1. INTRODUCTION
The Internet cannot prosper without Internet intermediaries. Although these intermediaries neither create online content nor initiate the decision to disseminate such materials, they are nonetheless vital for the transmission of online information, since they may function as Internet search engines (e.g. Google and Baidu), social media (e.g. Facebook and WeChat), and e-commerce platforms (e.g. Amazon, eBay, and Alibaba). Recent years have witnessed the adoption of starkly different law by two major international trade blocks in order to regulate what civil liabilityFootnote 1 an Internet intermediaryFootnote 2 should bear for online contents created or owned by third parties. In North America, based on section 230 of the Communication Decency Act (hereinafter “CDA”), the US convinced Canada and Mexico to conclude the US-Mexico-Canada Agreement (hereinafter “USMCA”) in 2018. The USMCA provides that Internet intermediaries should not be held civilly liable for the contents produced by a third party (hereinafter “Internet immunity”).Footnote 3 Unlike the US CDA section 230, the EU E-commerce Directive divides intermediaries into three categories (mere conduit, caching, and hosting) and applies restricted immunity to intermediaries (hereinafter “restricted Internet immunity”). The restriction was expanded with the Court of Justice of the EU (hereinafter “CJEU”) decision in the Google Spain caseFootnote 4 and most recently the General Data Protection Regulation (hereinafter “GDPR”) effective in 2018.Footnote 5 Both impose a high requirement for data protection and privacy in the processing of personal data within the European Economic Area (hereinafter “EEA”) and any enterprise (including Internet intermediaries) that processes the personal information of data subjects within the EEA.
The North American and the European trade blocks are competing in shaping global digital trade law, including the establishment of global e-commerce rules at the World Trade Organization.Footnote 6 Other countries find themselves caught in a global law-making battle in which the USMCA demands Internet immunity, whilst the EU restricts it.Footnote 7
In this battle, where does China stand? It is estimated that, in 2019, China will be the top global e-commerce market, with e-commerce sales more than three times greater than the US, estimated to be positioned just below China at second.Footnote 8 As such, Chinese views on the liability of Internet intermediaries for contents produced by third parties are critically important for the development of global law for digital trade. Indeed, 2018 was also a landmark year for Chinese law on digital trade: China’s E-commerce Law was enacted. In this context, this paper hopes to add to existing literature: it compares Chinese law on intermediaries with those of the US and the EU. It argues that the US law grants broad civil immunity to Internet intermediaries, and the EU and China restrict civil immunity to intermediaries but in different ways. This is on account of how, in the US, Internet intermediaries enjoy civil immunity as long as they do not become content providers. In the EU, aside from mere conduit intermediaries, all other intermediaries are subject to the notice-and-take-down mechanism before enjoying civil immunity. In contrast, in China, all intermediaries are subject to the notice-and-take-down mechanism but, even after an intermediary properly follows the notice-and-take-down mechanism, it may still be subject to civil liability under the Chinese Consumer Law. Further, this paper argues that the policy priority for the law for Internet intermediaries varies fundamentally in the three jurisdictions. The US law for intermediaries’ liability focuses on protecting freedom of speech under the First and Fourteenth Amendments of the US Constitution.Footnote 9 The EU emphasizes the protection of personal information as a fundamental human right. Contrastingly, Chinese policy priority is unclear. Though consumer protection has boomed in public popularity and increasingly attracted the attentions of the legislature and judiciary in China, it is doubtable that the protection of consumers can provide a prevailing policy support for Chinese law in the same way as freedom of speech and the protection of personal information do under the laws of the US and the EU.
In addition to this introduction, this paper has five parts. The first part defines Internet intermediaries. The second part explores Internet immunity under the US law, arguing that US law does not create a notice-and-take-down mechanism, but rather broadly exempts intermediaries from civil liability arising from contents produced by third parties. The third part discusses the EU law. It posits that the law of the EU creates restricted Internet immunity by the notice-and-take-down mechanism. The law of the EU highlights the protection of personal information as a fundamental human right. The fourth part focuses on Chinese law. Specifically, it contends that Chinese law also restricts the civil immunity that intermediaries can enjoy but with significant differences compared with the EU. The fifth part concludes the paper.
2. INTERNET INTERMEDIARY
In this paper, “Internet intermediary” refers to online services that do not produce or own online content. Intermediaries may function as Internet-access platforms, service providers, data-processing or web-hosting providers, such as domain-name registrars, Internet search engines, e-commerce platforms that do not take title to the goods being sold, e-commerce payment systems, and participatory media that do not create or own their content being published or broadcasted.Footnote 10 Intermediaries should be distinguished from information content providers; indeed, they are mutually exclusive.
In the US, “Internet intermediaries” denote interactive computer services under the US’s CDA § 230. “Interactive computer service” is defined as
any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions.Footnote 11
This definition under CDA § 230 resonates with the definition of “Interactive computer service” in the USMACA.Footnote 12 Interactive computer service providers (i.e. intermediary) and information content providers are mutually exclusive.Footnote 13 The latter refers to a person or entity that creates or develops, wholly or partly, information provided through the Internet or another interactive computer service.Footnote 14
As for the EU, the law divides Internet intermediaries into three categories: mere conduit, caching, and hosting information society services.Footnote 15 “Information society services” are broadly defined as including the provision of an online platform to sell goods and services owned by a third party; offering online information or commercial communications; allowing the search, access, and retrieval of data; transmitting information via a communication network; providing access to a communication network; or hosting information provided by a recipient of the service.Footnote 16
Conversely, Chinese law lacks a uniform definition of “intermediaries.” For instance, Article 22.2 of the Administrative Measures for Online Trading defines “third-party trading platform” as the information network systems providing webpage space, virtual business places, trading rules, match-making, information release, and other relevant services for both or all trading parties in online commodity-trading activities, which are available for both or all trading parties to independently conduct trading activities. This definition excludes intermediaries providing network access, server hosting, virtual-space lease, website and webpage design, and production, etc. The Chinese E-commerce Law provides that “e-commerce platform operators” signify legal persons or unincorporated associations that provide two or more parties in e-commerce transactions with services such as network business premises, deal making, and information release for the aforesaid parties to carry out transactions independently.Footnote 17 It is unclear whether this definition applies to Internet search engines, e-commerce payment systems, and social media. For example, many dealers sell products on Chinese social media WeChat. Could WeChat be considered as an “e-commerce platform operator”? The answer should be in the affirmative, as WeChat offers network business premises that facilitate deal making between customers and persons undertaking online business (i.e. Internet content providers).
Like the US’s CDA § 230, Chinese law also distinguishes intermediaries from information content providers. Article 4 of the Provisions of the Supreme People’s Court on Several Issues concerning the Application of Law in Hearing Civil Dispute Cases Involving Infringement of the Right of Dissemination on Information Networks (hereinafter “SPC Provisions on Right of Dissemination”) provides that, if the network service provider is able to produce evidence proving that it only provided automatic connections; automatic transmissions; information storage space; search, link, file-sharing technology; or other network services that do not contribute to an infringement, the network service provider should not be liable for the infringement caused by a third party using its service.Footnote 18 However, if a network service provider has provided any work, performance, or audio- or video-recording jointly with others by means such as co-operation, constituting a joint infringement, the People’s Court shall hold the network service provider jointly and severally liable.Footnote 19 Therefore, “intermediary” denotes the service that provides automatic connections; automatic transmissions; information storage space; search, link, file-sharing technology; or other network services.
As a conclusion, the key feature of Internet intermediaries in the US, EU, and China is this: the intermediaries do not produce or own online content and they are not the content providers.
3. THE US: INTERNET IMMUNITY
Content providers, either offline or online, should be responsible for the materials they publish. For example, in New York Times Co. v. Sullivan, the Supreme Court of the US held that newspapers and other content providers would be liable for defamation if they were guilty of “actual malice” when publishing false statements about public officials.Footnote 20 However, unlike content providers, Internet intermediaries are immune from civil liabilities derived from the contents produced by a third party as long as they do not become a content provider. This is the so-called “Internet immunity,” providing protection to Internet intermediaries—but not for content providers.
US courts use the “material contribution” test to determine whether an Internet intermediary exercises a content provider’s editorial functions.Footnote 21 A material contribution requires more than “merely taking action that is necessary to the display of allegedly illegal content” produced by a third party.Footnote 22 For example, in Fair Housing Council of San Fernando Valley v. Roommates.com, the US Court of Appeals for the Ninth Circuit held that Roommates.com materially contributed to the illegality of the content because it not only required users to enter characteristics and preferences such as age, race, sex, and sexual orientation as a condition of using its website, but also designed its website to hide listings from certain users based on these protected characteristics.Footnote 23 Maintaining rights to edit, publish, or remove contents produced by a third party will not render an intermediary a content provider.Footnote 24 A licensing agreement between an intermediary and a content provider is also inadequate in transforming the former into the latter if it cannot show that the intermediary had a role in writing or editing the allegedly defamatory material.Footnote 25
3.1 No Notice-and-Take-Down Mechanism
Internet immunity is provided by the infamous CDA § 230. In the 1990s, the US Congress recognized that intermediaries functioned as fora for diversified information exchange and possessed a great degree of control over the information that they received and transmitted online.Footnote 26 Hoping that Internet intermediaries would flourish with minimum government regulation so as to benefit all Americans, the US Congress enacted CDA § 230.Footnote 27 CDA § 230 has been praised as “the most important law protecting Internet speech.”Footnote 28 Its underlying policy is to promote the continued development of the Internet, preserve the vibrant and competitive free market, maximize user control over online information, remove disincentives for blocking and filtering objectionable or inappropriate online material, and ensure the vigorous enforcement of federal criminal laws.Footnote 29
The most important feature of CDA § 230 is (c), titled as protection for “Good Samaritan” blocking and screening of offensive material. It has two provisions. § 230 (c)(1) provides that Internet intermediaries retain civil immunity so long as they do not become “information content providers” (i.e. publishers or speakers) who are responsible, in whole or in part, for the creation or development of information provided through the Internet.Footnote 30 CDA § 230 was enacted in part to respond to Stratton Oakmont, Inc. v. Prodigy Servs. Co., where the New York Supreme Court held that an Internet intermediary was liable for defamation related to a message produced by a third party on its message board because it had removed other user postings from its message boards and advertised itself as family-friendly.Footnote 31 However, the scope of § 230 (c)(1) is not limited to defamation cases.Footnote 32 It has been applied to cases violating anti-discrimination lawsFootnote 33; fraud, negligent misrepresentation, and ordinary negligenceFootnote 34; false lightFootnote 35; and negligent publication of advertisements that cause harm to third parties,Footnote 36 to name a few. As such, if the duty that the plaintiff alleges an interactive computer service violated derives from the defendant’s status or conduct as a “publisher or speaker,” CDA § 230 (c)(1) precludes liability.Footnote 37
§ 230 (c)(2) exempts the civil liability of a provider or user of an interactive computer service from taking any voluntary action in good faith to restrict or provide technical means to restrict the availability of offensive online material.Footnote 38 § 230 (c)(2) applies to any provider of an interactive computer service, and not merely to those whom subsection (c)(1) already protects.Footnote 39 For example, in Zango v. Kaspersky, the Ninth Circuit Court of Appeals applies § 230 (c)(2) to vendors of anti-spam, anti-virus, and anti-malware services, and provided them with wide-ranging protection.Footnote 40
“[T]he most important § 230 ruling today” is Zeran v. Am. Online, Inc.Footnote 41Zeran held that § 230 aims to preclude tort-based lawsuits against Internet intermediaries for the purpose of promoting freedom of speech in “the new and burgeoning Internet medium.”Footnote 42 The US Court of Appeals for the Fourth Circuit concludes that, if notice-based liability is imposed, intermediaries would have to conduct ceaseless choices of suppressing controversial speech or sustaining prohibitive liability. This is directly contrary to the statutory purposes of § 230.Footnote 43
Indeed, whilst Zeran concerns torts, Schneider v. Amazon.com, Inc. demonstrates that CDA § 230 immunity also applies to contractual disputes.Footnote 44 Amazon.com allows third-party visitors to post comments related to publications sold on its website, provided that the postings follow Amazon’s guidelines. Visitors are informed that “any review in violation of the guidelines may not be posted.” The plaintiff’s book was sold on Amazon and at least one posting in relation to the plaintiff’s book violated Amazon’s guidelines. The plaintiff brought the violation to Amazon’s attention and Amazon’s representative allegedly promised to remove the postings within one or two business days. However, Amazon failed to do so and the plaintiff brought the action. The Court of Appeals at the State of Washington held that the immunity under CDA § 230 requires three elements: (1) the defendant must be a provider or user of an “interactive computer service”; (2) the asserted claims must demonstrate the defendant as a publisher or speaker of information; (3) the information must be provided by another “information content provider.”Footnote 45 The Court of Appeals held that, although Amazon maintained the right to edit or remove the posting, the information was provided by a third party. The plaintiff sought to recover damages arising from Amazon’s misrepresentations and its failure to remove the offensive posting. However, the court rejected this claim, holding that
assuming [that the plaintiff] could prove existence of an enforceable promise to remove the comments, [his] claim is based entirely on the purported breach—failure to remove the posting—which is an exercise of editorial discretion. This is the activity the statute [CDA § 230] seeks to protect.Footnote 46
In conclusion, CDA § 230 bars lawsuits that seek to hold a service provider liable for its exercise of a publisher’s traditional editorial functions including deciding where to publish, withdraw, postpone, or alter content.Footnote 47
3.2 Emphasize Free Flow of Information
The broad Internet immunity created by CDA § 230 is controversial.Footnote 48 However, imposing restrictions on CDA § 230 is difficult, as protecting the free flow of information under CDA § 230 derives from the freedom of speech contained in the First and the Fourteenth Amendments of the US Constitution. Thus far, the most successful restriction on CDA § 230 surrounds online information related to sex trafficking. In 2017, the US Congress passed the Allow States and Victims to Fight Online Sex Trafficking Act of 2017 (hereinafter “FOSTA”).Footnote 49 FOSTA creates an exception to CDA § 230: it holds interactive computer service providers liable for third-party content “that unlawfully promote[s] or facilitate[s] prostitution and websites that facilitate traffickers in advertising the sale of unlawful sex acts with sex trafficking victims.”Footnote 50 Due to the wide appreciation of freedom of information in the US, FOSTA has been met with mixed responses.Footnote 51 Advocators, such as trafficking victims and survivors, welcome this exception.Footnote 52 This was accompanied by the support of big Internet companies such as Google and Facebook.Footnote 53 Conversely, some opponents criticize FOSTA on the persuasion that it would negate Internet immunity in rendering § 230 litigation less predictable and more expensive as the courts have to perform longer factual inquires.Footnote 54 Others argue that it may violate the First Amendment and the Constitution’s ex post facto clause.Footnote 55
In November 2018, the US, Canada, and Mexico signed the USMCA.Footnote 56 The USMCA’s Article 19.17.2 provides that
no Party shall adopt or maintain measures that treat a supplier or user of an interactive computer service as an information content provider in determining liability for harms related to information stored, processed, transmitted, distributed, or made available by the service, except to the extent the supplier or user has, in whole or in part, created, or developed the information.Footnote 57
Article 19.17.3 offers immunity to intermediaries for their good-faith action in restricting access to harmful or objectionable contents produced by third parties. According to Article 19.17.4, the Internet immunity should not apply to intellectual-property infringement and criminal-law issues. Therefore, Article 19.17 is substantially similar to CDA § 230.Footnote 58
Article 19.17 is subject to Article 32.1 (General Exceptions) of the USMCA that, among other things, provides an exception for measures necessary to protect public morals pursuant to paragraph (a) of Article XIV of the WTO General Agreement on Trade in Services. Domestic measures necessary to protect against online sex trafficking, sexual exploitation of children, and prostitution—such as FOSTA—are considered necessary to protect public morals.Footnote 59 If the USMCA is ratified, the broad Internet immunity will extend to Mexico and Canada.Footnote 60 Consequently, a digital market featuring free flow of information is likely to be formed among the US, Mexico, and Canada.
4. THE EU: RESTRICTED INTERNET IMMUNITY
Dissimilarly to the US, the EU applies restricted Internet immunity to intermediaries; intermediaries in the EU do not enjoy the broad civil immunities like their US counterparts. Instead, only when certain requirements (e.g. the notice-and-take-down mechanism) are fulfilled can they enjoy civil immunity to contents produced by third parties. The civil immunity based on meeting the notice-and-take-down mechanism does not apply to content providers regardless of whether they publish online or offline.Footnote 61 Also different from the US’s spotlight on the free flow of information, the law of the EU imposes a higher obligation on intermediaries to protect personal information. This is because protecting personal information is considered a fundamental human right under the European Convention on Human Rights and Charter of Fundamental Rights of the EU.Footnote 62 The EU E-commerce DirectiveFootnote 63 and GDPR are the key EU laws regulating Internet intermediaries’ liability for the contents produced by third parties.
4.1 Different Notice-and-Take-Down Mechanisms
The EU E-commerce Directive divides intermediaries into three categories and offers different “notice-and-take-down mechanisms” (namely, safe-harbour rules) to protect them from civil liability arising from contents produced by third parties.Footnote 64
The first category includes intermediaries who provide “mere conduit” services, whereby an intermediary only transmits information provided by a recipient of the service or provides access to a communication network.Footnote 65 For example, this category would apply where the information transmitted is automatically, intermediately, and transiently stored by the intermediary for the sole purpose of transmission, and only for a period reasonably necessary for the transmission. The “mere conduit” intermediary is not liable for the information transmitted if the intermediary does not initiate the transmission, does not select the receiver of the transmission, and does not select or modify the information contained in the transmission.Footnote 66
The second category addresses intermediaries who conduct “caching.”Footnote 67 Here, there are four differences between “mere conduit” and “caching.” First, unlike “mere conduit,” “caching” does not concern the provision of access to a communication network. Second, “caching” allows the temporary storage of information for the sole purpose of a more efficient onward transmission of information to other recipients of the service upon their request, while “mere conduit” intermediaries do not have storage services.Footnote 68 Third, the “caching” intermediary is allowed to update the information, while the “mere conduit” intermediary is not. Fourth, the “caching” intermediary is immune from liability associated with automatic, intermediate, and temporary storage of information subject to a “notice-and-take-down” scheme: the intermediary should act expeditiously to remove or disable access to the information once it has actual knowledge of the fact that the information has been removed from the network, access to it has been disabled, or that a court or an administrative authority has ordered such removal or disablement. Therefore, it is evident that the conditions to be immune from liability of third-party contents differ between “mere conduit” and “caching” intermediaries.
The third category governs an intermediary “hosting” information provided by a third party.Footnote 69 The “hosting” intermediary should be immune from liability associated with the information stored on condition that they do not have actual knowledge of any illegal activity or information, or the provider acts expeditiously to remove or disable access to the information upon obtaining such knowledge.Footnote 70 Therefore, the “notice-and-take-down” mechanism for the “caching” intermediary is different from that of the “hosting” intermediary. Namely, the “caching” intermediary is not allowed to determine the legality of the information, while the “hosting” intermediary may do so.
For intermediaries in the second and the third categories, the “notice-and-take-down” mechanism will be triggered until the intermediary has “knowledge of illegal activity or information” produced by a third party.Footnote 71 Allegations of illegality should be sufficiently precise or adequately substantiated—otherwise an intermediary has no obligation to remove the alleged information.Footnote 72 Moreover, intermediaries have no “general obligation to monitor” or police users’ online expressionFootnote 73; nor are intermediaries obliged to actively seek facts or circumstances that may indicate illegal activities.Footnote 74 This is because monitoring requirements may lead to overcautious erroneous removal of lawful speech. Similar to CDA § 230, the underlying policy of the E-commerce Directive is to encourage industry self-regulation, safeguard the public’s general interest in the free flow of information, and protect the freedom of speech of Internet users.
4.2 Highlight Personal Information Protection
In the E-commerce Directive, allegations of illegality are required for the notice-and-take-down mechanism. However, the Google Spain case decided by CJEU in 2014 establishes the right to be forgotten, which requires an intermediary to remove personal information that is legally produced by a third party. Implemented in 2018, the GDPR further expands the intermediary’s monitor duty, invoking a severe penalty to incentivize them to remove personal information produced by third parties.
The Google Spain case concerned a Spanish man, Mario Costeja González, whose property was auctioned because he did not pay debts on time in 1998.Footnote 75 A Spanish newspaper published a legally mandated announcement of the auction, including Mr Costeja’s name. This announcement was made available online when the newspaper digitized its archives ten years later.Footnote 76 When Mr Costeja’s name was searched using the Google engine, the announcement topped the results.Footnote 77 Mr Costeja complained that he had since resolved his financial problems.Footnote 78 He applied to the Spanish data-protection agency and successfully obtained an order requiring Google Spain and its parent company, Google US, to remove the auction announcement from Google’s search results.Footnote 79 Google appealed. Google US argued that the Data Protection Directive (the predecessor of the GDPR) should not be applied. The CJEU disagreed and applied the Data Protection Directive to Google. It found that Google was the controller of the auction announcement because of its indexing function.Footnote 80 The court found that the Google search result established “a more or less detailed profile of the data subject.”Footnote 81 This contrasted with the Spanish newspaper that digitalized the announcement and was subject to different obligations under the Data Protection Directive.Footnote 82 The court required Google to delist the URL for the auction announcement in its search results—even if the publication by the newspaper itself was lawful.Footnote 83 Therefore, unlike the E-commerce Directive,Footnote 84 according to Google Spain, the public’s general interest in information should not outweigh the importance of personal data protection “as a rule.”Footnote 85
Google Spain leaves two main questions unanswered. First, what are the criteria and procedures to delist a URL? The CJEU requires Google and other intermediaries to remove data that are inaccurate or “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing,” taking into account public-interest factors including the individual’s role in public life.Footnote 86 Evidently, this guidance is ambiguous and contains no substantive and procedural details. Google refers to Article 29 of the Working Party’s guidelinesFootnote 87 and develops its own criteria and procedure from there.Footnote 88 After Google Spain, Google received 834,733 requests to delist, and subsequently delisted 3,281,701 URLs up to August 2019.Footnote 89 Nevertheless, Google is still hauled into courts due to jurisdiction conflicts and disputes on the transparency of removal.Footnote 90 Second, Google Spain does not discuss the freedom of speech of content publishers. When a URL is delisted from powerful search agencies, even if it still exists online, there will be far fewer chances that it can located by other Internet users.Footnote 91 However, when Google and other intermediaries decide to remove a URL from their search results, the URL has no recourse to a regulatory agency or court to challenge the removal and protect their right to the freedom of speech.Footnote 92
GDPR came into effect in 2018. It follows Google Spain, firmly establishing that a data subject has the right to erasure (i.e. “right to be forgotten”).Footnote 93 According to the GDPR, a data subject shall have the right to have a data controller erase his or her personal data without undue delay; indeed, the controller is obliged to do so under one of the following grounds.Footnote 94 First, the personal data are no longer necessary for the purposes for which they were collected or otherwise processed.Footnote 95 Second, the data subject withdraws their consent to processing and no other ground can justify the processing.Footnote 96 Third, the data subject objects to the processing and no overriding legitimate grounds can justify the processing.Footnote 97 Fourth, the personal data have been unlawfully processed or must be erased for other reasons.Footnote 98 However, the right to be forgotten should not be applied when the processing of personal data is necessary for exercising the right to the freedom of speech, for reasons of public interest, scientific or historical research, or statistical purposes in according to law.Footnote 99
Besides the right to be forgotten, a data subject also has the right to restrict the processing of his or her personal data.Footnote 100 The right to restrict processing differs from the right to be forgotten in that the former does not require the data’s erasure—rather, it merely restricts their processing.Footnote 101 The right to restrict processing can be exercised in four circumstances.Footnote 102 First, a data subject can restrict a controller to process his or her personal data when the data subject contests the accuracy of the data and the controller requires time to verify the accuracy.Footnote 103 Second, the processing is unlawful but the data subject does not request erasure, but requests the restriction of their use instead.Footnote 104 Third, the data subject requires his or her personal data to establish, exercise, or defend legal claims, although the data controller does not need the personal data for the purpose of processing.Footnote 105 Fourth, the data subject contests the legitimate process of his or her personal data and this claim is pending verification.Footnote 106
According to the GDPR, an Internet intermediary should follow a notice-and-take-down procedure to address requests brought by a data subject. An Internet intermediary may first restrict the processing of the data (e.g. making it no longer publicly available) after a data subject requests (the requester) the Internet intermediary to remove his or her personal data produced by a third party.Footnote 107 The data controller should review the request according to whether the processing of the personal data is necessary for exercising the right to the freedom of speech, for reasons of public interest, scientific or historical research, or statistical purposes in accordance with the law.Footnote 108 Generally, the intermediary should complete the review within one month.Footnote 109 Then, the intermediary is to inform the requester of the outcome and communicate the removal request to other controllers processing the same data.Footnote 110 For valid claims, the intermediary delists or erases the relevant personal data.Footnote 111 For invalid claims, it will stop restriction and restore the normal processing of the data.Footnote 112 Upon the data subject’s request, the intermediary must disclose any contact details of the third party who posts the data subject’s data.Footnote 113 In most cases, the intermediary has no obligation to inform the third party that the contents were delisted or erased.Footnote 114
Notably, Recital 21 of the GDPR provides that it “is without prejudice to the application of [the E-commerce Directive] in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.”Footnote 115 Consequently, the GDPR does not replace the intermediary liability rules of the E-commerce Directive.
In terms of intermediary liability for contents produced by a third party, there are three main differences between the E-commerce Directive and the GDPR. First, the E-commerce Directive imposes liabilities by dividing intermediaries into “mere conduit,” “catching,” and “hosting.” Regarding “hosting,” the E-commerce Directive further subdivides this category into scenarios where there exists knowledge of the illegal contents and those without. In contrast, the GDPR divides intermediaries into data controllers and processors. The notice-and-take-down procedure under the GDPR is for data controllers. Second, the GDPR notice-and-take-down procedure requires an intermediary to restrict the processing of relevant data even before the data subject’s request has been verified. The E-commerce Directive has no such requirement. Third, unlike the E-commerce Directive, the GDPR requires an intermediary to disclose the identity of the third party who posts the information upon a data subject’s request.Footnote 116 In conclusion, compared with the E-commerce Directive, the GDPR imposes a higher liability on intermediaries for contents produced by third parties.
The question is whether the E-commerce Directive or GDPR should be applied to an Internet intermediary. If the contents produced by a third party infringes upon other parties’ intellectual-property rights or is related to hate speech, the E-commerce Directive should be applied. A difficult case arises where a third party illegally posts personal information of a data subject online: should the E-commerce Directive or GDPR apply? Alternatively, should they be applied jointly? Further, suppose that the data subject requests Google, for instance, to delist the URL linking to the information from its search result: should Google follow the E-commerce Directive or GDPR? According to Corte di Cassazione in Italy, the E-commerce Directive applies to Google before it is notified of the illegal contents produced by a third party,Footnote 117 as Google is not a data controller before it is informed of the illegal contents.Footnote 118 In contrast, Google Spain rules that Google is always a data controller and thus should be subject to data-protection law.Footnote 119 Also consider the practical implications of the prohibitive penalty under the GDPR, whereby Google will be more incentivized to follow the GDPR rather than the E-commerce Directive.Footnote 120 Due to the long-arm jurisdiction created by the GDPR, courts may be prone to applying the GDPR as well. Hence, it remains to be seen how the courts in the EU will reconcile the E-commerce Directive and GDPR in terms of intermediary liability.
5. CHINA: INTERNET UN-IMMUNITY?
As in the US and the EU, in China, content providers are responsible for contents they produced online or offline.Footnote 121 As they are not content providers, Internet intermediaries can enjoy civil immunity—though they are subject to the Chinese version of the notice-and-take-down mechanism. However, the feature of Chinese law for Internet intermediaries is Internet un-immunity. Specifically, this stems from how China does not grant the same broad civil immunity to intermediaries for contents created by a third party as the US. In the EU, mere conduit intermediaries can enjoy civil immunity without being subject to the notice-and-take-down mechanism. In contrast, the Chinese version of the notice-and-take-down mechanism applies to all intermediaries, including mere conduit intermediaries. Further, even after an intermediary properly follows the notice-and-take-down mechanism after being notified, it may be still subject to civil liability in China.
The main Chinese laws regulating Internet intermediaries’ liabilities are Chinese Tort Law,Footnote 122 Provisions of the Supreme People’s Court on Certain Issues Concerning the Application of Law in the Hearing of Cases of Civil Disputes over the Use of Information Networks to Infringe upon Personal Rights and Interests (hereinafter “Provisions of SPC on Information Networks Infringement”),Footnote 123 Chinese E-commerce Law,Footnote 124 and Chinese Consumer Law.Footnote 125
According to Chinese Tort Law, an Internet user who infringes upon the civil right or interest of another person through the network services provided by an intermediary should assume the tort liability.Footnote 126 Chinese Tort Law should be read together with the Provisions of SPC on Information Networks Infringement and Chinese E-commerce Law. In particular, the former concerns online personal right infringement and the latter provides detailed regulations for goods and products sold online.
5.1 Online Personal Right Infringement
Online infringement of personal rights and interests refers to the infringement of the rights to names/titles, reputation, honour, portraits, and privacy. Article 36 of the Chinese Tort Law creates a civil immunity for the intermediary if it takes necessary measures such as deleting, blocking, or disconnecting the infringing material when receiving notice from the infringed party.Footnote 127 The intermediary should be jointly and severally liable with the Internet user if the intermediary has the relevant knowledge that the Internet user is infringing upon a civil right or interest of another person through its network services and fails to take necessary measures.Footnote 128 Different from the Chinese E-commerce Law, the Provisions of SPC on Information Networks Infringement provides a notice-and-take-down mechanism as a safe harbour to protect intermediaries from online personal right infringement claims.Footnote 129
According to the Provisions of SPC on Information Networks Infringement, a notice is valid as long as it contains (1) the name and contact details of the notifying party, (2) the URL against which necessary measures are required to be taken or relevant information sufficient to accurately locate the infringing contents, and (3) reasons for deleting the relevant information.Footnote 130 Should the intermediary fail to take the necessary measures in a timely manner after being notified, it shall be jointly and severally liable for any additional harm with the network user.Footnote 131 The courts will consider whether an intermediary has responded promptly by considering factors such as the nature of its service, the form and accuracy of the valid notice, the types of rights and interests infringed upon by the information, and the extent of the infringement.Footnote 132
Article 9 of the Provisions of SPC on Information Networks Infringement provides that a court should consider the following factors in determining whether the intermediary “has the relevant knowledge”: (1) whether the network service provider manually or automatically processes the infringing network information by recommendation, ranking, selection, editing, sorting, revision, or other means; (2) the information management capabilities that the network service provider shall possess, the nature of and ways in which the services are provided, and the possibility thereof for leading to infringement; (3) the types of personal rights and interests infringed upon by the relevant piece of network information, and the degree of obviousness of such infringement; (4) the degree of social impact of the relevant piece of network information, or the volume of website traffic thereof within a certain period of time; (5) whether it is technically possible for the network service provider to adopt measures to prevent infringement, and whether the network service provider has taken reasonable measures accordingly; (6) whether the network service provider has taken corresponding reasonable measures against the repeated infringing acts committed by the same network user or the same piece of infringing information; and (7) other relevant factors.Footnote 133
In the EU, the intermediary providing “mere conduit” services is generally immune and has no obligation to follow the notice-and-take-down mechanism. However, the Chinese Tort Law and Provisions of SPC on Information Networks Infringement apply the notice-and-take-down mechanism to all intermediaries.
An example is Cui Hailiang v. Aiming.Footnote 134 In 2010, Mr Song published a libel posting in relation to Mr Cui on an illegal website. Mr Cui requested that Mr Song delete this posting, but the latter asked for a fee. Mr Cui rejected this, instead filing a police complaint. Mr Song was subsequently imprisoned. However, this libel posting remained online and was republished by Dongjing and seven other websites that used the domain-name-registration service provided by Aiming. Whilst Mr Cui requested Aiming to take necessary measures to stop the spread of this libel post, Aiming did not respond to Mr Cui’s notice. Consequently, Mr Cui brought a case against Aiming for online defamation pursuant to Article 36 of the Chinese Tort Law. Here, Aiming argued that the libel posting was published by third-party websites that used its domain-registration service—and thus Aiming has no right to manage and review the postings on these websites; nor did it have an obligation to remove this posting. Article 36 of the Chinese Tort Law does not define the meaning of “network service provider.” The court held that domain-name registrars should be considered as a network service provider under Article 36, for two reasons. First, if the domain names of the seven websites that published the posting are not registered with Aiming, these websites cannot be accessed. Second, Aiming may have implemented necessary measures in order to mitigate the harm to Mr Cui, such as suspending its service to the seven websites. Therefore, considering a domain-name registrar as a network service provider can help the infringed party to promptly and effectively safeguard his or her legal right—indeed, such is the underlying policy of Article 36 of the Tort Law. Despite the fact that the libel posting was published by Dongjing and seven websites that were not Aiming, the court held that Aiming was liable to pay damages for its failure to take any action to remove the libel post.
Cui Hailiang v. Aiming was the first online-defamation case in China brought against a domain-name registrar for a posting published by a third party. Notably, from the facts of the case, it is unclear whether Aiming is the sole provider of the conduit service. In A Network Technology Co., Ltd of Hangzhou v. A Network Technology Co., Ltd of Changsha and Shenzhen Tencent Computer System Col, Ltd, the Zhangzhou Internet Court held that WeChat’s mini-programme service provider can enjoy civil immunity without being subject to the notice-and-take-down mechanism,Footnote 135 as the mini-programme service provider only provides auto-access, auto-transmission, and other basic network services. The Internet Court held that the term “network service provider”—as mentioned in the notice-and-take-down mechanism in Article 36 of the Chinese Tort Law—refers to the network service provider that provides information storage space or search, link, or other services. Essentially, like the EU E-commerce Directive, A Network Technology Co., Ltd of Hangzhou demonstrates that mere conduit intermediaries should be immune from contents produced by third parties and should not be subject to the notice-and-take-down mechanism. However, as an intellectual-property infringement case, A Network Technology Co., Ltd of Hangzhou is unclear as to whether its interpretation of Article 36 of Chinese Tort Law holds true for non-intellectual-property cases. Moreover, China is not a case-law country; thus, this case does not create a precedent. Therefore, whether the notice-and-take-down mechanism should be applied to mere conduit intermediaries in China has yet to be clarified.
5.2 Torts Related to Goods and Products Sold Online
Article 44.2 of the Chinese Consumer Law provides that, if an e-commerce platform provider (i.e. intermediary), first, knows, or should have known, that a dealer who sells a product or service on its platform is infringing upon the consumer’s right and interest, and, second, does not take any necessary measures, the platform provider shall be jointly and severally liable to the consumer with the dealer. Article 44.2 of the Chinese Consumer Law provides a general requirement and Article 38.1 of the E-commerce Law is lex specialis. It particularizes a specific circumstance of violation: where an e-commerce platform provider both knows or ought to know that the products or services provided by a dealer over its platform fail to meet the requirements for the protection of personal and property safety, and fails to take the necessary measures, the platform provider and the operator shall bear joint and several liability for the aforesaid violations.Footnote 136 Namely, as long as an e-commerce platform provider takes necessary measures, it will be immune from the liability relating to the products or services provided by the dealer over its platform. Article 36 of the Chinese Tort Law provides that, where a network user commits a tort through the network services, the victim of the tort shall be entitled to notify the network service provider to take necessary measures such as deletion, block, or disconnection.Footnote 137 Therefore, the “necessary measures” under Article 38.1 of the Chinese E-commerce Law and Article 44.2 essentially denotes the notice-and-take-down mechanism. However, neither the Chinese Tort Law, Chinese E-commerce Law, or the Chinese Consumer Law provides details of the notice-and-take-down mechanism. Courts may refer to the Provisions of SPC on Information Networks Infringement that provides details of the notice-and-take-down mechanism.
Suppose a platform provider properly follows the notice-and-take-down mechanism after receiving a consumer’s notice: will the platform provider be immune from the liability relating to the defective products or service sold by the dealer? The answer is in the negative. The reason for this resides in how Article 38.1 should be read together with Article 44.1 of the Chinese Consumer Law. Precisely, the latter provides that, if a platform provider cannot provide the true name, address, or contact information of a dealer selling products or services on its platform, the consumer can request the platform to cover the damages that the consumer suffered from the defective product or service.Footnote 138 Therefore, compared with the laws of the US and the EU, the Internet immunity in China is much more restricted.
In the US, however, constructive knowledge without affirmative action cannot deprive an e-commerce platform provider of immunity unless they have actual knowledge of the illegal online materials produced by third parties. For example, Randall Stoner v. eBay Inc., et al. concerns “bootlegs,” which are unauthorized recordings of a live musical performance.Footnote 139 eBay, through their online auction platform, facilitates sales by services such as notices, payment, insurance, and escrow. The plaintiff argued that eBay should be responsible for its own participation in selling bootlegs. The plaintiff further asserted that eBay failed to monitor the products auctioned on its service platform because “[t]he very description of some [the] recordings (e.g. ‘bootleg’ tapes) identifies some as contraband.”Footnote 140 The California Superior Court of San Francisco rejected both claims, holding that eBay is an interactive service provider (i.e. intermediary) and was therefore protected by the immunity clause under CDA § 230. This is due to the fact that the information concerning bootlegs came from third-party users. Even if eBay were to identify these products as contraband, the court held that Congress would have intended to remove any legal obligations of interactive computer service providers that may have attempted to identify or monitor the sale of illegal products, as “the threat of liability for failing to monitor effectively would … deter companies such as eBay from making their service available as widely and as freely as possible.”Footnote 141 Moreover, removing any legal obligation to monitor aims encourages self-regulation. Therefore, the plaintiff must prove “actual, rather than constructive knowledge of illegal sales, and some affirmative action by the computer service, beyond making its facilities available in normal manner, designed to accomplish the illegal sales.”Footnote 142 In contrast to the US CDA § 230, paragraph 1 of Article 38 of the Chinese E-commerce Law allows the evidence of constructive knowledge to deprive an e-commerce platform provider of immunity. This is another reason that intermediaries in China enjoy far less civil immunity.
More importantly, dissimilar to Article 38.1, Article 38.2 of the Chinese E-commerce Law imposes a general obligation on the e-commerce platform provider to review the qualifications or certificates of the dealers who sell goods or services related to the consumer’s life and health through the platform managed by the e-commerce platform provider.Footnote 143 This general obligation will not be exempted by the notice-and-take-down mechanism. The e-commerce platform provider will lose its immunity if it fails to review the qualifications or certificates of operators or fails to fulfil the safety guarantee obligations to consumers, thereby causing harm to them. Notably, Article 38.2 of the Chinese E-commerce Law only addresses goods or services related to the consumer’s life and health, while Article 38.1 applies to all other goods or services sold online. Besides the different scopes of application, consumers may find it more difficult to satisfy their burden of proof under Article 38.2 than that under Article 38.1. To make a claim under Article 38.1, consumers must prove that the e-commerce platform providers had actual or constructive knowledge of the defective products or services provided by a third party and that the e-commerce platform providers failed to take action against them. Proving that the e-commerce platform provider had actual or constructive knowledge may be accomplished by providing the notice that was sent by the consumer informing the platform provider of the violation. However, it is not an easy task for a consumer to prove that an e-commerce platform provider has probably reviewed the dealer’s qualifications or certificates or that the dealer has fulfilled its safety guarantee—especially when the review process and safety guarantee are embodied by internal documents adopted by the platform provider. Even if these documents are publicized online openly, it is still difficult for the consumers to prove whether they have been properly implemented by the platform provider.
On the other hand, the intermediary’s liability under Article 38.2 of the E-commerce Law needs clarification in four aspects.
First, the scope of “goods or services related to [a] consumer’s life and health” is not defined. For instance, medicine can be considered as a product related to a consumer’s life and health. However, whether a product such as a car or car tyre falls into this category remains unclear. The ambiguity of “goods or services related to consumer’s life and health” brings uncertainty to the obligations of e-commerce platform service providers.
Second, no clear guidelines are provided for an e-commerce platform provider to review the qualifications or certificates of dealers in different industries who sell products and services on the platform. Article 27 of the E-commerce Law provides that, where a dealer applies to an e-commerce platform operator to use the platform to sell products or provide services, the latter shall ask the former to submit authentic information concerning the dealer’s identity, address, contact information, and administrative licence; verify the information submitted; and periodically verify and update the files and related information. Article 27 applies to all dealers conducting online sales using the platform provided by e-commerce platform providers. It is unclear whether e-commerce platform providers should extend beyond the requirements listed in Article 27 and request more information about the qualifications and certificates for dealers selling goods and services related to consumers’ life and health. This seems to be justified, as Article 38.2 aims to provide enhanced protection to consumers who buy goods or services related to their lives and health. Hence, e-commerce platform providers ought to bear a higher burden of proof and request more documents than those listed in Article 27. Although this argument seems valid in a theoretical sense, it is in reality difficult to implement. For example, the qualifications and certificates for dealers in the pharmaceutical industry are significantly different from those in the automobile industry. It is, therefore, difficult to determine what sort of detailed information an e-commerce platform provider should request from a dealer in order to satisfy its review obligations under Article 38.2. Arguably, if an e-commerce platform provider has exercised due care in reviewing and verifying documents under Article 27, the provider should be considered as having satisfied its review obligation under Article 38.2. Article 38.2 provides enhanced protection for consumers by removing their burden of proof in demonstrating whether the platform provider knew or should have known that the product or service was defective. In other words, protection is afforded where an e-commerce platform provider fails to duly review the qualifications and certificates of dealers under Article 27 and a consumer suffers harm due to a defective product or service. The consumer can then request the e-commerce platform provider to bear the relevant liabilities according to law.
The third issue in relation to Article 38.2 is the ambiguity of the “safety guarantee obligations for consumers.” Does the “safety guarantee” refer solely to a duty implied by law on the platform provider to adopt safety protection measures? One argument is that the duty is the same as the duty imposed by Article 37 of the Chinese Tort Law on all persons responsible for managing hotels, shopping malls, banks, and other public places, as well as all persons organizing mass activities. If this argument is true, Article 38.2 of the Chinese E-commerce Law would have explicitly indicated that the platform provider should assume complementary liability as Article 37 of the Chinese Tort Law does. Complementary liability means that the third party should bear the liability first-hand and managers or organizers will be liable only when the third party fails to pay damages in cases such as bankruptcy. Article 38.2 of the Chinese E-commerce Law does not mention complementary liability. “Safety guarantee” under Article 38.2 of the Chinese E-commerce Law should go beyond the duty imposed by Article 37 of the Chinese Tort Law. It may refer to explicit guarantees provided by an e-commerce platform provider, such as a statement that the quality of all products sold on its platform is guaranteed. The courts should be allowed to hold the e-commerce platform provider’s implied guarantees by construing the user’s agreement or online advertisements.
Lastly, unlike Article 38.1 of the E-commerce Law that imposes joint and several liability on the e-commerce platform providers, Article 38.2 does not specify the liability of an e-commerce platform provider.Footnote 144 The legislative history of Article 38 demonstrates tensions between protecting online consumers and promoting the growth of e-commerce platforms. E-commerce platform providers have strongly advocated that they should be treated as the managers of public venues such as brick-and-mortar hotels, shopping centres, banks, stations, or entertainment places, or organizers of mass activities in real life under Article 37 of the Chinese Tort Law. Accordingly, if the harm to another person is caused by a third party, the third party should assume tort liability while the managers or organizers, should they fail to fulfil the duty or provide safety guarantee, should assume the corresponding complementary liability.Footnote 145 Applying Article 37 of the Chinese Tort Law to e-commerce platform providers was severely criticized by the general public upon the release of the E-commerce Bill in early 2018.Footnote 146 Opponents argue that e-commerce platform providers should be distinct from managers of brick-and-mortar hotels and shopping centres, and should not enjoy the protection granted by Article 37 of the Chinese Tort Law. This is partly due to the boom in Chinese e-commerce, resulting in a drastic increase in consumer complaints related to defective products or services sold online and an increasing difficulty in locating online shop operators to hold them responsible. This issue is exacerbated when Chinese e-commerce platform providers offer platforms to foreign shop operators for them to sell their products or services to Chinese consumers. Consumers find it challenging to hold foreign shop operators liable for defective products and misrepresentation. Further, criticisms also stemmed from the fact that Chinese Internet sales platforms are highly monopolized by only a few e-commerce platform providers, such as Alibaba, JD, Ctrip, etc. The inequality between e-commerce platform providers and consumers requires a policy choice against the extension of Article 37 to e-commerce platform providers. Though these criticisms have gained support from a few members in the Chinese NPC Standing Committee,Footnote 147 it seems that consumer protections remain insufficient to drive Chinese legislators to pass a clear policy choice favourable to consumers. Although consumer protection may gain public popularity in China, Chinese legislators will not make an explicit policy choice favourable to consumers without the proper constitutional support. Moreover, the e-commerce platform providers strongly lobbied against joint and several liability with online shop operators in cases where they failed to review the latter’s qualification or fulfil the safety guarantee obligations for consumers. Although the Chinese government has an interest in facilitating the development of the domestic e-commerce industry, the government, however, is also concerned that it is imposing too many obligations on e-commerce platform providers that may ultimately increase the online transaction costs that consumers would have to pay. Consequently, Article 38.2 of the E-commerce Law does not clearly specify an e-commerce platform provider’s liability. Instead, it provides that the issue of liability should be determined according to the relevant laws.
6. CONCLUSION
This paper argues that the US applies broad civil immunity to intermediaries and exempts them from civil liability arising from contents produced by third parties. Both the EU and China restrict civil immunity to intermediaries that meet the notice-and-take-down requirement. Chinese law is different from the US and the EU law in two important respects.
First, contemporary Chinese law imposes either higher liabilities (as compared with the US) on Internet intermediaries or unclear procedures to be immune (as compared with the EU). This is because, unlike US law, Chinese law does not grant absolute immunity to intermediaries. Nor does China divide intermediaries into categories of “mere conduit,” “caching,” and “hosting”—as per the EU—and applies the notice-and-take-down mechanism differently. Instead, intermediaries in China may be subject to civil liability even if they properly follow the notice-and-take-down mechanism that the Chinese Consumer Law provides. Moreover, it is unclear whether the “mere conduit” intermediaries can enjoy civil immunity without being subject to the notice-and-take-down mechanism in China.
Second, unlike the US and the EU—both of which have made explicit policy a priority regarding liabilities that Internet intermediaries should bear—Chinese policy choices are unsettled. The US law for intermediaries’ liability focuses on protecting the free flow of information under the First and Fourteenth Amendments of the US Constitution. In contrast, the EU emphasizes the protection of personal information as a fundamental human right. Yet, China has not made a clear policy choice. Consumer protection has boomed in public popularity and increasingly attracted the attentions of the legislature and judiciary in China. However, it is doubtable that the protection of consumers can provide a prevailing policy support for Chinese law in the same way as freedom of speech and the protection of personal information do under the laws of the US and the EU. This is because protecting consumers is a vague concept. It is fundamentally different from the freedom of speech and the protection of personal information that have direct constitutional supports in the US and the EU, respectively. Indeed, the legislative history of the Chinese E-commerce Law as discussed above also demonstrates that protecting consumers may not outweigh other competing considerations such as protecting intermediaries and developing e-commerce.
