Summary of the research on duties of care of Internet service providers

IViR (the Institute for Information Law) and the Leibniz Center for Law, two research institutes of the Law Faculty of the University of Amsterdam, have conducted a research on the duties of care of Internet service providers, commissioned by the WODC (the scientific and research center of the Dutch Ministry of Economy) and by the Dutch Ministry of Justice.

The research covers four countries (the Netherlands, Germany, United Kingdom and France) and five themes (Internet security, child pornography, copyright, identity fraud and trade of stolen goods). Internet service providers are understood as providers of Internet access, which can perform additional tasks such as hosting services or supplying added value services (e-mail).

The research question is focused on the forms of duties of care that apply to, or are developed for Internet service providers, the role of governments (regulation, co-regulation or self- regulation) and the underlying motivations for the chosen approach as well as the gained experience.

A varying picture emerges from the study, which indicates that the developments, including improving the balance within the value chain, are still under way. Internet security, more particularly with egard to the relationship between the Internet service provider and the end-user, is still in its infancy. This does not mean that nothing is happening in practice, but formally a framework has hardly een defined and there is little self-regulation at this stage. On the other hand, there is a virtually identical regimen for child pornography in the countries under study, where parties are prepared to provide far-reaching assistance in combating child pornography.

The notification system (INHOPE) is found in all countries either on the basis of self-regulation or in consequence of a legally defined duty of care. The position of filtering is a recurring issue in the prevention of the proliferation of child pornography. Much attention is devoted to copyright, and in two countries regulations on copyright have been tightened, so that it has become possible to restrict Internet access or to cut end-users off from the Internet. There is strong criticism against the new rules, and from the interviews it becomes clear that the actual reinforceability possibilities come in for much criticism as well. Identity fraud is mainly tackled in the context of the consequences of identity fraud. Making identity fraud punishable in itself (besides the possibilities already in place to act under public law) is generally not deemed necessary. The sale of stolen goods via platform providers (i.e. auction and selling sites etc.) is considered the platform provider’s prime responsibility.

The varying picture and the still existing dynamics make it hard to define proven best practices, for instance. Yet, the data gathered in the study provide some interesting information.