Applicable Law

Following hereafter is the normative analysis and thelegislative developments of the right to honor, personal and family privacy and image, with special emphasis on the protection of this right on the Internet and the services associated with it.

To provide a complete overview of this situation, these rights are going to be analyzed in an international, European and national view.

International regulations

The protection of these rights is not restricted for certain states, but is recognized by the main part of the international community, and are specifically protected by national constitutions and laws of many countries.

The Declaration of Human Rights of 1948 establishes the first source of norms regarding these rights, stating that: "No one shall be subjected to arbitrary interferences in

his privacy, family, domicile or correspondence, nor attacks on his honor and reputation. Everyone is entitled to the protection of the law against such interference or attacks."

Similarly, but specifically for minors, the International Covenant of Civil and Political Rights of 1966 and the International Covenant of Economic, Social and Cultural

Rights of 1966 give the right to all children to have a greater degree of protection, because of their particular characteristics.

This normative protection for minors is expressly stated in the document adopted by the Convention of the Children Rights of 1989, which states: "no child shall be subjected

to an arbitrary or unlawful interference in his privacy, family, home or correspondence, nor to unlawful attacks on his honor and reputation. The child is entitled to the protection of the law against such interference."

European Regulation

First, it must referred to the Rome Convention of 1950 (ECHR)62 that can be cited as the first European text that enshrines the protection of privacy and also, the Common Agreement 108 of the Council of Europe that defines the legal context of privacy protection, in relation to information and communications technologies. The International Convention of 1950 has also been particularly effective in the field of human rights protection in those States who have agreed to be bounded by its terms.

The importance of the Convention, for national legal systems, derives from its dual nature as a rule incorporated into the Spanish law by the Article 96 of the Spanish Constitution and as a criterion for the interpretation of fundamental rights with the provisions of the Article 10.2 of the Constitution. This dual nature has effects on the judgments issued by the European Court of Human Rights that implements the Convention. It produces legal effects in domestic laws and has been inspiring the work of the Constitutional Court in the interpretation of fundamental rights.

At the EU level, the provisions of the Charter of Fundamental Rights to the European Union (2000 / C 364/01)63 stipulates that "Everyone has the right to the respect of their

private and family life, home and communications”.

Similarly, in the European Charter on the Rights for the Child (A3-0172/92 European Parliament resolution of 8 July 1992) has stated that "Every child has the right to be

free from unwarranted intrusions by third parties in his private life, family, and not to suffer

62

The Rome Convention of 1950 regulates the right to privacy in Article 8 as follows: Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right, but as long as this interference is provided for by law and is necessary in a democratic society, is necessary for national security, public security, economic welfare of the country, the defense of order and crime prevention, protection of health or morals or the protection of the rights and freedoms of others.

Rome Convention of 4 November 1950 for the Protection of Human Rights and Fundamental Freedoms. Instrument of Ratification of 26 September 1979.

63

unlawful attacks that affects his honor, recognizing the right and also protecting their image”.

It should be noted that EU rules do not usually relate to privacy or the right to privacy, but many other rules use the term “privacy” when dealing with personal data (see section 3.2.1).

United States of America

In the U.S. the protection of privacy in the legislation is a complex interpretation of the Supreme Court’s work that, after nearly half a century, has reached to the constitutional recognition of the right to privacy. And it was by deducting it from “the shadows and dark shadows" of various amendments of the Constitution. The U.S. Constitution does not expressly recognize the right to privacy. This one was built by the Supreme Court from rights explicitly recognized in the Constitution, and by their combination with what was deduced from the "dark shadows" of the constitutional percepts.

Specifically, the Supreme Court has come to the fact that the U.S. Constitution does not contain a closed list of rights but, the Ninth Amendment stands with an open clause for the incorporation of new rights and states that "the Constitution lists certain rights”,“which does not means that this deny or disparage other rights granted to the people". Moreover, the Fourteenth Amendment has provided the Court a procedural argument to consider cases related to privacy, which gives citizens the right not to be deprived of life, liberty or their properties without due process of law”. Thus, the Due Process Clause acts as a clause guaranteeing the freedom of citizens against the powers of the State. These two specific clauses related to specific rights –the freedom of speech and people's participation in the First Amendment, that limits the military use of private houses during peacetime, and in the Third and Fourth Amendment, the protection of the domicile- have been used to infer privacy as a Constitutional right.

It should be noted that is not easy to analyze in a legal mode the regulation of privacy in the U.S., because of the U.S. have a federal State64.

64

They can be mentioned, in a nonexhaustive list, among others: Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 (1970). Privacy Act, 5 U.S.C. § 552 (1974). The Freedom of Information Act (FOIA), 5 U.S.C. § 552 (1974). Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g et seq. (1974). Right to Financial Privacy Act, 12 U.S.C. § 3401 et seq. (1978). Privacy Protection Act, 42 U.S.C. § 2000aa et seq. (1980). Cable Communications Policy Act 47 U.S.C. § 551 et seq. (1980). Electronic Communications Privacy Act (ECPA), 18 USC §§ 2701-11 (1986). Video Privacy Protection Act, 18 U.S.C. § 2710 (1988). Employee Polygraph Protection Act, 29 U.S.C. § 2001 et seq. (1988). Telephone Consumer Protection Act, 47 U.S.C. § 227 (1991). Driver's Privacy Protection Act, 18 U.S.C. §§ 2721-2725 (1994). Telecommunications Act, 47 U.S.C. §222 (1996). Electronic Freedom of Information Act Amendments of 1996, Public Law No. 104-231, 110 Stat. 3048 (1996). Financial Modernization Services Act ,Public Law 106-102, Gramm-Leach-Billey Act of 1999. Department of Transportation and Related Agencies Appropriations Act of 2000 § 350, Pub. L. No. 106-69; 113 Stat. 986 (1999). Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USAPA), H.R. 3162, (2001) o USA Patriot Act. Pen/trap Statute 18 USC §§ 3121- 27 (2002). Wiretap Statute, 18 USC §§ 2510-22, (2002).

Similar regulations are responsible for ensuring the protection of privacy of users in specific situations. In this regard are included 2 main rules:

• Telecommunications Act 1996 (adopted on June 13, 1996). This rule explicitly governs all aspects of the Internet dealing with violent content and/or pornography that may damage ethics and morals of the people, establishing the protection for the ISP (Internet Service Providers), regarding the contents published by third parties.

• Children's Online Privacy Protection Act 1998, which contains the specific regulations regarding acts designed to obtain information or deceive children when they are navigating on the web.

In terms of privacy, it is necessary to consider the "USA Patriot Act” (UPA) adopted on October 24, 2001. This rule is a clear limitation of the right to personal and family privacy and the confidentiality of communication, for any person in the United States, since the Federal Government has the full power to tap any kind of communication, internal or external, e-mail, telephone conversations, either text or voice messages, web browsing history, as well as consultations on Internet search engines. This intends to increase the security of the State against the organized crime and terrorism.

Spanish Laws

A national policy of recognition of the right to honor, personal and family privacy and image is enshrined in the Article 18.1 SC.

Subsequently, by the Act 1/1982 of May 5, Protection of the Civil Right to honor, personal and family privacy and image, the Spanish legislation develops this fundamental right, with a specific protection in civil matters.

The Criminal Law provides specific regulation in crimes that involves the violation of the rights to honor, privacy and image, regardless of the means by which they are committed. Under the point of view of the secrecy of communications and the fundamental right to data protection, this rule is combined with the publication of the Law 25/2007, Conservation of Information related to electronic communications and public communications networks that states the obligation for the operators to provide electronic communications services available to the public or for those who operates public communications networks, to retain traffic data generated by users via their phones or devices connected to the Internet, as well as the duty to transfer such data to agents empowered through a required judicial authorization, for purposes of detection, investigation and prosecution of serious crimes under the Criminal Law or specific related laws.

3.1.3 Possible risks. How could the right to honor, privacy and image be affected in a Social Network?

As noted in the beginning of this chapter, social networks and collaborative websites, are not free from danger of malicious attacks. Some situations may arise that threaten the integrity of the rights to honor, personal and family privacy and image of their users.

Thanks to the previous analysis and the interviews conducted in the sector, we are going to show situations that can damage the integrity of the users’ rights. This analysis starts at the moment the user is logged in the social network, and ends at the time the service is cancelled.

Thus, the first critical point is the user registration and profile settings process, since this is the phase in which the user must assess what is going to be published on his/her profile and the level of publicity that this information is going to have. This point is very important and must be taken care of by the users; it will be essential for the subsequent protection of their privacy and the one of all the members of their network.

In this initial stage, the right to personal and family is only affected when personal data are provided. It is affected if the service offers to the users the ability to make decisions about their environment, (for example, if the profile could be configured as a public or as a restricted space), then by how the user uses his/her profile, it could affect the honor on his/her personal images or the one of persons to whom he/she refers to.

Thus, a possible risk that may arise is that the user does not properly set the profile privacy level at the time of the registration, either through ignorance or because the social network does not have these settings.

A proper configuration of the profile privacy is essential; since often what is enabled by default on the platform allows the maximum degree of visibility. Therefore, an incorrect configuration or setup can affect not only to the contents that had been published by the user, but also to all other users who have published or shared information, since it will be accessible for the other members of the platform.

The routine of the users in the platform is the second moment when the right to privacy and image may be violated, depending on the kind of activities that the users perform. They could undermine the protection of these rights by the publication of intimate information in the platform. Any user could control the content that he/she wants to be published, but the implications of this action are not correctly appreciated. Furthermore, the control of the information in a social network is limited because any person on it could publish pictures, videos, reviews, images or labels with the name of other users.

Furthermore, it should be noted that the amount of information, data and images that can be published could be excessive and impact on the personal and third parties ´privacy.

• Personal privacy: even if the users are those who voluntarily publish their data, these platforms possess powerful tools for exchanging information, processing capacity and analysis of information provided.

• Third parties´ privacy: it is essential that users keep in mind that the upload of information and data of third parties could not be done, unless they have expressly authorized agree to it so the third parties could request immediately its removal. It is important to note that in most cases, social networks allow to search engines to index the user profiles, along with the contact information and profiles of related friends, which could be another risk for the protection of privacy. It may also hinder the removal of their information on the Internet.

Another risk that may occur while surfing on the social network, is the one related to the ability of these platforms to locate the user through the IP address and get to know the connecting device in order to contextualize the content and advertising displayed on it. This fact can be considered as an intrusion to the routines of the user that can seriously impair the right to privacy.

Finally, when the user requests to unsubscribe from the service, the right to privacy and image may also be affected. This happens because, in spite of the cancellation of the account, private information of the user could sometimes continue being accessible from profiles of other users and indexed and cached from different search engines available on the Internet.

3.1.4 Vulnerable Groups. Underage and legally incapacitated users.

This section gives specific attention to three groups that, by their nature, may be affected in a greater extent than other users; underage users, legally incapacitated users and workers, whose presence and participation in such platforms is common.

Underage and legally incapacitated persons

From a legal point of view, in matters related to the protection of honor, privacy and image, we have to take into account the specific regulation that already exists.

The Organic Law 1 / 1982 on the Civil Protection of the Right to honor, personal and

family privacy and image, specifically regulates the manner in which the consent should

be given by underage and legally incapacitated persons, in order to make an adequate protection of their rights to honor, privacy and image. In this regard, it provides that: "The

consent of underage and legally incapacitated persons should be provided by them if their conditions is considered as mature by the civil law."

Moreover, the law establishes two principles that contrast with the reality of the Internet. The Article 1 stipulates that: "the civil protection to honor, privacy and image is defined by laws and social practices according to the acts made by a person”. Moreover, referring to the underage persons the Section. 3, establishes a criteria, of the possibility that a mature underage person can consent in matters which affects his honor, privacy or image, and, in cases where children does not have the sufficient capacity to consent, the rule says that "the consent will need to be given by a written text of the legal representative, who will be required to inform to the Public Prosecutor about this consent. If in eight days the Public Prosecutor has objected the given consent, the judge will decide."

An additional criteria is what the Article 4 of the Organic Law 1/1996 of January 15, of Protection of Underage persons, that partially amends the Civil Code and the Code of Civil Procedures, which, in addition of recognizing the child's rights in Article 18 SC provides the intervention of the State Prosecutors in cases of spreading of information or use of images or names of the underage persons, in media that may involve an unlawful intrusion to their privacy, honor or reputation, or that may be contrary to their interests. Also, the provision orders to parents and/or guardians and to the authorities to respect these rights and protect them against possible attacks by third parties.

It is clearly evident, that the reality of social networks is beyond the actual regulations, so it required a systematic and proper interpretation of every law and regulation. Children under 14 years old are capable to understand the use of technology, capturing and reproducing information which affects their honor, privacy, image, their interests or others´. Photographs of children proliferate on the Internet on their own profile spaces, and even on pages linked to their families and/or to school activities.

It can be noted that the specific risks for children in this area are directly related to: • Access to inappropriate content.

• The possibility to have an online contact, and even in person, with malicious users. • The proliferation of children images and personal information published by

themselves or by third parties with ignorance of the risks associated with.

Social networks and websites, have main difficulties in achieving effective protection of users because their actual systems are unable to control publications made by their underage users, and by do not having tools that fully ensure the identity of their users.

Therefore, as the measures to control the content and access to inappropriate material, are not properly developed and implemented, the risk of violating the rights of the minors will persist.

To this factor it should be added that, (as we have emphasized) the Organic Law 1/1982, at the time that it was created, the usage of information and the image of the children, as the intervention of the Prosecutor, nowadays is certainly feasible thanks to technology. The ENISA paper 'Children in a virtual world: What parents should know about”65, published in September 2008 provides a series of recommendations to parents, highlighting, among other recommendations, the need to train and educate both (parents and children) alike.

Other cases: workers

From a legal point of view, the privacy of workers have an additional protection that the Royal Decree 1/1995 of March 24, complements by approving the text of the Workers' Statute (WS), that repeatedly states the right to workers to be respected by the employer. That rule provides that “records to workers could only be made in their lockers and just if