A Dutch court has ruled that Facebook can be required to use filter technologies to identify and pre-emptively take down fake ads linked to crypto currency scams that carry the image of a media personality, John de Mol, and other well known celebrities.
The Dutch celerity filed a lawsuit against Facebook in April over the misappropriation of his and other celebrities' likeness to shill Bitcoin scams via fake ads run on its platform.
In an immediately enforceable preliminary judgement today the court has ordered Facebook to remove all offending ads within five days, and provide data on the accounts running them within a week.
Per the judgement, victims of the crypto scams had reported a total of €1.7 million (~$1.8M) in damages to the Dutch government at the time of the court summons.
The case is similar to a legal action instigated by UK consumer advice personality, Martin Lewis, last year, when he announced defamation proceedings against Facebook -- also for misuse of his image in fake ads for crypto scams. Lewis withdrew the suit at the start of this year after Facebook agreed to apply new measures to tackle the problem: Namely a scam ads report button. It also agreed to provide funding to a UK consumer advice organization to set up a scam advice service.
In the de Mol case the lawsuit was allowed to run its course -- resulting in today's preliminary judgement against Facebook.
It's not yet clear whether the company will appeal but in the wake of the ruling Facebook has said it will bring the scam ads report button to the Dutch market early next month.
In court, the platform giant sought to argue that it could not more proactively remove the Bitcoin scam ads containing celebrities' images on the grounds that doing so would breach EU law against general monitoring conditions being placed on Internet platforms.
However the court rejected that argument, citing a recent ruling by Europe's top court related to platform obligations to remove hate speech, also concluding that the specificity of the requested measures could not be classified as 'general obligations of supervision'.
It also rejected arguments by Facebook's lawyers that restricting the fake scam ads would be restricting the freedom of expression of a natural person, or the right to be freely informed -- pointing out that the 'expressions' involved are aimed at commercial gain, as well as including fraudulent practices.
Facebook also sought to argue it is already doing all it can to identify and take down the fake scam ads -- saying too that its screening processes are not perfect. But the court said there's no requirement for 100% effectiveness for additional proactive measures to be ordered.
Its ruling further notes a striking reduction in fake scam ads using de Mol's image since the lawsuit was announced.
Facebook's argument that it's just a neutral platform was also rejected, with the court pointing out that its core business is advertising. It also took the view that requiring Facebook to apply technically complicated measures and extra effort, including in terms of manpower and costs, to more effectively remove offending scam ads is not unreasonable in this context.
The judgement orders Facebook to remove fake scam ads containing celebrity likenesses from Facebook and Instagram within five days of the order -- with a penalty of €10k per day that Facebook fails to comply with the order, up to a maximum of €1M (~$1.1M).
The court order also requires that Facebook provides data to the affected celebrity on the accounts that had been misusing their likeness within seven days of the judgement, with a further penalty of €1k per day for failure to comply, up to a maximum of €100k.
Facebook has also been ordered to pay the case costs.
Responding to the judgement in a statement, a Facebook spokesperson told us:
We have just received the ruling and will now look at its implications. We will consider all legal actions, including appeal. Importantly, this ruling does not change our commitment to fighting these types of ads. We cannot stress enough that these types of ads have absolutely no place on Facebook and we remove them when we find them. We take this very seriously and will therefore make our scam ads reporting form available in the Netherlands in early December. This is an additional way to get feedback from people, which in turn helps train our machine learning models. It is in our interest to protect our users from fraudsters and when we find violators we will take action to stop their activity, up to and including taking legal action against them in court.
One legal expert describes the judgement as "pivotal". Law professor Mireille Hildebrandt told us that it provides for as an alternative legal route for Facebook users to litigate and pursue collective enforcement of European personal data rights. Rather than suing for damages -- which entails a high burden of proof.
Injunctions are faster and more effective, Hildebrandt added.
This is a tort case, not based on GDPR. Enforcement of GDPR obligations can also be ensured via such penalty payments (much more effective than fines), ex art. 79 GDPR, which basically requires that tort actions can be filed against controllers if unlawful processing 4/4
— Mireille Hildebrandt (@mireillemoret) November 12, 2019
https://platform.twitter.com/widgets.js
"It clearly demonstrates that Facebook is an advertising platform that can be held liable under Dutch tort law for not taking adequate measure to remove fake ads, provided certain conditions apply (such as that the request for an injunction is sufficiently specific)," she said. "It also clearly demonstrates that filing an injunction to stop unlawful behaviour based on tort law can be very efficient, without having to prove damages, because the injunction can be enforced by way of penalty payments for each day that it is not complied with."
"I believe that this is the kind of action Member State should enable under art. 79 GDPR [General Data Protection Regulation] in the case of unlawful processing of personal data," Hildebrandt added.
"Art. 80 GDPR allows data subjects to mandate their right to file such an injunction to a dedicated NGO (thus enabling collective action). This is not the case for a tort actions suing for damages, in that case the GDPR leaves it up to the Member States whether or not to allow such mandating. On top of that suing for damages is very cumbersome in the case of unlawful processing, because it is usually very difficult to prove damages and to prove causality."
The judgement also raises questions around the burden of proof for demonstrating Facebook has removed scam ads with sufficient (increased) accuracy; and what specific additional measures it might deploy to improve its takedown rate.
Although the introduction of the 'report scam ad button' does provide one clear avenue for measuring takedown performance.
The button was finally rolled out to the UK market in July. And while Facebook has talked since the start of this year about 'envisaging' introducing it in other markets it hasn't exactly been proactive in doing so -- up til now, with this court order.
This report was updated with additional comment
