Wednesday 22 May 2024

Internet jurisdiction revisited

As legal and policy topics go, cross-border internet jurisdiction is evocative of a remote but restless volcano: smouldering away mostly unnoticed by public and lawyers alike, only to burst spectacularly into life at odd intervals.

The latest eruption has occurred in Australia, where last month the Australian eSafety Commissioner launched legal proceedings for an injunction against X Corp (Twitter) requiring it to remove or hide from all users worldwide a video of a stabbing attack on an Australian bishop. X Corp argues that geo-blocking the content from Australian users is sufficient. The eSafety Commissioner disagrees, since Australian users equipped with VPNs can evade the block. In a judgment published on 14 May 2024 Kennett J, a judge of the Federal Court of Australia, sided with X Corp on an interim basis and declined to continue a previously granted emergency injunction.

The underlying policy issue is that the internet is readily perceived as undermining local laws, since material posted on the internet outside the local jurisdiction is, by default, available worldwide. The Canadian Supreme Court in Equustek put it thus:

“Where it is necessary to ensure the injunction’s effectiveness, a court can grant an injunction enjoining conduct anywhere in the world. The problem in this case is occurring online and globally. The Internet has no borders — its natural habitat is global. The only way to ensure that the interlocutory injunction attained its objective was to have it apply where Google operates — globally.”

The countervailing concern is that when a court acts in that way in order to secure the effectiveness of its local law, it is asserting the right to impose that law on the rest of the world, where the material in question may be legal. Assertion of extraterritorial jurisdiction has always had the potential to create friction between nation states. When the internet arrived, its inherent cross-border nature created additional policy tensions that, 30 or more years on, have yet to be fully resolved.

The background to the current dispute is Australia’s Online Safety Act 2021. A social media service is in scope of the Act unless “none of the material on the service is accessible to, or delivered to, one or more end-users in Australia” (S.13(4)).  Thus any social media service in the world is within the reach of the Australian legislation, unless it can and does take steps that prevent all Australian users from accessing its content.  

However, the general territorial scope of the Act is not the end of the story. Under the Act the eSafety Commissioner can issue a removal notice in respect of ‘Class 1’ material if (among other things) the Commissioner is satisfied that the material can be accessed by end-users in Australia. A removal notice requires the service provider to “take all reasonable steps to ensure the removal of the material from the service”.  

Echoing S.13(4), S.12 provides that material is ‘removed’ if “the material is neither accessible to, nor delivered to, any of the end-users in Australia using the service.” (The court interpreted this as meaning all users physically located in Australia.)

The Commissioner sought continuation of the previously granted emergency injunction pending trial. The court therefore had to decide whether there was a real issue to be tried that the final injunction sought by the Commissioner would go further than the “reasonable steps” that were all that a removal notice could require.

X Corp had agreed to geoblock the 65 URLs specified in the removal notice, so that they are not accessible to users with IP addresses in Australia. The eSafety Commissioner sought an injunction that would require X Corp to remove the 65 URLs from its platform altogether, or make them inaccessible to all users. The Commissioner argued that such action was within the “all reasonable steps” that the removal notice required to be taken. X Corp argued that a requirement for worldwide removal or blocking of the material goes beyond what is “reasonable”.

The court held that although a voluntary decision by X Corp to remove the 65 URLs altogether would be reasonable (in the sense of easily justified), that was not the test where the Act imposes its requirements regardless of the wishes of providers and of individual users. “Reasonable” should therefore be understood as limiting what must be done to the steps that it is reasonable to expect or require the provider to undertake. Such steps include not only considerations of expense, technical difficulty and time for compliance, but (the issue that divided the parties) the other interests that are affected.

Significantly, when considering the other interests affected, the court brought into consideration the ‘comity of nations’. At an earlier point in the judgment Kennett J had said:

“The policy questions underlying the parties’ dispute are large. They have generated widespread and sometimes heated controversy. Apart from questions concerning freedom of expression in Australia, there is widespread alarm at the prospect of a decision by an official of a national government restricting access to controversial material on the internet by people all over the world. It has been said that if such capacity existed it might be used by a variety of regimes for a variety of purposes, not all of which would be benign. The task of the Court, at least at this stage of the analysis, is only to determine the legal meaning and effect of the removal notice. That is done by construing its language and the language of the Act under which it was issued. It is ultimately the words used by Parliament that determine how far the notice reaches.”

Nevertheless, when it came to consider reasonableness as a matter of construction of the language of the Act, something very like those considerations reappeared:

“49    If s 109 of the OS Act provided for a notice imposing such a requirement, it would clash with what is sometimes described as the “comity of nations” in a fundamental manner. …

50    If given the reach contended for by the Commissioner, the removal notice would govern (and subject to punitive consequences under Australian law) the activities of a foreign corporation in the United States (where X Corp’s corporate decision-making occurs) and every country where its servers are located; and it would likewise govern the relationships between that corporation and its users everywhere in the world.

The Commissioner, exercising her power under s 109, would be deciding what users of social media services throughout the world were allowed to see on those services. The content to which access may be denied by a removal notice is not limited to Australian content.

In so far as the notice prevented content being available to users in other parts of the world, at least in the circumstances of the present case, it would be a clear case of a national law purporting to apply to “persons or matters over which, according to the comity of nations, the jurisdiction properly belongs to some other sovereign or State”. Those “persons or matters” can be described as the relationships of a foreign corporation with users of its services who are outside (and have no connection with) Australia. What X Corp is to be permitted to show to users in a particular country is something that the “comity of nations” would ordinarily regard as the province of that country’s government.

51    The potential consequences for orderly and amicable relations between nations, if a notice with the breadth contended for were enforced, are obvious. Most likely, the notice would be ignored or disparaged in other countries. (The parties on this application tendered reports by experts on US law, who were agreed that a US court would not enforce any injunction granted in this case to require X Corp to take down the 65 URLs.)”

In similar vein the judge went on to consider the balance of convenience, in case he was wrong on the construction of the statute:

“56    If the considerations relating to the comity of nations (discussed at [48]–[51] above) had not led me to the view that the Commissioner has not made out a prima facie case, the same considerations would have led me to conclude that the balance of convenience does not favour extending the interlocutory injunction in its current (or any similar) form.

57    On the one hand the injunction, if complied with or enforced, has a literally global effect on the operations of X Corp, including operations that have no real connection with Australia or Australia’s interests. The interests of millions of people unconnected with the litigation would be affected. 

Justifying an interlocutory order with such a broad effect would in my view require strong prospects of success, strong evidence of a real likelihood of harm if the order is not made, and good reason to think it would be effective. At least the first and the third of these circumstances seem to be largely absent. The first is discussed above. 

As to the third, it is not in dispute that the stabbing video can currently be viewed on internet platforms other than X. I was informed that the video is harder to find on these platforms. The interim injunction is therefore not wholly pointless. However, removal of the stabbing video from X would not prevent people who want to see the video and have access to the internet from watching it.

58    On the other hand, there is uncontroversial expert evidence that a court in the US (where X Corp is based) would be highly unlikely to enforce a final injunction of the kind sought by the Commissioner; and it would seem to follow that the same is true of any interim injunction to similar effect. This is not in itself a reason why X Corp should not be held to account, but it suggests that an injunction is not a sensible way of doing that. Courts rightly hesitate to make orders that cannot be enforced, as it has the potential to bring the administration of justice into disrepute.”

A notable aspect of these passages is the approach to comity of nations, especially in the balance of convenience section which refers to the effect on millions of people unconnected with the litigation. It stands in significant contrast with the approach of the Canadian Supreme Court in Equustek (a trade mark and confidential information case).

The court in that case took an approach to comity that was both more abstract and more state-centric than that of Kennett J. It was abstract in that it was apparently sufficient that other countries would recognise the notion of intellectual property rights – without needing to consider the concrete question of whether the plaintiff in fact owned equivalent intellectual property rights throughout the world. It was more state-centric in that it focused entirely on the sensibilities of other states, without consideration of the individual interests and rights of users throughout the world.

Both differences are apparent from a passage in the British Columbia Court of Appeal judgment under appeal in Equustek, endorsed by the Canadian Supreme Court:

"In the case before us, there is no realistic assertion that the judge’s order will offend the sensibilities of any other nation. It has not been suggested that the order prohibiting the defendants from advertising wares that violate the intellectual property rights of the plaintiffs offends the core values of any nation." [BCCA 93]

The notion that international law is about more than mere state interests gains some support from the academic Jeremy Waldron. He has referred to:

‘the peaceful and ordered world that is sought in [international law] – a world in which violence is restrained or mitigated, a world in which travel, trade and cooperation are possible. . . . [This, he says, is] something sought not for the sake of national sovereigns themselves, but for the sake of the millions of men, women, communities, and businesses who are committed to their care’ [J. Waldron, ‘Are Sovereigns Entitled to the Benefit of the International Rule of Law?’ (2011) 22 European Journal of International Law 325.]

The Australian case is due to go forward to a full trial in July 2024. It has the potential to become a test of the circumstances in which courts will exercise jurisdictional self-restraint over the internet.

Tuesday 30 April 2024

The Corn Laws go digital

Eager student: I’m in­­ search of a tasty legal nugget to drop into my next essay. Any thoughts?

Scholarly Lawyer: I have just the thing for you: clause 122 of the Data Protection and Digital Information Bill. Post-Brexit geopolitics meets digital signatures, a strange mixture if ever there was one.

ES: I’m guessing that this is about eIDAS.

SL: Correct. What do you know about it?

ES: An EU Regulation, domesticated following Brexit, which defines three categories of electronic signature: ordinary, advanced and qualified (QES). eIDAS has been a pet project of the European Commission for years, and some EU countries require a QES to be used for some transactions. However, English law hardly ever requires anything more than an ordinary signature: something as informal as a name typed at the end of an e-mail can suffice. So for most purposes we can ignore advanced and qualified signatures.

SL: Right again. The main point of a QES is that the identity of the signatory is certified by a third party Qualified Trust Service Provider (QTSP) approved by a national supervisory body. Conceptually that is closer to notarisation than to a manuscript signature. If you think about it, even a witnessed wet ink signature does not require the witness to verify the identity of the signatory. It would be a radical departure from the long-standing flexible English law approach to signatures if we were to start encumbering electronic signatures with those kinds of legal formality requirements.

ES: But isn’t it quite useful for a signature to have that degree of assurance attached to it? Anyone could type a name at the end of an email.

SL: For sure, there is a broad spectrum of electronic and digital signatures. They offer differing degrees of assurance of identity or document integrity, ranging from none to highly probative. Those features may go to the evidential weight that a court gives to a contested signature, but just as with manuscript (for which even a pencilled ‘X’ can count as a signature) we don’t generally impose a bright line rule invalidating signatures below a specified level of reliability or assurance. Absent compulsion by law, there has been little demand for the full-blown QES. Indeed, in the UK the Information Commissioner’s Office (the designated supervisory body) has still approved only one QTSP.

ES: So qualified signatures are a red herring?

SL: They cannot be completely ignored. In Scotland there are real estate transaction rules based on QES; and in England the Land Registry is running a QES pilot. So QES are significant in that limited sphere. In the future there may be a move to allow deeds generally to be executed by means of a digital signature instead of witnessing. There would no doubt be suggestions that the full panoply of a QES should be required for that.

ES: That’s all by way of background. What does this Bill do?

SL: Within the EU, a QTSP approved in one EU country counts as a QTSP throughout the EU. Following Brexit, the UK unilaterally retained recognition of EU QTSPs. So an EU QTSP can still certify a QES for UK law purposes. The EU, on the other hand, ceased to recognise UK QTSPs (such as exist) post-Brexit.

Clause 122 of the Bill would give the Secretary of State power to lay regulations withdrawing UK recognition of EU QTSPs. Conversely, the SoS could extend recognition to foreign QTSPs (or equivalent) on a country by country basis, including countries outside the EU.

ES: So if the UK were to withdraw EU-wide recognition on Day 1, that would radically diminish the pool of available QTSPs that could certify a QES under UK law?

SL: Indeed so, unless automatic recognition were simultaneously extended to every EU country individually, or if EU QTSPs en masse applied for UK ICO approval. Clause 121 smooths the path for EU QTSPs to obtain approval, by deeming an EU conformity assessment report under eIDAS to have equivalent status to one issued by a UK conformity assessment body.

ES: So instead of recognising an EU QTSP itself, we could end up recognising a QTSP’s EU conformity assessment, wave it through and arrive in much the same place?

SL: It looks that way.

ES: So what really is the point of this legislation?

SL: It is difficult to be sure. Perhaps the UK government is miffed that the EU won’t mutually recognise UK-approved QTSPs, and wants to try to exert negotiating pressure on Brussels by taking power to withdraw recognition. (But one has to wonder whether withdrawing automatic recognition of EU QTSPs would merely shoot ourselves in the foot by cutting off the supply of qualified trust services in the UK.)

Perhaps there is an undercurrent of post-Brexit jingoism: what we really need to make the UK the best place in the world to transact online is a sturdy, copper-bottomed, certifiably British digital signature.

ES: What does the government say?

SL: The official answer that the Minister gave in the House of Commons last year was that the power enables revocation if continued unilateral recognition “no longer meet[s] the needs of the UK market”. The version in the Bill’s Explanatory Notes is: “should the continued unilateral recognition of EU qualified trust services no longer be appropriate”.

Various DSIT memoranda to Parliamentary Committees contain a third, more illuminating version: “either because the EU changes its current trust service standards, and/or the UK qualified trust service market matures to an extent that it is no longer appropriate to unilaterally recognise EU qualified trust services.”

None of these criteria is stated in the legislation itself, which places no constraints or conditions on the exercise of the power.

ES: I can see that the government might not want to be tied to possible future changes in EU law. But how would maturity of a UK market determine whether it is still appropriate to continue unilateral recognition?

SL: It sounds like: “Are there now enough UK QTSPs that we can afford to cut off QTSP services supplied from the EU?”. You could call that 21st century digital mercantilism. Go back to 1684 and we find, in Philipp Wilhelm von Hornick’s tenets of mercantilism: “That no importation be allowed if such goods are sufficiently and suitably supplied at home.”

ES: Digital Corn Laws?

SL: Very apposite. A feature of the protectionist mindset is to look at the issue solely from the perspective of producers, at the expense of consumers and the general public. How, we might ask, would the general public benefit from taking what is already a prescriptive, complex technology specification (albeit one rarely required by UK law) and grafting a narrower geographic restriction on to it?

In short, the public would not benefit. On the contrary, in the shape of the unwary user the public is put at risk. Austria provides a vivid example: a €3bn contract to supply double-decker trains to Austrian Federal Railways was invalidated by a judge who noticed that the contract was signed with a QES supported by a Swiss, rather than an EU, TSP.

It is for this kind of reason that the UK (or at least English law) is traditionally chary of imposing formalities. Requiring a particular kind of defined signature for a transaction to be valid is a more technically obscure, 21st century version of the Statute of Frauds, of which an official committee report of 1937 said:

“ 'The Act', in the words of Lord Campbell . . . 'promotes more frauds than it prevents'. True it shuts out perjury; but it also and more frequently shuts out the truth. It strikes impartially at the perjurer and at the honest man who has omitted a precaution, sealing the lips of both. Mr Justice FitzJames Stephen ... went so far as to assert that 'in the vast majority of cases its operation is simply to enable a man to break a promise with impunity, because he did not write it down with sufficient formality.’ ”

Where UK law does require a QES (which it is to be hoped will remain the exception) it would be doubly unwise to introduce a regime that would invalidate an otherwise perfectly satisfactory QES simply because the certifying QTSP was on the wrong side of the Channel.

ES: Weren’t many of the Statute of Frauds formalities abolished in 1954? 

SL: Indeed so. It would be beyond ironic if irritation at EU unwillingness to reciprocate recognition of QTSPs, or perceived national interest in fostering a self-sufficient UK trust service provider industry, resulted in the UK heading down the road of the kind of prescriptive formalities associated with civil law jurisdictions and which England and Wales, as a common law jurisdiction, long ago rolled back.

ES: Thank you. My essay awaits.