Investigating Cyber Law and Cyber Ethics

Ethics and Legal Aspects of Virtual Worlds Bente, G., Rüggenberg, S., Krämer, N. C., & Meadows, M. S. (2008). I,Avatar: The Culture and Eschenburg, F. (2008).Avatar-Mediated network- Consequences of Having a Second Life. Berkeley, ing: Increasing social presence and interpersonal CA: New Riders. trust in net-based collaborations. Human Com- munication Research, 34, 287–318. doi:10.1111/ Pasquinelli, E. (2010). The illusion of reality: j.1468-2958.2008.00322.x Cognitive aspects and ethical drawbacks: The case of Second Life. In Wankel, C., & Malleck, S. Boellstorff, T. (2010).Atypology of ethnographic (Eds.), Emerging Ethical Issues of Life in Virtual scales for virtual worlds. In Bainbridge,W. S. (Ed.), Worlds (pp. 197–216). Charlotte, NC: Information Online Worlds: Convergence of the Real and the Age Publishing. Virtual (pp. 123–134). London: Springer-Verlag. doi:10.1007/978-1-84882-825-4_10 Pearce, C. (2006). Seeing and being seen: Presence & Play in Online Virtual Worlds. Online, offline Ducheneaut, N. (2010). Massively Multiplayer and the concept of presence when games and VR Online Games as Living Laboratories: Oppor- collide. USC Institute for Creative Technologies. tunities and Pitfalls. In Bainbridge, W. S. (Ed.), Online Worlds: Convergence of the Real and the Prisco, G. (2010). Future evolution of virtual Virtual (pp. 135–146). London: Springer-Verlag. worlds as communication environments. In Bain- doi:10.1007/978-1-84882-825-4_11 bridge, W. S. (Ed.), Online Worlds: Convergence of the Real and the Virtual (pp. 279–288). London: Ess, C. (2009). Digital Media Ethics. Cambridge, Springer-Verlag. doi:10.1007/978-1-84882-825- England: Polity Press. 4_22 Guest,T. (2007). Second Lives:AJourney Through Sicart, M. (2010). This War is a Lie: Ethical Im- Virtual Worlds. London: Random House. plications of Massively Multiplayer Online Game Design. In Wankel, C., & Malleck, S. (Eds.), Hickey-Moody, A., & Wood, D. (2010). Ethics in Emerging Ethical Issues of Life in Virtual Worlds Second Life: Difference, Desire and the Produc- (pp. 177–196). Charlotte, NC: Information Age tion of Subjectivity. In Wankel, C., & Malleck, S. Publishing. (Eds.), Emerging Ethical Issues of Life in Virtual Worlds (pp. 153–176). Charlotte, NC: Information Soraker, J. H. (2010). The Neglect of reason: Age Publishing. A plea for rationalist accounts of the effects of virtual violence. In Wankel, C., & Malleck, S. Hoyle, C., & Zedner, L. (2007). Victims, Vic- (Eds.), Emerging Ethical Issues of Life in Virtual timization, and Criminal Justice. In Maguire, Worlds (pp. 15–32). Charlotte, NC: Information M., Morgan, R., & Reiner, R. (Eds.), The Oxford Age Publishing. Handbook of Criminology (4th ed., pp. 461–495). Oxford University Press. Tavani, H. T. (2007). Ethics and Technology: Ethical Issues in an Age of Information and Maher, M. L. (2010). What people talk about Communication Technology (2nd ed.). Hoboken, in virtual worlds. In Bainbridge, W. S. (Ed.), NJ: Wiley. Online Worlds: Convergence of the Real and the Virtual (pp. 201–212). London: Springer-Verlag. Wall, D., & Williams, M. (2007). Policing diver- doi:10.1007/978-1-84882-825-4_16 sity in the digital age: maintaining order in virtual communities. Criminology & Criminal Justice, 7, 391–415. doi:10.1177/1748895807082064 130

Ethics and Legal Aspects of Virtual Worlds Wall, D. S. (2007). Cybercrime. Cambridge, KEY TERMS AND DEFINITIONS England: Polity. Adaptive Governance System: A system Wankel, C., & Malleck, S. (2010). Exploring of governance that can adapt to the needs of the New Ethical Issues in the virtual worlds of the governed. It is flexible, collaborative and learn- twenty-first century. In Wankel, C., & Malleck, S. ing based. (Eds.), Emerging Ethical Issues of Life in Virtual Worlds (pp. 1–14). Charlotte, NC: Information Avatar: In computing, a representation of the Age Publishing. user in the form of a three-dimensional model. Whitson, J., & Doyle, A. (2008). Second Life and Cybercrime: Crimes that occur in online en- governing deviance in virtual worlds. In Leman- vironments. These can be subdivided into internet Langlois, S. (Ed.), Technocrime: Technology, enabled crimes, internet specific crimes and new crime and social control. Cullompton, Devon: crimes committed in a virtual world. Willan (pp. 88–111). Cybersociety: An online community of users Williams, M. (2006). Virtually Criminal: Crime, who have formed an either implicit or explicit deviance and regulation online. Oxon, England: society, possibly with a set of social norms, rules Routledge. and etiquette. Williams, M. (2010). The virtual neighbourhood Soft Law: A concept of law that is developed watch: netizens in action. In Jewkes, Y., & Yar, M. by agreement, laws which consist of informal rules (Eds.), Handbook of Internet Crime (pp. 562–581). which are non-binding but due to cultural norms Cullompton, England: Willan. or standards of conduct, have practical effect. Yee, N. (2010). Changing the Rules: Social Ar- Variable Ethics: The concept that ethics are chitectures in Virtual Worlds. In Bainbridge, W. not fixed but vary depending on the nature of the S. (Ed.), Online Worlds: Convergence of the Real virtual world you are in and the accepted norms and the Virtual (pp. 213–224). London: Springer- of that world. Verlag. doi:10.1007/978-1-84882-825-4_17 Virtual World: Virtual representations of three-dimensional spaces, often online. 131

132 Chapter 8 Narbs as a Measure and Indicator of Identity Narratives Ananda Mitra Wake Forest University, USA ABSTRACT Social media systems allow individuals to create a discursive identity for themselves using differ- ent tools all of which function as narrative bits of information, or “narbs,” which in unison create a composite identity of an individual. The narbs possess certain specific measurable attributes - type of content, authorship, frequency of appearance and spatial information. Each of these attributes offer bits of information about the individual and careful examination and enumeration of these attributes of the narbs produce a narb weight and a narb matrix which can be examined numerically to provide a preliminary understanding of how granulated an identity narrative would be when narbs are examined for a particular individual. INTRODUCTION SNS information could be used by individuals and institutions to learn about each other. The The growing number of people who have began two concerns that are addressed in this chapter to subscribe to social networking sites (SNS) deal with first, finding a way to systematically in the early part of the Twenty-first century has enumerate and analyze the information on SNS been a phenomenon that has attracted significant and secondly using the enumeration system to attention from scholars, popular media, and the better manage the way in which narrative bytes general population as people have embraced the or “narbs,” are produced and used (Mitra, 2010). SNS system as a tool of communication (Kirk- To begin with, it is useful to consider the place patrick, 2010; Lenhart, 2009). This growth has of SNS in a larger context of creating a presence also resulted in concerns over the way in which for an individual or institution when the “real” object disappears from sight to be substituted by DOI: 10.4018/978-1-61350-132-0.ch008 a discursive presence. Copyright © 2012, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited.

Narbs as a Measure and Indicator of Identity Narratives The phenomenon of creating a digital dis- primarily on the content of the connection. This cursive presence on SNS is an example of the chapter examines the ways in which the existing increasing digitization of everyday life activities and emergent tools are producing opportunities as an increasing number of people are creating for creating the presence that brings with concerns social media profiles or micro-blogging their every around deciphering the identity of an individual single mundane activity. However, the process of based on the digital presence that is created for creating a presence via technological mediation and by the individual. The key objective is to existed before digitization became the driving develop a systematic way of understanding how force behind much of modern tools. Consider for the presence is created around different elements instance the phenomenon of creating the “party such as content, authorship, place and frequency line”. This was a popular use of the familiar tele- at which the discourses are produced. The specific phone technology that would allow many people, form of digital tool is what has been labeled as often women, to connect with each other in a SNS2 and it is useful to consider the idea of social synchronous manner and talk over the phone for networking where presence exists and identity is long periods of time and share a variety of infor- constructed. mation about each other, and most importantly, about others in the form of gossip (Rakow, 1988). OVERVIEW OF SOCIAL The telephone allowed individuals to transcend NETWORKING the barrier of space and create a “telephonic pres- ence” where the telephonic glue held together the The transformation from the virtual communities people even if they were not “there” in the real. based around text-intensive discussion boards This idea was extrapolated when digitization al- to the SNS was made possible because of two lowed for the creation and circulation of the “digital major developments in the technological sphere presence” through tools such as such as listserves – availability of powerful digital machines, and and Usenet groups that were popular in the late the wide-spread penetration of high-speed data 1980s and early 1990s1. The technology was not connections. The first component of the change sufficiently sophisticated to allow for sharing of refers to the proliferation of digital tools, from much beyond written texts that would create the computers to smart cell phones, that are able to discursive space where the virtual communities rapidly process the large amounts of data produced would be formed (Mitra, 1996, 1997). by the digitization3 of audio and image informa- tion. The second component of the change refers A crucial common element in all the different to the way in which the digital tools are able to networks was the way in which a person would connect to central repository of data files which choose to present themselves within the network can store extremely large amounts of data that independent of the technology used to connect the can be rapidly transmitted from a centralized people. Bracketing out the real networks, where the location to a digital tool. These two technological “flesh and blood” person would actually interact developments led to the emergence and popularity with another “real” person, the specific network- of a class of Web-based applications that quickly ing technology had an impact on the specific came to be known as SNS. As pointed out in the presence that would be created. The telephone articles in the special theme section of the Journal only allowed for the voice to be the vehicle for of Computer Mediated Communication compiled creating the presence whereas the multi-media by Boyd and Ellison (2007) there were numer- options provided by Web sites such as Chatrou- ous SNS forums that came and went in the latter lette (Kreps, 2010) can allow for the production of a more detailed and variegated presence based 133

Narbs as a Measure and Indicator of Identity Narratives 1990s and the early 2000s, with different SNS the real entity that is depicted online. Secondly, providing different kinds of functionality and at- the matter, naturally, is simpler if the observer has tracting different levels of following among users. some a priori information about the real entity. Independent of what the nature and purpose of the For example, if one were to know that a person is SNS was, what remained common across these likely to exaggerate, then this prior information systems is the fact that users of these networks had would attenuate the interpretation of whatever is to create a digital presence of themselves to be a reported in an online situation. In such cases, the part of the network. To be sure, the very process real and the virtual coalesce to produce a specific of becoming a member of the network involved cybernetic presence where both the real and the the act of selecting a set of personal attributes virtual are considered together to understand who that would become the “profile” of the person a person is5. The authentic identity of a person or creating the presence. institution was the product of the ways in which an entity would manufacture specific images in The process of creating presence is, however, the realm of cybernetic space. Much of identity neither novel nor unique to SNS. For instance, the production in the synthetic digital-real realm was replacement of the “real” person by the “virtual” done by the careful selection and propagation of presence was witnessed with the emergence of discourse by the person or institution creating the the early virtual communities based on text based representation. Consider for instance the way in exchanges. Given the available technological so- which a “home page” is created where specific and phistication of the CMC of the 1980s and 1990s, carefully selected images and discourse is used to most of the interactions that made up the virtual describe the face of a person or an institution so communities were based on textual discourse that in combination with the real face of the entity made up by people who would use the computer a complete image of the unit is manufactured for to present a virtual self to other members of the global consumption. group4. The replacement of the real person by the virtually available discourse also created a condi- The situation changes somewhat with the SNS tion where the discourse became the primary mode where the primary method used to speak about of creating a presence of the person. This presence an individual is through the use of tiny narrative was removed from the real because it might have bits, abbreviated into the term ‘narbs’ that the been impossible to ever have a clear understand- individual along with the numerous friends can ing of the real entity since the entity was always place in the digital space called the profile of an already produced by discourses.This phenomenon individual (Mitra, 2010). These narbs become the produced specific issues related to the authenticity building blocks of the profile page of a person as of the entity that would be available in discourse they are constantly added to the profile page of an (Mitra, 2002). First, it would be impossible to be individual. Visiting the profile of an individual is sure that what was being presented in a discursive tantamount to examining the narbs of the person form was indeed what the entity was. This phe- and the narbs, in their summation, offers a notion nomenon extends to all entities that have a digital of what the person is like. Making attributions presence – from a person to an institution – and of the “real” person thus begins with the careful the presence is often the careful construction of a examination of the narbs that produce the digital “face” that is visible to the World (Hyde & Mitra, presence of the person on a SNS.The narbs become 2000). The user of the information must decide if the building blocks of the digital and cybernetic the presence is authentic and trustworthy so that presence of the individual and it is important to the observer can make specific attributions about consider a systematic way of enumerating the 134

Narbs as a Measure and Indicator of Identity Narratives narbs so that the composite narrative identity are produced by an individual and those that are can be judged for its authenticity and validity for produced for the individual by someone else. The presenting an accurate image of the real person. first kind is a “self narb” where an individual is The process begins by examining a set of specific able to retain control on the information that is attributes of all narbs. produced and circulated amongst the community of friends within a SNS. The second kind is the There are four significant attribute for each “other narb” where an individual has little control narb. To begin with, it is important to consider the on the information that is produced and circulated person who is the author of the narb. There are two within the group of friends within a SNS. Both possibilities that exist here – either the individual these narbs play a role in the production of the retains agency and authorship in producing the digital presence of an individual where an observer personal narb or it is a friend of the person who would study both set of narbs to put together the actually produces the narb that is placed on an digital image. Unless the observer is especially individual’s profile page. Another attribute of a careful in distinguishing between the self and the narb that is important to consider is the content of other narbs the composite image of the digital the narb, which could vary from simple text to an presence could have internal contradictions and elaborate video with commentary or connections inconsistencies that could produce a confusing with other texts via hyperlinks from the profile image. page. A third attribute of narbs is the frequency with which narbs are updated and the chronological The process is best illustrated with a hy- characteristics of the narbs. Finally, a fourth way pothetical example. Consider, for instance, a to consider the narbs is their relationships with profile page from any popular SNS. Generally real life space and place, since narbs can be used the information on the profile page is populated to indicate where a person is placed in the real with updates from the numerous friends who are world. It is important to note that these attributes on SNS as well as the updates of personal status do not represent independent and distinct forms of the individual. A person can choose to update of narbs, but using these attributes allow for the status at a rapid pace offering details of the flow of examination of any narb from all these different everyday life by recording simple events in one’s perspectives. Thus, for any narb it is possible to life. These self narbs could become a chronicle ask four specific questions – Who produced it? of the person’s real life existence. In that spirit, a What is it made up of? When was it produced? person on vacation with friends might simply be And where was it produced? Answering these recording the places visited over a span of time. questions about the numerous narbs can begin However, a friend travelling with the individual to create an image of an individual which then could be chronicling specific events during the becomes the locus of debate about the authentic- trip with the use of photographs that are tagged ity of the image. with name of the individual. As soon as a picture is tagged, that information usually appears on NARB ATTRIBUTES the profile page of the individual and a person observing the profile page is able to see the picture Agency that has been tagged. The picture could reveal information that could be quite contrary to what There are two major kinds of narbs that can be the updated status claims. While the individual’s identified on the basis of agency – those that self narb - the personal updates - might claim that the trip is educational, the other narb - the 135

Narbs as a Measure and Indicator of Identity Narratives tagged picture - could represent an evening at a in seminal work of scholars like Walter Fisher nightclub. These two narbs might not tell one (1987) and Paul Ricouer (1984) on narratives. consistent story leading to a conflicted image of Others have also demonstrated the way in which the individual, and consequently call into ques- identity is often constructed around specific narra- tion the authenticity and the trustworthiness of the tives that a person might create for oneself (Autio, different narbs. Yet, this is not necessarily a new 2004; Bers, 1999; Hall, 1992; Jones, et. al., 2008; phenomenon. In real life, a person is evaluated Redman, 2005; Whitebrook, 2001). However, on both in terms of the real face the person presents SNS, there are hundreds of other potential agents, as well as the way in which a person is described. with about the same authoring powers as any of Consider for instance the importance of letters of the other agents, who can contribute to the digital recommendation in the context of evaluating the image of the individual. There is no guarantee that worth of a person. For example, when a person these agents and their other narbs would have any might seek higher education opportunities it is not consistency with the self narbs – leading to the uncommon for an university to seek a “statement condition of confusion that an observer might of purpose” authored by the applicant and a set experience in developing a composite image of of letters of recommendation authored by trust- a digital person. Furthermore, the confusion is worthy individuals who can present an authentic exaggerated by the different kinds of content – description of the person within the context of the from simple texts to elaborate applications – that application to an institution of higher education. are used to produce the digital image. The next The combination of this information offers the section examines the different kinds of content evaluators some basis to come to a decision about that make up the narbs encountered. the person’s worth. This principle is immensely scaled up in the case of SNS. It is no longer the Content case that three to five people are offered the agency to remark on an individual but any one of The process of digitization reduces any form of the hundreds of friends that encrust an individual information into a series of binary codes eventu- are agents who can comment on the identity of an ally represented by ‘0’ and ‘1.’ The outcome of individual. Unlike the letter of recommendation this process is the fact that the code can be used that is sought from trustworthy agents, the hun- to represent any form of information: from written dreds of friends could say what they please about text to elaborate video; these different forms of an individual and contribute to the production of content can be combined to produce a composite the face of the individual. narrative about what the content refers to. The idea of multi-media presentation is built on the The conflict is the result of the fact that differ- construct that different kinds of content produce ent people act as authors of the narbs. Authorship an overall depiction of the subject matter of a and agency are closely related (Mitra & Watts, presentation. Narb content also operates in a 2001). The agent is the person who has an interest similar fashion. Most SNS allow the inclusion of in producing a specific image through carefully different kinds of content that can be accessed from selected discourse. The agent carefully selects the primary page allotted to a member of a SNS. the voice that would be utilized in telling a story. The simplest form of content is the text ‘update’ In the case of the self narbs an individual is able of personal status produced by a self narb. These to retain the control on agency and be thoughtful messages are usually short and provide rudimen- about the narrative that the self narbs produce. tary information about what a person might be Also, as in the case of most agents, there is a certain doing at a particular point in time. These simple internal consistency in the narrative, as suggested 136

Narbs as a Measure and Indicator of Identity Narratives updates of one’s status have become ubiquitous relatively inexpensive way of doing these updates elements for most SNS, and some have actually allows individuals to quickly add numerous narbs promoted these updates so aggressively that users to a profile presenting a fairly detailed story of might be producing these short messages at a very oneself using pictures and words. rapid interval. This type of content is usually only textual and can only be authored by the owner of It is also possible to create video and audio the SNS account. These updates can also be traced narbs where the user is able to present such in- over time to examine to the different status narbs formation as a part of the story one creates about that have been offered by an individual, virtually oneself. The fact that both audio and video content creating a narrative time line of the person using are technologically more difficult to handle pro- the text narbs. duces specific challenges for using them as narbs. In most cases, this type of content is provided as a These text narbs are supplemented in many hyperlink to a different digital resource that resides SNS by another series of textual content where on the Internet. Especially for SNS that are not the narb represents a publicly available message built around the audio/video platform, the audio/ sent to an individual by others. These textual video form of content becomes a little bit more narbs compose a narrative that shows what others challenging to use as a narb and also somewhat are telling an individual and display information more difficult to use for the observer. Part of the that might have been unknown to many of the difficulty arises from the fact that it takes a little observers who read these text narbs. Consider longer to consume the audio and video narbs, for instance the way in which a person is offered and by definition, the narb is a “bit” of informa- birthday wishes using text narbs that show one tion that creates a very quick image of a person. person wishing another a happy birthday. Such a Since narbs often function as the tiniest bit of textual narb often creates a cascade of messages personal information that can be read quickly, the as others are reminded of the day and in a short audio/video information is not as well suited to time numerous text narbs populate the primary serve as narbs making the process of creating the page of an individual.As in the case of any textual composite narrative somewhat more challenging content, the stories told by these narbs remain when the audio/video content is included in the embedded in the few words that can be used for production of narbs. the updates and messages. While the audio/video content is less suitable The details of the message change when for a large group of SNS, it must be noted that narbs are made up of visual content in the form there are some SNS that are designed around of pictures and videos. Such content is becoming video. These SNS focus only on video content increasingly popular with the rapid penetration of (which also contains the audio content) provided different tools that can easily collect and distribute by its numerous users and the image of the user visual information. Commonly used smartphones is produced around the video information con- are equipped with digital still and video cameras nected to an individual6. These Web resources and tiny computer programs, often called ‘apps,’ serve as SNS because these connect together many on these tools allows the user to instantly send individuals whose relation to each other is built a picture or video to a SNS Web site where the around the video content each person provides. visual content becomes a narb. The process of Furthermore, the video content provided by an “mobile uploads” that is offered by some smart- individual is potentially available to anyone else phones also allows the user to annotate the picture with access to the Web resource. A commercial with a textual narb creating a composite story example of the video SNS is YouTube where that includes the visual and textual content. The content is built completely around audio/video 137

Narbs as a Measure and Indicator of Identity Narratives information complemented by some text accom- get lost amongst the narbs provided by those who panying the video content. However, such content are regular in updating. do not qualify as narbs as in the case of other SNS where the networking component is considered The frequency of updates provide a sense to be very important. of commitment to keep others informed of the life story of an individual as new narbs appear In summary, the mainstream SNS resources are so that observers get an opportunity to see what built largely around images and words whereas the exactly might be happening in the life of another video and audio content is somewhat less utilized individual. However, the frequently updated narbs in the traditional SNS. The ease of producing the also embody a sense of flow of narbs where the text and images also leads to a variation in the frequently updated narbs, when observed in the frequency at which narbs are made available by correct chronological sequence, tells a specific individuals and that is another component of the story about the way in which a person’s life might narb that is worthy of consideration. have changed over time. These narbs become the living story of an individual and presents for others Frequency and Flow an opportunity to see what has gone on in one’s life, but could also provide the incentive to fol- One of the significant differences between the low the narbs of any particular individual as new way in which Web sites operate and narbs do is things are anticipated in the person’s life. As in the frequency with which information is updated the case of all good narratives the narbs that flow using narbs. Generally, Web sites do not change in a specific and observable manner over a period too often unless the Web site belongs to organiza- of time offer the continuity that a good story must tions that are in the business of reporting news or always have (Fisher, 1987). The continuity over information that must remain current. Personal time is also complemented by the way in which Web sites could change to show specific changes narbs are able to demonstrate movement through in real life events, but the process of altering a space as well. There are increasing numbers of Web site is more complex than creating a small tools that allow users to report their position in narb and reporting that to the SNS. The success space as they continue to provide narbs over time. of SNS lies precisely in the fact that individu- als habitually provide narbs that populate the Place SNS page of the all the people connected to that individual. These updates make up the primary Most narratives are located in specific places and content of SNS. However, it is also possible happen within a spatial context. At the same time, to consider the frequency with which different at a personal level, one of the most common que- individuals would provide new narbs. There is ries about a new acquaintance is, “where are you a good amount of variation in the frequency of from?” Knowing the spatial origins of a person updates with some people updating so rapidly that and the current spatial location provides a specific the traditional SNS was not considered to the be set of attributes for the person. Yet, in creating the best forum of such updates, and new forums the digital presence of an individual the place called micro-blogging system became popular where a person is becomes relatively inessential to accommodate those who would compulsively (Mitra, 2008). A person is in the virtual place report changes to their personal status as soon as called cyberspace, and the fact that the person is the change happened (McCarthy, 2009). On the constantly updating personal status via narbs was other hand, there are some who completely disap- considered sufficient to create a narrative about the pear from sight because their infrequent updates person, even though the spatial information can 138

Narbs as a Measure and Indicator of Identity Narratives offer significant additional information to better the user can actually build a complete narrative construct the identity narrative of an individual. based on the pins that indicate specific place narbs. The increasing adoption of the technology of- In this case, the place information is shared not fered by the Global Positioning System (GPS) only as the immediate location of the individual has begun to offer the place information as part based on GPS coordinates, but by participation of the narrative produced by SNSs. in an application that allows an observer how an individual has moved through space over time or The GPS technology allows a person to know the different places an individual has been over a where one is with great deal of accuracy7. If a length of time. This spatial information does not person has a GPS-enabled smartphone with map- rely on automated systems such as GPS, but are ping software installed on the phone then a person products of deliberate work by an individual to only needs to be in clear view of the sky and one share specific information related to the places would appear as a dot on a digital map. However, one has been to, or the place one occupies at the since smartphones are devices that also allow time of producing the narb by making a statement for SNS narb updates, it is possible to provide a like, “just landed in Chicago.” spatial narb that reports the location of a person’s smartphone at any point in time. As long as one The place narb thus operates in two different assumes that the smartphone is with the individual ways. It is possible to have a digital tool such it is possible to know where the person is. Hav- as a smartphone or GPS-enabled digital camera ing that information can add to the image of the automatically record and report the spatial in- person as different components of narbs build the formation. Such information can accompany a composite narrative about the individual. Indeed, mobile upload of a picture where there is meta- some of the smartphones and SNS have made the data about the place where the picture was taken. place narb a ubiquitous tool where the user only The second way a place narb appears is when a needs to activate a simple feature and the place person reports a place using specific applications narb would automatically report on the location that are built to offer spatial information or by a of the individual’s smartphone without the indi- personal status update that contains explicit spa- vidual actually having to do anything special to tial information. One primary difference between report the location. This is a passive process that these two modes lies in the frequency with which recedes into the background where an individual these narbs appear. The automatic method could might not have to do much more than a simple happen constantly whereas the method using the key press to create a narb that immediately reports applications or status update would only occur the location of the person’s smartphone as a narb when the individual chooses to provide the update. on SNS (Miller, 2010). The place narb becomes a good example of how the different components discussed in this essay The place narb has also been a part of an ac- offer an analytic framework and every narb could tive system where individuals would actively and indeed possess all the different components. deliberately report their location to create a specific narrative. Most SNS offer “third party” applica- Components of a Narb tions that allow a user to perform a large range of functions like report special kinds of information Based on the discussion above it is possible to about oneself or play multi-player games with claim that any particular narb possesses charac- their friends. One such application offers the user teristics that include different elements in different the opportunity to indicate the number of places amounts. Because any narb contains different one has visited using a map of the World. Here 139

Narbs as a Measure and Indicator of Identity Narratives portions of the four components identified here a fixed length of time it would be possible to it is possible to tag a specific narb with its dif- compute the total narb weight for an individual. ferent characteristics. The categorization of a narb is based around the answer to the following As also shown in Figure 1, a second numerical questions: value is obtained by creating a narb matrix which is made up of a two by two matrix where each of • Who creates the narb? the four numbers in the matrix represent the dif- • What is the content of the narb? ferent values attached to the four elements of the • How long after the previous narb does the narb. Using the principles of matrix mathematics, it is then possible to create a composite matrix narb under scrutiny appear? for numerous narbs over a fixed period of time. • What spatial location is specified in the Thus any narb could produce a narb weight and a set of narbs yield a narb matrix both of which narb? can play an important role in the process of creat- ing an identity narrative for an individual. It is then possible to tag any specific narb along these vectors where the answers indicate the Creating a number from a narb allows an ana- quality of the narb. When this analysis is applied lyst to move beyond the condition that narbs usu- to a collection of narbs available on a person’s ally do not lend themselves to very careful textual, profile page in any SNS it is possible to calculate critical or rhetorical analysis because narbs are, a numerical value for a set of narbs. That value by definition, bits of information and not lengthy can provide an indication about the usefulness of passages about an individual. Consequently narbs SNS narbs in composing the identity narrative of could be considered somewhat banal and not the person. In some cases, the numerical value truly worthy of analysis. At the same time, in a could have characteristics that would call into somewhat internally inconsistent manner, there question the authenticity of the identity narrative are instances when individual narbs sometimes composed from the narbs. In such cases it would become the focus of attention and the entire iden- be wise not to rely on narbs to offer an authentic tity of an individual could become crystallized identity narrative and look elsewhere to find such around only a small number of narbs among the narratives. The numerical value of a narb, or a set hundreds the person might have on the profile of narbs, is based on the weight of any narb with page of a SNS (see e.g., Frazier, 2010). There are respect to the four questions indicated earlier. thus two opposing threats related to the analysis of narbs – either the content could be ignored Each of the questions described here can have because narbs are considered inconsequential or responses that can be translated to specific numeri- a single narb could receive undue attention creat- cal values that provide a specific narb with very ing an unreliable narrative. Both these issues are specific quantitative values as described in Figure addressed when specific numeric values can be 1. Each narb is considered to have four contribut- produced about a single or set of narbs. ing elements that make up the total weight of the narb. Each contributing factor can provide up to The process would begin with the selection of one unit towards the weight making the maximum a threshold of narbs that would be used for the weight for any narb to be 4.0. This represents the analysis. This threshold could be a certain length summative value for the narb. For instance it is of time. For instance, it could be argued that narbs possible to claim that a self-narb that is simply that have been produced within the past twelve textual and presents location information within months are worthy of analysis, or only the last three hours of the earlier posting would have a 100 narbs need be analyzed. Once a defensible summative weight of 3.05 (see Figure 1). Over threshold has been established it is possible to 140

Narbs as a Measure and Indicator of Identity Narratives Figure 1. Computing the narb weight and narb matrix begin to create the set of numbers related to the realm of discourse analysis that more informa- narbs. Consider, for instance, an individual who tion is contained in a message that is made up of has 100 narbs available for analysis. Each of the different discursive components. A photograph narbs is represented as a narb matrix which also with written annotation and a brief audio element allows for the computation of the narb weight. would be considered more elaborated than a simple The first point of focus is the ‘C’ value of the textual update. Furthermore, the more complex matrix (see Figure 1). It has been argued in the content becomes a more trustworthy message 141

Narbs as a Measure and Indicator of Identity Narratives given that it contains greater depth which makes information to be used to construct the composite it more difficult to ‘fake.’ Given these assump- identity from the narbs. Yet, being a part of the tions, it is possible to claim that a higher ‘C’value matrix this value could be balanced against the ‘A’ would indicate a more variegated message. When value to ensure that the updates are indeed self- summed over all the 100 narbs, for an individual narbs as opposed to others providing information who offers highly elaborated narbs, the highest ‘C’ about an individual. A high ‘F’ value and a low value could be 100 and that would indicate that ‘A’ value would indicate that there is a need to there is sufficient information that is worthy of reconsider the authenticity of the narrative that careful further examination.That careful narrative can be produced by many people commenting analysis would help produce a detailed identity about an individual. narrative as compared to the case of an individual where the ‘C’ value is much lower. The final part of the matrix, the ‘P’ value is one with the most potential but is yet to become a The next value to consider is the ‘A’ value of very significant part of the identity construction. the narb matrix. As has been suggested earlier As indicated earlier, it is possible to get a sense of in the essay, it is possible that a person’s profile the place by looking for direct reference to place page is populated with narbs that are produced in the content of the narb. If indeed there is a by someone other than the individual. This would mention of place, for instance in the narb making produce a lower ‘A’ value. Indeed for 100 narbs a statement such as “I am in New York,” then that an ‘A’ value of under 30 would suggest that the can be verified to test if the statement was indeed individual has little control on the narbs that are truthful. An individual who has a high ‘P’ value available on the profile page problematizing the in self-disclosed location information produces reliability and authentic of the narbs since they a narrative identity whose authenticity can be are not authored by the individual. Once it is clear compared to real life information about the pat- that the individual has a low level of agency in terns of movement of the individual. However, the the creation of the narbs, it should follow that the potential of this component of the matrix also lies narbs are unreliable with respect to the creation of in the fact that with the increasing use of ubiquitous the identity narrative of the person. Others could location information, especially in smartphones, present narbs about an individual and it would the ‘P’information might get automatically coded be important to understand the motive behind into the narb and could always be expected to have the ‘other narbs’ before much can be made about a value of ‘1’ unless the individual disables that the identity narrative that relies on a set of narbs location functionality of the digital tool used to where the summative ‘A’value has a low number. produce the narb. In such a situation, there could well be questions about the reason for not disclos- The third part of the matrix, the ‘F’ value ing the location information. In some ways, the carries important information about the level of ‘P’value becomes a surrogate measure of privacy activity of an individual in the arena of digital about location with a lower ‘P’ value indicating social networking. Those who frequently update a desire on the part of the individual to keep the their status could yield a more detailed identity location information undisclosed. That informa- narrative compared to those who do not use the tion can help in building a composite narrative system as much. Therefore, a higher value for this identity of an individual. would indicate that there is a larger amount of 142

Narbs as a Measure and Indicator of Identity Narratives DISCUSSION AND set of narbs would yield useful information. For CONCLUDING REMARKS instance, consider the hypothetical summated narb matrices over a fixed period of time of two There is sufficient evidence to suggest that infor- individuals: mation from SNS is being used to make attribu- tions about individuals. Consider for instance the  2.5 3  (X)  2.5 10  (Y) situation with a waitress who lost her job because 0.50 0 0.75 3 of an impulsive status update on a popular SNS or the case of a college professor who was placed Even though they are posting similar type of on “administrative leave” because of a few narbs content as evidenced from the ‘C’ value of the posted on a SNS site (Frazier, 2010; Roper, 2010; matrices, the narbs of person ‘Y’could yield much Stripling, 2010). In such instances, these attribu- more authentic information given the higher value tions can have long-ranging effects on the lives for both ‘A’ and ‘P,’ and because the narb matrix of people whose narratives are produced out of of person ‘Y’ represent a more active person on the SNS information since these narratives “be- the SNS who holds agency over the narbs that come” authoritative and authentic based on the are available. It is therefore more likely that the discursive appeal of a single entry on the profile discursive analysis of the narbs of person ‘Y’ page of a person (Budden & Budden, 2008; Clark, would yield more authentic identity narrative. 2006; Finder, 2006). In such situations, there is Consequently, when large number of identity little desire and attempt to examine the discourse narratives might be sought, it would make more for its various components, and in relation to the sense to examine the discourses of person ‘Y’ as other type of information that is available at the compared to the person ‘X.’ Such comparisons profile page. Unfortunately, as demonstrated in can begin to simplify two major concerns related the few cases cited here, and numerous others to SNS – privacy and profiling. that go unreported, it is the limited number of discourses that often gain precedence when nar- The concerns of privacy and profiling are linked ratives are produced from narbs. Yet, these are to each other in certain instances where status indeed narbs, i.e., bits of information that must be updates that produce narbs become the source of combined to create the larger identity narrative. private information that results in the production This pitfall would be avoided when the numeric of profiles of individuals. Much of this concern, system described here is applied to the analysis, as stated in popular media, results from the fact before leaping to conclusions on the basis of a that specific narbs are used to create profiles single narb. as in the case of colleges which would use the narbs of high school students when they apply Creating a numeric rubric to examine narbs for admission into a college (Hechinger, 2008; is surely fraught with the danger of losing sight Livingstone, 2008). That approach often relies on of the discursive nature of the narbs. This essay single or very few narbs to create grand narratives is not about reducing the importance of a careful about the identity of an individual. However, as discursive analysis of narbs. Indeed, that process suggested here, it is first important to get a sense is a necessary part of the creation of identity narra- of the type of narbs that are actually available at tives and attributions about individuals. However, the personal SNS site of an individual. The first the process of textual and discursive analysis of step before creating narrative profiles ought to be specific narbs is a laborious and resource-intensive enumerating the narbs using the numeric system task. It would make much more sense to create suggested here. For instance, if the narb weight the summated narb matrices before selecting what over a fixed period of time is low, it is relatively safe to claim that the profile that can be obtained 143

Narbs as a Measure and Indicator of Identity Narratives from the narbs is weak and incomplete because the REFERENCES individual does not offer sufficient narbs to create a useful profile. If the narb weight is high then it Autio. (2004). Finnish young people’s narrative would be important to compute the narb matrix construction of consumer identity. International for the individual and examine the various cells Journal of Consumer Studies, 28(4), 388-398. of the narb matrix to decide if an authentic and reliable profile narrative can be obtained from the Bers, M. (1999). Narrative construction kits: Who narbs. This systematic approach could eliminate am I? Who are you? What are we? In Proceed- the need to look at the narb in detail if some sets ings of “Narrative Intelligence” Fall Symposium, of narbs can be screened out on the basis of the AAAI’99. narb matrix. With millions of people maintaining different kinds of narbs on multiple SNS sites Boyd, D., & Ellison, N. (2007). Social network the automated production of narb matrices could sites: Definition, history, and scholarship. Journal reduce the burden of looking at large amounts of of Computer-Mediated Communication, 13(1). narb content to find useful information. doi:10.1111/j.1083-6101.2007.00393.x Looking at narbs from the numeric perspective Budden, C. B., & Budden, M. C. (2008). The also offers individuals an opportunity to produce social network generation and implications for a systematic way of managing narbs. If a particu- human resources. 2008 ABR & TLC Conference lar cell, such as the ‘A’ value appears to be low Proceedings. compared to the overall narb weight, it would indicate to an individual that other people are Clark, A. S. (June 20, 2006). Employers look at contributing to an individual’s identity narrative Facebook, too. CBS Evening News. compared to the person himself or herself. Such checks based on the ongoing computation of a narb Finder, A. (June 11, 2006). For some, online per- matrix could offer a simple and systematic way sona undermines a résumé. The New York Times. to see how an individual’s profile is developing in the large SNS space. Knowing those values Fisher, W. R. (1987). Human communication as could allow an individual to change the kinds of narration: Toward a philosophy of reason, value, narbs being produced and become more mindful and action. Columbia, SC: University of South of the way in which narbs populate the identity Carolina Press. narrative being produced. Frazier, E. (2010). Facebook post costs The use of SNS is no longer a novelty, and is waitress her job. Charlotte Observer. Re- increasingly becoming a mainstay of the identity trieved from http: //www.charlotteobserver. of people. This increasing use of narbs requires com/2010/05/17/1440447/ facebook-post-costs- a more systematic way to manage narbs, and waitress-her.html that can be done with the use of narb weights and matrices. This chapter offers a way to do Hall, S. (1992) Cultural identity and diaspora. In the computations in a standardized manner that Rutherford (Ed.), Identity: Community, culture, can be applied to many different SNS systems difference. London, UK: Sage. because the four elements of a narb identified here remain common across most SNS systems. Hechinger, J. (2008). College applicants, beware: It is important to manage the narbs that create the Your Facebook page is showing. Wall Street identity narrative and management begins with a Journal. Retrieved from http: //online.wsj. com/ better understanding the nature of the narbs, as article/ SB122170459104151023.html suggested here. 144

Narbs as a Measure and Indicator of Identity Narratives Hyde, M., & Mitra, A. (2000). On the ethics Mitra, A. (1997). Virtual commonality: Looking of creating a face in cyberspace: The case of a for India on the Internet. In Jones, S. (Ed.), Virtual university. In Berdayes, V., & Murphy, J. (Eds.), culture. Newbury Park, CA: SAGE. Computers, human interaction and organizations (pp. 161–188). New York, NY: Praeger. Mitra, A. (2002, March). Trust, authenticity and discursive power in cyberspace. Communications Jones, R., Latham, L., & Betta, M. (2008). Nar- of the ACM, 45(3). doi:10.1145/504729.504748 rative construction of the social entrepreneurial identity. International Journal of Entrepre- Mitra,A. (2008). Using blogs to create cybernetic neurial Behavior & Research, 14(5), 330–345. space. Convergence, 14(4), 457–452. doi:10.1108/13552550810897687 Mitra, A. (2010). Creating a presence on social Kirkpatrick, M. (2010). Facebook’s Zuckerberg networks via narbs. Global Media Journal, 9(16). says the age of privacy is over. Read Write Web. Retrieved from http: //www.readwriteweb. com/ Mitra, A., & Watts, E. (2002). Theorizing cyber- archives/facebooks_ zuckerberg_says_the_age_ space: The idea of voice applied to the Internet of _privacy_is_ov.php discourse. New Media & Society, 4(4), 479–298. doi:10.1177/146144402321466778 Kreps, D. G. (2010). Foucault, exhibitionism and voyeurism on Chatroulette. Cultural Attitudes To- Rakow, L. (1988). Women and the telephone: wards Technology and Communication, 6, 17–21. The gendering of a communication technology. In Kramarae, C. (Ed.), Technology and women’s Lenhart, A. (January 14, 2009). Social networks voices: Keeping in touch (pp. 207–228). New grow: Friending mom and dad. Pew Internet & York, NY: Routledge. American Life Project. Redman, P. (2005). The narrative formation of Livingstone, S. (2008). Taking risky opportuni- identity revisited. Narrative Inquiry, 15(1), 25–44. ties in youthful content creation: Teenagers’ use doi:10.1075/ni.15.1.02red of social networking sites for intimacy, privacy and self-expression. New Media & Society, 10, Ricoeur, P. (1984). Time and narrative, I (trans. 393–411. doi:10.1177/1461444808089415 Kathleen McLaughlin and David Pellauer). Chi- cago, IL: University of Chicago Press. McCarthy, C. (2009). Twitter hits 5 billion tweets. cNet News. Retrieved from http: //news.cnet. Roper, M. F. (2010). The bosses who snoop on com/8301-13577_3- 10378353-36.html Facebook. The Guardian. Retrieved from http: // www.guardian.co. uk/commentisfree/2010/mar/ Miller, P. (2010). How to use Facebook places. PC 24/bosses-snoop-facebook-twitter-blogs World. Retrieved from http: //www.pcworld. com/ article/203819/ how_to_use_facebook_places. Stripling, J. (2010). Faculty on Facebook: Privacy html concerns raised by suspension. USA Today. Re- trieved from http: //www.usatoday. com/news/edu- Mitra, A. (1996). Nations and the Internet: cation/ 2010-03-02-facebook-professors_N.htm The case of a national newsgroup, “soc.cult. indian. Convergence (London), 2(1), 44–75. Whitebrook, M. (2001). Identity, narrative and doi:10.1177/135485659600200106 politics. New York, NY: Routledge. 145

Narbs as a Measure and Indicator of Identity Narratives ENDNOTES videos produce extremely large amounts of digital data that need to be processed by the 1 The adoption of these technologies led to digital tools. a flurry of academic discussion about the 4 The recognition of the disappearance of the creation of “virtual communities” as demon- “real” person and the accompanying cues strated in anthologies such as Virtual Culture that modify interpersonal communication compiled by Jones (1997) where scholars continues to be an area of focus for scholars examined the ways in which special com- as there is a continuing desire to understand munities could be imagined around shared the way in which the process of communi- discourses on the Internet. In many ways, the cation changes when some of non-verbal ideas developed in the late-90s allowed for cues are replaced by textual elements like the contextualization of the phenomenon of “smiley faces” or emoticons that remains a social networking that came to the forefront popular and standard set of symbols in much nearly a decade later. of CMC (see, e.g., Walther, 2001). 5 The idea of a “cybernetic space” refers to 2 The term “social network” which was a unique condition where the real and the best defined by Barnes (1954) around a virtual come together to produce a condi- continuum of stability and function of the tion where neither is privileged. The real networks where a network was made up of a is influenced by the virtual and the virtual limited number of spatially adjacent people conditions the real offering the opportunity who would create a connection to achieve to carve out a space where both are important a particular purpose. In the case of Barnes, (Mitra, 2003) his focus was on a small Norwegian com- 6 This is typically the case with commercial munity where he noted that the networks Web sites such asYahoo and Flickr that allow were of three major types: Stable organiza- individuals to store videos and pictures on tions with formalized modes of interaction, serves that can be accessed by a community unstable connections that were created for permitted by the user. specific functions, and networks based on 7 The use of the Global Positioning System interpersonal connections where other social (GPS) is quickly becoming ubiquitous as phenomenon like class would play a critical smartphones are equipped with GPS re- role in the creation and maintenance of the ceivers and mapping programs that allows network. To be sure, all these connections an individual to know where the person is, were based on spatial proximity limiting the and since the phone is a communication number of participants in any network. device, the individual can also announce the location to a community of friends. This has 3 Digitization refers to the process by which been commercialized by corporations such analog information like the electrical modu- as Foursquare and Facebook that allows lations produced by sound waves can be “friends” to share their locations with each converted to binary data made up of only two other. digits – ‘0’ and ‘1.’ The digitization process produces large sets of number made up of the two digits, and complex information like 146

147 Chapter 9 Cloud Based Social Network Sites: Under Whose Control? Jean-Philippe Moiny University of Namur, Belgium ABSTRACT In studying Social Network Sites (SNSes), this chapter starts from the identification of a loss of users’ control over personal information. It briefly defines what SNSes are and links them to “cloud computing.” Its purpose is to identify how American and European (or as the case may be, Belgian) laws empower users to recover some control where they lack technical means to control information related to them. It will be shown that user’s consent is central to numerous legal dispositions. To this end, four legal themes are studied: privacy, data protection (consent and right of access), confidentiality of electronic communications, and the prohibition of unauthorized access to computers (hacking). Through these reflections, the American and European perspectives are compared, and the differences between these inevitably lead to a final title underlying the importance of rules governing prescriptive and adjudica- tive jurisdictions concerns. These rules are finally sketched, before the conclusion finally summarizes the whole purpose. As the author of this chapter is a European jurist, European law constitutes the point of departure of the reflections, and can be sometimes (titles I and IV) the sole legal framework of the discussion. The information in this chapter is current up to January 28, 2010, save as otherwise stipulated. It should be noted that the information that is studied in context is constantly changing. DOI: 10.4018/978-1-61350-132-0.ch009 Copyright © 2012, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited.

Cloud Based Social Network Sites INTRODUCTION these SNSes often have a foot in Europe and the other in the United States – frequently California Two quotations illustrate a claim for control (Facebook, LinkedIn, and Second Life). But which coming from the users of Social Network Sites law and which judges are in control (IV)? (SNSes). From the US civil liberties association, before the American Federal Trade Commission This chapter defines what SNSes are, legally [FTC], “EPIC urges the Commission to […] re- and technically. It also suggests some consider- quire Facebook to give users meaningful control ation related to the SNSes market. For the needs over personal information” (EPIC v. Facebook of the whole purpose, Facebook is taken as a 1, 2009, no. 3)1, “[c]ompel Facebook to make its recurrent example. SNSes generally constitute data collection practices clearer and more compre- information society services pertaining to cloud hensible and to give Facebook users meaningful computing technology. Therefore, some ideas can control over personal information provided by be extended to cloud computing in general. The Facebook to advertisers and developers” (EPIC technology used and the functioning of SNSes lead v. Facebook 1, 2009, no. 118)2. Actually, “users to identifying a certain loss of control over their desire control over the collection and use of in- personal data by users. Some legal issues related formation about them” (UC Berkeley, School of to this loss are therefore addressed. Moreover, pri- Information [UCBSI], 2009, p. 5). More recently, vacy and data protection are studied in this chapter. a modification of Facebook’s privacy settings lead A legal conception of privacy which empowers to a new complaint of EPIC noticing that users users is chosen as regardsAmerican and European are now forced to make public data they could perspectives. In this respect, the horizontal effect formerly keep restricted (EPIC v. Facebook 3, of the fundamental right to privacy is discussed. 2010). It has notably been claimed that Facebook The focus then moves to specific concerns related “Converted Facebook Users’Private Information to data protection. The quality of consent of the into “Publicly Available” Information” (EPIC v. data subject, apparently omnipresent in the context Facebook 3, 2010, nos. 35 and ff.) and “Discloses of SNSes, is discussed. The data subject has to be the Personal Information of Facebook Users with- informed by SNS providers. His consent should be out Consent” (EPIC v. Facebook 3, 2010, nos. 65 separated from his consent to the general terms and and ff.). As regards the European Union and the conditions of the SNS. And finally, such consent group known as the Berlin Working Party, SNSes has to be freely given. This last point requires to providers were already advised to “[i]mprove user be linked with the considerations related to the control over use of profile data” (International SNS market. The relevance of the data subject’s Working Party on Data Protection [IWGDPT], right of access in the context of SNSes is then 2008, pp. 6-7). examined, before the confidentiality of electronic communications is brought into focus. The use In the context of SNSes (I), Internet surfers of cookies by the SNS provider is specifically seem to partially lose the legitimate3ownership of discussed in this framework.And some reflections data relating to them. They suffer a loss of control4 relate to the qualifying an SNS as an electronic (II).To some extent, law – at least, the fields studied communications service. Mainly, this chapter here – faces this concern. But how is and should identifies which communications are protected. it be done (III)? American and European regula- The interest then moves to the protection of the tory systems both need to be referred to, and their user’s terminal. The prohibition of hacking is dis- differences brought into focus. While individuals cussed in the context of SNSes. It is questioned if are not generally bothered by these differences, a breach of the terms of use of an SNS by a user 148

Cloud Based Social Network Sites in fact makes them a “hacker.” Other specific SNSes also use what is called “cloud comput- developments related to cookies are scrutinized. ing.” Cloud computing is “a different form of IT Finally, the text briefly discusses European pri- infrastructure” (Joint, Baker, & Eccles, 2009, p. vate international law from the prescriptive and 270). SNSes usually embed different kinds of adjudicative jurisdictions5 viewpoints. Due to cloud computing services11. They consist of ap- the differences between American and European plications utilized by users from their browser, law, the question of the applicable law becomes on remote third-party servers. In this respect, an particularly relevant in a context where different SNS is “software as a service.” Users’data (texts, legal systems and cultures collide. images, videos, etc.) are also stored in datacenters, generally located abroad (e.g. in the U.S. as regards THE CONTEXT OF SOCIAL Facebook12), and not on the users’ own personal NETWORK SITES computers. These datacenters are managed by the SNS provider (or their subcontractor) who then This section describes what SNSes are from the provides “data storage as a service” (or, more technical and legal viewpoints. It also tries to generally, “infrastructure as a service”). Finally, describe the relevant market of SNSes. This latter looking at Facebook-like SNSes, a “platform as will then reveal relevant as regards the consent of a service”, the application programming interface SNSes users. To these ends, only European law [API] is also provided to developers. Such API is taken into account. enables them to create applications (software) running through the SNS13. Social Network Sites and Cloud Computing In European legal terms, these kinds of services are Information Society Services in the sense of Briefly and technically, an SNS “can be defined the E-commerce Directive14. In fact, SNSes are as [a] website whose main purpose is to act as a normally “provided for remuneration.” Their connector among users” (Levin & Sánchez Abril, providers pursue an economic activity15. Indeed, 2009, p. 1017) 6. In particular, we could call SNSes “are usually for-profit businesses” (Levin Facebook and similar SNSes7 “meta-SNS.” This et al., 2009, p. 1019)16. In the case of Facebook, means SNSes that relate to indeterminate contexts. advertisement banners and the targeted adver- Through them, users can share whatever kind of tisement service Ads (and its variants Social information they want, from individualized and, Ads and Engagement Ads17) secure an economic generally, nominative profiles. Data – whether counterpart for Facebook Inc. These applica- personal or not – and their exchange, are essential tions, for which you have to pay, are integrated attributes of SNSes8. Providers host and manage to the social network. Ads offers companies – or the profiles completed by users, and what these anyone – the ability to target a defined audience users share. Applications can sometimes also of the network, according to criteria they choose be added to the profiles9. This constitutes the – e.g. sex, age, location or other criteria cor- principal business promoted by SNS providers: responding to certain fields of the user’s profile Hosting and making available data to members –, to promote services or products. The Insights of the social network10, according to the sharing tool can be cited too. It permits the assessment rules chosen by these users among a range of op- of the effectiveness of the ordered targeted ads. tions (e.g. Facebook’s privacy settings) defined The Gifts application can also be noted, enabling by SNS providers. people to send gifts ($1 per gift) to friends. Finally, Polls, to carry out polls through the network, is also for a charge. Facebook is not the only one 149

Cloud Based Social Network Sites SNS with advertisement functionalities. Indeed, to say that the company could be forbidden from LinkedIn and MySpace also offer a user targeted adopting certain conduct that other companies are advertisement function (Office of Privacy Com- free to adopt. For instance, could a dominant SNS missioner of Canada [OPCC], 2009, pp. 22 and provider prevent an application developer from 30). Moreover, licenses granted by users to SNS building an application on the SNSAPI (refusal to providers allow the latter to commercially use the supply) offering the users the possibility to easily copyrighted content of the former. Some of these retrieve all their data from the SNS, in a conve- licenses go beyond the sole technical needs for nient format, to easily leave the network? Could the functioning of the provided service. In this the SNS provider rely on targeted advertising and respect, these licenses might also constitute this processing of personal data of its users (or even kind of economic counterpart18. the sale of personal data) to finance its service and offer them for “free” to its users (predatory This chapter will discuss the consent of an SNS pricing)?Although these questions are interesting, user is usually central to the legal rules that are the purpose only concentrates on the definition of identified to empower users to recover control over the relevant market and the potential identification their personal data in the abovementioned context. of a dominant position. Since the free character of the users’consents will partially depend on the SNSes market, this latter In regards to the relevant market, SNS is a is then now discussed. wide concept that covers different services that can generally be qualified as “multi-sided plat- The Market of Social Network Sites form.” “A multi-sided platform provides goods or services to two or more distinct groups of European competition law and the economic customers who need each other in some way and tools it relies on are useful to give an insight into who rely on the platform to intermediate transac- the SNS market. Taking Facebook as a point of tions between them” (Evans, 2008, pp. 8-9). For departure, the SNS relevant market has first to be instance, Facebook proposes targeted advertise- identified. This leads “to identify in a systematic ment services to businesses (Ads), services to those way the immediate competitive constraints faced who promote political, businesses, etc. (Pages), by an undertaking” (EC DG Competition, 2005, services to “friends” (the average user Profile), no. 12). If there are a lot of SNSes providers in an application programming interface [API] for the relevant market of the SNS, the user will be any developer of application, etc. To some extent, free to choose one or another, depending on his these groups of customers are dependant. The preferences as regards, for instance, price, func- more users there are users, the more companies tionalities, data processing, etc. However, it would are interested in advertising over the network. still be necessary that these providers compete The more there are applications on the network, as regards these elements – e.g. data protection. the more users want to join the network, and vice versa. The more companies advertise through the After the relevant market has been identified, network, the more the provider earns money, the it is interesting to observe if a SNS provider has longer the service remains free for its users and a dominant position on this market. Because of can be permanently innovating, the more users this situation a dominant position could make this will be inclined to join and remain on the network, provider insensitive to the claim of control aris- etc. As D.S. Evans (2008, p.10) writes, “many ing from society19. Such a situation can prevent multi-sided platforms make their money from one the web surfers to effectively choose. Moreover, side and make access to the platform available to competition law would prohibit the dominant another side for a price that does not cover the SNS provider from abusing his position20. That is 150

Cloud Based Social Network Sites cost of provision. Facebook, for example, is free of individuals he wants to keep alive. Then, to to users and makes money by selling advertising.” leave the SNS – for example to search for better The functionalities of Facebook for which we data protection21 –, he will have to convince his have to pay will therefore lead to the providing relational network to do the same. Knowing that of free users profiles. in the latter situation, they would not necessarily wish to migrate. Such qualitative users’ network A priori, there is no one global market for would be more important (i.e., Facebook-like SNSes. And the purpose does not delimit the SNSes than YouTube-like ones). markets of SNSes. It only gives some elements for reflection. For instance, one division could These three identified elements – the purpose(s) be made between what would be called a large of the network, the offered functionalities and, or narrow thematic centered SNS – e.g. a net- specifically, the network of users – lead to the work related to movies (Flixster), to business possibility that SNSes are not substitutable or (LinkedIn), to sexuality, etc. – and meta-SNS, interchangeable goods (or services) from the unrelated to specific topics – e.g. Facebook, consumers’viewpoint. “This approach to product Netlog, Bebo, MySpace, etc. SNSes can also be market definition uses a ‘functional interchange- targeted to a particular geographic region or to ability’yardstick based on the ‘qualitative’criteria the whole world. Another division could follow of characteristics, price and intended use” (Jones from the functionalities, the “tools”, provided & Sufrin, 2008, p. 62). Therefore, different SNSes by the SNS. For instance, YouTube is content in the broad sense of the concept can pertain to dif- broadcasting oriented, while Twitter was more ferent relevant markets22. For instance, Facebook a text messages communication tool. Facebook and YouTube (purchased by Google, Inc. in 2006) is at once a text messages communication tool, a are clearly not in the same market. The launch of content broadcasting tool and a platform for third Google Buzz demonstrated it. Facebook and eBay party applications. If Twitter and Facebook are are not in the same relevant market23. Due to their not thematic-centered, they nonetheless diverge different purposes, Facebook and LinkedIn could as regards the functionalities provided. arguably be deemed to pertain to different relevant markets, despite the fact that Facebook offers the But whatever the case, the network of users is possibility to join a “work” network. Arguably, critical in regards to the success and the lure of the Facebook and Twitter are not in the same relevant SNS concerned. This is true from a quantitative market, diverging as regards their functionalities. viewpoint – how many users does the network Twitter was originally oriented to the sharing of involve and how much are they involved? What short messages. While Facebook gives a wider could be called the quantitative users network? range of functionalities. T. Eisenmann, G. Parker This is extremely relevant in regards to YouTube- and M. VanAlstyne (2009, pp. 12 and 14) identify like SNS and meta-SNS such as Facebook. More- Facebook and Twitter as “weak substitutes.” That over, the network of users can be relevant from a is to say that they “serve the same broad purpose more subjective qualitative viewpoint – Who is but satisfy different sets of user needs because in the network (e.g. are my friends there)? What they rely on different technologies.” They also could be called the qualitative users network? provide another example: From this last viewpoint, the temporal dimension is particularly relevant, as the following scenario Monster.com and LinkedIn.com use different shows: The more a user uses an SNS, the more approaches in helping users find and fill jobs: he is captive of this SNS. Because, on the one searchable listings and social networking, hand, he brings his own individual network in the respectively. These approaches offer different SNS; and, on the other hand, he creates a network 151

Cloud Based Social Network Sites advantages: listings are valuable when parties with a huge barrier to entry. However, these lat- wish to conduct a comprehensive search, whereas ter are not necessarily irremediably closed to the social networks provide a mutually trusted third market. Entering the market – or even, creating party’s assessment of fit. a new market – by elaborating a new functional- ity and being really innovative (e.g. Twitter) is a Anyway, it needs to be underlined that the solution28.As T. Eisenmann, G. Parker and M. Van offered functionalities and the offered websites Alstyne (2009, p. 1) write, “revolutionary function- can quickly evolve. What “matters is that a suf- ality” is a path to enter the market. Moreover, the ficiently large number of consumers do consider authors pointed out that “platform envelopment” that a product is a good substitute for the product is another way29. A new entrant could also try to supplied by the undertaking concerned” (EC DG leverage the position he has in a second market Competition, 2005, no. 18)24. The purpose here is (e.g. webmail such as Gmail) in the SNS market not to say that each SNS equals a specific relevant (Google Buzz). In so doing, the entrant is able to market. For instance, YouTube and Dailymotion profit from the network of users it has in this second are direct competitors. They share the same pur- market, simply adding a new functionality to the pose and propose similar functionalities. Facebook platform he manages. Of course, SNS providers and MySpace could also be deemed to pertain to inspire each other. A company can also enter the the same relevant market. But if these two latter market by purchasing an incumbent firm. For are both intended to (notably) socialize, how taking example, Google bought Youtube and Facebook into account what we called the qualitative users tried to buy Twitter30. Finally, free data portabil- network? If too much importance is given to the ity – and more generally, interoperability of cloud fact that the friends and contacts of a particular user computing services, would contribute to making it are located only on one SNS and not on another, easier to enter a market. However, this is not the this could lead to a too narrow definition of the case. Indeed generally, “[o]ne of the most press- relevant market. But if no importance is given to ing issues with respect to cloud computing is the such a question, the risk would be then to miss current difference between the individual vendor the fact that there is no concrete alternative for a approaches, and the implicit lack of interoper- particular user. And that this latter has therefore ability” (Jefferey & Neidecker-Lutz, 2010, p. 31). no real possibility to choose. Anyway, the data portability seems possible even in the present technology context as was stated In any case, the “demand substitutability”25 in a workshop organized by the W3C31. It would can be low since, notably, SNSes produce posi- permit the migration from one SNS, reinforcing tive and direct (and indirect) network effects. “A individuals’ freedom. However, it could also be network effect, as defined in [Spulber’s] discus- a threat for privacy and data protection if it is not sion, refers to the dependence of a consumer’s well designed – what about the export of privacy benefit on the consumption of another consumer. settings (Grimmelmann, 2009)32? In short, “network effects are mutual benefits of consumption” (Spulber, 2008, p. 10)26. This is These elements show that the SNSes market is directly linked to the multi-sided platform markets not so easy to draw, and that it can rapidly change. above-mentioned.And this also implies, on the one This is not without consequences as regards the hand, that users bear high switching costs if they potential dominant position of an SNS provider. want to migrate.Their profile, data and network are While alone today in his own market, he could anchored in a particular SNS27. On the other hand, tomorrow face numerous new competitors. To new entrants in a SNSes market are confronted remain in a dominant position, the SNS provider, 152

Cloud Based Social Network Sites Facebook for instance, should have significant who does not develop applications (developers), market power33 in the relevant market of “meta- does not order targeted ads, etc. Although, there SNS.” In other words, Facebook will have to be exist other users of the services provided through able to act “independently” of its customers, its the network. competitors and of consumers34. It constitutes “the largest social network service in the United Initially, a user controls the production of States”35 and its significant presence in the Eu- personal data relating to him/herself on an SNS. ropean market cannot be ignored. But while its The user decides which data they reveal. However market share could be high, an oligopoly could this primary control over personal data is limited. exist (e.g. Facebook, MySpace, Bebo and Netlog). First, other users can disseminate data through the And the difficulty to enter the market might also network; or more insidiously, for instance, when be relative. It has moreover to be noted that in they synchronize their iPhone with Facebook39. the “new economy”36, “[d]ominant positions are Second, SNSes providers could spontaneously and often temporary and fragile” (Jones & Sufrin, automatically collect data from other sources, such 2008, p. 429), and “[c]ompetition is dynamic”, as other websites (e.g. via Facebook Beacon40), taking place “to satisfy the market.” Firms com- cookies41, data brokers, etc., pursuing “enhance- pete “to dominate the market” and are “fragile ment” to get more accurate profiles (UCBSI, monopolists” that have to continuously innovate 2009, p. 9). SNSes providers can also compel (Ahlborn, Evans, & Padilla, 2001, p. 160). So, users to disclose data such as their real name, date even assuming that Facebook has a high market of birth and email address42. The user in ques- share, the dynamics of the new economy lessens tion does not have any practical control over this the relevance of this observation (Ahlborn, Ev- production of data. Admittedly, as regards what ans, & Padilla, 2001, p. 163)37. “[C]urrent market they have to disclose, users can lie… The cookie shares may overstate or understate probable future method43, contested in DoubleClick (2001)44, and competitive significance” (Antitrust Moderniza- the recording of clickstream data “generated by tion Commission, 2007, p. 40). Moreover, it our cyber-activity” (Kang, 1998, p. 1119)45 (also shouldn’t be ignored that “competition to obtain known as “clicktrail” (Kang, 1998, p. 1227)) are a monopoly is an important form of competition” good examples.The SNS provider is able to record (Posner, 2001, p. 117)38. the user’s use of – or his behavior on – the social network. What the users do when logged on and These considerations sketched the SNSes mar- when they are not; provided the fact that the use kets and underlined a potential lack of choice – of of a cookie is necessary in this latter case46. For liberty – that users could suffer. These elements instance, Facebook’s privacy policy47 permits have to be kept in mind each time law takes into Facebook to record clickstream data relating to account the consent of the SNS user. its users48. So it could store which pages the users consulted, which searches have been made, the USERS’ LOSS OF CONTROL groups they joined49, etc. A users’loss of control in SNSes can be noticed at Subsequently, by choosing privacy settings, three levels:The creation of personal data, their ac- SNS members have the feeling they control the cessibility and their deletion. Facebook will be the dissemination of personal data related to them. principle example used in this section. The focus However, again, this control is limited. First and of this examination is the “average user” of the foremost, users cannot control personal data they SNS. The “average user” of the SNS is someone didn’t personally disclose. Then, the privacy set- tings are themselves limited. In fact, users do not define their content. Their options are set out by 153

Cloud Based Social Network Sites the SNS provider and can evolve as the provider ‘Pages’ they are a fan of. Moreover, the user can wishes (e.g. modifying the functionalities of the also specify to which friends are addressed the website or directly changing the settings). The posts they make on their ‘Wall’. The complaint infrastructure where users socialize can transform of EPIC also had effect over Facebook since, for out of their control, even against their wishes. This instance, users are now able again to make their lack or loss of control is reinforced by the use of friend list confidential56. A huge concern is that cloud computing technologies50. In addition, the in a short period of time, due to the processing content of the privacy settings have to be techni- capabilities of today’s computers, vast amounts cally secure51. Furthermore, privacy settings gener- of data can be extracted from the network. No ally concern the communication of data between matter if the privacy settings come back later to users and not as concerns the SNS provider. This their original status. means that “once information is ‘out’, forget about maintaining exclusive control over it” (Kang & Finally, the user’s last means to control the Buchner, 2004, p. 242). Once data are accessed proliferation of data related to them is outright by other users, an individual cannot control deletion, which is equally limited as regards data subsequent uses of the data by them. Facebook’s not directly produced by the user. Moreover, SNS evolution illustrated the relativity of privacy set- providers sometimes reserve the right to keep tings and their fluctuations. Originally, only the data after the deactivation of the user’s account or name of the members and the sub-networks they during a certain period of time in backup copies. joined (professional, geographic, etc.) had neces- Once again, when data are downloaded by other sarily to be shared through the global Facebook users, they cannot be deleted. This SNSes practice network52. But thereafter, the user’s profile photo, illustrates the lack of control over the deletion of their friends list, the ‘Pages’they are a fan of, their data. For instance, the reactivation option of Hi5 sex and geographical location53 were considered suggests that data will be kept (OPCC, 2009, p. by Facebook to be public information. But this 17)57. In regards to LinkedIn when a user wishes has again evolved54. Anyway, this was crucial to terminate his account and permanently delete as regards Facebook Platform and Applications. their data, they must send an email to LinkedIn Indeed, according to Facebook’s former privacy (OPCC, 2009, p. 24)58. LiveJournal keeps a us- policy: “Applications will always be able to access ers’ data thirty days after the suppression of their your publicly available information (name, Profile account (OPCC, 2009, p. 29)59. And finally, con- picture, gender, current city, networks, friend list cerning Facebook, originally a member couldn’t and pages) and information that is visible to ev- delete their account, while now they can choose eryone.” EPIC’s recent complaint before the FTC between deactivation and permanent suppression illustrates the importance of the modification55. of their account; the bleeding occurred and is not As a matter of interest, this previous modifica- reversible. tion of the privacy settings seemed to have gotten Mark Zuckerberg, Facebook’s CEO, into trouble USERS EMPOWERED TO CONTROL when his own photos were publicized… (EPIC v. Facebook 1, 2009, no. 41). But for all that, positive When a specific loss of control has been identified, evolutions cannot be denied. In this respect, a user law – but not only law – might bring a solution. can now, admittedly to a limited extent, control Hearing that the present paper is focused on law, Facebook’s use of their name as regards Social how does the law – or specific parts of it – deal Ads and the affixing of this name to advertise- with the identified loss of control? Privacy and ments delivered to their friends, telling them the Data Protection are first studied, from general 154

Cloud Based Social Network Sites U.E. and U.S. perspectives. Then, two specific 2008, p. 41). Privacy, under the view suggested topics are evoked: Consent and contract, and the by Y. Poullet and A. Rouvroy, can be defined as data subject’s right of access. The confidentiality the right to “informational self-determination”, as of electronic communications is discussed sec- identified in 1983 by the German Bundesverfas- ondly, in general and as regards more specifically sungsgerichtshof (Poullet & Rouvroy, 2009/1, cookies. Finally, the protection of Internet surf- pp. 52-58). According to the authors (2009/1, p. ers’ computer terminals is approached as regards 75), one of the facets of privacy is that we have hacking in general, a specific concern related to a certain control over a number of aspects of our cookies being then addressed. personalities that we project to the world. PRIVACY AND DATA PROTECTION Data protection can be seen as an evolution of privacy due to the new challenges raised in our General Discussion information society and the new privacy threats (Poullet, 2008, p. 38). It is aimed at ensuring the This section examines users’ loss of control, respect of privacy (Docquir, 2008, p. 84) – but users’ understanding of privacy, and addressing not only privacy63 –, and the EHR Court links these concerns from EU and US perspectives. data protection directly to the human right to have Solove (2002) interestingly pointed out that: “Not their private and family life respected64. As we all privacy problems are the same and different will see, data protection notably proceeds to the conceptions of privacy work best in different “horizontalization” of privacy. “[D]ata protection contexts. Instead of trying to fit new problems into and privacy are clearly substantially overlapping old conceptions, we should seek to understand the concepts” (Walden, 2007, p. 461). But data protec- special circumstances of a particular problem.” tion has its own legal regime (Docquir, 2008, p. Such conceptions of privacy will empower the user 86).And “the right to data protection is recognized to recover some control. (Solove 2002, p. 1147) as an autonomous fundamental right in Article 8 of the Charter of Fundamental Rights of the European Union European Union” (Working Party 29, WP168, p. 5). It provides data subjects with legal means to Numerous legal instruments relate to privacy and exercise a control over personal information. It data protection. The main rules the purpose takes also frames the activities of the data controllers. into account are Article 8 of the European Con- In this respect, the fundamental purpose65 and vention for the Protection of Human Rights and data quality66 principles, enshrined in directive Fundamental Freedoms [ECHR] and the directives 95/46/EC, are crucial. And to some extent, they 95/46/EC and 2002/58/EC60. Without defining mirror H. Nissembaum’s conception of privacy as privacy – one cannot61 and others have already “contextual integrity” (Dumortier, 2009, p. 13), studied this concept in depth62 –, the purpose is discussed later. As regards the relations between focused on a useful understanding of privacy. The privacy and data protection, according to P. De latter ensures individuals, using data protection Hert and S. Gutwirth (2006, pp. 67-69 and 71- rules, a certain power of control in the context of 76), privacy could be viewed as an “opacity tool”, SNSes. They receive control such as regards their protecting individuals against public and private “informational environment” and the “circula- actors’ interference in their individual matters. tion of their image”, the processing activities of While data protection would be a “transparency the data controller being then restricted (Poullet, tool” aimed at compelling these actors to use good practice, focusing on the transparence of their procedures and acts (De Hert & Gutwirth, 155

Cloud Based Social Network Sites 2006, pp. 69-70 and 76-82). In this respect, pri- this latter can be subdivided into different subcat- vacy has a prohibitive nature and data protection egories. For instance in the UK, R. Clayton and offers various procedural guarantees, channeling H. Tomlinson (2001, pp. 204-207 and 223-238) powers to protect the individual’s privacy and identify five “horizontal” impacts that the Human to promote accountability. Consistent with this Rights Act (1998) can have on disputes between model, privacy would restrict the reduction of the private litigants. To sum up, a right of the ECHR control that individuals enjoy as regards personal has a direct horizontal effect69 when a Court can data. While data protection would determine the deduce from the ECHR’s pronouncements, the terms according to which such reductions could legal effects directly applying to private legal be accepted. As a working rule, we could retain relations. Whereas the same disposition of the that data protection implements privacy in practi- ECHR would have an indirect horizontal effect if cal terms, within the context of computing and the Court had to rely on previously existing private Internet technologies, arming data subjects with law applying to the particular case at stake, then specific subjective rights against data controllers. construing these rules in the light of the ECHR70. This partly answers a question that now needs to For instance, in the UK, the ECHR has an indirect be briefly addressed, that is, the horizontal effect horizontal effect (Clayton & Tomlinson, 2001, of Article 8 ECHR. And this also avoids some pp. 217-218; Phillipson, 1999). This is also the speculative reflections about what the ECHR case in Germany, and more or less the case in could impose on the States as regards the private Belgium, the situation in The Netherlands and in relations involved in the (contractual) context of France being less clear (van der Plancke & Van SNSes. Leuven, 2008, pp. 201-202)71. The human rights enshrined in the ECHR A crucial question is to determine to what ex- – and more precisely Article 8 ECHR 67 – can tent a State is obliged under ECHR to ensure that have a horizontal effect68. It is also referred to private relations are compatible with human rights as the German theory of “Drittwirkung” (“third (van der Plancke & Van Leuven, 2008, p. 210) party effect of human rights”). Originally human and, in particular as regards the present point, the rights only concerned the relations between, on right to privacy. Horizontal effect is clearly linked the one hand, individuals, and on the other hand, with the positive obligations falling to the States. the State. This is the “vertical effect” of Human “[P]ositive obligations are a source of horizontal rights. Nowadays, it is well established that they effect” (Gardbaum, 2006, p. 770). However, “the also concern interpersonal relations. This is their actual extent to which the state [(i.e. its organs in- “horizontal effect.” The State has an “obligation cluding the Courts72)] is to protect private persons to protect human rights” and, in this respect, “to is highly controversial and unclear in theory and avoid human rights violations by private person” practice as yet” (Nowak, 2003, p. 50). And the (Nowak, 2003, p. 50). Generally, the horizontal States have a margin of appreciation to this end, effects of the ECHR are brought in by legislative the proportionality principle also applying73. It can measures of the Member States of the Council of here be referred to what is called the “diagonal Europe protecting fundamental rights (data protec- effect” of the ECHR (Dickson, 1999, pp. 59 and tion rules could be an example as regards Article ff.)74. In this respect, the State can be held respon- 8 ECHR, criminal law as regards Articles 2 and 3, sible by the European Court of Human Rights for etc.). Before a national Court, the horizontal effect the violation of rights enshrined in the ECHR by of the ECHR – or, more generally, of constitutional private parties if such a violation is permitted by rights – can manifest itself in two general ways: its inaction75, “by tolerating the occurrence of the directly horizontal or indirectly horizontal. And prohibited acts” (Meron, 2000, no. 11). And such 156

Cloud Based Social Network Sites inaction could be the fact of a court denying, for as regards personal data related to them when instance, the right to privacy of an individual vis- they are not technically able to do so themselves. à-vis another individual, and failing to remedy a And if data protection rules do not apply for any violation of the ECHR. In such case, the violation reason, the indirect horizontal effect of Article 8 of the ECHR by an individual could then be only ECHR could be invoked. indirectly (Zwaak, 2006, p. 29) brought to the European Court of Human Rights, which would United States of America give a ruling as regards the state responsibility76. Originally in the United States78, privacy was Agood example arises from the SNSes context conceptualized in common law from S. Warren – and more generally cloud computing – to illus- and L. Brandeis’s paper (1890). Privacy was iden- trate the usefulness of the judicial (before a Court) tified as the “right to be let alone.” Later, it was potential of the indirect (or direct) horizontal effect systematized by W. Prosser, in four privacy torts: of Article 8 ECHR. Let’s take as the premise that Intrusion Upon Seclusion,Appropriation of Name the directive 95/46/EC – and its implementation or Likeness, Publicity Given to Private Life (also in a particular Member State – does not apply to known as Public Disclosure of Private Facts) and a particular user subscribing to an SNS, due to Publicity Placing Person in False Light (Richards a domestic use exemption77. In such a case, the & Solove, 2007, pp. 146-156; Dunne, 2009, pp. European regime related to transborder data flows 195-197)79. Among these torts, confirmed in the will then not apply. Though, this user could send Second Restatement of Torts, the purpose essen- personal data concerning other individuals (data tially focuses on the Public Disclosure of Private subjects) to a foreign State where the facilities – Facts Tort, preventing the disclosure of data. data centers – of the SNS provider are located, The torts relate to inter-individual relations. The no matter if the data protection afforded by this American federal Constitution enshrines the right State is or is not adequate. If this provider then to privacy. The Fourth Amendment is notably a processes the data for its own purposes or subse- cornerstone to this end80. Some constitutions of quently discloses the data collected in any way, federated States also enshrine the right to privacy. the “data subjects” could suffer damage, just as But “the state charters, like the federal constitu- the privacy of the subscriber to the SNS himself tion, do not regulate interactions among citizens” could be threatened. If it were the case, Article 8 (Schwartz & Reidenberg, 1996, pp. 9-10). In other ECHR and its horizontal effect would ensure the words, “[t]he state constitutions emphasize the protection of the data subjects and the privacy powers of government and the limits on them, of the user at stake. For instance, in Belgium, a rather than the regulation of relations between lawsuit could be initiated on the basis of Article citizens” (Schwartz & Reidenberg, 1996, pp. 1382 of the Belgian Civil Code (general rule as 9-10). They primarily concern relations between regards extra-contractual liability) coupled with States and individuals (vertical effect), requir- Article 8 ECHR. In other words, the horizontal ing a “state action” to apply. Nonetheless, “the effect ofArticle 8 ECHR could help to fill the gaps development of ‘state action’ doctrine shows that in data protection rules in the SNSes – or cloud even where the constitutional rights are defined computing – context, ensuring the data subject in vertical terms, the courts will extend constitu- the recovery of control. tional guarantees to some relationships between private individuals” (Clayton & Tomlinson, To sum up, data protection and privacy give 2001, p. 208). The American Constitution can in the users of SNSes a certain legal control over fact be considered to have an indirect horizontal their personal information, empowering them, to some extent, to prevent or limit what can be done 157

Cloud Based Social Network Sites effect (Gardbaum, 2005, p. 415)81. In California the US Supreme Court did not hesitate, recently, to for instance, the “constitutional right to informa- watch for the setting of these social norms before tional privacy has been found to apply to both deciding on the question of reasonable expecta- the public and the private sector” (Schwartz & tion in the context of work and communication Reidenberg, 1996, pp. 133-134). Referring to the technologies88. It explicitly avoided the discus- common law (privacy tort) and the Californian sion. And M. Zuckerberg claiming that “privacy Constitution, the Supreme Court of California, in is no longer a ‘social norm’” (EPIC v. Facebook Hernandez v. Hillsides (2009), recently underlined 2, 2010, no. 10) might be accepted. that these “two sources of privacy protection ‘are not unrelated’ under California law.” Citing Because of the necessity of a reasonable ex- another decision, the Court recalled that the right pectation of privacy, what is “knowingly exposed to privacy in the California Constitution “creates to the public” is not protected (Sprague, 2008, p. at least a limited right of action against both pri- 125)89. So “there will be no cause of action if [the vate and government entities”82 (emphasis added plaintiff] happened to reveal this information in by the author). However that may be, under the cyberspace often regarded as public” (Purtova, American Constitutional system, States do not 2009, p. 511). And yet, as we wrote above, the have any “positive obligations” according to the sharing of data – personal and otherwise – is at Constitution (Schwartz & Reidenberg, 1996, p. the core of SNSes. As an example, the U.S. Court 35). In this respect, constitutional systems gener- of Appeals for the Ninth Circuit held, in USA v. ally reject positive obligations; “like in the United Forrester (2007), that there is no reasonable ex- States, are thereby rejecting an important source pectation of privacy as regards “Internet Protocol of indirect horizontal effect”, (Gardbaum, 2005, (“IP”) addresses of the websites the defendant p. 770). visited”, “and the total volume of data transmit- ted to and from the defendant’s account”90. This Privacy suffers substantial weaknesses in the reasoning has also already been transposed in the context of SNSes. The only one that holds our context of “electronic bulletin boards” where data attention is its dependence on the well-known are delivered to a huge number of users: “reasonable expectation of privacy” .83 84 If technological progress sometimes creates such In Guest v. Leis, 255 F.3d 325, 333 (6th Cir. 2007), expectations, it often erodes them (Sprague, 2008, we concluded that users of electronic bulletin p. 89)85. The more technologies are used to moni- boards lacked an expectation of privacy in material tor individuals, the less they have expectations posted on the bulletin board, as such materials of privacy (Solove, 2002, p. 1142). In the same were “intended for publication or public posting.” sense, “[w]ith every click of the mouse on the Of course the public disclosure of material to an Internet, the expectation of privacy diminishes and untold number of readers distinguishes bulletin a voyeuristic society expands” (Kane & Delange, board postings from e-mails, which typically have 2009, p. 347). Informing individuals about data a limited, select number of recipients. (Steven War- processing could also have the same pernicious shack v. USA, 2007) (Emphasis added by author). effect86. So, a duty to inform could, in this respect, be problematic. “The problem […] is that [the] Anyway, users have reasonable expectations protection [of privacy] dissipates as technology of privacy as regards the content of their emails develops and enters general public use” (Sprague, and email accounts, as it is illustrated by Steven 2008, p. 121). In other words, “[e]xpectations of Warshack v. USA (2007). So, useless to say that privacy are established by social norms” (Sprague, choosing privacy settings is a minimum a user has 2008, p. 129)87. In City of Ontario v. Quon (2010), to do if he/she hopes to be protected. 158

Cloud Based Social Network Sites So what place is left for privacy in SNSes? they suffer from vagueness as regards SNSes99, SNS providers and users seem to have a great and even as regards the Web more generally100. deal of latitude with the personal data they can access. However, Warren and Brandeis (1980, Commercial practices are also framed by FTC p. 198) have already argued that “common law enforcement actions against unfair or deceptive secures to each individual the right of determining, practices within/or affecting commerce101 which ordinarily, to what extent his thoughts, sentiments, leads to a “growing ‘common law’ of privacy” and emotions shall be communicated to others.” (UCBSI, 2010, p. 10)102. As regards SNSes, Twit- And the US Supreme Court judged that “both ter has already had to deal with the FTC (In the the common law and the literal understandings Matter of Twitter Inc., FTC, 2010), as Facebook of privacy encompass the individual’s control of might do in the context of the EPIC et al. com- information concerning his or her person” (U.S. plaints (EPIC v. Facebook 1, 2 & 3, 2009, 2010). Dept. of Justice v. Reporters Committee, 1989). Finally, even if the SHP, (their weaknesses put “[I]nformation privacy” was thus already antici- aside) incorporate a limited “system of consumer pated in the oldestAmerican conceptualization of control” (Manny, 2003, p. 6), these only relate to privacy. “Information privacy is ‘an individual’s personal data coming from EU. claim to control the terms under which personal information – information identifiable to the WHAT HELP CAN BE individual – is acquired, disclosed, and used’” FOUND TODAY? (Kang, 1998, p. 1205, quoting the Principles for Providing and Using Personal Information pro- The concept of “limited privacy” could help. Ac- duced by the Clinton administration’s Information cording to L. Strahilevitz (2004, p. 18), Infrastructure Task Force)91. Limited privacy” is the idea that when an indi- Does American data protection fill the gap vidual reveals private information about them- we identified? Its application is sectoral92 and selves to one or more people, they may retain a general statute law related to “commercial a reasonable expectation that the recipients of data brokers”93 – or the profiling industry – and the information will not disseminate it further. “behavioral advertising”94 is lacking. It can be (Strahilevitz, 2004, pp. 18-22). pointed out incidentally, that the private sector is supposed to be virtuous when self-regulating. An “expectation of limited privacy” would then “Self-regulation, after all, is simply the ability be at stake. The prime example quoted by the L. to decide for oneself what the term ‘reasonable’ Strahilevitz (2004, pp. 18-22) in this respect, in means” (Killingsworth, 1999, p. 71)95. That California, is based on the intrusion upon seclusion contrasts sharply with EU perspective where tort, other cases involving the public disclosure mandatory rules generally apply96. Therefore, of private facts tort. But the courts unfortunately “e-socialization” is regulated through privacy not necessarily accept it (Strahilevitz, 2004, pp. policies. These policies are mandatory under the 22-25). Safe Harbor Principles97 [SHP] and, sometimes, under State law98. But it has to be underlined Some researchers have suggested remedies as that, more generally, different elements “have all regards privacy and data protection. One would recently converged to create a new environment be to create a specific “model of propertized in which implementing a privacy policy is a busi- personal information” that constitutes a “hybrid ness necessity for most, and legally advisable for inalienability” model (Schwartz, 2004). Another all” (Killingsworth, 1999, p. 59). Unfortunately, solution would be to adapt trade secrecy default 159

Cloud Based Social Network Sites rules “to the licensing of personal information” The theory of H. Nissenbaum (2004), concep- (Samuelson, 2000). Still another way would be tualizing privacy as “contextual integrity”, seems to rely on a dynamic theory of informational also particularly relevant concerning SNSes. Ac- privacy, being an “autonomy-based approach to cording to her, privacy would ensure individuals data privacy protection” focusing on the mean- a right to maintain the contextual integrity of the ingful autonomy of the individual (Cohen, 2000). information at stake105. In this same sense, F. Du- According to L. Strahilevitz (2004), a possibility mortier (2009, p. 15) underlines that “European would result in defining reasonable expectations authorities could impose less multi-contextual of privacy according to the “Social Network content for SNSes by demanding the operators of Theory” (Strahilevitz, 2004). Privacy would then such sites to limit their architecture in accordance depend on people to whom the data have been with each user’s specific intents.” Both theories communicated. fit best the cases of “meta-SNS” like Facebook, where lots of contexts intertwine and when the Next to these interesting propositions, two service is offered with the so highly praised op- other solutions seem particularly relevant in the portunity for users to control information related context of SNSes. As a new “path” to take to to them106 – though it is still requested. enhance users’privacy protection,American com- mon law and English common law could be linked It is interesting to note that, to some extent, (Richards & Solove, 2007, pp. 156-158). The both theories focus on the purpose of the com- English common law focused on the development munication of data. Like the European general of the breach of confidentiality103 tort – highlighted data protection directive 95/46/EC enshrines the byWarren, Brandeis and Prosser. Indeed, this latter fundamental purpose principle of the processing. tort takes into account the “limited purpose” for which data have communicated to third-parties, However, whatever theory is chosen to overstep focusing on the “nature of the relationship” at the classically required reasonable expectation stake, in spite of the “nature of the information” of privacy, concerns remain. On Facebook-like which has a main role as regards the American SNSes, the “misleading notion[s] of “commu- privacy tort. An “expectation of trust” would be nity”” and “friends” (IWGDPT, 2008, p. 2) are protected (Richards & Solove, 2007, pp. 174-175). “nebulous at best” (Kane & Delange, 2009, p. In this respect, it could be helpful to give the us- 319). Indeed, “OSNs have loosened traditional ers of an SNS the ability to construct their own notions of intimacy and friendship and their re- privacy policy they could contractually oppose spective nomenclature” (Levin & Sánchez Abril, other users when they access their profiles. For 2009, p. 1018). This remains a practical hurdle instance, before viewing the profile of a user – or to better privacy. This is all the truer when third- before becoming a friend of this user –, another party applications are able to extract personal user could have to accept a preliminary page, data from SNS databases. We conclude finally clicking “I accept” and concluding a clickwrap with N. Purtova (2009, p. 514), that “the current contract with the user whose profile is going to US data protection law offers virtually no tools be consulted. Such a privacy policy could also be to return control of personal data to individuals” opposed to applications developers, etc. However, (emphasis added by author). But it is necessary to to this aim, SNS providers would have to modify add that a positive evolution could occur thanks the software they offer. Another concern would to privacy scholars and civil liberties associations. then arise, that is to say: how far such contract And this would necessarily be through statute law could go as regards limitations to the freedom of or through a groundbreaking case-law. expression of the user consulting the profile104? 160

Cloud Based Social Network Sites SPECIFIC TOPICS common that, according to P. Polański (2007, p. 323), it could join the ranks of Internet customs112. To confront SNSes with data protection and pri- Answering a complaint directed against Facebook, vacy does constitute a huge task. Therefore, this the Assistant Privacy Commissioner of Canada section focuses on two relevant concerns relating has recognized that, “[o]ur views with respect to to data protection: Consent and contract, and the advertising have adapted to the social network- right to access. We discussed elsewhere the mate- ing site business model. We have accepted that a rial applicability of directive 95/46/EC to SNSes certain amount of advertising is something users providers, and take as a premise that it applies107. have to agree to since use of the site is free and the company needs to generate revenue.” (Denham, Consent and Contract 2009, no.14)113 The Trade of Personal Data: Without explaining The very question is how far the freedom of further the issues raised by the conclusion of a contract can go. How to market personal data if contract between SNS providers and their users one accepts that it can be marketed? Since one’s – this was seen previously108 –, a meeting of the image can be exploited114, what about other SNS user’s and SNS provider’s minds can occur. personal data115? The answer lies between two Indeed, the former adheres to the latter’s offer of extremes defining how one perceives personal a contract of adhesion109. This contract seems to data: “Ordinary commodity” or “absolute intan- be the place where, and above all the means by gibility”116. A median path should be found in which, consent is given by data subjects – users concreto, taking into account the place afforded of the SNS – to the SNS provider’s processing of by data protection to consent, the different subjec- personal data related to them110. The economy of tive elements and the interest of the collectivity. the proposed deal looks straightforward: “Let me In this respect, perceptions can vary significantly. process your data in order to deliver and target Some think that “[t]he sanctity of personality is advertisements, I’ll give you a “free” access to my inconsistent with selling privacy in the market- network and I’ll delete the data if you delete your place, for baubles”, and others not concerned account.” Or, following a worst-case scenario, about, “transform themselves into commercialized “let me do what I wish with your data (including entertainment packages to satisfy their own exhi- selling it to data brokers, government agencies, bitionism and other people’s voyeurism” (Kang potential employers, etc.), I’ll give you access to & Buchner, 2004, p. 230). Taking Facebook as my network that I can deny for any reason, and an example, if targeted advertising is necessary I reserve the right to keep your data even if you to the economic viability of the SNS – without deactivate your account”111. any doubt, a valuable service for its users –, and limited to the possibility, for companies, to select In other words, using an SNS could lead to some criteria to define an audience, without any consent to the sale of personal data. It is well known access to personal data and any other transfer of that “[i]ntangible information has become a basic personal data117, this seems acceptable. asset, the fuel driving the “Information Economy”, and personal data comprises a substantial share of However that may be, beyond the “privacy such information assets” (Walden, 2007, p. 459). prohibiting limits”118, such marketing needs to be Advertisements and behavioral advertisements – led according to data protection rules. Because notably having recourse to the use of cookies and data protection rules pertain to public order, web beacons – drive a significant part of the web they restrict the parties’ autonomy. According to industry. This use of, for instance, cookies, is so Belgian contract law, if the contract between the SNS provider and its user has an effect of creating 161

Cloud Based Social Network Sites or maintaining a processing operation contrary function of the API Platform has to be clearly to these rules, it is void119. It is true that consent explained to users. Indeed, personal data can be has a limited value as legitimate ground for data retrieved via such a platform; any developer of processing (Poullet & Rouvroy, 2009/1, pp. 72- applications could be located anywhere in the 74). Anyway, as far as SNS providers recourse to world. This reinforces the density (complexity) the data subject’s consent, this consent has to be and opacity of the “SNS cloud” at stake. Users a “freely given, specific and informed indication should know where their personal information is or of his wishes” (Article 2, h) Directive 95/46/EC). at least, where it may be processed (stored, made It has to be “unambiguously given” (Article 7 a) available, etc.)123. Moreover, no matter where data Directive 1995/46/EC). A qualified consent is are collected (from the data subject or a third-party) required. Moreover and notably, it can only relate information duties enshrined in directive 95/46/ to processing aimed at “specified, explicit and le- EC should have to be fulfilled before any contract gitimate purposes” (Article 6.1, b) Directive 95/46/ is concluded124. This may be crucial due to the EC), and involving “adequate, relevant and non practice of clickwrap and browsewrap contracts. excessive data” (Article 6.1, c) Directive 95/46/ Such information is decisive as regards the will EC) in relation to the purposes of the processing, to enter into a contract and to use the service. data which can only be kept “for no longer than is necessary” for these purposes (Article 6.1, e) Consent has also to be specific. As regards of directive 95/46/EC). This “qualified” consent SNSes, it is given, notably, when the user sub- is also limited as regards its objective120. The scribes to the service and creates an account, click- purpose next only focuses on the fact that consent ing on “Create my account”, “I accept” or similar is qualified, that is to say: Informed, specific and formulations. When he clicks, he is considered to free. This latter point also directly echoes with our consent to terms of use and the privacy policy125. brief analysis of the SNS market. Firstly, consent can only target specific process- ing operations. Data subjects cannot concede a A Qualified Consent: Consent has to be in- “thematic general power” to process personal formed. SNSes and cloud computing technologies data. “Consent in bulk for any future processing can seem impenetrable – where are the data?121 without knowing the circumstances surrounding While the purposes of the processing have to be the processing cannot be valid consent” (WP171, specified and explicit. As far as targeted adver- 2010, p. 14). Consent must be “limited.” Secondly, tisements are concerned, better information is and although consent to the processing of personal needed as E. Denham pointed it out (2009, nos. data is clearly linked with the concluded contract 134 and 139)122. It has been noted however above between the user and the SNS provider, it should that privacy policies are usually vague, which is be technically dissociated from the expression of incompatible with directive 95/46/EC. Explana- the “blanket assent” to the general terms of use tory screens related to data protection – how pri- and privacy policy of the SNS in question126. It is vacy settings work?; what data are processed for here referred to about how consumers conclude which purposes?, etc. – could be of help before (e-)contracts. “ ‘Blanket assent’is best understood the user subscribes to an SNS.Although Facebook to mean that, although consumers do not read has already answered that such a process would standard terms, so long as their formal presentation dissuade web surfers from joining the network and substance are reasonable, consumers compre- (Denham, 2009, no. 66). As E. Denham (2009, hend the existence of the terms and agree to be nos. 13 and 51) suggested, a real time information bound to them” (Hillman & Rachlinski, 2001, pp. process, anterior to the processing of any personal 33-34). “ ‘Blanket assent’ means only that, given data, could be useful. In cases like Facebook, the the realities of mass-market contracting, the con- 162

Cloud Based Social Network Sites sumer chooses to enter a transaction that includes use the offered technology (SNS) or reject it. This a package of reasonable, albeit mostly unfavorable directly refers to the short analysis of the SNSes to her, boilerplate terms” (Hillman & Rachlinski, market suggested above. It is impossible here 2001, pp. 33-34). In another but similar context, to go into economic details of the “meta-SNS” Working Party 29 declared itself in favor of such market. It can only be emphasized that the his- a procedural dissociation (WP115, 2005, p. 5)127. tory of Facebook shows that this latter has acted “[C]onsent means active participation of the data relatively independently from its customers – subject prior to the collection and processing of having then seemed to be dominant –, modifying data” (Working Party 29, WP171, 2010, p. 15). It the website, the privacy policies and the terms of is not tacit acquiescence.And in the United States, use several times130. However, it cannot be denied the FTC (In the matter of Sears, 2009) might that users’ (often represented by American civil deem, in some particular cases, that the practice liberties unions) protests have also influenced the of a company is deceptive when it promotes its website and its policy. The intervention of public business without informing users before they authorities has also had the same effect. Practically, consent to any terms of use and privacy policy, the combination of both interventions had effect. and outside these documents, about their practices Although “dominance is fleeting” (Evans, 2008, related to personal data processing128. Irrespective p. 17) in such markets, the KnowPrivacy (UCBSI, of the fact that the processing occurs later, after 2010, pp. 11-12) study underlined, as regards web that the individual has expressed consent. privacy in general, that “there is not enough market differentiation for users to make informed choices The data subject’s will, must finally be freely […; b]ecause [privacy policies] are all equally given. As stated O. De Schutter, studying the poor, users have no viable alternatives. This is a renunciation to fundamental rights, what is sus- market failure” (emphasis added by the author). picious in a particular deal, is the commercial And “the argument that users should simply avoid exploitation (“marchandisation”) of the right certain websites is unrealistic [; m]ore and more of at stake, specific constraints arising from trade our social and political discourse is taking place banking on the individuals’ needs (De Schutter, on these popular websites” (UCBSI, 2010, p. 31) 2005, p. 457). Individuals’ behaviors are dictated where we are unceasingly urged to be. So it has by their need of a material advantage or by finan- to be emphasized that consent expressed in the cial incentives (De Schutter, 2005, p. 463). In the use of SNSes is often not free. SNSes context, for instance, “the introduction of a fee should be considered as an additional option This is all the truer when the SNS provider at the choice of the user for financing the service proceeds to unilateral modifications to the privacy instead of the use of profile data for marketing” settings – or functionalities – of the network that (IWGDPT, 2008, pp. 6-7). This is possible with have to be accepted if the user wants to continue LiveJournal129. But it has to be kept into mind using the network in the same way. This occurred that, “the interest in privacy is like the interest in several times as regards Facebook131. In such cases, receiving access to the electoral franchise, clean if the user as no other alternative than leaving air, or national defense: it should not depend on the network if he does not agree to changes, his socioeconomic status” (Schwartz, 2004, p. 2086). consent is not free. Direct or indirect (through the Behind any doubt, competition within the SNS evolution of the service) modifications of privacy market is relevant and could be decisive in regards settings restricting the original panel of choices to commercial use of personal data. If a user has the user could make are forbidden by data protec- no real choice, his consent is not free. With no tion rules. With the exception that if the further possible alternative, the user can only accept to processing implied by the modification is com- 163

Cloud Based Social Network Sites patible with the original processing, which is not DATA SUBJECT’S RIGHT the case when the degree of accessibility to users’ OF ACCESS personal data over an SNS is increased. Indeed, if a user originally can limit the accessibility to Article 12 of Directive 95/46/EC grants to every such data, he cannot reasonably expect that such data subject “three fundamental rights” (Leberton, fundamental characteristic of the offered service 2009, p. 320)134 relating to the personal data pro- will later be modified. Another exception is if the cessing at stake and towards the data controller:A processing is based otherwise than on the data right of access, a right of rectification and a right subject’s consent.An archetype of such forbidden of erasure or blocking. These rights constitute a evolution of privacy settings would precisely be to legal means afforded to data subjects against the consider as public information, information whose previously mentioned lack of control they suffer access to could originally be restricted by users. in the SNS context. They are equipped against unlawful processing of personal data concerning Conclusion and Thoughts About them. They can seek out who is processing the the Safe Harbor Principles data (the SNS provider, another user135 (application developer or anyone else) or a third-party to the Keeping the previous points in mind, it can be network), claiming the deletion of the data at stake argued that an SNS provider like Facebook, as a if the data are conserved for too long a period of data controller, often cannot legally rely on the time, depending on the purposes of the processing consent of its users to process personal data re- (e.g. if the SNS provider keeps a user’s data after lated to them. Users are not clearly and willingly this latter has chosen to delete his account). If the informed, their consent is usually non specific, “average” user of an SNS falls within the scope of and not free enough. Of course, it is impossible directive 95/46/EC – which is not necessarily the to suggest a conclusion as regards every possible case136 –, it has to be noted however that the right case. Each processing operation requires particular of access of the data subject could conflict with study. And if consent is void, however, this does his right to the confidentiality of his electronic not mean that the processing involved is illegal communications137 and, as may be the case, with for this reason. Indeed, their legitimacy can be his right to the secrecy of his correspondence. But founded on, for instance, Article 7, f) of directive these concerns are not addressed here. 95/46/EC132. According to directive 95/46/EC (Article 12, Across the Atlantic, Facebook and LinkedIn a)), the data subject has a right to be informed, by have adhered to the SHP133. According to the the controller, about the recipients (or categories choice principle of the SHP, an SNS provider has of recipients) to whom the data are and have been to inform (European) data subjects “about the disclosed or communicated. The European Court purposes for which it collects and uses informa- of justice has recently ruled that, to ensure the tion about them.” What it does when they decide aforementioned rights (rectification, erasure and to access the offered service, therefore consent- blocking), the right of access must of necessity ing to the processing operations at stake. Under relate to the past. If that were not the case, the data SHP, a qualified consent is not required. In this subject would not be in a position effectively to respect and without an in-depth analysis, SHPdoes exercise his right to have data presumed unlawful not directly seem to permit the aforementioned or incorrect rectified, erased or blocked or to bring reasoning. legal proceedings and obtain compensation for the damage suffered.” (College van burgemeester en 164

Cloud Based Social Network Sites wethouders van Rotterdam v. M.E.E. Rijkeboer Moreover, it must be noted that “U.S. law will 2009, no. 54) (Emphasis added by author.) apply to questions of interpretation and compli- ance with the SHP.” Therefore, if there is no Needless to say, the right of access is a corner- risk for the individual’s privacy, it is tempting to stone of data protection as regards the transparency conclude that any burden supported by the data of processing operations and the effectiveness of controller would be disproportionate. And as it data protection rules – that is to say, of data sub- has been mentioned above, in the SNS context, jects’ control over personal data. Thus, as a rule, American courts could deem that the user of an SNS providers would have to store information SNS cannot have a reasonable expectation of about people who have had access to personal privacy142 – or reasonable expectation for “limited data related to their users physical persons138, privacy.” His privacy will thus not be threatened. when they have been involved in such transfers Therefore, following American law, the right of as data controllers. Admittedly, as far as the past access enshrined in the SHP could have shrunk to is concerned, the right of access can be limited. virtually nothing in the SNSes context. Limiting it, different factors can be taken into ac- count:The possible exercise of the aforementioned It is finally of great interest, as the study rights implies an appreciation of: the length of time KnowPrivacy – based on the fifty most consulted the personal data are to be stored; the obligation websites in the United States at the time of the following from Article 6 (e); the more or less study – has shown, to mention the sharing of sensitive nature of the data; the risks represented information between affiliates (here, the SNS by the processing; the number of recipients; and, provider and its affiliated companies). Such shar- finally, the burden (having regard to the state of ing is usually foreseen in the privacy policies of the art and the cost of their implementation) that websites. The study emphasized in this respect such a storage represent for the data controller that “[b]ased on our experience, it appears that (College van burgemeester en wethouders van Rot- users have no practical way of knowing with terdam v. M.E.E. Rijkeboer 2009, nos 57-59)139. whom their data will be shared” (UCBSI, 2009, p. A balance has to be struck140. So to some extent, 28) – what the European right of access can do. It this fundamental right of access empowers the notably underlined that “MySpace, one of the most data subject to “track” the personal data related popular social networking sites (especially among to them in and outside an SNS. younger users), is owned by NewsCorp, which has over 1500 subsidiaries” (UCBSI, 2009, p. 28)143. In the US, how the right of access has been And the study did not include “subsidiaries of enacted by the SHP can be deplored. Indeed, subsidiaries.” The European right of access could it is indirectly dependent on American privacy be especially useful and helpful to identify if such regulation: sharing of personal data occurred. It would also be useful if the SNS provider and the application [I]ndividuals must have access to personal infor- developers were deemed to be joint controllers mation about them that an organization holds and of the processing involved by the applications. be able to correct, amend or delete that information As regards Facebook, is the pure creation of a where it is inaccurate, except where the burden platform permitting the access by an application or expense of providing access would be dispro- to the data of the users who accept this application portionate to the risks to the individual’s privacy enough to make of Facebook and the developer in the case in question, or where the legitimate joint controllers? If Facebook compels the users rights of persons other than the individual would (technically or by contract) to share a minimum be violated. (Access Principle and FAQ no. 8)141 of information with such an application – i.e. (Emphasis added by author.) 165

Cloud Based Social Network Sites through the platform –, to be able to use it – and added by author). If the material scope of the other application, making the access to the API directive146 is circumscribed in such a manner, Platform functionality conditional to the sharing some of its dispositions nonetheless apply beyond, of personal data –, it is a co-controller at least as such as Articles 5.1, 5.3 and 13147. As regards the regards these data. What about if Facebook does confidentiality of communications, the protected not compel users to share any personal informa- communications must be realized by means “of tion, the application developer having to require a public communications network and publicly a specific authorization of the users adding his available electronic communications services.” application? In this case, Facebook would seem Both concepts are defined by directive 2002/21/ not to be a data controller. When applications can EC (Article 2, d) and c)) which definitions apply access to data of an SNS, the question of joint as regards directive 2002/58/EC (Article 2). To control will depend on the particular functioning be public, the network and the electronic com- of the platform at stake and is crucial as regards munication services have to be “available to all the applicability of data protection rules.Anyway, members of the public on the same basis” (EC if the SNS provider and an application developer Communication, 1998), “as opposed to use in a were deemed joint controllers, they would be private or corporate network” (EC staff working both compelled to monitor the applications. For document, 2004, no. 4.2); the Directive 2002/58/ instance, they would store a “log” of the personal EC “focuses on public electronic communications data these applications accessed. And if the SNS networks and services, and does not apply to closed provider is able to store the clickstream of its user groups and corporate networks” (Recital 55 average users, it should be able to record this of directive 2009/136/EC). “access stream.” To apply the above-mentioned rule in the CONFIDENTIALITY OF ELECTRONIC context of SNSes firstly requires identifying COMMUNICATIONS which electronic communication services and public networks are at stake. In this respect, our This section tries to identify in European (III.2.1.) little knowledge of computers science inevitably and American (III.2.2) law, which communica- limits the scope of the discussion. Secondly, the tions are protected and when under the confiden- communications that are protected under direc- tiality of electronic communications protected by tive 2002/58/EC are specified. And thirdly, the both laws. implementation of the latter directive in Belgian law is confronted to the analysis. European Law Electronic Communications According toArticle 5.1 of directive 2002/58/EC, Service(s) and Network(s) Member States have to ensure the confidential- ity of electronic communications – exceptions When an individual uses an SNS, he first connects of course existing144. This “e-Privacy” directive to and uses the Internet – a “public communica- applies “to the processing of personal data in tions network” [PCN]148 – with his computer149 connection with the provision of publicly avail- through his own Internet access provider – a able electronic communications services in public classical “electronic communications service” communications networks in the Community”145 [ECS]150 provider151. By these means, he is able (Article 3.1 of directive 2002/58/EC) (emphasis to use the software (as a service) provided by the SNS provider. He clicks on the relevant but- tons and writes messages or selects files in the 166

Cloud Based Social Network Sites relevant fields to make the application work and servers, switches and routers linked with cables, do what it is expected to do (send a message, maybe at one place in the world or maybe at dif- join a group, chat, share a video, modify a birth ferent interconnected via the Internet locations date, change privacy settings, etc.). For instance, in the world. As private companies, for instance, he writes a message in a specific field, selects have sometimes their own private network. These the names of the contact (or friend) he wants to facilities are used to provide the SNS website, to write to, and then clicks on “send.” According answer users’ requests, to store users’ data and to the terminology of the Working Party 29, the make them available, etc. However, it is true that SNS provider would be its own Internet Service the “computers” used by the SNS providers to of- Provider152 when it hosts the social network (the fer its service could be deemed not to constitute a application and its web interface – the website) CN under the definition of Directive 2002/21/EC. and users’ data (there profile, what they share, It would only be considered as equipment158. In etc.), and replies to users’ requests (WP37, 2001, such a case, it would then be clear that the SNS p. 24). It provides content: the application and its provider could not be a PCN provider, since it web interface connected to a giant database. The would even not operate a CN.And hearing that the content broadcasted in the relevant fields of the network at stake would then be the Internet, the Website constantly changes according to users’ IAPes would be the only ECS providers, because wishes, these latter being able to share and ac- they would be the only ones to convey data on cess to others’ information through a framework the PCN at stake. The exchange of information designed by the SNS provider. Design which is between users permitted by the SNS provider on more or less modifiable by members depending on its own computers and database would then hap- the SNS153, and can therefore also change. Finally, pen outside any CN. we assume that the SNS provider most probably subscribes to an Internet access service which If it is taken as premise that the SNS provider enables him to connect to and make available its operates his own CN, which seems correct in website on the Internet. technique, it conveys signals on this particular network to answer users’ requests and give them However, could the SNS provider himself be the web pages with content they asked. These considered as the provider of an ECS (the SNS)? web pages are the visible lay out of the SNS and Or, even as a PCN provider (the technical infra- its functionalities. In this perspective, the SNS structure necessary for the working of the SNS)? provider would seem to provide an ECS. However, services providing, or exercising editorial control What is central in regards to the qualifica- over, content transmitted using CN – e.g. Internet tion as an ECS is “the conveyance of signals on – and ECS – e.g. Internet access – are explicitly electronic communications network [CN154]” excluded from the definition of ECS; Information (emphasis added by author). This is, for instance, society services which do not consist wholly or clearly done by an Internet access provider [IAP] mainly in the conveyance of signals on CN are not (the one of the SNS provider, and the one of the ECS (Article 2, c), of directive 2002/21/EC). In user at stake). The definition is neutral from a other words, directive 2002/21/EC “does not cover technological viewpoint155, and the IAP is the services such as broadcast content, or electronic archetype of the ECS provider in the context of commerce services” (Proposal for a Directive on Internet. An SNS provider should most probably a common regulatory framework for electronic operate an electronic communications network communications networks and service, 2000). [CN] in the sense of directive 2002/21/CE – which The recital 10 of Directive 2002/21/EC specifies provides a large definition156. Indeed, it should that the “provision of web-based content” is not have (or at least rent157) computers, computers 167

Cloud Based Social Network Sites covered by this Directive. And in our view, it technically, data packets are in principle conveyed can be considered that the SNS provider mainly on the Internet by the IAPes, and that is on this provides content: an application giving access to conveyance that directive 2002/21/EC focus. The a wide database through a website with different fact that the provided service has an interpersonal functionalities. Therefore, the SNS provider is communicative ambit (webmails and even SNSes not an ECS provider. And the SNS is not an ECS. and Forums) does not prevent that content is of- The conveyance evoked above is nothing else fered, relying on the IAPes conveyance services to than an incidental activity necessary to deliver finally deliver webpages to users. In this respect, the content asked by users of the SNS. With it does not matter that an application can retrieve other words, the service provided by the SNS data from the databases at stake160. provider do not consist mainly in the conveyance of signals, which processing operations are only To sum up, in our view, the SNS provider is incidental due to the fact that the SNS provider considered not to operate a CN, and then only hosts and operate himself its website159. A web the IAPes provide a conveyance service over the hosting service provider could to the contrary be Internet. Or, the SNS is considered to operate a an ECS because its main activity would consist CN; however, does not offer an ECS because in the conveyance of signals. Its task is to answer the offered service consists mainly in offering and send the right pages requested by users, not to content. And the reasoning is coherent despite provide any specific content of his own. Taking the interpersonal communicative ambit of SNSes as a premise that the SNS is not an ECS, the CN which will be nonetheless taken into account as of the SNS provider could neither be considered regards the protected communications. Not to as a PCN because it would not be mainly used for consider SNSes provider as ECS and/or PCN the provision of ECSes. And the only one ECS- providers is not without consequences as regards, PCN layer that exists in the context of SNSes is of course, telecom regulation, but also, data re- the IAPes-Internet one. tention duties161. As regards the SNS context and directive 2002/58/EC, the publicly available ECS However, theWorking Party 29 (WP148, p. 12) and CN at stake are Internet access services and has already considered that “publicly accessible the Internet. To some extent, this view reflects email service” is an electronic communication the reasoning held by the Austrian Regulatory service, and Recital 10 of Directive 2002/21/EC Authority for Broadcasting and Telecommuni- underlined that “voice telephony and electronic cations ([ARABT], 2005, p. 5) as regards voice mail conveyance services are covered by this over IP162. The protected communications have Directive” (emphasis added by author), while the now to be identified. provision of “web-based content” is not. In our view, this reasoning cannot apply to webmail or Protected Communications “webmail-like” services such as the “send a mes- under Directive 2002/58/EC sage” functionality that SNSes, such as Facebook, could offer, or such as different forums over the Directive 2002/58/EC provides that Member Web. Indeed, in the same sense as above, a Web- States “shall prohibit listening, tapping, storage mail service would not constitute an ECS because or other kinds of interception or surveillance of what is provided is mainly content: an application communications and the related traffic data by offering people the possibility to communicate persons other than users, without the consent of through mails and back up these latter. It is clear the users concerned” (Article 5.1 of directive that both services, Webmail and SNS, permit the 2002/58/EC) (emphasis added by author). A exchange of information between their users, but communication is “any information exchanged or 168

Cloud Based Social Network Sites conveyed between a finite number of parties by and the recipient both use their IA to connect to means of a publicly available electronic commu- the SNS an use its functionalities. nications service” (Article 2, al. 2, d) of directive 2002/58/EC) (emphasis added by author). Such Data are, during a second stage, stored by the a communication (its content and its traffic data) SNS provider who makes them available accord- is protected to ensure the respect of fundamental ing to the privacy settings or the functionality of rights as recalled by Recitals 2 and 3 of directive the SNS chosen by users166. Here, it is not clear 2002/58/EC163. In this respect, the interpersonal if the protection afforded by Article 5 of directive communicative ambit or function of the service 2002/58/EC goes further than the first transmission provided by the SNSes is relevant, contrary to stage identified above. It neither provides that it what has been suggested as regards the qualifica- doesn’t apply after the transmission of the com- tion as an ECS. munication. In our view, some communications should remain protected after their transmission To identify which pieces of information through the Internet. Specifically, users who first are protected and in the context of SNSes; it is conveyed to the SNS provider are intended to a taken as a point of departure that a user wants finite number of users of the SNS and stored on to share data (text, image, sound or video) with the SNS provider servers. In regards to these other users of the SNS. To be protected, a com- communications, the SNS works as a “technical munication needs to satisfy a technical criterion storage” necessary to the conveyance of data be- – the means by which it is exchanged –, and an tween SNS users. Without the SNS provider, there “audience” one – who are pieces of information is no communication. So, if during a first stage intended to? In our view, the appreciation of these data are transmitted to the SNS, it usually occurs criterions can vary according to the fact that the for a “technical storage” purpose. Information communication is in transmission or is, after the is generally not intended to SNSes provider167. transmission, in storage in the SNS. Any piece And in our view, even when communications are of information exchanged between SNS users is conserved as back up by their parties, they could conveyed through the Internet and subsequently, nonetheless remain protected under Directive via the SNS provider through its own facilities164. 2002/58/EC. Even if it is true that the prohibi- tion of hacking will protect stored information, During a first stage, as already noted, informa- the confidentiality of communications affords to tion users want to share on SNSes are conveyed users’ protection of their communications vis-à- by IAPes, through the Internet, to the SNS pro- vis the SNSes providers and, as the case may be, vider. Any communication arising in this first vis-à-vis application developers and other users transmission stage between the SNS provider and who are authorized to access the computers at the SNS user is exchanged between those two stake168. Users usually let their communications parties and protected against any interference of stored somewhere, either for their ongoing trans- a third party. But data are not directly conveyed mission, either for pure convenience as backup. between users by their IAPes, since the SNS is For example, in regards to web mail, users may always a necessary intermediary mean to access wish to save their mails as backup on the servers such data165. The other user who is addressee of the webmail (which usually is a default option): has also to use his own IA service to be able to Even if users bring them back to their computers connect to Facebook and retrieve data. In other using web mail software (i.e., Microsoft Outlook words, when data are exchanged between users orApple Mail). Users also sometimes act this way of an SNS, the above-mentioned first stage of to be able to consult these mails everywhere in the communication occurs for each user: then sender world. Not to protect such stored communication 169

Cloud Based Social Network Sites would risk ruining the confidentiality of electronic parts of such profiles (e.g. Walls)? For example, communications, limiting this latter to a very short on Facebook, a group can be “open”, “closed” or first transmission stage. “secret.” Open, a group is public. Anybody can join and consult the discussion board, the group’s Taking Facebook as an example, the purpose Wall, etc. In such a case, to join a group doesn’t can be illustrated and some nuances can be involve a protected electronic communication, as brought.The electronic communications involved it is the case of posting text, images, etc. However, by the use of the “send a message” (to one or the pure information resulting in the consultation more friends) functionality of the SNS are clearly of the group’s wall, discussion board, etc., remains protected. Even after messages are not deleted by a protected communication because it is only ex- users having received and saw them, they should changed with Facebook. If a group is closed, only also remain protected. Indeed, either they are kept members approved by the administrators of the for back up reason, either for ongoing discussion group can see the discussion board and the wall and because it works as a kind of “recording chat.” join it. However, the group description is visible Instant messaging conversations are also protected by non members, while what is shared through the (they can be made between two friends). As it pages of the group is not. Finally, if the group is would also be the case of the chat (or “video secret, it doesn’t appear in the members’ profiles, chat”) communications on “Chatroulette” for or in the search results of the SNS. An invitation instance169. Invitations to events sent to a limited has to be sent to the potential future member. As number of friends are also protected. The list of regards profiles, the accessibility to data can also webpages visited by a Facebook user, would these be limited, when the wall of a user is restricted to pages be profiles, Facebook pages or groups, is his friends or to a particular list of friends. In such also generally protected. Indeed, the subjacent context, communications seems to appear between communications only occur between the user a finite number of parties, and a priori, it could at stake and Facebook170 – the requests are only arguably be considered that the confidentiality of intended to Facebook. In all these instances, the electronic communications applies. addressee of the pieces of information are limited and do not fluctuate. However, how to take into account the fact that a group, a part of a profile, or any other part of the To the contrary, wall posts and data shared on network, can be restricted to selected members but the SNS with all the users of the SNS – or even nonetheless numerous members and of different any web surfer when the relevant data are publicly contexts (work, sport, education, sexuality, etc.) available from the web –, are not protected com- and whose number is fluctuating? In our view, if in munications171. Admittedly, strictly speaking, the fact, access to the particular part of the profile, to number of members of an SNS is finite. Nonethe- the group, etc., at stake is systematically given to less, if anybody can join an SNS (just as in the the general public on the same basis172, or given to case of Facebook), data which are available to a lot of people from really different contexts173 or, the whole community are clearly public. It would more generally, fluctuating, it can then be argued then be excessive to consider that such a sharing that the communications at stake are not protected. involve protected electronic communications.The Indeed, in these cases, the communication has audience of the network is fluctuating between an indeterminate or irrelevant audience which an unrealistic minimum of two users (if we take composition is fluctuating. Even if this audience, as a premise that a communication occurs) and a at a certain times share pieces of information, it is maximum of nearly the whole world… a finite sharing, which parties can be numbered. Pieces of information are posted and their ac- But what about information exchanged through private groups, and restricted access profiles or 170

Cloud Based Social Network Sites cessibility can vary. To deem it otherwise could tion. In this respect, communications are private threaten the Freedom of expression174, notably when they are not intended to “every man jack” ensured by the ECHR which, as already noted, (“tout un chacun”) (Proposition of Data Privacy can have a diagonal indirect effect. Therefore, Act, Belgium, 1992, p. 7). such communications would be protected dur- ing the first transmission stage – still occurring Some scholars argue that the protection afford- between two parties. But not during the second ed by the LEC goes further the pure transmission technical storage stage where they are intended of the communication (de Terwangne, Herveg, & to an indeterminate or irrelevant audience which Van Gyseghem, 2005, pp. 50 and 91; Lambert, composition is fluctuating. 1999, pp. 203-204). Indeed, this transmission condition is not required under the LEC while It has now to be evaluated if such reasoning it is explicitly needed in Article 314 bis of the can be transposed as regards the implementation Belgian PC178. Nonetheless, other scholars argue of directive 2002/58/EC, taking Belgium as an that the LEC only applies during the transmission example. of the communication (Docquir, 2008, pp. 81-82; de Corte, 2000, p. 12)179. As regards Article 314 Protected Communications bis of the Belgian PC, its aim is not to protect under Belgian Implementation communications when they are “at destination”, of Directive 2002/58/EC for instance as shown by the travaux parlemen- taires, when mails are stored on the computer If the above-mentioned reasoning seems defend- of the addressee (LEC, preparatory act, 1992, p. able as regardsArticle 5 of Directive 2002/58/EC, 6), but during their transmission. In this respect, how it is implemented in Belgian law and does it has been judged, by the Leuven Court of first this reasoning remain valid? The confidentiality instance (N.V. G.P.G. v. C.P., 2007), that an e-mail of electronic communications is protected through not already read or downloaded from the server is both rules that existed before directive 2002/58/ still in transmission and therefore still protected EC: one is enshrined in the Belgian Penal Code by the PC. [PC]175 and the other one is in the Law on Electronic Communications [LEC] (Article 124).According How to apply both dispositions? For instance, it to the LEC, no one can, if he is not authorized by has been argued that the PC protected the content all the persons directly or indirectly involved in the of the communication, while the LEC protected electronic communication, intentionally acquaint other pieces of information such as the existence himself with the existence of this electronically of the communication and its parties – traffic data. transmitted and not sent to him communication, However, to acquaint oneself with the content of a intentionally identify the persons concerned by communication also implies to acquaint oneself of the transmission of the information and its con- the existence of the communication. In our view, tent, or still use in anyway the identification or P. De Hert’s reasoning related to e-mails gives the data obtained (intentionally or not). To break a good solution and permits the interpretation this rule is criminally punished176. According to above mentioned related to Article 5 of directive Article 314bis of the Belgian PC, shall notably be 2002/58/EC and the context of SNSes.According punished the one who, with any apparatus, inten- to the author, the protection of PC lasts until the tionally listen (or make listen), acquaint himself or emails are taken in and until the addressee has tape private177communications to which he is not knowledge of the emails, which is to say during a participant, during their transmission, without their transmission180. And then the LEC can still the consent of each participant to the communica- apply after the transmission of the e-mail (De Hert, 2001, pp. 124-125 and footnote no. 86). 171

Cloud Based Social Network Sites Conclusion or photooptical system that affects interstate or foreign commerce” (18 USC § 2510 (12))184. For Finally, the fate of the protected communications example, the First Circuit held that an email and the and their traffic data is under the control of the “[t]ransmission of completed online forms […]” qualified consents of the parties to these com- (Pharmatrak, Privacy Litigation, 2003) constitute munications, even when they are stored. This such communications. In the case of SNSes, mes- means that to acquaint himself of protected com- sages sent from one profile to another one or more, munications, a third party needs the consent, as or instantaneously sent via Chat functionalities defined by directive 1995/46/EC181 and exposed should be considered as electronic communica- in the first part of this chapter, of each party to the tions. Even if such a definition seems to show that communication. And such a third-party could be the spectrum of the protected communications is an advertiser, an application developer, the SNS broader than according to directive 2002/58/EC, provider182, etc. We suggested that this qualified the next developments will show that restrictions consent protect whole the communications occur- related to the audience of the communications at ring between a user and the SNS provider, during stake also exist. a first transmission stage. Then, during the second technical storage stage, are only protected those The WiretapAct is first very briefly discussed, communications which are intended to a finite because it will reveal less relevant as regards number of parties and when such parties do not SNSes. The Stored CommunicationsAct requires constitute an indeterminate or irrelevant audience more developments. Then, the consent of the user whose composition is fluctuating. of the SNS is studied as a potential exception to the application of both acts. AMERICAN LAW Wiretap Act In the United States, the Electronic Communica- tions Privacy Act [ECPA] ensures the confiden- According to the Wiretap Act185, it is notably for- tiality of the electronic communications. “Title bidden to intentionally intercept any wire, oral, I of the ECPA, known as the Wiretap Act [(18 or electronic communication (18 USC § 2511 (1) USC §§ 2701-2712)], protects wire, oral, and (a)). Hearing that “a contemporaneous interception electronic communications while in transit. Title – i.e., an acquisition during “flight” – is required II, also known as the Stored Communications Act to implicate [this Act]” (USA v. Steiger, 2003)186. (SCA) [(18 USC §§ 2701-2712)], protects data Therefore, as regards the context of SNSes, the while held in storage” (Kane & Delange, 2009, WiretapAct will only apply to the first transmission p. 324)183 (emphasis added by author). And the stage we identified – communications occurring definitions of the terms of the Wiretap Act also between the SNS user and the SNS provider. And apply to the Stored communications Act (18 USC the Stored Communications Act directly focuses § 2711 (1)). on communications that are stored for short or long term – once data are on the SNS servers, In both Acts, what is protected is an electronic they are stored. communication. Electronic communication is a wide concept. It means “any transfer of signs, sig- Stored Communications Act nals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by The Stored Communications Act “provides pri- a wire, radio, electromagnetic, photoelectronic vacy protection to communications held by two types of providers”: The provider of public elec- 172

Cloud Based Social Network Sites tronic communication services187 [ECS] and the An obvious purpose for storing a message on an ones of public remote computing services [RCS]188 ISP’s server after delivery is to provide a second (Kerr, 2004, p. 7). The principle is that they can- copy of the message in the event that the user not knowingly divulge to any person or entity the needs to download it again – if, for example, the content189 of the users’electronic communications message is accidentally erased from the user’s own (18 USC § 2702 (a) (1) (2)). However, they can computer. The ISP copy of the message functions divulge non-content information to private enti- as a “backup” for the user. Notably, nothing in ties (but not to a governmental entity) (18 USC the Act requires that the backup protection be § 2702 (a) (1) (3))190. If the services they provide for the benefit of the ISP rather than the user. are not public191 – which is generally not the case Storage under these circumstances thus literally of SNSes –, the Stored Communications Act does falls within the statutory definition. (Theofel v. not apply. The Act also provides that, except in Farey-Jones, 2003) some cases, nobody can “intentionally [access] without authorization a facility through which an The regimes related to both types of stored electronic communication service is provided” or communications substantially differ as regards “intentionally [exceed] an authorization to access the access to the communications by the Govern- that facility” when the electronic communication ment193. For our purpose, as regards the disclosure is “in electronic storage in such system” (18 USC of information to private entities, one discrepancy § 2701 (a) (1) and (2)). has to be pointed out. Indeed, it could reveal im- portant in the context of SNSes. As regards the As O.S. Kerr (2004, p. 9) points out, the “clas- RCS, the communications are protected “if the sifications of ECS and RCS are context sensitive: provider is not authorized to access the contents of The key is the provider’s role with respect to a any such communications for purposes of provid- particular copy of a particular communication, ing any services other than storage or computer rather than the provider’s status in the abstract.” processing” (18 USC § 2702 (a) (2) (b)). It is In this respect, O.S. Kerr (2004, p. 10) writes that therefore still useful to qualify the SNS provider. “files held in intermediate “electronic storage”192 are protected under the ECS rules”, while files held The traditional ECS provider is an Internet for “long-term storage by that same provider are service provider, a phone company or even a protected by the RCS rules.” So, the “traditional webmail provider. But Courts have already view” is that an email, not opened – or not retrieved deemed that an electronic bulletin board fits the from the webmail server – falls under the ECS definition of an ECS (Kaufman v. Nest Seekers, rules, while an opened one – or a retrieved from 2006)194. In addition, it has been the case of a the webmail server one – falls under the RCS “web-based forum where parties could commu- rules (Kerr, 2004, pp. 10-11). nicate” (Inventory Locator v. Partsbase, 2005). Therefore, SNSes groups, profiles, etc., could be But it has to be underlined in this respect that, at stake. In this respect, not all electronic bulletin according to the Court of Appeals for the Ninth boards or forums would be protected. Indeed, as Circuit (Theofel v. Farey-Jones, 2003), such it was stated by the Eleventh Circuit in Snow v. non-retrieved mails can be deemed to be stored DirectTV (2006), in “order to be protected by for backup purposes and then still falling under the [Stored Communications Act]; an Internet the ECS rules. It has to be recalled that the Ninth website must be configured in some way so as Circuit rules California where numerous SNS to limit ready access by the general public”195. are established (e.g. Facebook and Twitter). The And according to the Court’s judgment referring Ninth Circuit decided the following: to Konop v. Hawaiian Airlines (2002), the simple 173

Cloud Based Social Network Sites need of a registration without any screening could are accessible from the Web without subscribing be insufficient for the application of the Stored to the SNS will not be protected. Of course, the Communication Act. The Court underlined that: present reasoning would only apply insofar as Courts accept to make an analogy between an [A] short simple statement that the plaintiff screens SNS and a Forum or a webmail depending on the the registrants before granting access may have communications at stake. been sufficient to infer that the website was not configured to be readily accessible to the general The RCS rules target longer storage of data – public. However, Snow failed to make this or any beyond the backup storage. It requires processing remotely similar allegation. Instead, Snow’s al- services, and these services originally concerned legations describe, in essence, a self-screening an “outsourcing function” needed, originally, methodology by which those who are not the where companies do not have the technological website’s intended users would voluntarily excuse resources to have their own IT infrastructure to themselves. Because this is insufficient to draw process data themselves (Kerr, 2004, pp. 26-27). an inference that the website is not readily ac- Clearly, SNSes permit their users to store data for cessible to the general public, Snow’s complaint a long term, as they also provide data storage as a fails to state a cause of action and it was proper service. For instance, YouTube has already been to dismiss it. (Snow v. DirectTV, 2006) deemed to constitute a RCS (Viacom v. YouTube, 2008). Of course, the same considerations as And in Konop v. Hawaiian Airlines (2002): above mentioned related to the public or private character of the service will apply. Most probably, “Konop controlled access to his website by re- and putting aside Theofel v. Farey-Jones (2003), quiring visitors to log in with a user name and SNS will usually be considered as RCS because password. Konop provided user names to certain users outsource the processing of their data and Hawaiian employees, but not to managers or store them on the SNS provider’s servers for an union representatives. To obtain a password and indeterminate period of time. view the site, an eligible employee had to register and consent to an agreement not to disclose the Therefore the following question arises: If site’s contents.” Theofel v. Farey-Jones (2003) does not apply, SNS provider being considered as RCS provid- Since “Anyone can join” Facebook and also ers and not ECS providers, how far the access, other SNSes, a user’s content available to any to provide other services, to the data claimed by member of the network (e.g.Wall posts of “public” the SNS provider in the privacy policy and terms profile but nonetheless restricted to the members of use affects the protection afforded to its users of the SNS) will not be protected under the Stored by the Stored Communications Act? For instance Communications Act and the ECS rules. To the as regards Facebook, Facebook Inc. can access contrary, the content which will only be disclosed the data to deliver targeted advertisements, how to the user’s friends (“private” profile), who have does this have to be taken into consideration? In been screened because they have been individually other words, when and how far is an access “in accepted by the user at stake, could be protected. connection” with the provision of the service? The suggested reasoning above as regards com- For example in Viacom v. Youtube (2008), the munications occurring between a finite number Court decided that the authorization of YouTube of parties could be transposed here. Of course to “access and delete potentially infringing private and a fortiori, the public parts of the profile that videos is granted in connection with” YouTube’s provision of storage services (emphasis added by author). It is impossible here to answer that 174

Cloud Based Social Network Sites question which seems close to the question of the communication is carried on among the parties users’ consents that can lead to an exception to in the presence of one another or by means of a the Stored Communications Act and the Wiretap telegraph, telephone, or other device, except a Act. This question can be addressed now. radio, shall be punished…” Consent and Stored Therefore, only the confidential communica- Communications Act tions are protected, that is to say the communica- and Wiretap Act tions “carried on in circumstances as may reason- ably indicate that any party to the communication The consent to terms of service and privacy policy desires it to be confined to the parties thereto.” of SNSes websites could lead to an exception to And in any case, such a communication is not “a the prohibitions set in the Stored Communica- communication made in […] any other circum- tions Act196 and in the Wiretap Act197. To this stance in which the parties to the communication respect, there is a substantial difference between may reasonably expect that the communication American law and European law. In other words, may be overheard or recorded” (California Penal communications can be intercepted when they Code § 632 (c)). Moreover, the “person” targeted are transmitted or disclosed when they are stored by the offence “excludes an individual known by with the consent, to sum up, of one of the parties all parties to a confidential communication to be to the communication. For “example, the sender overhearing or recording the communication” (originator) of an e-mail as well as any intended (California Penal Code § 632 (b)). recipients may give consent to disclose the com- munication” (Ackermann, 2009, p. 43). Under The lawfulness of the collection of clickstream the Stored Communication Act, according to the data through cookies has been discussed in regards federal rules protecting electronic communica- to the Stored CommunicationsAct and theWiretap tions, a “one party consent” is then only required Act. These Acts illustrate the consequences of a (Schwartz & Reidenberg, 1996, p. 226). “one party consent” rule. In DoubleClick Privacy Litigation (2001)198, the Court applied the same Some States, such as California, have however reasoning as regards the consent in the Stored adopted a “two-party consent rule” (Schwartz & Communications Act and in the Wiretap Act. It Reidenberg, 1996, p. 227) requiring the consent noted that contracts existed between DoubleClick of each party to the communication at stake. But and the websites involved in the use of cookies for for instance, the relevant Californian rule, related the DoubleClick’s advertisement program. Due to the eavesdropping or recording of communi- to these contracts, electronic communications be- cations, is of little help here. Indeed it does not tween these websites and their web surfers – their lead to the same result we could plead for under clickstream – could lawfully be communicated to directive 2002/58/EC. In the case of communica- DoubleClick199; “because plaintiffs’ GET, POST tions realized through the Internet, the Californian and GIF submissions to DoubleClick-affiliated Penal Code § 632 (a) would apply. According to Web sites are all “intended for” those Web sites, this disposition: the Web sites’authorization is sufficient to except DoubleClick’s access under § 2701 (c)(2).” As “[e]very person who, intentionally and without regards the identification number of the cookie, the consent of all parties to a confidential com- that is not communicated to the Web sites at munication, by means of any electronic amplifying stake, the Court considered that, even if it were or recording device, eavesdrops upon or records protected – quod non according to the Court –, the confidential communication, whether the DoubleClick’s access is authorized because: 175

Cloud Based Social Network Sites In every practical sense, the cookies’identification by assenting to the YouTube website’s Terms of numbers are internal DoubleClick communica- Use and Privacy Policy, which contain provisions tions – both “of” and “intended for” Double- licensing YouTube to distribute user submissions Click. DoubleClick creates the cookies, assigns (such as videos) in connection with its website them identification numbers, and places them on and business, disclaiming liability for disclosure plaintiffs’hard drives. The cookies and their iden- of user submissions, and notifying users that tification numbers are vital to DoubleClick and videos they divulge online in the public areas of meaningless to anyone else. In contrast, virtually the website may be viewed by the public (Viacom all plaintiffs are unaware that the cookies exist, v. YouTube, 2008) that these cookies have identification numbers, that DoubleClick accesses these identification And the Court answered that, numbers and that these numbers are critical to DoubleClick’s operations. (DoubleClick Privacy [N]one of those clauses [could] fairly be con- Litigation, 2001) (emphasis added by author)200 strued as a grant of permission from users to reveal to plaintiffs [(notably Viacom, claiming While an application of directive 2002/58/EC that it owned copyrights in television programs, would have required, in addition, the consent of etc., broadcasted by YouTube users)] the videos the web surfers. that they have designated as private and chosen to share only with specified recipients (Viacom As regards the consent itself and the Wiretap v. YouTube, 2008) (emphasis added by author) Act, if a party has knowledge or notification of the interception, her consent does not need to be It is interesting to see that the Court directly express and can only be “inferred from the sur- takes into account the fact that the users at stake rounding circumstances” (Garrie & Wong, 2009, have defined privacy settings. p. 146, footnote no. 88). A qualified consent as what is required under directive 95/46/EC is Conclusion not needed. The First Circuit Court of Appeals considered, still as regards the Wiretap Act, that, The protection of the confidentiality of commu- nications seems more elaborated in the United Consent may be explicit or implied, but it must be States than in Belgium where the transposition actual consent rather than constructive consent”; of directive 2002/58/EC as regards this topic is it requires an “actual notice” or that “the sur- relatively brief. But directive 2002/58/EC gives rounding circumstances convincingly show that Member States enough margin to establish a the party knew about and consented to the inter- well balanced framework. The ECPA and, more ception. (Pharmatrak, Privacy Litigation, 2003) precisely, the Stored CommunicationsAct should offer the SNSes users a mean to control, by their Finally, in Viacom v. YouTube (2008), where consents, the protected communications. However the YouTube RCS and the Stored Communica- and some interpretation concerns put aside, only tions Act were at stake, the Court addressed, in the consent of one party to the communication some extent, the question of the scope of the user at stake is required. And such consent does not consent to the terms of use and privacy policy need to be qualified as it has to be as regards di- of the website. It had been argued that users of rective 2002/58/EC. This shows two substantial YouTube have consented to the disclosure of data 176

Cloud Based Social Network Sites differences between the American and European coming from this latter, to the former. It should regimes of confidentiality of electronic com- be pointed out that, particularly as regards SNSes, munications. the user’s computer terminal is more than a place where personal information is stored202 and life PROTECTION OF COMPUTERS happens. It is also, and above all, a mean to be- have, a necessary extension of the individual to Judge Kleinfeld, who dissented in USA v. Micah “e-socialize” with others and, more generally, to Gourde (2006), underlined that: “e-act.” [F]or most people, their computers are their most Whatever can be the links between privacy, private spaces. People commonly talk about the data protection and the computer terminal, the bedroom as a very private space, yet when they purpose focuses on the prohibition of hacking have parties, all the guests — including perfect (III.3.1). It then underlines the consequences that strangers — are invited to toss their coats on the directive 2002/58/CE could have as regards the bed. But if one of those guests is caught exploring use of cookies. Indeed, cookies imply the access the host’s computer, that will be his last invita- to the computer of a web surfer (III.3.2). In this tion. There are just too many secrets on people’s context, the user’s consent is still a key mean of computers, most legal, some embarrassing, and control. some potentially tragic in their implications […] a married mother of three may be carrying on a HACKING AND SNSES steamy email correspondence with an old high school boyfriend. Or an otherwise respectable, Hacking is internationally prohibited, like it is in middle-aged gentleman may be looking at dirty Belgian and American law. The unauthorized ac- pictures. (USA. v. Micah Gourde, 2006) cess to a computer is forbidden.As regards SNSes, it seems particularly interesting to determine if Without any doubt, the web surfer’s termi- a breach of a contract (terms of use), concluded nal – computer or mobile phone, etc. – is a very between the user and the SNS provider as regards private space. So much that Y. Poullet (2008, pp. the use of the website, could lead to a hacking. 62-65) has already suggested that it should be at Indeed, the access to the provider’s servers would the core of a third generation of data protection then occur contrary to what is authorized to users. rules, making it closer to a “private electronic space”, a “virtual domicile” (Y. Poullet, 2010). The Prohibition of Hacking The author also refers to Germany that knows a new fundamental right to the confidentiality and Thanks to the prohibition of hacking, the SNS the integrity of the technological information sys- user is empowered to control the access to his tems, based on the general right to personality201. personal computer, the writing of data on it and In our view, the user should have the complete the extraction of data from it.As the SNS provider ownership of its terminal, controlling to which is empowered to do the same as regards his own other terminals this latter “speaks” and what it servers. In the Internet, the use of cookies, for “tells” them. For instance, everybody should have instance, involves accessing to and writing data a user-friendly mean to monitor (and, need be, on the web surfer’s personal computer. As the to block) the electronic communications coming use of a SNS implies writing on the computers from its computer terminal to the Internet and of the SNS provider. The Council of Europe’s Covenant on Cybercrime (Budapest Convention, 177

Cloud Based Social Network Sites 2001) compels its Member States203 to establish a a system – external hacking –, a malicious intent criminal offence forbidding hacking204. It targets being an aggravating circumstance (Article 550 the intentional access, “without right”, to computer bis, § 1, CP). Will also be punished anyone who, systems (Article 2 of the Budapest Convention, with a fraudulent intent, exceeds his power to ac- 2001). A scholar emphasized that since “in order cess to such a computer system – internal hacking to be considered an offence, the conduct must (Article 550 bis, § 1, CP). Therefore, the mens be committed intentionally and unlawfully, i.e. rea varies depending on the qualification as an “without right””, “there are acts which, if duly “external hacking” (to access without authoriza- […] accepted as lawful commercial practices, tion) or an “internal hacking” (to exceed rights of will not be considered a criminal offence under access).The internal hacking requires a fraudulent the Convention” (Csonka, 2006, p. 483) (em- or malicious intent. That is to say the lure of illegal phasis added by author). Indeed, according to profit or malice (Projet de Loi, 2000, p. 16). In the Explanatory Report of the Budapest Conven- each case, the breaking of a protection system is tion (no. 38): “legitimate and common activities not a constitutive element of the offence (Projet inherent in the design of networks, or legitimate de Loi, 2000, p. 17)206. Of course, if such protec- and common operating or commercial practices tion systems have been broken or by-passed, it should not be criminalized.” is then impossible, for the individual at stake, to argue that he ignored he was not authorized to For instance as regards cookies, the explana- access to the computer at stake207. tory report follows: InAmerican federal law208, the Computer Fraud The application of standard tools provided for in andAbuseAct (18 USC § 1030 [CFAA])209 forbids the commonly applied communication protocols hacking. Who “intentionally accesses a computer and programs, is not in itself ‘without right’, in without authorization or exceeds authorized ac- particular where the rightholder of the accessed cess, and thereby obtains” (18 USC § 1030, (a) system can be considered to have accepted its 2°) “information from any protected computer210” application, e.g. in the case of ‘cookies’ by not will be punished (18 USC § 1030 (a), 2° (C)). rejecting the initial installment or not removing Like in the Belgian PC, the breaking of a protec- it (no. 48) tion system is not required. But contrary to this Code, the mens rea is the same in both cases of Therefore, it seems implicitly that to define the hacking (internal or external). Coming back to parameters of a browser or to let the default rules the example of cookies, in the aforementioned play is enough to authorize access to a computer. matter DoubleClick Privacy Litigation (2001), Although the actual widespread browsers – Safari, the Court applied this statute. However, the les- Internet Explorer and Firefox – do not integrate a sons it provides are limited for the purpose, since really user-friendly tool to easily and practically DoubleClick did not question that it had not had manage the cookies coming from the different the authorization to access web surfers’ comput- websites. And although numerous websites – like ers. The debate focused on the kind of damage at SNSes, e.g. Facebook – technically compel web stake and the threshold victims had to demonstrate surfers to accept cookies to access the website. for the success of their suit. This is precisely what they failed to do, leading them to the failure of The Belgian PC protects everyone against an their lawsuit211. This case nonetheless shows that unauthorized access to his computer (Article 550 the use of cookies could lead to hacking. bis CP)205. In the Code’s words, will be punished anyone who, knowing that he is not authorized, American case law provides some answers to access to a computer system or remains in such an interesting question that could be decisive in 178

Cloud Based Social Network Sites the SNSes context and that needs now to be ad- she falsely represented herself as a young boy dressed: Could a breach of a contract – if there is (with a photo). She knowingly violated MySpace actually a contract between an SNS provider and terms of use compelling users to provide real its users212 – amount to an unauthorized access information. The American government, suing to a computer, constituting therefore a criminal her, pleaded that such a behavior constituted a offence? hacking – without specifying if it was an internal or an external one – of MySpace’s servers214. Hacking and Breach of a Contract Judge Wu concluded that the government In the United States, different cases show that “[t] wrongly charged her because of the “void-for- he extent of authorization may turn upon the con- vagueness doctrine”215. Although he specified tents of an employment agreement or similar docu- that “within the breach of contract approach, most ment, a terms of service notice, or a log-on banner courts that have considered the issue have held outlining the permissible purposes for accessing a that a conscious violation of a website’s terms of computer or computer network” (Computer Crime services/use will render the access unauthorized and Intellectual Property Section, Criminal Divi- and/or cause it to exceed authorization”216. As sion ([CCIPS], 2007, pp. 6-10). Courts have had stated by Judge Wu, “[t]o avoid contravening the to decide if the knowingly breach of a website’s void-for-vagueness doctrine, the criminal statute terms of service (AOL) (AOL v. LCGM, 1998), must contain “relatively clear guidelines as to pro- and even those of an SNS (MySpace) (USAv. Lori hibited conduct” and provide “objective criteria” Drew, 2009) could lead to hacking. Indeed, the to evaluate whether a crime has been committed” access to an SNS necessarily implies the access (USA v. Lori Drew, 2009). He deemed in particu- to the computer systems of its provider (or of the lar that if any breach of terms of use constituted provider’s subs contractors). As regards internal a criminal offense of hacking, the “fair warning hacking and the CFAA, a conscious behavior, with- requirement” would not be satisfied217. Which out any malicious intent, suffices to be punished means that an average individual would not be as it has been noted. In AOL v. LCGM (1998), able to identify what is forbidden and what is not. where unsolicited bulk emails were at stake, the defendant was deemed guilty of hacking213. The Not to follow Judge Wu’s point of view in the Court decided that, context of SNSes would lead to potentially sen- tence for internal hacking anyone who, breaching Defendants have admitted to maintaining an – without any bad intent – the terms of use requiring AOL membership and using that membership to its identification, would act under a pseudonym. harvest the e-mail addresses of AOL members. Such “an interpretation that criminalizes routine Defendants have stated that they acquired these computer use would give the government the e-mail addresses by using extractor software power to arrest any typical computer user” (Kerr, programs. Defendants’ actions violated AOL’s 2010, p. 17). Terms of use are potentially really Terms of Service, and as such were unauthorized. vague and “[v]iolating the [terms of service] is (AOL v. LCGM, 1998) the norm; complying with them the exception” (Kerr, 2010, 21). Terms of use can be so vague Whereas, in the matter of USA v. Lori Drew, that any illegal intent – from a civil or a penal the defendant was found not guilty (2009). In viewpoint – in the use of the website – or service this latter case, the defendant was a mother who – at stake would lead to a breach of these terms218. harassed a young girl using MySpace. To this aim, This would therefore make the web surfer guilty of hacking. The reasoning can be pushed to an absurd result taking an IAP as an example. If an 179