New defamation laws that came into force on 1 January set out a voluntary procedure that website operators can follow to absolve themselves of liability for defamation when they receive a complaint about comments posted by others on their site.
To qualify for the defence against liability, the rules broadly require website operators to act as an intermediary between complainants and the authors of allegedly defamatory comments posted on their site. They require operators to inform authors that the comments they have posted are the subject of a complaint and even delete the comments in some circumstances.
The regulations allow complainants to force website operators to remove their name and email address from notices of complaint they submit when they are being passed on by the operators to posters.
No other details have to be omitted from the original complaints notices before they are passed on by website operators to posters for the website operators to retain their defence against liability under the new framework, and new guidelines on how the complaints-handling procedure should work (9-page / 142KB PDF) explain that the defence still applies even if the posters can identify complainants from other information contained in that notice.
"If the complainant indicates that he or she does not wish his or her name or contact details to be passed to the poster, then to keep the defence the operator must ensure that these are deleted before the Notice of Complaint is sent to the poster," FAQs for the guidance said. "However, there is no requirement for the operator to remove any other information in the Notice of Complaint that might identify the complainant."
However, data protection law specialist Kathryn Wynn of Pinsent Masons, the law firm behind Out-Law.com, warned that, despite the provisions, website operators should assess whether full disclosure of complaint notices to posters, even where the name and email address of complainants has been omitted, is compliant with data protection laws.
"Although website operators have to take certain steps in order to rely on the defence under Section 5 of the new Defamation Act and the accompanying regulations, they cannot ignore data protection completely and should still be mindful of the complainant’s privacy concerns and their own obligations under the Data Protection Act, particularly where the disclosure is in excessive of what is required to fall within the statutory defence" Wynn said.
Wynn said that website operators should explain to complainants what information they are obliged to disclose to comment posters under the new defamation regime and should also inform them of the information they intend to disclose to those alleged offenders before sending on a notice of complaint to those authors.
"Website operators should seek to only disclose information about the complaint as is strictly necessary for the poster to remove the comment and to take any other rectification steps," she said. "Although the alleged offender might be able to identify the individual making the complaint without any personal identifiers, such as the complainants' name or email address, being disclosed, if the complaint was particularly emotive, for example, disclosing an unedited version of the complaint could disclose expressions of opinion that the complainant had made about the alleged offender. Such expressions of opinion also constitute personal data."
"If in doubt, website operators would be well advised to agree with the complainant the text of the complaint that is going to be disclosed to the alleged offender. If this is not feasible in the circumstances, the website operator should, at the very least, carry out some sort of privacy impact assessment and document the justifications for disclosing an unedited version of the complaint, particularly where the complainant has expressed concerns about their details being disclosed to the alleged offender," she said.
The new guidelines explain that even if authors amend the comments they posted after a website operator notifies them of a notice of complaint, website operators may still be required to delete them.
"If the poster alters the statement but doesn’t remove it, the operator must follow the process in order to keep the Section 5 defence," the guide said. "This means that, for example, if the poster fails to reply to the operator within the specified period, or fails to provide all the information required under the Regulations, then the operator must remove the statement in order to retain the Section 5 defence."
The new rules require a "reasonable website operator" to delete comments posted on their site within 48 hours if they believe the name and address provided to them by an author they have served a notice of complaint to are "obviously false". In addition, where authors of defamatory comments repost the same or substantially similar comments after they have been removed twice before from the site, website operators would be obliged to remove the comments within 48 hours of receiving a notice of complaint.
The new guidance makes clear that website operators may have to make their own assessment about whether contact details are false or whether material re-posted is substantially similar. How those operators act could affect whether they can rely on the defence against liability provided for under the new framework, it said.
"[Website operators] will need to decide if you think the details are obviously false," the guidance said. "If a complainant brings an action against an operator on the basis that the operator has failed to comply with the process in these circumstances, it will be a matter for the court to decide whether a reasonable operator would have considered the details provided by the poster to be obviously false."
"[Website operators] will need to reach a view on whether the defamatory imputation made in the [newly posted] statement is the same or substantially the same as in the previous postings by the same poster," it added. "For example the poster may just have changed the wording so that it is not identical, but the defamatory imputation is effectively the same. In this situation, if you follow the full process rather than removing the statement within 48 hours of receiving the Notice of Complaint, and the complainant brings proceedings against you on the basis that you have failed to comply with the Regulations, it will be a matter for the court to decide whether your action was appropriate."