Alberto Cerda: "There are many more international agreements to protect intellectual property than to protect people's privacy"

Alberto Cerda is the international affairs director at Derechos Digitales, a Chilean NGO, and a specialist in intellectual property and privacy issues. In this interview, he analyses the legislation and policies being adopted in Latin America to deal with online violence against women involving the invasion of privacy, and the responsibility assigned to internet intermediaries and individuals.

Erika Smith: In cases of online violence against women we frequently see this issue of personal information, often intimate photos, which may or may not have been taken voluntarily but whose dissemination on the internet is not consensual, or sometimes the women have not given their consent for their photos to be linked with their personal information or other data. There are few remedies available because it is not entirely clear which laws and rights are being violated. In South America what remedies are there for women in this situation, whether under the law or from the companies themselves?

Alberto Cerda: I’d like to answer that in two parts. First off, I will refer to the general framework for the protection of privacy in circumstances like these, and secondly I will refer to problems in the application of the law in the online environment.

In general terms, Latin American countries recognise the right to privacy in their constitutions, which also establish protection for the privacy of individuals from the actions of both the state and private parties. The constitution protects you not only when the state attempts to infringe on your privacy, but also when a private party, such as a corporation, a company, your neighbour or your ex-boyfriend, attempts to infringe on your privacy. This is the rule of thumb in the majority of the region’s countries. Unfortunately it is not the case in Mexico, where the constitution basically protects your privacy against the state. In addition, in almost all of the region’s countries there are specific criminal laws that establish prison sentences, fines or other penalties for those who invade the privacy of others in serious circumstances. There are also laws that protect the inviolability of communications and the improper handling of personal information.

Finally, there are civil law provisions that enable the enforcement of financial responsibility for infringing the right to privacy. Thus the general framework in Latin America comprises a mix of constitutional, criminal and civil law.

The problems arise when we transfer all of these laws and regulations to the internet, because while their application may be clear in the offline world, it becomes less clear in an online setting. Who is responsible in the kind of situation you described? If someone takes inappropriate photos of you and posts them on the internet along with your personal information, is the responsible party the person who directly perpetrated the act of taking your picture and posting the information online, or is it the service provider that hosts the content? Who is criminally responsible, and who should be financially responsible? The answers here are somewhat ambiguous. Some countries have made some degree of progress in determining rules to establish responsibility in different cases in the online environment, but in general, this is an issue that still needs to be addressed in Latin America. Generally speaking, we have no specific rules for clearly determining who is responsible when a violation of privacy takes place on the internet.

ES: But it isn’t just a question of who is responsible in terms of the commission of the crime, but also who can remedy it. Maybe the internet service provider or the website isn’t responsible for it, but they can remedy it, they can take down the content, and that’s a bit different.

AC: Exactly. Under constitutional provisions, some countries permit people whose private lives are being affected to use the courts to file for protective measures, such as getting content taken down or blocked. But, in general, constitutional provisions only allow for the adoption of protective or preventive measures; they do not make it possible to obtain financial compensation. That requires civil law provisions, and these are somewhat unclear when it comes to determining who is responsible. Is it only the individual who committed the crime, or also the internet service provider, especially if it is profiting from maintaining the content online? And when does the internet service provider’s responsibility begin? From the moment when a court order is issued to take down the content, or before then? Determining when the internet service provider begins to be financially responsible for the violation of people’s privacy is a recurring issue in Latin America, especially in Argentina and Brazil. Then there are the criminal law provisions which are even more difficult to apply to corporations or companies, because they are conceived for imposing penalties on individuals who commit the crimes, such as, in our case, the person who infringed on your privacy by taking your photo and posting it on the internet. In addition, criminal law provisions are not uniform, they vary significantly from one country to another.

In summary, some constitutional provisions could be applied to everyone, and provide for the immediate adoption of protective and preventive measures. But if the goal is to obtain financial compensation, it depends on the jurisprudence of each country. And if the goal is to obtain a criminal penalty, this would only apply to the individual who effectively committed the crime in question.

ES: And in this case many countries have not determined responsibility in this regard.

AC: We have the case of “revenge porn”, in which someone takes intimate photos of his girlfriend and then posts them on the internet after they break up. Under certain hypotheses, this could be viewed as a crime of infringement of privacy. But under other hypotheses it could be difficult to interpret as a crime. One of the principles of criminal law is that citizens must know exactly what is or is not a crime, so that they can adjust their behaviour accordingly, in order to prevent arbitrary punishment by the state. This is why criminal conduct must be well defined in law. The problem is determining to what degree crimes against privacy established in criminal codes that have been in force for more than 50 years are applicable to the online environment. Applying a criminal law provision and sending someone to jail in a case that is not contemplated by the law is a violation of human rights. To defend victims of online invasion of privacy, the most reasonable approach would be to try to update our legislation so that it can unequivocally deal with the problem.

ES: And of course it depends on the justice systems in different countries…

AC: Exactly. In Chile, the legal provisions on privacy were adopted in early 2000 and in sufficiently comprehensive terms for this type of phenomenon to constitute a crime in the online environment. But in many countries, laws to protect privacy were written in the 19th century.

ES: In Chile, for example, are there cases of women or men talking about this kind of dissemination of their images against their will?

AC: A few years back there was a highly publicised case in which army officers went into a female officer’s computer and accessed intimate photos of her which they then posted on the internet. These officers received prison sentences for their acts.

ES: Something that troubles us is the way that these cases of intimate photos being disseminated without consent are labelled revenge porn. We are troubled by this term, because the reaction of a lot of people is to go after pornography in the legislation. A lot of the concern about pornography is frequently a result of people’s concerns about child pornography, but often what gets legislated is pornography in general. There is nothing wrong with taking intimate photos or making intimate videos in and of itself; what concerns us is when they are disseminated without consent.

AC: Most of the countries in Latin America have specific legislation on child pornography. The problem with it is the lack of agreement on what constitutes child pornography. In some countries child pornography is defined as images in which actual boys and girls can be seen engaged in behaviour with a sexual connotation. In other countries it also includes graphic images that represent a minor, such as comics. This lack of agreement can cause problems because it hinders police work and international collaboration to prosecute those responsible for this type of conduct. In addition, if the definition is overly broad it can endanger freedom of expression, with regard to content that may be pornographic but does not infringe on the rights of children, or content that shows nudity but is not pornographic. This has been a problem in the United States, because the penalisation of indecent communications has led to the censorship of legitimate content, such as websites that illustrate breast cancer. So the problem with a lack of a uniform concept of child pornography is that, on the one hand, it creates obstacles for the criminal prosecution of those who effectively should be penalised, and on the other, it creates certain threats to freedom of expression and the circulation of information that is relevant for other purposes, such as public health.

Some countries penalise those who produce and those who disseminate child pornography, and others also penalise those who host it, as long as it is not simply the result of the automatic hosting of content, that is, simply the result of the way the internet works. Personally, I am in favour of prosecuting child pornography, but I am not in favour of sacrificing everyone’s basic rights in order to prosecute a marginal criminal phenomenon. I don’t think it is necessary for internet service providers to store everyone’s electronic communications for a year in order to prosecute a crime that is committed by marginal group of people within a society. I think this is dangerous, especially because once this information has been gathered to prosecute this small group of people, it remains available for other purposes, such as political persecution, extortion of private individuals, or the simple legislative temptation to broaden its use for purposes other than those for which the storage of information was originally intended.

ES: Right now there are countries in Latin America that are passing data retention laws like you have described, using this or other pretexts.

AC: In Peru they were discussing a bill on the matter last year, which I believe was approved. In 2003, Chile approved a law on this matter and subsequently attempted to expand the obligation to include not only the internet service providers but also cybercafés, forcing them to keep a record of their customers. Fortunately the Constitutional Court annulled the latter law. Argentina passed a law and the Supreme Court annulled it, because it violated the right of defence, since it did not establish mechanisms to distinguish legitimate communications from those that were not, such as those covered by professional secrecy between attorney and client. Colombia has just passed legislation on data protection. Ecuador passed regulations on data protection but they were not even approved by the legislature, as required by human rights standards, but rather through a simple decree from the telecommunications authority.

Throughout Latin America many data retention laws are being adopted with the excuse of prosecuting child pornography or other crimes, creating the threat of their use for such purposes as political persecution or discrimination on the basis of political, sexual or religious differences.

ES: It is also an enormous burden for any small-scale service provider, and without data protection laws.

AC: Precisely. What we are seeing in Europe is a major trend of constitutional courts revoking these data retention laws, as in the case of Germany, the Czech Republic and Romania. These laws, by definition, infringe on the presumption of innocence, because under the pretext that there is a criminal loose in society, everyone is placed under suspicion.

ES: Returning the subject of solutions or remedies, let’s suppose that there is a legal remedy for women facing a situation of violation of their privacy. You mentioned earlier the situation in Argentina and Brazil, where there are currently many cases. What is the tactic used and why is it different? Why is it emerging in these countries? In what way are their legal frameworks different, promising or troubling?

AC: Most of the legal actions that have been undertaken in Argentina and Brazil in this area are aimed at obtaining financial compensation from internet service providers for having hosted content that associates a person with indecent or offensive images. My perception is that most of these actions are aimed more at attempting to obtain some sort of financial compensation from the companies than at holding those who actually committed these offences responsible.

ES: And when it is a case of online violence against a woman where her image is being misused and where what she is seeking is not necessarily financial compensation but rather the elimination of the content?

AC: In a case like that there are a number of mechanisms. One mechanism, established in the Inter-American Convention on Human Rights, is the availability of an effective remedy, usually known as a writ of protection or writ of injunction, that makes it possible to obtain a court order for the content to be taken down, because it infringes basic rights like privacy. This makes sense when the service provider is located in the same country, but it is problematic when the content is hosted in other countries. It becomes very difficult to enforce the protection of people’s rights in cases of transborder communications.

ES: Have they been successful? And under what law in Argentina or Brazil?

AC: In Argentina, they have used constitutional provisions on the protection of data and privacy and laws on the protection of private information with civil code provisions on civil responsibility for injuries to third parties. In Chile they have used legislation on criminal responsibility for infringement of privacy. Various countries in the region have laws on the protection of personal information that establish protection not only for alphanumeric data but also images, sounds or any other piece of information that can be associated with a certain or ascertainable person. If a photographic image is posted with a name, we are dealing with personal information, and this kind of legislation provides a certain amount of protection. The problem is that, first of all, not all countries have this legislation, and second, the law is effective as long as the internet service provider hosting the content is located in the same country. It can be cumbersome when international assistance is needed from another country because the content is hosted abroad, especially if that other country does not have similar legislation or there are no judicial cooperation arrangements between the two countries.

ES: What is your recommendation for a woman who is in this situation?

AC: My recommendation would vary a great deal from one country to another. For Chile, my recommendation would be to determine the source of the information and where the information is hosted, in order to use a constitutional mechanism, as these generally tend to be faster and more effective than taking legal action in any other courts. A writ of protection can take two or three months to obtain in Chile. A criminal action can take years, a civil action decades. First I would try to get the content taken down and stop it from being further disseminated, and there are constitutional mechanisms for this available in almost all the countries of the region. Then I would assess whether to pursue a criminal action against the person who effectively committed the crime and perhaps a civil liability suit against that person or even the internet service provider that hosted the content knowing it was a crime.

ES: And what can you do if you want swift action by a service provider located in another country?

AC: Although it is quite absurd, there are many more international agreements to protect intellectual property than to protect people’s privacy. In many cases it is easier and more effective to use the argument of intellectual property rights over the content I want taken down than to argue that it is an infringement of my privacy. The problem arises when I need to prove intellectual ownership, because this depends a lot on the particular country. In some countries, for example, it is presumed that the owner of a photographic image is the person portrayed, while in others, it is assumed to be the photographer. Modern society provides greater protection for intellectual property than for our privacy, which is rather insane. This approach will work, for example, in the United States, where service providers like Facebook or Twitter that house content will react more swiftly to a request on the grounds of protection of intellectual property than one on the grounds of privacy.

ES: Thank you very much, Alberto.