FOURTH SECTION
CASE OF STANDARD VERLAGSGESELLSCHAFT mbH v. AUSTRIA (No. 3)
(Application no. 39378/15)
 
JUDGMENT
 
Art 10 • Freedom of expression • Unjustified court orders against applicant media company to disclose data of anonymous authors of offensive comments posted on its Internet news portal in context of political debate • Authors of online comments not considered journalistic sources • Interference with applicant company’s freedom of press due to lifting of anonymity and effects thereof, notably chilling effect on forum users, irrespective of outcome of any subsequent proceedings as to user-generated content • No absolute right to anonymity which, albeit an important value, had to be balanced against other rights and interests • Impugned interference weighing less heavily in proportionality assessment than a media company’s liability for user-generated content • Prima facie examination sufficient for balancing exercise in context • Domestic courts’ failure to conduct any balancing between opposing interests at stake
 
STRASBOURG
7 December 2021
FINAL
 
07/03/2022
 
This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Standard Verlagsgesellschaft mbH v. Austria (no. 3),
The European Court of Human Rights (Fourth Section), sitting as a Chamber composed of:
 Yonko Grozev, President,
 Tim Eicke,
 Faris Vehabović,
 Iulia Antoanella Motoc,
 Armen Harutyunyan,
 Gabriele Kucsko-Stadlmayer,
 Pere Pastor Vilanova, judges,
and Andrea Tamietti, Section Registrar,
Having regard to:
the application (no. 39378/15) against the Republic of Austria lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by an Austrian limited liability company, Standard Verlagsgesellschaft mbH (“the applicant company”) on 7 August 2015;
the decision to give notice to the Austrian Government (“the Government”) of the complaint concerning Article 10 of the Convention;
the observations submitted by the respondent Government and the observations in reply submitted by the applicant company;
the comments submitted by Media Legal Defence Initiative who were granted leave to intervene by the President of the Section;
Having deliberated in private on 14 September and 9 November 2021,
Delivers the following judgment, which was adopted on that 
last-mentioned date:
Introduction
1. Alleging a violation of Article 10 of the Convention, the applicant company complained that court orders imposing an obligation to disclose data revealing the identity of users who had posted comments on the applicant company’s Internet news portal had infringed its freedom of expression – specifically, its right to enjoy freedom of the press. THE FACTS
2. The applicant company, a limited liability company registered in Vienna, was represented by Ms M. Windhager, a lawyer practising in Vienna. 3. The Government were represented by their Agent, Ambassador H. Tichy, Head of the International Law Department at the Federal Ministry for European and International Affairs. 4. The facts of the case, as submitted by the parties, may be summarised as follows. Background TO the case
5. The applicant is a limited liability company based in Vienna. It owns and publishes a daily newspaper published in print format (Der Standard), in digital format (as an “e-paper”) and in an online version (derStandard.at). The applicant company describes its work as being of a multi-media nature, and its editorial office (Redaktion) does not distinguish between the print and the digital medium. The online news portal run by the applicant company under derStandard.at (hereinafter “the portal”) carries articles assigned to it by the editorial office and discussion forums relating to those articles. At the end of each article, the applicant company invites registered users to post comments with a banner stating “Your opinion counts” and a field entitled “Your comment ...” that allows them to insert text. 6. In the course of the registration process (during which new users have to accept the applicant company’s general terms and conditions, see paragraph 7 below), each user is required to submit his or her name, surname and email address to the applicant company; moreover, he or she may, optionally, submit a postal address. Users are informed that their data will not be seen publicly. 7. The applicant company’s general terms and conditions state that its forum rules (the latest version of which can be found on the portal) must be complied with. Under the heading “Community guidelines” the applicant company reminds users that their comments are an essential and valuable part of the portal. It emphasises that the forum rules are to be respected and are taken into consideration during moderation, as the quality of discussions is of great concern to it. The portal is described as providing a platform for lively, interesting and inviting dialogue. Under a subheading entitled “quality features (Qualitätsmerkmale) of posts” the applicant company provides guidelines on how to write a comment. Under a subheading “forum rules” it reminds users that they are responsible for their own comments and that they may be held liable for them; moreover, it is indicated that the applicant company will only disclose user data if required to do so by law. Inter alia, personal attacks in the form of insults, threats or abuse, as well as defamatory statements or statements damaging to businesses, are not accepted. The applicant company reserves the right to delete posts that do not comply with the community guidelines. Offensive, discriminatory or hateful usernames are not tolerated. 8. Under a subheading “procedure for moderation” the applicant company informs its users that it has installed an automated keyword-screening system. All user comments are screened for problematic content by this system before they are posted on the portal. In the event that the system flags a problematic comment, it becomes subject to a manual review before possible publication. 9. The automated screening system also takes other factors into account – in particular, the number of previous “hits” in respect of comments posted by the same user, or whether the comment was made by someone who has recently registered with the portal. Furthermore, all comments on material relating to particularly sensitive issues may have to undergo a manual review before publication. Discussion forums may be closed, if deemed necessary. 10. After publication, user comments are subject to an editorial review by the applicant company on a regular basis. 11. Moreover, the applicant company has implemented a “notice and take down” system by which other users can trigger a manual editorial review of published user comments by means of a “report” button. 12. According to the applicant company, its moderators review up to 6,000 user comments per day and requests for deletion are granted liberally. User data are disclosed, upon request and in accordance with the law, to third parties if it is sufficiently clear that the comment in question may have violated a person’s rights.
comments published on the portalComments concerning K.S. and the FPK

13. On 19 March 2012 an article under the heading “[S.] Brothers take action against forum users” (“Gebrüder [S.] gehen gegen Foren-User vor”) was published on the portal. The article related, inter alia, to K.S., who was at that time a leader of the Freedom Party in Carinthia (Die Freiheitlichen in Kärnten – FPK), a right-wing regional political party that at the time of the events was represented in the Carinthia Regional Parliament and in the Regional Government in coalition with two other parties. The article quoted a remark made by K.S. describing people who attacked him in forums as “down-at-heel guys who sound off” (“Schmuddeltypen, die sich hier ausrotzen”). The article attracted more than 1,600 user comments. 14. On 22 March 2012 a reader with the username “Tango Korrupti2013” posted the following comment relating to that article:
“Corrupt politician-assholes forget, [but] we don’t ELECTION DAY IS PAYDAY!!!!!”
(“Korrupte Polit-Arschlöcher vergessen, wir nicht WAHLTAG IST ZAHLTAG!!!!!”)
15. On 23 March 2012 a reader with the username “rrrn” posted the following comment:
“[It] was to be expected that FPOe/K, ... -opponents would get carried away. [It] would not have happened if those parties had been banned for their ongoing Nazi revival.”
(“War zu erwarten, dass FPOe/K, ... -Gegner ueber die Straenge schlagen. Waere nicht passiert, wenn diese Parteien verboten worden waeren wegen ihrer dauernden Nazi-wiederbelebung.”)
16. On 16 April 2012, K.S. and the FPK requested the applicant company to disclose the name, address and email address (hereinafter “user data” – see paragraph 6 above) of the comments’ authors in order to be able to institute civil and criminal proceedings against them. 17. On 18 April 2012, the applicant company replied that they had deleted the comments but refused to disclose the relevant user data. The time of the deletion was no issue in the following proceedings. Comments concerning H.K. 18. On 5 May 2013 an interview with H.K. under the heading “What you call uproar, I call effective advertising” (“Was Sie Aufruhr nennen, nenne ich Werbewirksamkeit”) was published on the portal. H.K. stated, inter alia, that posters and slogans had to generate emotion, because without emotion there could be no success in politics. He was at that time a member of the Austrian national assembly (Nationalrat) and the general secretary of the right-wing Austrian Freedom Party (Freiheitliche Partei Österreichs – FPÖ). 19. Following the publication of this interview, on the same day a reader with the username “try_error” posted the following comment:
“[I]f we did not perpetually misunderstand the meaning of freedom of expression and if undermining our constitution and destabilising our form of government were consequently to be made punishable – or at least, if anti-mafia law were for once to be applied to the extreme-right scene in Austria – then [H.K.] would be one of the greatest criminals in the Second Republic ...”
(“würden wir nicht ewig meinungsfreiheit falsch verstehen und wäre das sägen an der verfassung und das destabilisieren unserer staatsform konsequent unter strafe gestellt, oder wäre wenigstens der mafiaparagraf einmal angewendet worden auf die rechtsextreme szene in österreich, dann wäre [H.K.] einer der größten verbrecher der 2ten republik ...”)
20. On 20 June 2013, H.K. asked the applicant company to delete the comment and to disclose the user data (see paragraphs 6 and 16 above) of the author in order to be able to institute civil and criminal proceedings against him. 21. On 26 June 2013, the applicant company replied that it had deleted the comment but refused to disclose the relevant user data. The time of the deletion was no issue in the following proceedings. Proceedings against the applicant companyProceedings initiated by K.S. and the FPK

22. On 11 June 2012 K.S. and the FPK brought a civil action against the applicant company pursuant to section 18(4) of the E‑Commerce Act (see paragraph 37 below). K.S. claimed user data relating to the reader with the username “Tango Korrupti2013” (see paragraph 14 above). The FPK claimed user data relating to the reader with the username “rrrn” (see paragraph 15 above). K.S. and the FPK asserted that the respective posts constituted defamation (Ehrenbeleidigungen; üble Nachrede), within the meaning of Article 1330 of the Civil Code (see paragraph 34 below) and within the meaning of Article 111 of the Criminal Code, as well as insulting behaviour (Beleidigung) within the meaning of Article 115 of the Criminal Code, and that they needed the user data sought in order for them to be able to lodge claims against those users. 23. The applicant company maintained that it was not obliged to disclose the user data because the comments at issue were not defamatory, but rather constituted permissible value judgments. It referred to K.S.’s position as a politician, the style that he adopted when making public statements, and the kind of expressions used by other members of the FPK. Moreover, it argued that it was – under section 31(1) of the Media Act (see paragraph 35 below), which regulated the protection of editorial confidentiality (Redaktionsgeheimnis) – entitled to refuse to disclose its sources. 24. On 10 September 2013 the Vienna Regional Civil Court (Landesgericht für Zivilrechtssachen Wien) dismissed the action. It held that it could not be established whether the user comments at issue had undergone a manual review before publication. It considered that the applicant company had acted as a host and that section 18(4) of the E‑Commerce Act (see paragraph 37 below) was thus applicable. It argued that the question of whether a specific comment was covered by the right to freedom of expression was a matter that had to be examined on a case-by-case basis, given that the limits of acceptable criticism were wider for politicians than for private individuals. It went on to examine the content and the context of the posts and stated that they had been made several days after publication of the respective article, being just two out of more than 1,600 user comments (see paragraph 13 above). The court found that the comment posted by the reader with the username “Tango Korrupti2013” (see paragraph 14 above) did not directly refer to K.S. but was a general statement concerning a public discussion on corruption. It stated that the second comment posted by the reader with the username “rrrn” (see paragraph 15 above) directly referred to the FPK but was based on a sufficient factual basis given that members of the FPK had previously used terms that originated from the diction of National Socialists, such as “the healthy will of the people” (“gesundes Volksempfinden”) and “block warden” (“Blockwart”). The court concluded that the requirements for disclosure under section 18(4) of the E‑Commerce Act had not been met, because the claimants had not demonstrated that illegal acts had taken place. It was thus unnecessary to examine the applicant company’s submissions concerning the protection of editorial confidentiality. The claimants appealed. 25. On 26 May 2014 the Vienna Court of Appeal (Oberlandesgericht Wien) allowed the appeal and ordered the applicant company to disclose the requested user data within fourteen days and to pay the costs incurred by the claimants during the proceedings. It established that both comments at issue could in general be categorised as “defamatory” within the meaning of Article 1330 of the Civil Code and had been posted within the context of the article with the title “[S.] Brothers take action against forum users”, published on the applicant company’s portal (see paragraph 13 above). The claimants were thus entitled under section 18(4) of the E‑Commerce Act to demand the disclosure of the user data. Referring to the Supreme Court’s established case-law (see paragraph 39 below), the Court of Appeal noted that any distinction between a statement of facts, a value judgment and a potentially “excessive” value judgment (Tatsachenbehauptung, Werturteil und Wertungsexzess) had to be determined in proceedings against the actual author of the comments in question and not in proceedings against the relevant service provider. In respect of the instant case, it held that the applicant company could not rely on the protection of the right to editorial confidentiality because it had not been possible to establish whether the user comments at issue had been subjected to a manual review before publication. Thus, there was no connection between the applicant company’s journalistic activities and the users’ comments. Section 31(1) of the Media Act (see paragraph 35 below) required at least some kind of action/review/taking account (Tätigkeit/Kontrolle/Kenntnisnahme) by an employee of a media company. The applicant company appealed. 26. On 19 February 2015 the Supreme Court (Oberster Gerichtshof) upheld the Court of Appeal’s judgment (see paragraph 25 above). It held that information received by persons covered by section 31(1) of the Media Act was protected by editorial confidentiality under that provision only if it had been disclosed to those persons in the course of their carrying out their journalistic activities. It considered that merely screening for keywords with the aid of software was not sufficient to establish a connection with journalistic activity; editorial ex post reviews would not lead to a different result, because they only related to comments that had already been published. As regards the obligation to disclose user data under section 18(4) of the E‑Commerce Act, the Supreme Court held that according to its established case-law (see paragraph 39 below) it was sufficient that a layperson (juristischer Laie) was capable of perceiving that a finding of liability under Article 1330 of the Civil Code (see paragraph 34 below) could not be ruled out. If that were the case, the person concerned would have an overriding interest in the disclosure of the user data. The Supreme Court reiterated the wording of the comments at issue (see paragraphs 14 and 15 above) and found that they could in general be categorised as “defamatory” within the meaning of Article 1330 of the Civil Code (see paragraph 34 below). It went on to conclude that an overriding legal interest had therefore been substantiated, without specifying the considerations on which it had based that conclusion. 27. According to the Supreme Court, in the absence of any connection with journalistic activity, there had been no unlawful interference with the applicant company’s right to enjoy freedom of the press under Article 10 of the Convention or section 31 of the Media Act. 28. The Supreme Court’s decision was notified to the applicant company’s lawyer on 4 May 2015. Proceedings initiated by H.K. 29. On 26 July 2013 H.K. brought a civil action against the applicant company, seeking to obtain from it user data relating to the reader with the username “try_error” (see paragraph 19 above), and essentially relying on the same arguments as those advanced by K.S. and the FPK (see paragraph 22 above). The applicant company maintained substantially the same arguments as it had made in the other set of proceedings (see paragraph 23 above). 30. On 25 November 2013 the Vienna Inner City District Court (Bezirksgericht Innere Stadt Wien) dismissed the action. It stated that section 31 of the Media Act was not applicable. Pursuant to section 18(4) of the E-Commerce Act, it examined both the wording and the context of the comment within a political discussion and held that the limits of acceptable criticism were wider as regards a politician as such than as regards a private individual. In this respect, the court emphasised H.K.’s own provocative behaviour as a politician that could be perceived as polarising and occasionally aggressive and inflammatory. It concluded that the requirements for disclosure under section 18(4) of the E‑Commerce Act had not been met, because the claimant had not demonstrated that an illegal act had taken place. The claimant appealed. 31. On 29 April 2014 the Vienna Regional Civil Court allowed the appeal and ordered the applicant company to disclose the relevant user data within fourteen days and to pay the costs incurred by the claimant during proceedings. It relied on essentially the same reasoning as the Vienna Court of Appeal in its judgment of 26 May 2014 relating to the action brought by K.S. and the FPK (see paragraph 25 above). The applicant company appealed. 32. On 15 December 2014 the Supreme Court upheld that judgment for essentially the same reasons as those set out in its judgment of 19 February 2015 (see paragraphs 26-27 above). 33. The Supreme Court’s decision was notified to the applicant company’s lawyer on 13 February 2015. RELEVANT legal framework and practice
Domestic LawCivil Code (Allgemeines Bürgerliches Gesetzbuch, published in the Collection of Judicial Acts, no. 946/1811)

34. Article 1330 of the Civil Code, as in force since 1 January 1916 (published in Imperial Law Gazette no. 69/1916), provides as follows:
“1. Anybody who, as a result of defamation, suffers real damage or loss of profit may claim compensation. 2. The same shall apply if anyone disseminates allegations that jeopardise a person’s reputation, income or livelihood, the falsity (Unwahrheit) of which was known or should have been known to him or her. [Such a person] also has a right to request a retraction and the publication thereof ...”
Media Act (Mediengesetz, published in Federal Law Gazette no. 314/1981)
35. Section 31(1) and (2) of the Media Act, as amended, in force since 1 January 2008 (published in Federal Law Gazette no. 112/2007), state as follows:
“(1)  Media owners, editors, copy editors and employees of a media company or media service have the right to refuse, as witnesses in criminal proceedings or other proceedings before a court or an administrative authority, to answer questions relating to the identity of the author, sender or source of articles and documentation, or to any information that they have obtained in connection with their profession. (2)  The right stipulated in paragraph (1) must not be bypassed – in particular by ordering the person enjoying this right to disclose: documents; printed matter; image, sound or data carriers; illustrations; or other representations of such contents, or by confiscating them.”
E-Commerce Act (E-Commerce Gesetz, published in Federal Law Gazette no. 152/2001)
36. Section 16(1) of the E-Commerce Act reads as follows:
“(1)  A service provider who stores information provided by a user is not liable for the information stored at the request of that user, on condition that:
1.  the provider does not have actual knowledge of any illegal activity or [illegal] information and, as regards claims for damages, is not aware of facts or circumstances from which any illegal activity or information is apparent; or
2.  the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to [such] information.”
37. Section 18(4) of the E-Commerce Act provides as follows:
“(4)  Service providers mentioned in section 16 must transmit the name and address of a user of their service, with whom they have concluded agreements concerning the storage of information, to third parties at the request [of those third parties] if they demonstrate (glaubhaft machen) an overriding legal interest in determining the identity of [that] user and [establishing the existence of] a particular illegal situation, and furthermore demonstrate that knowledge of such information constitutes a material prerequisite for legal prosecution.”
Enforcement Act (Exekutionsordnung, published in Federal Law Gazette no. 79/1896, as amended in Federal Law Gazette no. 86/2021)
38. Section 354 of the Enforcement Act reads as follows:
“(1)  A claim to an act (Anspruch auf eine Handlung) which cannot be performed by a third party and the performance of which depends exclusively on the will of the obligor shall be enforced by the execution court upon application by way of fines or by imprisonment for a maximum total period of up to six months. (2)  Execution shall begin by notice being served that a penalty will be imposed in the event of default; initially, only notice of a potential fine may be served. [Should] the time-limit ... for the performance of the act [in question] expire, the threatened coercive measure shall be enforced at the request of the enforcing creditor and, at the same time, notice of increasingly severe coercive measures shall be served, with the setting of a new time-limit in respect of the performance [of the act in question]. Enforcement of the latter shall only take place at the request of the enforcing creditor”. Domestic Practice
39. Regarding service providers’ duty under section 18(4) of the E‑Commerce Act (see paragraph 37 above) to disclose user data, the Supreme Court has established in its case-law that for a claimant to demonstrate an overriding legal interest it is sufficient that it is not possible to rule out the possibility of a finding of liability under Article 1330 of the Civil Code (see paragraph 34 above) on the basis of the contested allegations. Any distinction between a statement of facts and a potentially excessive value judgment has to be determined in proceedings against the actual author of the comments in question and not in proceedings against the relevant service provider (see Supreme Court judgments of 23 January 2014, 6 Ob 133/13 x; of 30 January 2017, 6 Ob 188/16 i; and, more recently, of 27 November 2019, 6 Ob 156/19 p). RELEVANT International INSTRUMENTS
40. Relevant material concerning freedom of communication on the Internet and its limits referenced in the instruments of the Council of Europe, the United Nations (UN) and the European Union is outlined in paragraphs 44-57 of the judgment in Delfi AS v. Estonia ([GC], no. 64569/09, ECHR 2015). The quoted material contains, inter alia, the Declaration on freedom of communication on the Internet adopted by the Committee of Ministers of the Council of Europe on 28 May 2003 (ibid., § 44) which identifies the principle of anonymity in the field of communication on the Internet and states as follows:
Principle 7: Anonymity
“In order to ensure protection against online surveillance and to enhance the free expression of information and ideas, member states should respect the will of users of the Internet not to disclose their identity. This does not prevent member states from taking measures and co-operating in order to trace those responsible for criminal acts, in accordance with national law, the Convention for the Protection of Human Rights and Fundamental Freedoms and other international agreements in the fields of justice and the police.”
41. The relevant material quoted in Delfi AS (cited above) further contains Recommendation CM/Rec(2011)7 of the Council of Europe’s Committee of Ministers to member States on a new notion of media which underlines the importance of the role of intermediaries (ibid., § 46), the report of the UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression dated 22 May 2015 (A/HRC/29/32) which states that no State should use or force intermediaries to undertake censorship on its behalf (ibid., § 48), and relevant parts of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce), OJ 2000 L 178, p. 1 on the liability of intermediaries (ibid., § 50). 42. In addition, the Directive on electronic commerce provides as follows:
“(9)  The free movement of information society services can in many cases be a specific reflection in Community law of a more general principle, namely freedom of expression as enshrined in Article 10(1) of the Convention for the Protection of Human Rights and Fundamental Freedoms, which has been ratified by all the Member States; for this reason, directives covering the supply of information society services must ensure that this activity may be engaged in freely in the light of that Article, subject only to the restrictions laid down in paragraph 2 of that Article and in Article 46(1) of the Treaty; this Directive is not intended to affect national fundamental rules and principles relating to freedom of expression.
... (14)  ... the implementation and application of this Directive should be made in full compliance with the principles relating to the protection of personal data, in particular as regards unsolicited commercial communication and the liability of intermediaries; this Directive cannot prevent the anonymous use of open networks such as the Internet.
... (41)  This Directive strikes a balance between the different interests at stake and establishes principles upon which industry agreements and standards can be based.
... (52)  The effective exercise of the freedoms of the internal market makes it necessary to guarantee victims effective access to means of settling disputes; damage which may arise in connection with information society services is characterised both by its rapidity and by its geographical extent; in view of this specific character and the need to ensure that national authorities do not endanger the mutual confidence which they should have in one another, this Directive requests Member States to ensure that appropriate court actions are available; Member States should examine the need to provide access to judicial procedures by appropriate electronic means.”
43. Recommendation CM/Rec(2014)6 of the Council of Europe’s Committee of Ministers to member States on a Guide to human rights for Internet users, adopted on 16 April 2014, stated the following:
“Freedom of expression and information
You have the right to seek, receive and impart information and ideas of your choice, without interference and regardless of frontiers. This means:
1.  you have the freedom to express yourself online and to access information and the opinions and expressions of others. This includes political speech, views on religion, opinions and expressions that are favourably received or regarded as inoffensive, but also those that may offend, shock or disturb others. ...
2.  restrictions may apply to expressions which incite discrimination, hatred or violence. These restrictions must be lawful, narrowly tailored and executed with court oversight.
...
6.  you may choose not to disclose your identity online, for instance by using a pseudonym. However, you should be aware that measures can be taken, by national authorities, which might lead to your identity being revealed.”
44. The European Parliament resolution of 21 May 2013 on the EU Charter: standard settings for media freedom across the EU (2011/2246(INI)), OJ 2016 C 55, p. 33, stresses the following:
“28.  ... that the fundamental right to freedom of expression and freedom of the media is not only reserved for traditional media, but also covers social media and other forms of new media; underlines the importance of ensuring freedom of expression and information on the internet, notably through guaranteeing net neutrality, and consequently calls on the EU and the Member States to ensure that these rights and freedoms are fully respected on the internet in relation to the unrestricted access to and provision and circulation of information;
...”
45. The Appendix to Recommendation CM/Rec(2018)2 of the Council of Europe’s Committee of Ministers to member States on the roles and responsibilities of Internet intermediaries (adopted on 7 March 2018) reads as follows, in so far as relevant:
“2.4. Use of personal data
2.4.1. Intermediaries should not disclose personal data to a third party unless required by law or requested to do so by a judicial authority or other independent administrative authority whose decisions are subject to judicial review that has determined that the disclosure is consistent with applicable laws and standards, necessary in a democratic society and proportionate to the legitimate aim pursued.
...”
46. The UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated the following in his report of 22 May 2015 to the Human Rights Council (A/HRC/29/32):
“60. States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. ... States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users. Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms). Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals ... and subject to judicial warrant and the protection of due process rights of individuals.”
47. The UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated the following in his report of 11 May 2016 to the Human Rights Council (A/HRC/32/38):
“85. States bear a primary responsibility to protect and respect the right to exercise freedom of opinion and expression. In the information and communication technology context, this means that States must not require or otherwise pressure the private sector to take steps that unnecessarily or disproportionately interfere with freedom of expression, whether through laws, policies, or extra-legal means. Any demands, requests and other measures to take down digital content or access customer information must be based on validly enacted law, subject to external and independent oversight, and demonstrate a necessary and proportionate means of achieving one or more aims under article 19 (3) of the International Covenant on Civil and Political Rights. ...”
48. The UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated the following in his report of 30 March 2017 to the Human Rights Council (A/HRC/35/22):
“78. It is also critical for the Council and States to draw the connections between privacy interference and freedom of expression. ... But certain interferences – such as overbroad requests for user data and third-party retention of such data – can have both near- and long-term deterrent effects on expression, and should be avoided as a matter of law and policy. At a minimum, States should ensure that surveillance is authorized by an independent, impartial and competent judicial authority certifying that the request is necessary and proportionate to protect a legitimate aim.”
THE LAW
ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION
49. The applicant company complained that being ordered to disclose the data of users who had posted comments on its Internet news portal had infringed its freedom of expression, as provided by Article 10 of the Convention, which reads as follows:
“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”
Admissibility
50. The Government argued that the application should be rejected for being manifestly ill-founded, pursuant to Article 35 § 3 (a) and § 4 of the Convention. 51. The applicant company submitted that the application was admissible. 52. The Court considers, in the light of the parties’ submissions, that the complaint raises serious issues of fact and law under the Convention, the determination of which requires an examination on the merits. The Court therefore concludes that this complaint is not manifestly ill-founded within the meaning of Article 35 § 3 of the Convention and that the Government’s objection must be dismissed. It also notes that the application is not inadmissible on any other grounds listed in Article 35 of the Convention. It must therefore be declared admissible. MeritsThe parties’ submissions

(a)   The applicant company
53. The applicant company argued that the user data in question constituted journalistic sources. They were thus protected by editorial confidentiality in the same way as were data of authors of readers’ letters published in a newspaper. Furthermore it complained that the domestic courts had characterised the user comments as potentially defamatory under Article 1330 of the Civil Code (see paragraph 34 above), arguing that, on the contrary, they in fact constituted permissible value judgments. 54. Authors of posts in online discussion forums, just as authors of readers’ letters, had to be able to rely on their protection by media owners, as ensured by editorial confidentiality. Otherwise, they could be deterred from assisting the press in informing the public about matters of general interest. At the very least, users would adjust their behaviour by limiting their exercise of the right to open discussion in a way that would be at odds with the kind of free culture of discussion protected by Article 10. The applicant company’s media operations had earned an excellent reputation for offering critical and reflective media coverage. That reputation would without a doubt be negatively affected by an absence of statements on its platform caused by a “chilling effect”. 55. Owing to the difficult legal situation, operators of online discussion forums might limit or even shut down those forums for good. Thus, not only the author of the comment, but also the applicant company and the public had a legitimate interest in protecting the identity of people who posted such comments. 56. The domestic courts had forced the applicant company into the “corset” of a host with regard to user comments, without taking into consideration its obligation as a media company to exercise due diligence when disclosing sensitive data. The Supreme Court’s view notwithstanding, the forum operated by the applicant company had been developed through significant investment and deployment of personnel, and had to be considered as one where some kind of action or review would be undertaken by specially trained employees (see paragraph 25 above), and where the right to editorial confidentiality was therefore legitimate. 57. Lastly, the Supreme Court had not considered the particular circumstances of users’ comments, such as whether the person affected by the post in question was a public figure or whether a comment had been posted in the course of a political discussion. It had not carried out an appropriate balancing test as required by the Court’s case-law. (b)   The Government
58. The Government stated that in the absence of a sufficient connection between the publication of the comments and the applicant company’s journalistic activities, the applicant company could not in the present case invoke its right to editorial confidentiality. The fact that a host filtered comments through software on the basis of keywords and subsequently manually reviewed those comments did not mean that the host’s activities were journalistic in nature, and nor did the fact that a review was conducted after the publication of such comments. The applicant company’s role as a host offering a discussion forum on its website differed from its role as a publisher of articles. As a publisher, the applicant company had to take full responsibility for its articles. As a host, on the other hand, it enjoyed the exemption from liability enshrined in section 16 of the E-Commerce Act (see paragraph 36 above). To counterbalance that privilege, the applicant company, as a host, had a duty to disclose certain data to persons who made credible an overriding legal interest. The aim of that duty was to enable persons whose rights had been violated (as a result of unlawful activity or information originating from a user unknown to them) to prosecute the offender. The applicant company could not at the same time invoke both the exemption of liability granted to hosts and the safeguards afforded to publishers with regard to their sources. 59. Moreover, the Supreme Court’s decision had not restricted the applicant company’s right to receive and impart information. The Supreme Court had not required the applicant company to delete the comments nor to pay compensation, and nor had it taken a final decision on the lawfulness of those comments. 60. Even assuming that there had been an interference with the applicant company’s rights under Article 10, that interference had been prescribed by law and had been proportionate. The legal framework applied by the Supreme Court had struck a fair balance between opposing points of view and interests in respect of the question of fundamental rights and had fallen within the wide margin of appreciation afforded by the Court in this field. As a positive obligation under Article 8 of the Convention, the State had to provide instruments enabling an individual to effectively combat defamation and personal violations by other private persons. 61. Experience had shown that users’ anonymity on the Internet was often abused to defame individuals or to disseminate hatred. Such behaviour did not contribute to a meaningful public debate. It was rather a hindrance to it. Users’ anonymity contributed considerably to an “online disinhibition effect” which could deter other users who valued respectful communication. It had to be ensured that the legitimate interest in anonymity did not eventually reduce the pluralism of opinions and thus restrict freedom of expression. Third-party intervener
62. The Media Legal Defence Initiative (a non-governmental organisation, based in the United Kingdom, that provides legal support to journalists, bloggers and independent media) submitted that anonymity was of crucial importance to the right to freedom of expression online as people’s willingness to engage in debate on controversial subjects in the public sphere had always been linked to the possibility of doing so anonymously. The disclosure of journalistic sources and surveillance could have negative consequences for the right to freedom of expression, given a breach of the right to confidentiality of an individual in respect of his or her communications. The same applied to cases concerning the disclosure of anonymous user data.

Outcome for Article 10: violation