In recent years the Organisation for Economic Co-operation and Development (OECD) has been at the forefront of the global policy dialogue on Internet intermediary liability.

In 2011 it adopted a set of Internet Policy-Making Principles that contemplate Internet intermediaries being involved in the online enforcement of intellectual property rights, via both voluntary “co-operative measures”, and as a result of the conditions that Internet intermediaries must satisfy to take the benefit of copyright safe harbor and limitation of liability legal regimes.

Background

The OECD is an international organization founded in 1961 to provide a forum for governments to share experiences and develop policy to stimulate economic development and world trade. It currently has 34 member countries (including the US, the EU, Japan, South Korea, Chile, Australia and New Zealand) and works with all major emerging economy countries. (Observer countries include China, Russia, Brazil and India). OECD has a permanent secretariat staff that produces research reports and policy recommendations. While OECD has no formal treaty-making or norm-setting power, its reports and recommendations are extremely influential in the governments of its member states and observer countries.

In 2008 OECD member countries adopted the Seoul Declaration for the Future of the Internet Economy at an OECD Ministerial Meeting in Seoul, Korea.  A key part of the implementation of that was OECD analysis and policy recommendations on the roles that Internet intermediaries play in the Internet economy.

OECD Internet Intermediary Research Reports

The OECD published several thoughtful reports on these issues: The Economic and Social Role of Internet Intermediaries (2010), and The Role of Internet Intermediaries in Advancing Public Policy Objectives (2011). These reports have now been consolidated with findings from a 2010 Experts Workshop into a book.

The second report included case studies of Internet intermediaries’ roles in various areas, including online copyright enforcement. It analyzed the U.S. notice and takedown regime, Canada’s notice –notice system, and the Graduated Response regimes in France, South Korea, New Zealand, and Ireland, and the U.K. Digital Economy Act’s draft Code of Initital Obligations. It noted that there was very limited empirical evidence about the effectiveness of imposing obligations on Internet intermediaries to filter and block potentially copyright-infringing content and Graduated Response regimes.

The following principles were identified in an initial set of best practices recommendations for government policymakers:

1. Policy and legal frameworks should provide appropriate protection & liability / remedy limitations to Internet intermediaries.

2. General Principles:

• Policy development should involve all relevant stakeholders.
• A whole-of-government approach is required.
• Policy frameworks should differentiate between different intermediary activities.
• Policy frameworks should consider marketplace incentives.
• Policy frameworks should consider social cost & externalities.
• Governments should undertake cost-benefit analyses.

3.  Governments should encourage private sector initiatives:

• Governments should encourage innovative private sector initiatives.
• Governments should encourage self or co-regulation.
• Policy and legal frameworks should help enforce codes of conduct.
• Governments should consider public policy objectives in systems & processes.
• Governments can play an important role.

4. Principles in Policy Implementation:

• Fair and efficient cost sharing.
• Undertake risk assessments.
• Safeguard civil liberties.
• Provide for due process.
• Reduce need to assess legality.

5. Governments should co-operate with stakeholders to generate quantitative data.

6. Governments should co-operate internationally to:

• Improve predictability and consistency of legal frameworks.
• Consider cross-border implications.
• Co-operate across borders for enforcement.
• Increase international harmonization.

The final version of the second report made a set of findings, including:

• Governments should engage in analysis before adopting or maintaining any intermediary liability policy. Such analyses should consider the impacts on all interested parties, including rights holders, ISPs and other intermediaries, users and governments.
• Further assessment of the equity of cost sharing is needed.
• Private arrangements among parties that go beyond notice and notice may be efficient, but issues related to an ISP’s liability for suspension of service should be reviewed and addressed.
• Official determination of copyright infringement should be relied upon as much as possible before imposing sanctions, with consideration given to developing an expedited adjudication process. To the extent that sanctions of Internet users are not based on official determinations of copyright infringement, expeditious procedures should be developed that afford users notice of such action and the opportunity to contest it.
• If proposals for mandatory filtering that require ISPs examine Internet traffic in order to detect signs of copyright infringement are developed, they should include an objective, independent and transparent analysis of technical feasibility as well as of potential effects on free expression, privacy, rights holders’ interests and effective enforcement.
• An assessment should be made of the feasibility, costs and benefits of having governments compile and maintain lists of websites found to be infringing and of any requirement for ISPs and other intermediaries to block access to these sites or to deny service to them, including the costs of potential over-blocking, any potential effect on the free flow of information, as well as the potential impact on effective enforcement.

Internet Intermediary Policy Recommendations

The OECD has played a key role in developing policy recommendations on the need to protect the open Internet, and on how to regulate Internet intermediaries and foster Internet-related innovation in national economies.

OECD Council Recommendation on Internet Intermediaries

In 2010 the OECD began work on an OECD Council Recommendation on Internet intermediaries –a set of best practice recommendations to national policymakers on appropriate legal and policy frameworks to foster Internet-related economic growth, innovation, and protect citizens’ rights of due process, freedom of expression and privacy, based on findings from the 2010 and 2011 reports.  This culminated in a final draft Council recommendation, which has been under consideration by OECD member governments since February 2011.

Communiqué on Internet Policy-Making Principles

In parallel, at the initiation of the US delegation, in 2011 the OECD developed a Communiqué on Internet Policy-Making Principles, endorsing 14 high level principles to be taken into account in policy making:

1. Promote and protect the global free flow of information;
2. Promote the open, distributed and interconnected nature of the Internet;
3. Promote investment and competition in high speed networks and services;
4. Promote and enable the cross-border delivery of services;
5. Encourage multi-stakeholder co-operation in policy development processes;
6. Foster voluntarily developed codes of conduct;
7. Develop capacities to bring publicly available, reliable data into the policy-making process;
8. Ensure transparency, fair process, and accountability;
9. Strengthen consistency and effectiveness in privacy protection at a global level;
10. Maximise individual empowerment;
11. Promote creativity and innovation;
12. Limit Internet intermediary liability;
13. Encourage co-operation to promote Internet security;
14. Give appropriate priority to enforcement efforts.

The Communiqué was adopted by governments and some of OECD’s stakeholder groups (the business and internet technical community groups) at a High Level Meeting on the Internet Economy in June 2011.

The civil society stakeholder organization at OECD (CSISAC) supported the Communiqué’s 14 high level principles for Internet policy-making but declined to endorse the final Communiqué because of concerns with the accompanying explanatory text. These included:

• The Communiqué’s over-emphasis on protection and enforcement of intellectual property rights at the expense of citizens’ fundamental rights and freedoms.
• The Communiqué’s failure to acknowledge the importance of balanced IP regimes to spur creativity and innovation;
• The Communiqué text could allow governments to use Internet intermediaries to police their networks and platforms for potential intellectual property infringement, which could in turn impede Internet users' ability to seek, receive, and impart information and undermine their privacy.  

This was particularly troubling in the context in which the Communiqué was developed. It was drafted within a few weeks and adopted at a high-level inter-government meeting at a time when there was vigorous ongoing debate in international, regional, and national fora about the appropriate role and responsibilities of Internet intermediaries, and the scope of protection against liability afforded to intermediaries was before courts in various OECD countries. 

In December 2011, OECD member countries adopted an OECD Council Recommendation incorporating the Communiqué’s 14 high level principles. The controversial explanatory text that accompanied the principles was included as an appendix for informational purposes only. CSISAC welcomed the adoption of the Recommendation incorporating just the high-level principles. The OECD is currently considering proposals for wider adoption and implementation of the Internet Policy-Making Principles.

EFF is a member of CSISAC and was closely involved in both the OECD’s Internet intermediaries work, and the development of the Communiqué on Internet Policy-Making Principles. The following comments reflect the concerns that EFF had with the OECD Communiqué text.  This is not a CSISAC statement, and does not necessarily represent the views of CSISAC and all its members.

Internet Disconnection, Filtering, and Blocking of Content

The Communiqué envisages that Internet intermediaries will take voluntary co-operative measures to address and deter intellectual property infringement. These could include filtering or blocking of web content, or disconnection of Internet users upon a repeat allegation of copyright infringement under a Three Strikes or Graduated Response policy.

The Communiqué provides:

“Sound Internet policy should encompass norms of responsibility that enable private sector voluntary co-operation for the protection of intellectual property. Appropriate measures include lawful steps to address and deter infringement, and accord full respect to user and stakeholder rights and fair process.”

Based on the experience in various countries, the types of voluntary measures that could be adopted by Internet intermediaries for this purpose include:

• Three Strikes/ Graduated Response Internet disconnection after repeat allegations of copyright infringement, suspension of Internet access, and bandwidth throttling (as seen in the U.S., Ireland, Belgium);
• Website blocking (as seen in Ireland, the UK and many EU countries);
• Filtering communications for potential copyright-infringing material (as ordered in Belgium)

In addition, the Communiqué’s text on Internet intermediary liability raised concerns that new and more onerous conditions could be required of Internet intermediaries in order for them to qualify for limitation of liability regimes in national copyright laws.  For instance, the US copyright safe harbor regime provides for limited liability for Internet intermediaries that engage in 4 types of activity so long as they meet a set of threshold qualifying conditions. While the Communiqué recognized the need for limitations on Internet intermediary liability, the text could be read as conditioning the limitation of liability on Internet intermediaries taking particular actions, which might increase over time.

"Limitations play an important role in promoting innovation and creativity, the free flow of information, and in providing the incentives for co-operation between stakeholders. Within this context governments may choose to convene stakeholders in a transparent, multi-stakeholder process to identify the appropriate circumstances under which Internet intermediaries could take steps to educate users, assist rights holders in enforcing their rights or reduce illegal content, while minimising burdens on intermediaries and ensuring legal certainty for them, respecting fair process, and more generally employing the principles identified in this document.”

Tweaking the conditions that Internet intermediaries must satisfy to qualify for limitation of liability regimes is not new. For years, IP rightsholders have engaged in litigation in the US, the EU, Australia and elsewhere, in which they have argued for more onerous interpretations of the qualifying conditions as a way to nudge the balance between rightsholders and network service providers embodied in these legal regimes. The threshold qualifying conditions in the US legal regime in 17 U.S.C. §512 are some of the most heavily litigated parts of US Copyright law.

Getting these conditions right is important because they have a direct bearing on the scope of citizens’ freedom of expression and privacy. These conditions are a key part of the political compromise that led to the adoption of the DMCA safe harbor regime in the US in 1998 and the e-Commerce Directive regime in the EU in 2000. Internet users were not at the bargaining table when these legislative compromises were struck. Therefore it is particularly important that disputes about the scope of qualifying conditions are adjudicated by judges, who are best-placed to weigh up the rights of intellectual property rightsholders and the fundamental rights and civil liberties of Internet users, and make appropriate allocations of enforcement costs between online service providers and IP rightsholders.

Privacy and Personal Data Protection

EFF and other CSISAC members were also concerned about references to cross-border data access and flows in the Communiqué’s explanatory text on the principle on Promotion and Enabling of Cross-Border Delivery of Services. This could be read as supporting a reduction in the current level of protection for Internet users’ personal data by permitting Internet companies that operate in multiple countries to transfer their users’ data across borders, from jurisdictions with high levels of protection (such as the EU) to jurisdictions which have lower levels of protection (such as the US).

This was particularly concerning for privacy advocacy groups because the OECD’s 1980 Guidelines on the Protection of Privacy and Transborder Flows of Personal Data were in the process of being reviewed at the same time that the Communiqué text was being negotiated. The OECD Guidelines form the basis of many OECD countries’ laws restricting the transfer of personal data to other countries with lower levels of data protection, and are widely seen as more protective of Internet users’ privacy than alternative frameworks such as the APEC Privacy Framework.

The final Communiqué text includes express recognition of the need for protection of Internet users’ personal data, which alleviated some of the concerns with the previous text. The final version of the explanatory text on Protection and Enabling Cross-Border Delivery of Services provides that:

“Suppliers should have the ability to supply services over the Internet on a cross-border and technologically neutral basis in a manner that promotes interoperability of services and technologies, where appropriate. Users should have the ability to access and generate lawful content and run applications of their choice. To ensure cost effectiveness and other efficiencies, other barriers to the location, access and use of cross-border data facilities and functions should be minimised, providing that appropriate data protection and security measures are implemented in a manner consistent with the relevant OECD Guidelines and reflecting the necessary balance among all fundamental rights, freedoms and principles.”

Additional Resources

• Position Paper [PDF] on the Appropriate Role of Internet Intermediaries in Protecting Intellectual Property Rights for OECD June 2010 Workshop.
• CSISAC’s Statement of Concerns with the June 2011 Communique on Internet Policy-Making Principles, June 28, 2011.
• CSISAC’s Statement on the adoption of the OECD Recommendation on Principles for Internet Policy Making, December 13, 2011.

Acknowledgement: EFF thanks Gwen Hinze, EFF Policy Fellow, for producing this analysis (December 2012).