The “right to be forgotten” and other cyberlaw cases go to court

From copyright to privacy, courts have become the front line of cyberlaw “We’re entering a phase where there’s so much more unease”

“The law can’t be right if it’s 50 years old. Like, it’s before the internet.” The quote is from a speech Larry Page made at a Google developers conference in 2013, and it’s a fair summary of how technology companies have traditionally viewed the legal system. Regulations can’t keep pace with technological change, so opt for forgiveness over permission. If your idea is successful, you’ll be able to defend it by the time authorities tell you to stop.

“If you look at the relationship between innovation and how society interacts with it, the emphasis has been on ‘code as law,’ ” says Urs Gasser, the executive director for Harvard’s Berkman Center for Internet & Society. That means relying mostly on software to govern online interactions—blocking spam or Twitter trolls, even trying to identify copyright infringement. Gradually, that approach is starting to change. “Post-Snowden,” Gasser says, “there’s a renewed emphasis on ‘law as law,’ to regulate code.”

The change has come partly because tech companies increasingly have their own turf to protect—and the money to seek help from Washington. On June 13, bandwidth-hungry internet companies including Netflix won a sweeping victory against the likes of Verizon and AT&T. A broad 2-1 decision by the U.S. Court of Appeals for the D.C. Circuit upheld the Federal Communications Commission’s authority to set rules on net neutrality, preventing broadband providers from favoring data traffic from certain sources—or squeezing those sources at outsize rates. (The cable companies say they’ll appeal to the U.S. Supreme Court.)

Often as not, Silicon Valley is fighting one government or another, too. Some companies are seeking looser protections for labor or copyright; others want to confirm the limits of U.S. law enforcement’s authority abroad. “I think we’ve moved out of the time when people were either triumphalists or predicting catastrophe,” says James Grimmelmann, a law professor at the University of Maryland who specializes in digital issues. “But we’re entering a phase where there’s so much more unease. There are so many problems … which are hard to fix without messing other things up.”

For now, with Congress paralyzed, changes are most likely to come through patchworks of court precedents. Here are four other questions courts have been grappling with that could reshape the digital world:

1. Do gig-economy companies have to hire workers as employees?

Tan v. GrubHub The only thing growing faster than gig-economy companies may be the number of potential labor class actions being filed against them. More than a dozen such cases involve startups, and most allege “employee misclassification”—that the companies treat workers as contractors when they should be employees entitled to a minimum wage and overtime.

In April, Uber settled a class-action case in California for $84 million. The settlement allows the company to keep paying drivers as contractors and didn’t resolve the underlying issue. “The Valley wants clarity,” says Shannon LissRiordan, the lawyer at Lichten & LissRiordan who represented the drivers. She’s also filed lawsuits that might make for stronger cases. One involves food delivery service GrubHub, which treats workers who sign up for delivery shifts as contractors.

A month before the Uber settlement, a federal judge dismissed most of Liss-Riordan’s class-action complaint against GrubHub, which has since been amended for reconsideration, but ruled that the part of the case concerning the company’s alleged failure to reimburse business expenses could proceed. The company has said the case doesn’t have sufficient facts to go forward. (LissRiordan’s firm also represents individual GrubHub workers in separate arbitration proceedings.)

The question of who’s a contractor depends on facts that vary from company to company, such as how much control the employer has or who supplies workers’ equipment. The stakes are high, says Daniel Rockey, a partner at law firm Bryan Cave who represents Lyft: “Potentially, the whole gig-economy model is at stake.”

Lawsuits may have already started to change the gig economy: Startups such as Instacart, Shyp, and home-care provider Honor HealthCare have hired workers as full-time employees with benefits in the past couple of months. “The case against Uber seems to have had a tremendous deterrent effect,” Liss-Riordan says. “I’m proud of that.”

2. What does copyright cover?

Star Athletica v. Varsity Brands A case the U.S. Supreme Court has agreed to hear in its 2016-17 term could dramatically affect the business of 3D printing. At issue is the eligibility of cheerleader uniforms for copyright protection. Give me a ©!

In the U.S., you can’t copyright “useful articles,” like a table, but you can copyright artistic creations, like a design on its surface. Varsity Brands, the $300 million-a-year queen bee of cheerleading uniform makers, is suing upstart Star Athletica for selling uniforms Varsity says infringe on its copyrights. Varsity’s position is that its uniforms’ stripes and other patterns can be copyrighted; Star says those patterns are essentially functional.

Since the passage of the 1976 Copyright Act, courts and scholars have devised several tests to separate an item’s design from its function. A district court held that Varsity’s uniforms couldn’t be copyrighted, but the appellate court ruled for Varsity, concluding that the designs were distinctive enough for protection.

A clear Supreme Court ruling on the line between useful articles and artistic creations would help 3D-printing businesses whose customers are concerned that in the absence of clear rules they could violate someone’s copyright (page 56). Printing company Shapeways and printer maker Formlabs joined an amicus brief urging the court to take the case. “Right now, everyone is in a supercautious

Changes are most likely to come through patchworks of court precedents

defensive mode,” says Shapeways general counsel Michael Weinberg. Martin Galese, general counsel of Formlabs, says: “Uncertainty has priced people out of the business who can’t afford legal representation.”

3. How much power does the U.S. have to access data abroad?

Microsoft v. United States Microsoft’s case against the federal government, argued before an appellate court last September, is expected to determine how easily the feds can access data stored in other countries. It could also determine whether the U.S. will be able to maintain its lead in the cloud-computing business, worth $100 billion a year and growing fast.

The case began when a judge issued a warrant for information relevant to a narcotics investigation, stored in a Microsoft data center in Ireland. Microsoft, which is also lobbying for cloud-era updates to U.S. privacy laws, challenged the warrant, arguing the Department of Justice doesn’t automatically have jurisdiction over data held abroad. The Justice Department says Microsoft has enough control over its foreign data center for a warrant to apply. Microsoft sued and lost in district court, then appealed to the U.S. Court of Appeals for the Second Circuit.

Microsoft’s stand for privacy dovetails with its financial interests. If it loses, rival cloud companies abroad will have a much better sales pitch. “A number of governments have told us that they will trust American technology only if we win,” says Brad Smith, the company’s president and chief legal officer. “They won’t be comfortable putting information in Americanrun data centers if the U.S. government can reach into their country with a unilateral search warrant.”

Even worse for the industry and consumers, other countries would almost certainly follow the U.S.’s lead, says Marc Zwillinger, founder of ZwillGen, a law firm that focuses on technology, who wrote the amicus brief Apple filed on Microsoft’s behalf. “If the standard set here is that foreign law is given no weight,” Zwillinger says, “foreign governments will impose similar orders that U.S. law can be disregarded.” Microsoft has already gotten a taste. Last year a company executive in Brazil was detained by police demanding access to a local user’s Skype data, which was stored in the U.S. Under U.S. law, Microsoft was forbidden to share it.

4. Can France expand Europe’s “right to be forgotten” worldwide?

Google v. CNIL In 2014, Europe’s high court affirmed a “right to be forgotten,” allowing people in the EU to formally request that search engines remove links to outdated or irrelevant material about them. It’s not an absolute right: The web pages themselves remain online; search companies don’t have to grant every request; and public figures merit less protection than others. But the ruling was a blessing for people whose top Google result was a dumb quote they gave their college newspapers.

Initially, however, Google delisted search results only on European domains, such as France’s .fr or Germany’s .de. Then it tried delisting results on all domains, but only for searches made in the country where the request originated. In March, CNIL, France’s data protection regulator, fined the company €100,000 ($113,000) for failing to comply with its interpretation of the 2014 ruling. “The territorial scope of the delisting is just a point of interpreting and applying the law,” says Mathias Moulin, the agency’s deputy director in charge of enforcement.

In May, Google appealed CNIL’s decision to France’s highest administrative court, the Conseil d’État, which can take the case or refer it back to the EU high court. While the case will rest on technical details of European data protection law, it has broader implications. “If French law applies globally,” wrote Google’s general counsel, Kent Walker, in a Le Monde op-ed following the appeal, “how long will it be until other countries— perhaps less open and democratic—start demanding that their laws regulating information likewise have global reach?”

That’s an argument unlikely to win over a French court, though. “We have this really interesting conflict emerging between the desire of multinationals to create the most global internet possible and the jurisdictional demands of other countries,” says Trevor Hughes, head of the International Association of Privacy Professionals. “That tension is only going to increase.”

The bottom line Cases now working their way through U.S. and European courts could do a lot to update laws to keep pace with technology.