Can big data accumalators be guilty of defamation/libel/slander?

Question

It is currently in the news that there are accusations that the Global Internet Forum to Counter Terrorism (GIFCT) has been used to target individuals. As I understand it third parties, Only Fans in this case, told GIFCT that images from certain individuals were associated with terrorism and GIFCT publishes identifiers of images (hashes) that other third parties (Meta in this case) acted on to the detriment of those individuals (their images and/or accounts were removed by Meta because of the association with terrorism). For a statement to be defamatory it is required that:

• The statement was communicated to a third party;
• It caused or is likely to cause serious harm to the claimants reputation:
  • It causes the regard in which the subject is held by right thinking or reasonable members to be lowered;
  • It substantially affects in an adverse manner the attitude of others towards the claimant.

It seems this would apply in this case, as it consisted of one of the worse accusations possible in this day and age it could be considered extremely so. The same basic model is used by other organisations, such as credit reference agencies (X is a bad credit risk) and CIFAS (X is a fraudster or easy mark). These is the defence of honest opinion, but one could at least make the claim that the word of a competitor would not be considered sufficient proof of terrorism for a reasonable person to repeat said claims.

Are these sorts of determinations the sort of thing that could generate a valid claim of defamation? As they are usually transmitted in the form of a web service I do not know if it would could as libel or slander.

Answer 1

united-states

Usually, big data collectors who get something wrong while acting in good faith and simply making a mistake, at least unless they are notified of the problem and fail to correct it, are not liable for defamation in the U.S. since they have not met the intent requirement for a defamation action (or because statutory immunity such as the immunity provided by Section 230 (citing Dennis v. MyLife.com, Inc., 2021 WL 6049830 (D.N.J. Dec. 20, 2021)) or certain provisions of the Fair Credit Reporting Act applies, sometimes but not always, with a statutory remedy as a substitute for common law liability).

Defeating a defamation lawsuit isn't always what it's cracked up to be for a defendant. For example, the Better Business Bureau recently prevailed in defamation lawsuit only after seven years of litigation (an outcome that suggests that a case that can survive an early dismissal may have significant settlement value). A Better Way Wholesale Autos, Inc. v. Better Business Bureau of Connecticut, 2021 WL 5112673 (Conn. Superior Ct. Oct. 19, 2021) (discussed here).

More often, the common law remedy is the tort of negligent misrepresentation (which applies to false statements of material facts made in the course of a business or occupation as a result of the negligence of the person making the statements), or in the case of a credit reporting agency, a statutory claim under federal laws regulating credit reporting agencies. See also, e.g., Megan Valent, "The United States: Big Data, Little Regulation", 28 U. Miami Bus. L. Rev. 434 (2019).

One has to show particularized injury from a violation to state a claim, however, including claims under the statutory remedy that purports to give standing to anyone whose information is inaccurate. See Spokeo, Inc. v. Robins (U.S. 2016) and TransUnion, LLC v. Ramirez (U.S. 2021) (involving inaccurate terrorism warnings from a credit reporting agency). The TransUnion case essentially added a constitutional standing component to the publication and damages elements that would apply in a defamation action in the context of a statutory claim under the Fair Credit Reporting Act that doesn't expressly require either of these elements.

Many of the legal issues, however, are unsettled questions of first impression.

european-union

A survey of the issues in an E.U. context can be found at Thomas Hoeren, "Big data and the legal framework for data quality" International 25(1) Journal of Law and Information Technology 26-37 (January 8, 2017). https://doi.org/10.1093/ijlit/eaw014 the abstract of which states:

Power has a lot to do with knowledge, access to, and utilization of data. But in the context of the debate about power, the question of data quality is hardly ever raised. This is because legal standards for data quality are lacking. The first attempts to regulate this question can be found hidden in Article 6 of the EU Data Protection Directive and in the regulation on scoring in section 28b of the German Federal Data Protection Act (BDSG). From this, with the help of initial research attempts by computer science and sociology, we can develop a provisional, fragmentary framework for legal standards in data quality, as I will demonstrate in the following 10 theses.

U.S. courts will often decline to assert jurisdiction over GDPR claims arising under the laws of European countries. See Finch v. Xandr, Inc., 2021 WL 5910071 (S.D.N.Y. Dec. 14, 2021) (discussed here).