Professor Chris Marsden – written evidence (IRN0080)

Written evidence: The internet: to regulate or not to regulate?

Declaration of Interests: I am a professor of internet law at the University of Sussex. I am a media board member of the Society for Computers and Law, the professional society for lawyers interested in this space, and on the stakeholder advisory committee of Nominet. Neither of those are paid roles, and I am not submitting evidence on their behalf or that of the University of Sussex. I have also advised many Governments over the years on these issues.

Q:              Do we need a regulatory regime for the internet? Is it desirable? Is it possible? If it is, what form should it take, self-regulation, something more directive, such as co-regulation, or imposed direct regulation by statutory body?

My last time before a Committee of either the Lords or the other place was the joint scrutiny committee of the Communications Bill 2003. At that point we were asking when we would move away from self-regulation towards some form of co-regulation, and here we find ourselves again, 16 years after Lord Puttnam chaired that Committee.

The framework for internet law is quite old. It is based on a US law, the Communications Decency Act of 1996, so it is 22 years old, and we have dealt with the way in which it has been adapted since then. In the UK, we have the E-Commerce Regulations 2002, which are based on the Electronic Commerce Directive 2000 which itself was drafted in the last century. So the framework for internet law at least is from the last millennium, which may lead us to think that it is due for an update. We deal with several pieces of law that are much older than that. Some of the issues that arise out of the Panama Papers leak concern the breach of privacy and attorney-client privilege. Those date long before the internet.

Internet regulation broadly does not just involve the law. We are all regulated by the internet. Nudge regulation has become the issue that government talks about as a way of influencing consumers, but anyone who has been using the internet since the 1990s is aware that the internet is constantly nudging us in the direction in which various parties want us to behave[1]. It is the largest single experiment in nudge regulation that exists. Ever since the browser was invented and the first cookie was placed on a computer we have been nudged in different directions[2]. The DCMS Fake News inquiry has been talking about some pretty substantial nudging in the political sphere.

Self-regulation continues, and even in the absence of any new laws we would expect the development of the internet not to be static[3]. As I have described it to the European Commission in the past, impact assessments of internet law that ask, “What happens if we do nothing?”, do not involve stasis. The zero option is the internet continuing to develop[4]. Our relationship with the internet, as society and as individuals, continues to develop, so the do-nothing option is not one in which nothing happens. A great deal happens, but without legislative impulse.

Co-regulation is now even used by the United States Congress to describe certain aspects of internet regulation. It is quite a broadly used term that is used not just in Brussels and Paris but here and in North America to a great extent. It actually came from Australia[5]. We have often talked about de jure co-regulation, where we have a piece of legislation in place that tells the industry, “regulate or else”. A very good example is the Digital Economy Act 2010, which included two specific elements of co-regulation. One told Nominet that it will have to behave as a disinterested party. The other was to do with the Authority for Television on Demand, which was later subsumed within Ofcom but was very much a co-regulatory initiative.

De facto co-regulation exists where the regulators have used their powers of extreme persuasion. It is an area where the industry players are very aware that the regulator has power. If a telecoms company is talking to Ofcom, which regulates it formally in one area, and Ofcom wishes it to take action in another area, such as the voluntary code of conduct that was introduced on net neutrality and broadband speeds, the degree of voluntariness in that, from the point of view of the telcos, was pretty limited over the years in which it was being introduced. There can be lots of de facto co-regulation taking place as well as de jure co-regulation that is included in the Digital Economy Act.

Dr Nash and I wrote about content on mobile phones and co-regulation 15 years ago, so we have been talking about this for a very long period[6]. It is emerging even in areas where we may not see a legislative impulse. There is lots of interesting room to see that happening.

Ten years ago now, I constructed a Beaufort scale of co-regulation for the European Commission[7]. You will be familiar with the Beaufort scale of wind speed. The wind in this case was the degree to which the Government were breathing on the forms of self-regulation that were taking place. Zero was a calm, which would be an entirely technical standards body whose standards were formed entirely within the technical community, such as the Internet Engineering Task Force, up to a 12, which could be the forms of co-regulation that were formalised in the Digital Economy Act 2010.

Between zero and 12 there is a lot of room for us to see different elements of influence that have been exerted. Given some of the recent discussions in Select Committees, Congress and elsewhere, we are probably seeing that wind blowing a lot more strongly from Government and from Parliaments towards trying to achieve something much closer to co-regulation than to self-regulation.

As lawyers we will say something about terminology first—and then something about what we can do in practical terms. On the terminology, unfortunately the term that the media always use is ISP, which is meaningless in European law. We have ISSPs—information society service providers—as Lorna suggested. We also have telcos, an even uglier term, which are the electronic communications service providers (ECSPs)[8]. They are of a different category from the service providers themselves, and we are aware that the electronic communications service providers have always been required to have much more regulation than the standard other platforms. ECSPs are critical infrastructure and there are resilience requirements affects the way we expect them to be monitored. It is now 15 years since British Telecom first introduced the Cleanfeed system, which was an attempt to block some websites online. It was the beginning of our attempt to regulate content in this way through co-regulation, and there was much debate about that.

There was a large conference at Georgetown Law School at which 25 experts presented papers on how to regulate platforms, published in an electronic law journal[9]. The United States of America is boxed in by their Communications Decency Act 1996, even though they have attempted to amend it in a very small way. The Act talks about “online service providers” or “interactive service providers”, because it was almost pre-internet.

We have three alternatives:

1. not to regulate, but the world develops without regulation.

2. to regulate all the platforms that we might be concerned about.

3. to regulate only the dominant platforms.

Where you have a relatively stable duopoly or oligopoly of companies, they lend themselves very effectively to co-regulation because you have very few industry players to influence. Market entrants are much harder to regulate. The danger is that regulation can perpetuate a duopoly or oligopoly situation.

In February, Facebook and Google announced that between them they were going to appoint 50,000 more content moderators[10]. That sounds like a lot, but given the amount of content they deal with, it is not. It somewhat gives the lie to the idea that Artificial Intelligence and algorithms are the way we regulate content in future[11]. It is actually Mechanical Turks, people being employed—subcontracted, typically—to carry out these activities[12], and, by the way, in different parts of the world where their own cultural understanding of the content they are dealing with may not be ideal[13].

We need to address this question: if we want to regulate, do we want to introduce rules that apply only to the large platforms or to all platforms? We should be aware of the danger that if you apply them to all platforms, you introduce entry barriers. If you apply them only to large platforms, you have the problems of what we might think of as some very unpleasant niche players.

Q:              What part should users play in establishing and maintaining online community standards for content and behaviour?

Reporting abuse has become a difficult tool, because so many of the people whose speech we would like to restrict are simply mass-reporting people trying to stop them. Alt-right and other groups will simply report en masse somebody trying to reform their speech. The existing tools that are being used are not working very effectively.

Technology companies tell us a lot about solutions that should have been adopted but were not. Twitter had a fork in the road six years ago. It could have become a much more observant community-friendly platform then but chose not to on commercial grounds[14]. Venture capitalists used to fund these companies from their inception until they became unicorn companies that were floated on the stock market. Now they fund them from their inception until they arrive just below the merger thresholds and get bought by Facebook or Google[15]. It would interesting to know from those venture capitalists the extent to which they think they have some social responsibility to ensure that those innovations are not as user-unfriendly as they have been up to now[16].

Secondly, in order to persuade these companies to adopt technologies that prevent illegal content, you need to regulate the code on how these companies program their platforms. That is considered to be a step across the Rubicon but they do it to each other all the time. Facebook regulates the environment in which it exists and the way it controls third parties, not through unilateral contracts that it thinks it controls us with but because it controls the advertising platform. The companies are constantly regulating each other’s code, and it would be useful to think about the degree to which legislators can nudge them towards a more socially responsible use of that code.

Q:              How can we get the user to understand the role they are playing and to take the responsibility they should be taking and see the consequence of their actions?

There was a very interesting speech given last month by Commissioner Vestager, the European Commissioner for Competition, saying that what we have seen created in front of us are essentially addiction platforms[17]. All those little alerts that we get on our smartphone are little dopamine hits: we get a little reward from the fact that we think we are not alone in the world and we are being constantly alerted to new things happening. She pointed out that we allow 13 year-olds to use these platforms perfectly legally in the UK—it differs in different European countries—in a way that we have decided not to do to for alcohol, tobacco or other types of addiction. Those are her words rather than mine. The world is built on addictive substances, from tea and sugar to everything else, but we should be aware that we are doing this[18].

United States Child Online Privacy Protection Act 1998, established the age of 13. There are differing ages of consent for using platforms in different countries across Europe - Germany, for instance, insists on 16[19]. In DCMS Select Committee, Dr Aleksandr Kogan discussed how these platforms are used[20]. We should be aware of the way these platforms operate and ask some of those more profound questions about that.

A decade ago we were talking about MySpace, and today we talk about Facebook, Instagram and WhatsApp—both of them owned by Facebook. But it was not just MySpace that was supplanted by Facebook, it was also Bebo, a much more child-friendly, community-aware social network that was trying to keep to European standards. It was a US start-up by an English couple, but it tried to keep to more European standards of co-regulation and it was swept away in the Facebook tide[21]. So we have had options before.

There are alternative ways, alternative communities, that are much more privacy and community-friendly. These companies have lost. I may take a perspective which competition economists would not agree with, but my view is that these companies have won in their space. It is no longer only 10% of the population using a social network, the vast majority do, and they are all using the same one. That is not accidental; it is a feature of the technologies, not a bug. You achieve a dominant position, and once a company has that dominant position we may think about how we want to treat that company.

Q:               Design of the services: Is there a new way of thinking about this, not 20th-century thinking for 21st-century situations?

I wrote a book with Ian Brown from Oxford University, who is now at the Department of Digital, called Regulating Code[22]. If you want to achieve meaningful results, you have to deal with the way the companies regulate us and persuade them to regulate us differently, which means persuading them to change the way they engineer their software.

One of the reasons why the United States looks to us in Europe with expectancy to see if we can solve these problems is that we have specific consumer laws that deal with the online environment. I have described the need for what I described as a “prosumer law”[23]. It is an ugly term, but we are all prosumers if we ever update Facebook, Twitter or anything else, or run a blog. We are producers as well as consumers, as well as being citizens, obviously.

The European Commission is talking a lot about moving towards a much more robust framework for the online consumer. It has actually used the overarching phrase “a fair deal for consumers” as what they want to move towards[24]. In the United States, that does not play very well, as it sounds like the second President Roosevelt. Nevertheless, asking, “Okay, what do we need for prosumers?”—admittedly, as you say, 20 years after we recognised the problems—would be a much more holistic way of considering how to solve some of these problems.

Q:              What processes do online platforms use to moderate the content that they host, and are those processes fair, effective and transparent? Secondly, what processes, if any, should be implemented for individuals who wish to reverse decisions and moderate content? Who should be responsible for overseeing those processes?

The first problem is that the dominant platforms are United States-based platforms, and their moderation processes are designed with a view to the First Amendment to the United States Constitution. This creates problems, because we do not share their views on hate speech and other elements. That is a major problem. We have an international law that helps us in this space, which is the Council of Europe Cybercrime Convention 2001, but the Protocol No.1 of 2003 on hate speech to the Cybercrime Convention was never signed by the United States. It ratified the Cybercrime Convention 2001 in its original form from 2001, but not the hate-speech element.

The processes are designed in California, typically, or in Seattle, depending on the company. The issue in Europe that makes this slightly more awkward is that in the United States they have been quite careful to make sure that there are requirements to put back. This relates to your second question about what happens if your content is taken down and how you appeal. There are appeal procedures that you can go through that were very carefully designed in something grandly entitled the Digital Millennium Copyright Act 1998, which was in fact the United States 1998 copyright reform, which requires put-back.

Unfortunately, even though the E-Commerce Directive is of a slightly later date, it does not have those put-back provisions. Therefore we have often described this in the past as a “shoot first, don’t ask questions” provision[25]. When content is taken down in Europe, there are no requirements to appeal and put it back up again. You are simply told by whichever service provider it is that you have breached the terms of service— at any one time we have all breached the terms of service, because they are very long unilateral contracts that inevitably we are almost always in breach of—so you do not get a chance to put it back up again.

The closest that we have been to some process that we might recognise as approximating to a legal process is the process that has been instituted by Google under the right to be forgotten law, which is the result of a court case interpreting European law. It is actually more the right to be obscure, because Google does not remove the content from the internet; it just removes it from Google searches, although that in effect removes it for most purposes from people’s view.

Under that procedure, Google has dealt with about 2 million cases[26]. They can be appealed to data protection authorities and then to courts, but they go through that procedure. That is the closest thing we have had to transparency on a large scale, although we should also add all the cases that have dealt with domain names and the way those are removed from one party and given to another. There are not a great number of examples of that actually in process. I am suggesting a sort of employment creation scheme for lawyers. This is an under-lawyered area of society, so I make no apologies for that necessarily.

Q:              Do you think that the use of automated content filtering systems that use algorithmic processes to identify harmful content could provide a means for effective self-regulation by platforms?

It is an open question, so I do not want to pretend that there is a definitive answer at this stage. The answer will be different next year and the year after, and the Lords Artificial Intelligence Committee has reported on some of these issues[27]. You will get an enormous number of false positives in taking material down. That is almost inevitable. It is very difficult for AI to tell the difference between a picture of fried chicken and a Labrapoodle dog, simply because of the nature of the attempts by algorithms to match these things[28]. So we will have a huge number of false positives if we rely very heavily on algorithms to filter. It will need human intervention to analyse these false positives. So as a first step, you can use AI, but Google and Facebook are employing 50,000 more people not as a job creation scheme and because of the benevolence of the companies but because they recognise that there will have to be a mixture in order to achieve any kind of aim.

One of the problems is that they are responding to a perceived need to remove more content, rather than addressing what you said in your previous question about fair process and due process in these things. I suspect they will focus on the former to the exclusion of the latter simply because of the Mechanical Turk idea: that they are subcontracting to people on very low wages. It is certainly not UK minimum wage; it is far below that. That is obviously a great deal cheaper than employing a lawyer to work out whether there should be an appeal to actually put content back online.

I very much agree there should be audited self-regulation, which is a form of co-regulation, being a very important element. I fear that the incentive structure that we set up will be an incentive structure for platforms to demonstrate how much content they have removed, when actually a very important additional question is, “Show us the examples of successful appeals to put content back online”, in order to demonstrate that they are not simply, as I said earlier, shooting first and not asking questions, which would be their tendency.

Q:              Do we leave it to the platforms to deal with the online regime, or do we need determined regulatory intervention, or even law, to make this happen?

There were two recent judgments of the European Court of Human Rights. The first was an Estonian Grand Chamber case, Delfi AS v Estonia (2015), in which, essentially, a news website was made liable for the comments that were underneath the news article. It was fined for the comments, which led news websites across Europe to think that perhaps they would have to do something: either pre-moderate, which the BBC has always done but which commercial publishers have always said would require a great deal of investment, or alternatively remove comments altogether. That case has since been followed by MTE v. Hungary (2016), which restored some kind of balance. It came to a different conclusion on the facts. So we are still stuck with the principles from Delfi, although differently applied in MTE. Without overruling Delfi (which as a lower chamber, they could not), they stepped back[29].

We face a profound issue, which is that if we do require prior approval of comments, whether it be on Twitter, a news website or wherever else, we are requiring a great deal more investment, and websites may well choose to remove comment altogether. Let us assume that it is a bad thing to remove them altogether.

Q:              What information should online platforms provide to users about the use of their personal data, and how should that be presented to them? With the GDPR coming into force on 25 May, does this provide sufficient protection for individuals in the use of their data, et cetera?

I work with a much greater specialist in this area, Dr Nicolo Zingales, who has published a book called Regulating Platforms­ as a result of United Nations work[30]. Our personal data is currently regulated from Dublin and Portarlington in Ireland; it was formerly Portarlington alone, but then it moved to Dublin and Portarlington. If you are not familiar with Portarlington, it is a fairly small town in Ireland, but it is where the Irish Data Protection Commissioner was based. It has never fined Facebook or Google a euro. Fines are not the only measure of the effectiveness of statutory regulation, but you might expect something to appear as a sign of effectiveness. As things stand, we are regulated via Ireland. The DCMS inquiry on fake news is dealing with Cambridge Analytica, which is being examined by the Information Commissioner here, but not Facebook, which is still to be the responsibility of the Irish Data Protection Commissioner. That was confirmed by the group of data protection regulators, the Article 29 Working Party.

I am somewhat cynical about trying to introduce greater transparency. The greater the transparency, the greater the amount of information you give to users, who do not read it in the first place. We can try to afford greater transparency, but the degree to which that helps us is limited. There is current controversy about the fact that Facebook has essentially relocated the jurisdiction for non-European and non-North American users of Facebook to California, rather than to Dublin, as I think many people assumed it would do. You are told that if you do not agree to the terms of service you can no longer use Facebook. That is a fairly profound response to a failure to accept what are effectively unilateral terms. Transparency is necessary, but it is a small first step towards greater co-regulation.

We tend far too infrequently to consider the other area of great regulatory arbitrage and changes, which is the financial services industry. One element of the Sarbanes Oxley Act 2003­, ­which regulates public listed companies in the United States­, that should probably have been thought about more by internet lawyers was the placing of personal responsibility on directors of financial services companies to keep data safe in S.404. That changed enormously the culture around the risk management of data in financial services companies.

Giving directors personal responsibility to keep data safe or to do other things with it is a useful way of focusing attention. I know that many members of the Committee are directors of companies themselves and will be aware that that does focus the attention.

Q:              Should there be transparency in what algorithms can be used for whatever purposes and the extent to which they can be used other business models, where arguably their use could be deemed to be fraudulent?

I want to introduce use an ugly term: replicability—the ability to replicate the result that has been achieved by YouTube or whatever company is producing the algorithm. Algorithms change all the time, and one accepts that the algorithm at one particular time, for instance for Google search, is changed constantly, and there are good reasons for it wanting to keep that as a trade secret. But you would like to be able to look at the algorithm in use at the time and, as an audit function, run it back through the data and make sure you can produce the same result. We do this in medical trials all the time; it is a basic principle of scientific inquiry. It would help us to have more faith in what is otherwise a black box that we just have to trust.

Veale, Binns and Van Kleek have been working on going beyond transparency to replicability: to be able to run the result and produce the answer that matches the answer they have[31]. You do not just want to ask the company, “Is that fair?”, because it will say, “Yes, it is fair”. One wishes to do it independently. If you can produce replicability, you can have much more faith in the system. However, companies will not just volunteer that. It is expensive for them to do, and if it is expensive to show people results it is even more expensive to show them results and make sure that they do not change your liability. They will not volunteer that.

Q:              Is current competition law is enough, if it were properly applied, to regulate the activities of these platforms?

There is this great schism between competition lawyers and communications lawyers. It should be said that I am probably a heretic when it comes to competition law; I do not believe that competition law solves the problems in these markets, first, for reasons to do with data protection, which is clearly outwith the ambit of competition law, but, secondly, because many of the monopolies that we have seen emerge in the communications agencies have emerged so fast that the claim that they are durable, permanent monopolies would normally fail the test of competition law[32]. Competition law will not be a solution. It is actually a wonderful way of parking the issue and saying that we do not have to deal with it. We will come back in 10 years’ time and see where Facebook is, and who knows where we will be in relation to Facebook at that point. That is one issue that emerges.

The other issue is Brexit. I have not mentioned the B word so far, but a lot of people in the industry were surprised to learn that we will be leaving the Digital Single Market post Brexit. That is quite a dramatic step for the UK communications industry to take. If we do, we become a rule taker from Brussels across this set of issues. One reason why people in Georgetown and other places look at us as say, “How do you solve the problem?”, is because we were always considered to be problem solvers in Brussels in Digital Single Market issues. Leaving aside the cliché of the unsinkable aircraft carrier and the fact that US companies have huge investments in the UK, the assumption was that we would temper somewhat the views in Brussels that were taken by the other major party—the German-French alliance—on some of these issues. That ability to influence Brussels substantially disappears if and when we Brexit. As a third country, it will be very interesting to see the extent to which we can influence the regulation of platforms.

Brexit opens up new opportunities. I think the Secretary of State has suggested that, for the first time in a very long time, we can rewrite the Electronic Commerce Directive, which terrified almost everyone I have spoken to about it. That really is untying a Gordian knot. It will be very interesting to see what happens. We will be in a very different environment, and while I assume that the Committee will only be able to be very prospective in its discussion about what will happen post Brexit, it means that some of our stable understandings about the intervention of competition law and other things will change very rapidly.

There is another point which is that we have an Open Internet Regulation (EC/2015/2120). That introduced, first, pan-European mobile roaming, which some of us enjoy. The second element is net neutrality rules, which are in a state of some flux at the moment[33]. I sit on the advisory panel for a report on the implementation of these rules in Brussels.

A problem that will emerge if and when we leave the European Union is that we will no longer be required to follow those rules on, for example, zero rating[34]. One aspect of that that the Committee might be interested in is that when you look at mobile phone contracts in the UK at the moment, many have zero-rating on specific applications—Spotify, for example, and even Netflix, which are very large consumers of data. Most of those do not include the BBC, as a non-commercial player. There is no incentive to allow iPlayer data to be consumed freely in that way.

It will be interesting to see whether there is a divergence in the way the net neutrality rules are implemented. Ofcom wrote the rules that we have in Europe. It was the chair of the working party of BEREC. It would be interesting to see, having written the rules, if we then go outside the rules, the extent to which we conform to the rules.

Q:              It is an international set of agreements that we ultimately need. Is there a natural place where that should come from? What role could the UK take in trying to establish something at a global level?

One reason why we constructed the Beaufort scale, with these 12 degrees of co-regulation, is in order to be able to move sectoral regulation up and down the scale according to conditions in society and in the market. That may be a more flexible way. One of the advantages of co-regulation is that the Government can always blame the market for not producing the results they want. They say, “We were not regulating, so it is not our failure”. It is the market’s failure or the user’s failure, even.

I declare an interest in that I have consulted for the Organisation for Economic Co-operation and Development (OECD) over the last two years on regulation in this area[35]. Mexico at the time was the largest non-European member of the OECD, aside from the obvious United States. In terms of size of economy, we will become the largest non-aligned member of the OECD post Brexit. The OECD does some fascinating and important work in this area—not direct regulatory work but work that helps to advise on regulation—and I suggest that some of its work has been very influential in assessing what we should do about intermediary liability, for instance. It is a really interesting venue to consider the statistical evidence.

11 May 2018