An Italian court has convicted three Google executives of violations of the country's privacy code, handing them a six month suspended prison sentence over a video hosted on the site which shows an autistic child being bullied.
The ruling threatens to undermine the safe harbour usually enjoyed by companies such as Google, who under EU law are not held responsible for content they did not create.
Turin school pupils filmed their bullying of an autistic schoolmate and posted the video on YouTube. Google has said that it removed the video "within hours" of it appearing on the site and helped police to identify the person who uploaded it.
But four current and ex-Google executives were charged by Italian prosecutors with defamation and invasions of privacy over the fact that the video was hosted at all.
Two current and one former Google executive were convicted. They are its legal officer David Drummond and global privacy counsel Peter Fleischer as well as former employee George Reyes.
The EU's E-Commerce Directive protects service providers from liability for material that they neither create nor monitor but simply store or pass on to users of their service. The Italian ruling could threaten the operation of that exemption.
Service providers are not exempt unless they act to remove illegal material once they are made aware of it. They also can lose exemption if they monitor content.
Google does not monitor YouTube content but only responds to complaints. The case against the executives argued that the company did not have enough staff to properly monitor videos.
Google said that it would appeal the ruling.
"In essence this ruling means that employees of hosting platforms like Google Video are criminally responsible for content that users upload. We will appeal this astonishing decision because the Google employees on trial had nothing to do with the video in question," said Google lawyer Matt Sucherman in a statement.
Google said that the ruling threatens to undermine the legal basis of many of the internet's most popular services.
"European Union law was drafted specifically to give hosting providers a safe harbor from liability so long as they remove illegal content once they are notified of its existence," said Sucherman. "[This ruling] attacks the very principles of freedom on which the Internet is built. Common sense dictates that only the person who films and uploads a video to a hosting platform could take the steps necessary to protect the privacy and obtain the consent of the people they are filming."
"If that principle is swept aside and sites like Blogger, YouTube and indeed every social network and any community bulletin board, are held responsible for vetting every single piece of content that is uploaded to them - every piece of text, every photo, every file, every video - then the Web as we know it will cease to exist, and many of the economic, social, political and technological benefits it brings could disappear," said Sucherman.
Telecoms law expert Jon Fell of Pinsent Masons, the law firm behind OUT-LAW.COM, said that though the E-Commerce Directive did provide a safe harbour, it was not absolute.
"The service provider will not be liable where it does not have actual knowledge of unlawful material and, where a claim for damages is made, is not aware of fact or circumstances from which it would have been apparent to the service provider that the activity or information was unlawful," he said.
"This means that, whilst there is no obligation to monitor the contents of a web site, a service provider should not merely turn a blind eye," he said. "The [UK Regulations implementing the Directive] provide that the service provider cannot rely on the fact that it did not have constructive knowledge as a defence."
"The service provider must act immediately upon gaining knowledge that the material is unlawful by either removing or disabling access to the material, and the person who has posted the material must not be under the authority or control of the service provider," said Fell. "This reflects the terms of the EU Directive and is why in the UK there is an emphasis on having a robust take down notice and procedure."
Fell also said that it may be the case that a particular Italian law is not in fact bound by the E-Commerce Directive.
"Assuming that Google can show that it did not know about the material before being notified by the authorities – which is difficult to prove - then the E-Commerce Directive should have provided it with protection," he said. "However, in the UK the e-commerce regulations are drafted so as to apply only in relation to the laws that were in force at the time the regulations came into force." "Any laws passed subsequent to that date need to be specifically added to the protection afforded by the regulations by means of a Statutory Instrument. This may or may not be the case in Italy, but if it is, Google will need to ensure that the laws under which they are prosecuted are included within the relevant protection."