Rapidshare required to monitor for user generated content that infringed copyright

03 December 2008

Dr Fabian Niemann, Henning Krieg

In Germany it is an established principle that a host can be made liable to monitor user generated content that infringes copyright.  A host that has previously been made aware of infringing material on its platform can be injuncted, under the ‘disquietor’ principle, to stop it making similar content available; and placing it under a positive ongoing duty to monitor for infringements of copyright. However, until recently it was not clear what the duty to monitor actually covered. However, the Rapidshare case in the Hamburg regional appeal court has provided guidance as to how a company could comply with its duty to monitor.

It is unclear in Germany under what precise circumstances online intermediaries, such as hosting providers or internet platform operators, may be liable for copyright infringing content uploaded to their servers by users. A recent judgment against the operators of the Rapidshare filesharing platform by the Hamburg Regional Appeal Court has now introduced new considerations into the discussion. The judgment has, however, not made online intermediaries’ situations easier.

The judicial background

The German Federal Court of Justice, the Bundesgerichtshof, has repeatedly held that an online intermediary that has previously been made aware of infringing material on its platform that infringes copyright and other third party rights can be obliged to monitor user generated content for future similar violations of third party rights. The court decided this even though the E-Commerce Directive (as well as the German Telemedia Act, which implements the E-Commerce Directive into German law), excludes any general obligation on an online intermediary to proactively search for unlawful user generated content (see previous report in Bird & Bird’s IT & E-Commerce Bulletin).

The Bundesgerichtshof considers that the liability limitation provisions in the E-Commerce Directive do not apply to injunctive claims. Injunctive claims can be brought, for example, against a so-called “disquietor”. A disquietor is a person who contributes to another person's infringement and has knowledge of the infringement. The disquietor comes under a "surveillance duty" in order to prevent further similar infringements. An online intermediary can be held liable as a disquietor, under German law, if it does not take sufficient steps to prevent future violations after (a) such a violation has taken place on its platform, and (b) it has been made aware of the earlier violation.

The Bundesgerichtshof emphasised that "no unreasonable duties to monitor are to be placed on [an online intermediary], which would challenge its whole business model". However, the court has not defined the limits of the possible “duty to monitor" clearly. Additionally there have been some inconsistent judgments of regional courts as a result (see report in Bird & Bird’s IT & E-Commerce Bulletin).

The facts

The latest of these judgments has been issued by the Regional Appeal Court in Hamburg against the operators of the Rapidshare.com and Rapidshare.de filesharing platforms. On these platforms, users can anonymously upload any type of file (e.g. MP3s, JPGs, and computer programs). Registration is not required, and an identity check does not take place. The platform is highly popular. On Rapidshare.de, 250,000 files are uploaded daily. According to Rapidshare’s own statements, around 5 to 6 percent of the 28 million files available on Rapidshare.com are “piracy” copies. Two filters are used to prevent or remove unlawful uploads. The first, called “MD5”, prevents files which are identical to files previously removed from Rapidshare for infringement of third party rights from being uploaded. The second filter is used to search filenames (but not the files themselves) for keywords such as the names of computer programs.

Rapidshare was sued by the owner of the copyright in certain software programs which had been unlawfully uploaded to Rapidshare several times. The plaintiff sought to have Rapidshare identified as a disquietor, so that it would stop copying or making software programs available on the platform and to stop third parties from doing so.

The findings of the Rapidshare judgment

The Hamburg court, returning a comprehensive judgment spanning over 73 pages, held that the measures that the operators of the Rapidshare platforms were liable. The measures they had put in place were not sufficient to avoid the "disquietor principle" being applied.

In determining the extent of the duty to monitor, the court considered that it would always be important to consider the facts of the individual case, and to balance different individual interests. However, the court identified certain relevant criteria for the balancing test. This had not been done by other German courts before in such detail. According to the Regional Appeal Court in Hamburg, the criteria should be:

  • the importance and weight of the rights in question; 

  • the function of the online intermediary (e.g. does he receive a commission); 

  • whether it is just and reasonable to expect the rightowner to actively engage in the protection of his rights;

  • whether the rightowner is dependent on the online intermediary to protect his rights (e.g. because he cannot take action against the users himself as he has no access to information about their identity); and 

  • whether the legal and business model of the online intermediary would be hampered by the measures demanded.

The court found that the measures applied by Rapidshare were not sufficient. For example, the court considered that the filters deployed were insufficient, since (a) the smallest changes to files could circumvent the MD5-filter, as it only removed identical files, and (b) the names of files checked by the second type of filter would not necessarily reflect the content of the files.

The court, however, recognised that the protection against liability under the Telemedia Act should not be reversed under the disquietor principle, and that the requirements to monitor should not be excessive. However, this would require that an online intermediary adopts a legal business model that complies with the legal regime. The court considered that Rapidshare had not done this, but had deliberately and illegitimately exploited the anonymity of the internet in operating its business. Although it is not necessary to require Rapidshare to provide its services only to registered users, the court’s view was that it should have at least stored the IP numbers of its users. This would have meant that it could have blocked users’ access where they were using an IP address that had previously been used to upload unlawful content.  Data protection law would not prevent this solution.

Outlook

The judgment still leaves many questions open. One of them, for example, is the question of what type of content filters the courts would consider acceptable in order to prevent the disquietor principle being applied.

The judgment clearly illustrates, however, that under the current legal framework online intermediaries should take active steps to avoid unpleasant outcomes. Although there is no certainty that these steps can be used, useful measures to take could include:

  • Prohibiting uploading unlawful content in user agreements and user policies;

  • Educating users about what is unlawful content; 

  • Asking the user community to report unlawful content; 

  • Reacting to reports of unlawful content; 

  • Blacklisting certain types of content, if the probability of unlawful content is high (e.g. ban recorded media on online market places); 

  • Taking a cooperative approach towards rightowners; 

  • Reviewing licence models (e.g. does the online intermediary want to acquire rights to use the uploaded content);

  • Developing accurate and helpful technical solutions as far as possible and feasible.