of expression. 6
*84 The internet has not altered the fundamental importance that we grant to the
protection of reputation, as individuals or as a society. Reputation still remains an
integral part of the dignity of every person, 7 and also operates as a ‘quintessential
public good’, allowing society to order itself using complex informational networks
about each individual and ultimately, to create a genuine community identity. 8 It
serves as an important individual good, allowing us to create social bonds and
, Page
communicate complex social information, 9 and also allows the formation and
cohesion of social units. However, the internet has changed how information about
us is transmitted and how it can be controlled. Howarth notes that the internet
(combined with mobile devices) ‘threatens to become the most dangerous tool of
ostracism and humiliation in human history’. 10
Our reputations have become ‘more enduring and yet more ephemeral’ – in the
sense that there is more information about us than ever, with the potential to
continuously impact our reputation, and yet existing in a more permanent fashion,
easily and conveniently accessible to anyone who wishes to type our names into a
search engine.11 Speech can be anonymous or pseudonymous, can traverse
jurisdictional boundaries in the blink of an eye and rebukes the comparatively simple
control that existed when someone was defamed through a major newspaper. Thus,
it can be seen that the protection of reputation on the internet is of fundamental
importance.
C. The Defamation Framework and the Internet
A number of issues have led to some predicting the ‘extinction’ of defamation law. 12
While this is perhaps premature, there is no doubt that certain peculiar issues arise
with the application of defamation law to the internet, most pressingly, in the
ubiquity of private intermediaries in online speech. This section will begin with a brief
outline of some general issues with the defamation framework as applied to internet
communication, before engaging with the issue of defamatory comments on social
media platforms, focussing on the application of defamation law to the individual
poster and to the social media intermediary. The purpose of this section *85 is to
highlight the approach that defamation law has taken towards speech online, and the
difficulties this approach has for reputational protection – thereby raising the
possibility that litigants will turn elsewhere.
The disaggregation of the ‘community’ and the struggle to find applicable values
against which to judge the defamatory statement,13 the introduction in the UK of the
‘serious harm threshold’ (which has been interpreted as requiring a threshold higher
than the common law standard plus requiring the words to cause or have caused
serious harm in terms of the impact and consequences of publication, as opposed to
the publication itself) 14 and liberally applied defences have all raised the concern
that defamation law has excluded a large portion of reputational damaging material
from its remit, reducing its applicability and attractiveness to those victim of online
defamation. 15 Defamation law has also failed to take advantage of technological
possibilities of the internet in remedying reputational harm. Mullis and Scott criticise
the UK Government for failing to implement mandatory discursive remedies for
online defamation such as corrections, appending of notices or rights of reply 16 and
Ardia believes defamation law has failed to integrate itself with the networked
society, providing quick methods of retraction and correction, embedded in the
networks themselves and that focus on information reliability. 17
While the above may point to doctrinal limitations with the current law of
defamation, and reform may be desirable on a number of these issues, of perhaps
more importance are the practical hurdles that any litigant will have to face in
