Disclosure of personal data
RELEVANT legal framework and practice Domestic LawCivil Code ( Allgemeines Bürgerliches Gesetzbuch, published in the Collection of Judicial Acts, no. 946/1811) Civil Code ( Allgemeines Bürgerliches Gesetzbuch, published in the Collection of Judicial Acts, no. 946/1811) Civil Code ( Allgemeines Bürgerliches Gesetzbuch, published in the Collection of Judicial Acts, no. 946/1811) 34. Article 1330 of the Civil Code, as in force since 1 January 1916 (published in Imperial Law Gazette no. 69/1916), provides as follows: “1. Anybody who, as a result of defamation, suffers real damage or loss of profit may claim compensation. 2. The same shall apply if anyone disseminates allegations that jeopardise a person’s reputation, income or livelihood, the falsity ( Unwahrheit ) of which was known or should have been known to him or her. [Such a person] also has a right to request a retraction and the publication thereof ...” Media Act ( Mediengesetz, published in Federal Law Gazette no. 314/1981) 35. Section 31(1) and (2) of the Media Act, as amended, in force since 1 January 2008 (published in Federal Law Gazette no. 112/2007), state as follows: “(1) Media owners, editors, copy editors and employees of a media company or media service have the right to refuse, as witnesses in criminal proceedings or other proceedings before a court or an administrative authority, to answer questions relating to the identity of the author, sender or source of articles and documentation, or to any information that they have obtained in connection with their profession. (2) The right stipulated in paragraph (1) must not be bypassed – in particular by ordering the person enjoying this right to disclose: documents; printed matter; image, sound or data carriers; illustrations; or other representations of such contents, or by confiscating them.” E-Commerce Act ( E-Commerce Gesetz, published in Federal Law Gazette no. 152/2001) 36. Section 16(1) of the E-Commerce Act reads as follows: “(1) A service provider who stores information provided by a user is not liable for the information stored at the request of that user, on condition that: 1. the provider does not have actual knowledge of any illegal activity or [illegal] information and, as regards claims for damages, is not aware of facts or circumstances from which any illegal activity or information is apparent; or 2. the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to [such] information.” 37. Section 18(4) of the E-Commerce Act provides as follows: “(4) Service providers mentioned in section 16 must transmit the name and address of a user of their service, with whom they have concluded agreements concerning the storage of information, to third parties at the request [of those third parties] if they demonstrate ( glaubhaft machen ) an overriding legal interest in determining the identity of [that] user and [establishing the existence of] a particular illegal situation, and furthermore demonstrate that knowledge of such information constitutes a material prerequisite for legal prosecution.” Enforcement Act ( Exekutionsordnung, published in Federal Law Gazette no. 79/1896, as amended in Federal Law Gazette no. 86/2021) 38. Section 354 of the Enforcement Act reads as follows: “(1) A claim to an act ( Anspruch auf eine Handlung ) which cannot be performed by a third party and the performance of which depends exclusively on the will of the obligor shall be enforced by the execution court upon application by way of fines or by imprisonment for a maximum total period of up to six months. (2) Execution shall begin by notice being served that a penalty will be imposed in the event of default; initially, only notice of a potential fine may be served. [Should] the time-limit ... for the performance of the act [in question] expire, the threatened coercive measure shall be enforced at the request of the enforcing creditor and, at the same time, notice of increasingly severe coercive measures shall be served, with the setting of a new time-limit in respect of the performance [of the act in question]. Enforcement of the latter shall only take place at the request of the enforcing creditor”. Domestic Practice 39. Regarding service providers’ duty under section 18(4) of the E ‑ Commerce Act (see paragraph 37 above) to disclose user data, the Supreme Court has established in its case-law that for a plaintiff to demonstrate an overriding legal interest it is sufficient that it is not possible to rule out the possibility of a finding of liability under Article 1330 of the Civil Code (see paragraph 34 above) on the basis of the contested allegations. Any distinction between a statement of facts and a potentially excessive value judgment has to be determined in proceedings against the actual author of the comments in question and not in proceedings against the relevant service provider (see Supreme Court judgments of 23 January 2014, 6 Ob 133/13 x; of 30 January 2017, 6 Ob 188/16 i; and, more recently, of 27 November 2019, 6 Ob 156/19 p). RELEVANT International INSTRUMENTS 40. Relevant material concerning freedom of communication on the Internet and its limits referenced in the instruments of the Council of Europe, the United Nations (UN) and the European Union is outlined in paragraphs 44-57 of the judgment in Delfi AS v. Estonia ([GC], no. 64569/09, ECHR 2015). The quoted material contains, inter alia, the Declaration on freedom of communication on the Internet adopted by the Committee of Ministers of the Council of Europe on 28 May 2003 (ibid., § 44) which identifies the principle of anonymity in the field of communication on the Internet and states as follows: “Principle 7: Anonymity In order to ensure protection against online surveillance and to enhance the free expression of information and ideas, member states should respect the will of users of the Internet not to disclose their identity. This does not prevent member states from taking measures and co-operating in order to trace those responsible for criminal acts, in accordance with national law, the Convention for the Protection of Human Rights and Fundamental Freedoms and other international agreements in the fields of justice and the police." 41. The relevant material quoted in Delfi AS v. Estonia further contains the Recommendation CM/Rec(2011)7 of the Committee of Ministers to member States on the new notion of media which underlines the importance of the role of intermediaries (ibid., § 46), the report of the UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression dated 22 May 2015 (A/HRC/29/32) which states that no State should use or force intermediaries to undertake censorship on its behalf (ibid., § 48) and relevant parts of the Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce) on the liability of intermediaries (ibid., § 50). 42. In addition, the Directive on electronic commerce provides as follows: “(9) The free movement of information society services can in many cases be a specific reflection in Community law of a more general principle, namely freedom of expression as enshrined in Article 10(1) of the Convention for the Protection of Human Rights and Fundamental Freedoms, which has been ratified by all the Member States; for this reason, directives covering the supply of information society services must ensure that this activity may be engaged in freely in the light of that Article, subject only to the restrictions laid down in paragraph 2 of that Article and in Article 46(1) of the Treaty; this Directive is not intended to affect national fundamental rules and principles relating to freedom of expression. ... (14) ... the implementation and application of this Directive should be made in full compliance with the principles relating to the protection of personal data, in particular as regards unsolicited commercial communication and the liability of intermediaries; this Directive cannot prevent the anonymous use of open networks such as the Internet. ... (41) This Directive strikes a balance between the different interests at stake and establishes principles upon which industry agreements and standards can be based. ... (52) The effective exercise of the freedoms of the internal market makes it necessary to guarantee victims effective access to means of settling disputes; damage which may arise in connection with information society services is characterised both by its rapidity and by its geographical extent; in view of this specific character and the need to ensure that national authorities do not endanger the mutual confidence which they should have in one another, this Directive requests Member States to ensure that appropriate court actions are available; Member States should examine the need to provide access to judicial procedures by appropriate electronic means.” 43. The Recommendation CM/Rec(2014)6 of the Committee of Ministers to member States on a Guide to human rights for Internet users, adopted on 16 April 2014, stated the following: “Freedom of expression and information You have the right to seek, receive and impart information and ideas of your choice, without interference and regardless of frontiers. This means: 1. you have the freedom to express yourself online and to access information and the opinions and expressions of others. This includes political speech, views on religion, opinions and expressions that are favourably received or regarded as inoffensive, but also those that may offend, shock or disturb others. ... 2. restrictions may apply to expressions which incite discrimination, hatred or violence. These restrictions must be lawful, narrowly tailored and executed with court oversight. ... 6. you may choose not to disclose your identity online, for instance by using a pseudonym. However, you should be aware that measures can be taken, by national authorities, which might lead to your identity being revealed.” 44. The European Parliament resolution of 21 May 2013 on the EU Charter: standard settings for media freedom across the EU (2011/2246/INI)) stresses the following: “28. ... that the fundamental right to freedom of expression and freedom of the media is not only reserved for traditional media, but also covers social media and other forms of new media; underlines the importance of ensuring freedom of expression and information on the internet, notably through guaranteeing net neutrality, and consequently calls on the EU and the Member States to ensure that these rights and freedoms are fully respected on the internet in relation to the unrestricted access to and provision and circulation of information; ...” 45. The Council of Europe’s Appendix to Recommendation CM/Rec(2018)2 of the Committee of Ministers to member States on the roles and responsibilities of Internet intermediaries (adopted on 7 March 2018) reads as follows, in so far as relevant: “2.4. Use of personal data 2.4.1. Intermediaries should not disclose personal data to a third party unless required by law or requested to do so by a judicial authority or other independent administrative authority whose decisions are subject to judicial review that has determined that the disclosure is consistent with applicable laws and standards, necessary in a democratic society and proportionate to the legitimate aim pursued. ...” 46. The UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated the following in his report of 22 May 2015 to the Human Rights Council (A/HRC/29/32): “60. States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. ... States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users. Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms). Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals ... and subject to judicial warrant and the protection of due process rights of individuals.” 47. The UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated the following in his report of 11 May 2016 to the Human Rights Council (A/HRC/32/38): “85. States bear a primary responsibility to protect and respect the right to exercise freedom of opinion and expression. In the information and communication technology context, this means that States must not require or otherwise pressure the private sector to take steps that unnecessarily or disproportionately interfere with freedom of expression, whether through laws, policies, or extra-legal means. Any demands, requests and other measures to take down digital content or access customer information must be based on validly enacted law, subject to external and independent oversight, and demonstrate a necessary and proportionate means of achieving one or more aims under article 19 (3) of the International Covenant on Civil and Political Rights. ...” 48. The UN Human Rights Council’s Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated the following in his report of 30 March 2017 to the Human Rights Council (A/HRC/35/22): “78. It is also critical for the Council and States to draw the connections between privacy interference and freedom of expression. ... But certain interferences – such as overbroad requests for user data and third-party retention of such data – can have both near- and long-term deterrent effects on expression, and should be avoided as a matter of law and policy. At a minimum, States should ensure that surveillance is authorized by an independent, impartial and competent judicial authority certifying that the request is necessary and proportionate to protect a legitimate aim.” THE LAW ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION 49. The applicant company complained that being ordered to disclose the data of users who had posted comments on its Internet news portal had infringed its freedom of expression, as provided by Article 10 of the Convention, which reads as follows: “1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.” Admissibility 50. The Government argued that the application should be rejected for being manifestly ill-founded, pursuant to Article 35 § 3 (a) and § 4 of the Convention. 51. The applicant company submitted that the application was admissible. 52. The Court considers, in the light of the parties’ submissions, that the complaint raises serious issues of fact and law under the Convention, the determination of which requires an examination on the merits. The Court therefore concludes that this complaint is not manifestly ill-founded within the meaning of Article 35 § 3 of the Convention and that the Government’s objection must be dismissed. It also notes that the application is not inadmissible on any other grounds listed in Article 35 of the Convention. It must therefore be declared admissible. MeritsThe parties’ submissions The parties’ submissions The parties’ submissions (a) The applicant company 53. The applicant company argued that the user data in question constituted journalistic sources. They were thus protected by editorial confidentiality in the same way as were data of authors of readers’ letters published in a newspaper. It furthermore complained about the domestic courts characterising the user comments as possibly defamatory under Article 1330 of the Civil Code (see paragraph 34 above), arguing that, on the contrary, they in fact constituted permissible value judgments. 54. Authors of postings in online discussion forums, just as authors of readers’ letters, had to be able to rely on their protection by media owners, as ensured by editorial confidentiality. Otherwise, they could be deterred from assisting the press in informing the public about matters of general interest. At the very least, users would adjust their behaviour by limiting their exercise of the right to open discussion in a way that would be at odds with the kind of free culture of discussion protected by Article 10. The applicant company’s media operations had earned an excellent reputation for offering critical and reflective media coverage. That reputation would without a doubt be negatively affected by an absence of statements on its platform caused by a “chilling effect”. 55. Owing to the difficult legal situation, operators of online discussion forums might limit or even shut down those forums for good. Thus, not only the author of the comment, but also the applicant company and the public had a legitimate interest in protecting the identity of people who posted such comments. 56. The domestic courts had forced the applicant company into the “corset” of a host provider with regard to user comments, without taking into consideration its obligation as a media company to exercise due diligence when disclosing sensitive data. The Supreme Court’s view notwithstanding, the forum operated by the applicant company had been developed through significant investment and deployment of personnel, and had to be considered as one where some kind of action or review would be undertaken by specially trained employees (see paragraph 25 above), and where the right to editorial confidentiality was therefore legitimate. 57. Lastly, the Supreme Court had not considered the particular circumstances of users’ comments, such as whether the person affected by the posting in question was a public figure or whether a comment had been posted in the course of a political discussion. It had not carried out an appropriate balancing test as required by the Court’s case-law. (b) The Government 58. The Government stated that in the absence of a sufficient connection between the publication of the comments and the applicant company’s journalistic activities, the applicant company could not in the present case invoke its right to editorial confidentiality. The fact that a host provider filtered comments through a software program on the basis of keywords and subsequently manually reviewed those comments did not mean that the host provider’s activities were journalistic in nature, and nor did the fact that a review was conducted after the publication of such comments. The applicant company’s role as a host provider offering a discussion forum on its website differed from its role as a publisher of articles. As a publisher, the applicant company had to take full responsibility for its articles. As a host provider, on the other hand, it enjoyed the exemption from liability enshrined in section 16 of the E-Commerce Act (see paragraph 36 above). To counterbalance that privilege, the applicant company, as a host provider, had a duty to disclose certain data to persons who made credible an overriding legal interest. The aim of that duty was to enable persons whose rights had been violated (as a result of unlawful activity or information originating from a user unknown to them) to prosecute the offender. The applicant company could not at the same time invoke both the exemption of liability granted to host providers and the safeguards afforded to publishers with regard to their sources. 59. Moreover, the Supreme Court’s decision had not restricted the applicant company’s right to receive and impart information. The Supreme Court had not required the applicant company to delete the comments nor to pay compensation, and nor had it taken a final decision on the lawfulness of those comments. 60. Even assuming that there had been an interference with the applicant company’s rights under Article 10, that interference had been provided for by law and had been proportionate. The legal framework applied by the Supreme Court had struck a fair balance between opposing points of view and interests in respect of the question of fundamental rights and had fallen within the wide margin of appreciation afforded by the Court in this field. As a positive obligation under Article 8 of the Convention, the State had to provide instruments enabling an individual to effectively combat defamation and personal violations by other private persons. 61. Experience had shown that users’ anonymity on the Internet was often abused to defame individuals or to disseminate hatred. Such behaviour did not contribute to a meaningful public debate. It was rather a hindrance to it. Users’ anonymity contributed considerably to an “online disinhibition effect” which could deter other users who valued respectful communication. It had to be ensured that the legitimate interest in anonymity did not eventually reduce the pluralism of opinions and thus restrict freedom of expression. The third-party intervener 62. The Media Legal Defence Initiative (a non-governmental organisation based in the United Kingdom that provides legal support to journalists, bloggers and independent media) submitted that anonymity was of crucial importance to the right to freedom of expression online as people’s willingness to engage in debate on controversial subjects in the public sphere had always been linked to the possibility of doing so anonymously. The disclosure of journalistic sources and surveillance could have negative consequences for the right to freedom of expression, given a breach of the right to confidentiality of an individual in respect of his or her communications. The same applied to cases concerning the disclosure of anonymous user data. The Court’s assessment (a) Existence of an interference 63. The Government disputed that the applicant company’s right to enjoy freedom of the press, as guaranteed under Article 10 of the Convention, had been interfered with by the domestic courts’ decisions (see paragraphs 58–59 above). The Court will first examine whether there was in fact such an interference – either in the light of the need to protect journalistic sources or on other grounds. (i) General principles 64. The fundamental principles concerning freedom of expression and the protection of journalistic sources are well-established in the Court’s case-law (see Sanoma Uitgevers B.V. v. the Netherlands [GC], no. 38224/03, §§ 50 and 51, 14 September 2010; and Goodwin v. the United Kingdom, 27 March 1996, § 39, Reports of Judgments and Decisions 1996 ‑ II). 65. Regarding journalistic sources, the Court’s understanding of the concept of a journalistic “source” is “any person who provides information to a journalist”; it understands the term “information identifying a source” to include, in so far as they are likely to lead to the identification of a source, both “the factual circumstances of acquiring information from a source by a journalist” and “the unpublished content of the information provided by a source to a journalist” (see Telegraaf Media Nederland Landelijke Media B.V. and Others v. the Netherlands, no. 39315/06, § 86, 22 November 2012, and the cases cited therein). 66. In the case of Schweizerische Radio- und Fernsehgesellschaft and Others v. Switzerland ((dec.) no. 68995/13, § 71, 12 November 2019) the Court has provided an overview of its case-law regarding situations that are considered to constitute an interference with the right to freedom of expression under Article 10 of the Convention. Among other factors, a conviction or an order to pay damages in a situation that can have a limiting impact on the enjoyment of freedom of expression is seen to constitute an interference (ibid.). In Nordisk Film & TV A/S v. Denmark ((dec.), no. 40485/02, ECHR 2005 ‑ XIII) the Court held that the decision of the Danish Supreme Court to compel the applicant company to hand over unedited footage which could not be regarded as sources of journalistic information nevertheless constituted an interference within the meaning of Article 10 § 1 of the Convention. It found however that the degree of protection under Article 10 to be applied in that situation could not reach the same level as that afforded to journalists when it came to their right to keep their sources confidential. 67. The Court has previously ruled on cases concerning the liability of providers of online debate forums on which users had posted comments. In none of those cases was the interference with the rights of the provider under Article 10 called into question (see Delfi AS v. Estonia [GC], no. 64569/09, § 118, ECHR 2015; and Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt v. Hungary, no. 22947/13, § 45, 2 February 2016). In Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt (§ 61), the Court explicitly stated that the second applicant in that case, as a large news portal, provided a forum for the exercise of freedom of expression, thus enabling the public to impart information and ideas. Accordingly, the Court concluded that the second applicant’s conduct had to be assessed in the light of the principles applicable to the press. (ii) Application of the above principles to the present case 68. The Court notes at the outset that the instant case does not concern the liability as such of the applicant company but its duty as a host provider to disclose user data in certain circumstances, under section 18 of the E ‑ Commerce Act (see paragraph 37 above), despite its role as an editor of journalistic work. In this role, it runs a news portal which carries discussion forums and allows users to post comments relating to articles published by the applicant company (see paragraph 5 above). It thus uses these forums to participate in the dissemination of ideas with regard to topics of public interest (see paragraphs 73 and 78 below). The comments at issue in the instant case referred to two articles published by the applicant company (see paragraphs 13 and 18 above). 69. In this regard, during the domestic proceedings the applicant company relied on the argument that the authors of the comments in question constituted journalistic sources and that their identities were therefore protected. The domestic courts, on the other hand, concluded that owing to the fact that no kind of journalistic activity was involved, the applicant company could not invoke editorial confidentiality with respect to the user comments. In the Government’s view, the applicant company could not at the same time invoke both the exemption of liability granted to host providers and the safeguards afforded to publishers with regard to their sources (see paragraph 58 above). According to the Government, there had in any event been no interference with the right to receive and impart information, as the applicant company had not been held liable, and nor had it been obliged to delete any content (see paragraph 59 above). 70. The Court’s understanding of a journalistic “source” (see paragraph 65 above) is in line with the Recommendation on the right of journalists not to disclose their sources of information (which was adopted by the Committee of Ministers of the Council of Europe) and the definitions given in the Appendix thereto (cited in Sanoma Uitgevers B.V. v. the Netherlands [GC], no. 38224/03, § 44, 14 September 2010). According to the definitions set out in this Appendix, the term “information” means any statement of fact, opinion or idea in the form of text, sound and/or picture (ibid.). 71. In the instant case, the Court concludes that the comments posted on the forum by readers of the news portal, while constituting opinions and therefore information in the sense of the Recommendation, were clearly addressed to the public rather than to a journalist. This is sufficient for the Court to conclude that the comments’ authors could not be considered a source to a journalist. The Court therefore agrees with the Government that the applicant company could not rely on editorial confidentiality in the instant case. However, an interference with Article 10 may also occur in ways other than by ordering the disclosure of a journalistic source (see paragraph 66 above). 72. In the cases of Delfi AS and Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt it was undisputed that the liability of providers of online debate forums interfered with their rights under Article 10 (see paragraph 67 above). In Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt (§ 25), the Hungarian Constitutional Court had applied the principles of freedom of the press to the applicants. The Court shared this view (see paragraph 67 above). The Court does not overlook the fact that in the case of Delfi AS it accepted the domestic courts’ classification of the applicant as a publisher (ibid., § 128), whereas in the instant case the domestic courts considered, in respect of the comments at issue, the applicant company to be a host provider (see paragraphs 24 and 30 above). However, whether there may be an interference with Article 10 cannot depend on the legal categorisation of a provider by the domestic courts. Rather, the Court finds that it must take into account the circumstances of the case as a whole. 73. While the Court accepts that the applicant company acted as a host provider with regard to the publication of the comments at issue, this was only one of its roles as a media company. It publishes a daily newspaper (and an online version thereof) and maintains a news portal on which it initiates conversations regarding its articles by inviting users to post comments (see paragraph 5 above). It does not only provide a forum for users but takes an active role in guiding them to write comments, describing those comments as an essential and valuable part of the news portal (see paragraph 7 above). User-generated content on the applicant company’s portal is at least partly moderated (see paragraphs 8-12 above). The Court finds that these activities are closely interlinked. This is supported by the fact that there is no separate editorial office for the portal, which is described as a platform for dialogue as a whole – including both articles and discussions on those articles (see paragraphs 5 and 7 above). It is thus apparent that the applicant company’s overall function is to further open discussion and to disseminate ideas with regard to topics of public interest, as protected by freedom of the press (see paragraph 68 above). 74. In the light of the Declaration on freedom of communication on the Internet adopted by the Committee of Ministers of the Council of Europe (see Delfi AS, cited above, § 44), which emphasises the principle of anonymity for Internet users in order to enhance the free expression of opinions, information and ideas (see also the UN Special Rapporteur’s report cited above in paragraph 46), the Court has no doubt that an obligation to disclose the data of authors of online comments could deter them from contributing to debate and therefore lead to a chilling effect among users posting in forums in general. This affects, indirectly, also the applicant company’s right as a media company to freedom of press. It invites users to comment on its articles in order to further discussion on its journalistic work (see paragraphs 5 and 65 above). To achieve this goal, it allows authors of comments to use usernames (see paragraph 7 above); upon registration, users are informed that their data will not be seen publicly and will only be disclosed if required by law (see paragraphs 6 and 7 above). The forums’ rules dictate that certain content is not accepted, and that comments are screened by a keyword system, may be subject to a manual review and will be deleted if they are not in line with the rules (see paragraphs 7-12 above). 75. The Court does not lose sight of the ease, scope and speed of the dissemination of information on the Internet, and the persistence of such information once disclosed, which may considerably aggravate the effects of unlawful speech compared to traditional media (see Delfi, cited above, § 147). It therefore agrees with the Government (see paragraph 61 above) that the Convention does not provide for an absolute right to anonymity on the Internet. 76. At the same time, the Court is mindful of the interest of Internet users in not disclosing their identity. Anonymity has long been a means of avoiding reprisals or unwanted attention. As such, it is capable of promoting the free flow of opinions, ideas and information in an important manner, including, notably, on the Internet (see Delfi, cited above, § 147). Thus, it can indirectly also serve the interests of a media company (see paragraph 74 above). 77. The Court observes that different degrees of anonymity are possible on the Internet. An Internet user may be anonymous to the wider public while being identifiable by a service provider through an account or contact data that may be either unverified or subject to some kind of verification. A service provider may also allow an extensive degree of anonymity for its users, in which case users are not required to identify themselves at all and they may only be traceable – to a limited extent – through the information retained by Internet access providers. The release of such information would usually require an injunction by the investigative or judicial authorities and would be subject to restrictive conditions. It may nevertheless be required in some cases in order to identify and prosecute perpetrators (see Delfi, cited above, § 148). 78. In the instant case, the applicant company, as a media company, awards its users a certain degree of anonymity not only in order to protect its freedom of the press but also to protect users’ private sphere and freedom of expression – rights all protected by Articles 8 and 10 of the Convention (see paragraphs 68 and 73 above). The Court observes that this anonymity would not be effective if the applicant company could not defend it by its own means. It would be difficult for users to defend their anonymity themselves should their identities have been disclosed to the civil courts. 79. The Government’s argument that no final decision on the lawfulness of the comments has been taken (see paragraph 59 in fine above) does not change the evaluation, as the interference lies in the lifting of anonymity and the effects thereof, irrespective of the outcome of any subsequent proceedings. Such an interference with the media company’s rights will weigh less heavily than the interference in a case in which the media company is held liable for the content of a particular comment by being fined or obliged to delete it. The weight of a given interference is however a matter to be examined in a proportionality test when balancing the interests at stake (see paragraphs 92-95 below). 80. The Court therefore finds that the domestic courts’ orders in the two sets of proceedings to disclose the requested user data constituted an interference with the applicant company’s right to enjoy freedom of the press under Article 10 § 1 of the Convention. Such interference will be incompatible with Article 10 § 2 of the Convention unless it is “prescribed by law”, pursues one or more legitimate aims and is “necessary in a democratic society” in order to achieve the aim concerned. (b) Lawfulness and legitimate aim 81. It was not disputed between the parties that the interference was prescribed by law (namely, by section 18(4) of the E-Commerce Act – see paragraph 37 above), nor that it served a legitimate aim (namely, the protection of the reputation and rights of others). (c) Necessary in a democratic society 82. It remains to be determined whether the impugned interference was “necessary in a democratic society”. (i) General principles 83. Freedom of expression constitutes one of the essential foundations of a democratic society and one of the basic conditions for its progress and for each individual’s self-fulfilment. Subject to paragraph 2 of Article 10, it is applicable not only to information or ideas that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb. Such are the demands of pluralism, tolerance and broadmindedness without which there is no “democratic society”. As enshrined in Article 10, freedom of expression is subject to exceptions, which must, however, be construed strictly, and the need for any restrictions must be established convincingly (see, for example, Couderc and Hachette Filipacchi Associés v. France [GC], no. 40454/07, § 88, ECHR 2015 (extracts) and the cases cited therein). 84. The relevant principles concerning the balancing of interests when examining an interference with freedom of expression have been summarised as follows (see Delfi AS, cited above, §§ 138 and 139): “138. When examining whether there is a need for an interference with freedom of expression in a democratic society in the interests of the “protection of the reputation or rights of others”, the Court may be required to ascertain whether the domestic authorities have struck a fair balance when protecting two values guaranteed by the Convention which may come into conflict with each other in certain cases, namely on the one hand freedom of expression protected by Article 10, and on the other he right to respect for private life enshrined in Article 8 (see Hachette Filipacchi Associés v. France, no. 71111/01, § 43, 14 June 2007; MGN Limited v. the United Kingdom, no. 39401/04, § 142, 18 January 2011; and Axel Springer AG [ v. Germany [GC], no. 39954/08,] § 84[, 7 February 2012]). 139. The Court has found that, as a matter of principle, the rights guaranteed under Articles 8 and 10 deserve equal respect, and the outcome of an application should not vary according to whether it has been lodged with the Court under Article 10 of the Convention by the publisher of an offending article or under Article 8 of the Convention by the person who has been the subject of that article. Accordingly, the margin of appreciation should in principle be the same in both cases (see Axel Springer AG, cited above, § 87, and Von Hannover v. Germany (no. 2) [GC], nos. 40660/08 and 60641/08, § 106, ECHR 2012, with further references to Hachette Filipacchi Associés ( ICI PARIS ), no. 12268/03, § 41, 23 July 2009; Timciuc v. Romania (dec.), no. 28999/03, § 144, 12 October 2010; and Mosley v. the United Kingdom, no. 48009/08, § 111, 10 May 2011). Where the balancing exercise between those two rights has been undertaken by the national authorities in conformity with the criteria laid down in the Court’s case-law, the Court would require strong reasons to substitute its view for that of the domestic courts (see Axel Springer AG, cited above, § 88, and Von Hannover (no. 2), cited above, § 107, with further references to MGN Limited, cited above, §§ 150 and 155, and Palomo Sánchez and Others v. Spain [GC], nos. 28955/06, 28957/06, 28959/06 and 28964/06, § 57, ECHR 2011). In other words, there will usually be a wide margin afforded by the Court if the State is required to strike a balance between competing private interests or competing Convention rights (see Evans v. the United Kingdom [GC], no. 6339/05, § 77, ECHR 2007 ‑ I; Chassagnou and Others v. France [GC], nos. 25088/94, 28331/95 and 28443/95, § 113, ECHR 1999 ‑ III; and Ashby Donald and Others v. France, no. 36769/08, § 40, 10 January 2013).” 85. The Court has identified a number of relevant criteria that must guide its assessment when balancing Article 8 and Article 10, of which particularly pertinent to the present case are: whether a contribution is made to a debate of public interest; the subject of the report in question; the prior conduct of the person concerned and how well he or she is known; the content, form and consequences of the publication in question; and the gravity of the penalty imposed on the journalists or publishers (see Von Hannover v. Germany (no. 2) [GC], nos. 40660/08 and 60641/08, §§ 109 to 113, ECHR 2012; and Axel Springer AG v. Germany [GC], no. 39954/08, §§ 90 to 95, 7 February 2012). 86. In this regard, the Court reiterates, that there is little scope under Article 10 § 2 of the Convention for restrictions on political speech or on debate on matters of public interest (see, for example, Ceylan v. Turkey [GC], no. 23556/94, § 34, ECHR 1999 ‑ IV; Wingrove v. the United Kingdom, 25 November 1996, § 58, Reports of Judgments and Decisions 1996 ‑ V; and, more recently, Couderc and Hachette Filipacchi Associés, cited above, § 96). 87. As to the limits of acceptable criticism, the Court has repeatedly held that freedom of the press affords the public one of the best means of discovering and forming an opinion on the ideas and attitudes of political leaders. The limits of acceptable criticism are accordingly wider in respect of a politician than in respect of a private individual. Unlike the latter, the former inevitably and knowingly lays himself open to close scrutiny of his every word and deed by both journalists and the public at large, and he must consequently display a greater degree of tolerance, especially when he himself makes public statements that are susceptible of criticism (see, for example, Oberschlick v. Austria (no. 1), 23 May 1991, §§ 58-59, Series A no. 204; Lingens v. Austria, 8 July 1986, § 42, Series A no. 103; and, more recently, Couderc and Hachette Filipacchi Associés, cited above, § 121). 88. Moreover, the Court has clearly stated that speech that is incompatible with the values proclaimed and guaranteed by the Convention is not protected by Article 10, by virtue of Article 17 of the Convention. The examples of such speech examined by the Court have included statements denying the Holocaust, justifying a pro-Nazi policy, linking all Muslims with a grave act of terrorism, or portraying the Jews as the source of evil in Russia (see Delfi AS, cited above, § 136 and the cases cited therein). (ii) Application of those principles to the present case 89. The instant case concerns the applicant company’s duty as a host provider to disclose personal data of its users, not its own civil (or criminal) liability for the users’ comments (see paragraph 68 above; compare and contrast Delfi, cited above, § 128). Moreover, the comments made about the plaintiffs (see paragraphs 14, 15 and 19 above) although offensive and lacking in respect, did not amount to hate speech or incitement to violence (see the case-law quoted in paragraph 88 above), nor were they otherwise clearly unlawful (compare and contrast Delfi, cited above, § 128). 90. The comments in question concerned two politicians and a political party, respectively, and were expressed in the context of a public debate on issues of legitimate public interest, namely the conduct of those politicians acting in their public capacities and their own comments published on the same news portal (see paragraphs 13 and 18 above). 91. Although anonymity on the Internet is an important value (see paragraphs 76-78 above), the Court is aware that it must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others (see K.U. v. Finland, no. 2872/02, § 49, ECHR 2008). 92. The importance of a sufficient balancing of interests arises from this awareness, in particular if political speech and debates of public interest are concerned. This issue is not only reflected in the Court’s longstanding case-law (see paragraphs 86-87 above), but also in the above mentioned international-law material concerning Internet intermediaries: the relevant documents of the Council of Europe and the United Nations Human Rights Council state that requests for the disclosure of user data must be necessary and proportionate to the legitimate aim pursued (see paragraphs 45-48 above). As the Government has pointed out (see paragraph 60 above), a potential victim of a defamatory statement must be awarded effective access to a court in order to assert his or her claims before that court. In the Court’s view this means that the domestic courts will have to examine the alleged claim and weigh – in accordance with their positive obligations under Articles 8 and 10 of the Convention – the conflicting interests at stake, before deciding whether the data relating to the author’s identity are to be disclosed. In the instant case, those conflicting interests do not only comprise the plaintiffs’ right to protect their reputation and the applicant company’s right to freedom of press, but also its role in protecting the personal data of the comment’s authors and the freedom to express their opinions publicly (see paragraph 78 above). 93. The Court agrees with the appeal courts that the comments in questions could be understood as seriously offensive. However, while the first-instance courts in both sets of proceedings did conduct a balancing test (see paragraphs 24 and 30 above), the appeal courts and the Supreme Court did not give any reasons why the plaintiffs’ interests in the disclosure of the data were “overriding” the applicant company’s interests in protecting their authors’ anonymity. This is of particular concern in a case like the present one where the comments could be characterised as political speech that could not be considered as being clearly illegal. Referring to the Supreme Court’s case-law they only argued that the balancing of interests was not a matter to be examined in proceedings against the relevant service provider, but rather should be carried out during proceedings against the author of the allegedly defamatory comments. According to the appeal courts and the Supreme Court, it was sufficient that “a layperson was capable of perceiving that a finding of liability under Article 1330 of the Civil Code could not be ruled out”. If that was the case, the person concerned would have an overriding interest in the disclosure of the user data (see paragraphs 25-26, 27, 31-32 and 39 above). They thus concluded directly from the refusal of editorial confidentiality, the comments’ offensive nature and the requirement that a finding of liability could not be ruled out to the applicant company’s duty to disclose the data. 94. The Court finds that the Supreme Court’s case-law does not preclude a balancing of interests. In fact, this case-law would have provided for a certain balancing between the opposing interests in respect of fundamental rights when requiring an assessment whether a finding of liability under Article 1330 of the Civil Code could not be ruled out. This applied all the more to the instant case, as it was obvious that the comments at issue were part of a political debate. However, the appeal courts and the Supreme Courts did not base their assessment on any balancing between the interests of the authors of the particular comments and of the applicant company to protect those authors, respectively, on the one side, and the interests of the plaintiffs concerned on the other side. 95. As stated above (see paragraphs 68 and 89), the Court does not overlook that the instant case did not concern the applicant company’s liability for the comments (by contrast, see Delfi AS, cited above, § 142; and Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt, cited above, § 71). In this regard, the Court accepts that for a balancing exercise in proceedings concerning the disclosure of user data, a prima facie examination may suffice (see paragraph 66 above). In fact, section 18(4) of the E-Commerce Act (see paragraph 37 above) allows for the establishment of prima facie evidence. This was not disputed by the Government (see paragraph 58 above). Furthermore, the courts enjoy a certain margin of appreciation, even if it is narrow when political speech is concerned (see paragraph 86 above). However, even a prima facie examination requires some reasoning and balancing. In the instant case, the lack of any balancing between the opposing interests (see paragraph 94 above) overlooks the function of anonymity as a means of avoiding reprisals or unwanted attention and thus the role of anonymity in promoting the free flow of opinions, ideas and information, in particular if political speech is concerned which is not hate speech or otherwise clearly unlawful. In view of the fact that no visible weight was given to these aspects, the Court cannot agree with the Government’s submission that the Supreme Court struck a fair balance between opposing interests in respect of the question of fundamental rights (see paragraph 60 above). 96. The Court finds that in the absence of any balancing of those interests the decisions of the appeal courts and of the Supreme Court were not supported by relevant and sufficient reasons to justify the interference. It follows that the interference was not in fact “necessary in a democratic society”, within the meaning of Article 10 § 2 of the Convention. 97. There has accordingly been a violation of Article 10 of the Convention. APPLICATION OF ARTICLE 41 OF THE CONVENTION 98. Article 41 of the Convention provides: “If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.” Damage 99. The applicant company claimed a total amount of 17,882.38 euros (EUR) in respect of pecuniary damage. This sum is composed of EUR 12,254.80 for the costs of legal representation (including VAT) and court fees, which it had to pay to K.S. and FPK in the first set of proceedings, and EUR 5,627.58 for the costs of legal representation (including VAT) and court fees, which it had to pay to H.K. in the second set of proceedings. 100. The Government did not contest this claim. 101. The applicant company also claimed EUR 6,000 in respect of non ‑ pecuniary damage. 102. The Government contested this claim, arguing that the applicant company had failed to set out the basis of its calculation and that the finding of a violation of a Convention right often constituted in itself sufficient reparation. 103. The Court reiterates that it cannot speculate what the outcome of the proceedings would be if they were in conformity with the requirements of Article 6 § 1 of the Convention (see Osinger v. Austria, no. 54645/00, § 57, 24 March 2005 and the references cited therein). The same applies in the instant case in which a procedural violation of Article 10 is found (see paragraph 96 above). Accordingly, the Court dismisses the applicant company’s claim for pecuniary damage. As regards the claim for non ‑ pecuniary damage, the Court finds that given the circumstances of the present case the finding of a violation constitutes in itself sufficient just satisfaction for any non-pecuniary damage the applicant company may have sustained (see, for example and mutatis mutandis, Vereinigung Bildender Künstler v. Austria, no. 68354/01, § 44, 25 January 2007). Costs and expenses 104. The applicant company claimed EUR 22,780.96 for the costs and expenses incurred before the domestic courts and EUR 4,894 for those incurred before the Court. These sums include VAT. 105. The Government considered these claims excessive and disputed the assertion that the procedural steps taken by the applicant company had been effective. The applicant company could not claim more than it would have been awarded had it been successful in the domestic proceedings. As regards the costs of the proceedings before the Court the Government argued that the applicant company had been able to rely in part on the written submissions presented in the domestic proceedings when preparing the submissions to the Court. 106. According to the Court’s case-law an applicant is entitled to the reimbursement of costs and expenses only in so far as it has been shown that these were actually and necessarily incurred and are reasonable as to quantum (see Associated Society of Locomotive Engineers and Firemen (ASLEF) v. the United Kingdom, no. 11002/05, § 58, 27 February 2007, and the cases cited therein). In the present case, regard being had to the documents in its possession and the above criteria, the Court considers it reasonable to award the sum of EUR 15,000 for costs and expenses incurred in the domestic proceedings and EUR 2,000 for the proceedings before the Court, plus any tax that may be chargeable to the applicant company. Default interest 107. The Court considers it appropriate that the default interest rate should be based on the marginal lending rate of the European Central Bank, to which should be added three percentage points.
The Court held that there had been a violation of Article 10 (freedom of expression) of the Convention in the present case, finding that the court orders in question had not been necessary in a democratic society. The Court found, in particular, that user data did not enjoy the protection of “journalistic sources”, and there was no absolute right to online anonymity. However, the domestic courts had not even balanced the interests of the plaintiffs with the interests of the applicant company in keeping its users anonymous so as to help promote the free exchange of ideas and information as covered by  Article 10 of the Convention.