Under a proposed EU regulation, private individuals, authorities, companies and organisations would not be allowed to mention another person's health, ethnic origin, religion or political opinions on the internet without that person's "explicit consent". The proposed legislation would affect tweets, blogs, web pages and public Facebook pages. Journalists, artists and authors, however, would get a free ride.
Anyone thinking of commenting on US president Obama's African background, on EU president Barroso's youth in the Portuguese Maoist left, or on a colleague's involvement in a trade union might have to think twice, unless they are a journalist, artist or author. Without the "explicit consent" of the person concerned, or unless that person has "manifestly made public" their ethnic origin, political opinions or trade-union membership, they could face trouble.
Bodil Lindqvist, a Swedish maintenance worker and part-time webmaster, learned this the hard way. In 1998 she built a website to inform young confirmands about the people who worked for the local parish in Alseda, a small congregation in the Swedish Protestant Church. Five years later the EU court found that Lindqvist had violated the data protection directive by "processing sensitive personal data". She had mentioned — in a humorous way, but still — that one of the people had injured her foot, and health data are by definition sensitive.
The message deemed offensive by the EU judges read, in translation from the web page: "Wild XXXX? Well, I'm not that wild after all. But I sure got wild when I fell down from the ladder and injured my foot. So now I'm on part-time sick leave! Ouch!" The next sentence noted that this person had been employed by the church for three years, as had her father and grandfather. There was nothing offensive there.
Still a criminal
The odd, not to say absurd, Lindqvist case has so far had very little impact on internet users other than Bodil Lindqvist herself. But she paid a price. "Even if the High Court in Jönköping later judged that I did not have to pay the fine — 4,000 Swedish kronor, about €460 — based on a bagatelle threshold, I am still considered to be a criminal. My husband and I had to move from the parish," she says.
The Lindqvist case lingers on. The European Commission regards it as a platform for departure for the future. This is shown in a classified but leaked document on the data protection package presented by the Commission in January. In the proposed regulation there are some suggested exceptions from the general rules. One such exception covers the processing of personal data in an "exclusively personal or household activity" (article 2.2 d), as is also the case with the directive from 1995 now in force. In plain language, purely private correspondence, for example within a family, should not be covered by EU law. But how private is the internet? Several member countries — Germany, the UK and Sweden are mentioned — have asked the Commission whether this "household exception" could also cover social networks on the internet. No, it should not, the Commission has answered.
Net users beware
A central passage of the leaked document, dated June, reads: "COM (the Commission) affirmed the compatibility with the Lindqvist case law (...) COM replied that in its view the Regulation should apply to an individual who uses a social network and has 'with the public' privacy settings, i.e. when personal data are available to an unrestricted number of individuals and not only to a limited audience at large." In other words, anything uploaded to the net, and thus accessible to the public, would be regulated by the proposed data protection rules.
As a general rule, the following would become a no-go zone: "The processing of personal data, revealing race or ethnic origin, political opinions, religion or philosophical beliefs, trade-union membership, and the processing of genetic data or data concerning health or sex life or criminal convictions and offences or related security measures shall be prohibited" (Article 9.1). The proposal thus clashes head-on with all kinds of net publishing, as well as with the fundamental right to freedom of expression. Should the media ask permission to publish a person's political opinions or ethnic background? Can anyone blog about Barroso's political past without his consent?
A privileged caste
To avoid such a conflict, the Commission suggests a way out: some would get a free ride. Member states would provide exemptions for data processing "solely for journalistic purposes or the purpose of artistic or literary expression" (article 80). Journalists, artists and authors would thus be placed in a special category, or caste, not to be affected by the legislation. The rest of the European population would be. Private bloggers, tweeters and Facebook users — or simply people who, like Bodil Lindqvist in 1998, upload material to a website — would have to obtain explicit consent from the persons mentioned in their postings.
Peter Hustinx, the European Data Protection Supervisor, has criticised this approach, urging that the references to journalistic, artistic and literary purposes be dropped in favour of referring only to the general freedom of expression. In today's media landscape every citizen can act as a public watchdog through a blog, Hustinx argued in an opinion delivered in March. So far his suggestion has seemingly had no impact on the Commission.
David Törnberg, a legal expert at the Swedish Ministry of Justice, confirms that there is now genuine uncertainty among EU negotiators about how social media should be regarded in future: "We have understood from the Commission that the Lindqvist judgement shall be applied in full force. Sweden, and several others, have questioned whether this really should be the case, for example for private individuals having public Facebook pages." Asked whether there are now many thousands, if not millions, of more or less private web pages made public on the net, he replies: "Exactly. And it will create a problem if you adopt a law that no one will adhere to. The law has to be realistic if the legislation is to be respected."
The proposal has met heavy opposition from member-state governments on many other aspects as well. The Commission and the Parliament still hoped for a decision before the end of their term in 2014. The disputed web page was disconnected from the net shortly after it was uploaded; the quoted passage was made available with the assistance of Bodil Lindqvist, and the name of the person with the injured foot has been redacted.