1

In an essay published at the dawn of the new century, Oliveira Ascensão noted the following about the then emerging information society:

"We are at a time when amazing possibilities open up – which man can use or not, or even misuse." [1]

2

Among the most vivid expressions of the latter alternative is the phenomenon, now more topical than ever, of disinformation. This will be taken here to mean the creation, presentation, and dissemination of demonstrably false or misleading information, for profit or with the intention of deceiving its addressees, and which may cause damage to public interests.

3

Disinformation is not to be confused with illegal content disseminated by the media, which includes, among many others, hate speech, incitement to commit crimes, child pornography or the unauthorised reproduction of works and performances protected by copyright and related rights. While disinformation may well comprise such content, it typically includes other material, which is not covered by any specific legal prohibitions because it is false or misleading.

4

Strictly speaking, disinformation is not a new phenomenon: it has probably existed since power and control over scarce resources were fought over among human communities. But the advent of the Internet and social media has exponentially increased the scale on which it is practised and the damage it can cause to society at large and to individuals within it. [2]

5

Several recent events reveal the harmful potential of misinformation disseminated through those media. Among many others are the 2016 Brexit referendum, [3] the US presidential elections of 2016 [4] and 2020, [5] the opposition moved in several countries to the Covid 19 vaccination campaigns, [6] and the military invasion of Ukraine by Russia in 2022. [7]

6

One may however ask how disinformation can be regulated. The question is not easy to answer, since essential values related to the rule of law are at stake here. These include freedom of expression, as enshrined in the European Convention on Human Rights, [8] in the Charter of Fundamental Rights of the European Union, [9] and in the constitutions of its Member States. [10]

7

No less relevant, though, are the integrity of the democratic process, which recent history proves to be severely undermined by the systematic and large-scale dissemination of disinformation; national security, potentially weakened by public decisions and policies based on false or distorted information; and the free and informed consent of citizens in the exercise of their civil rights and liberties, which can be vitiated by disinformation. [11]

8

The legal regulation of disinformation must therefore be obtained by weighing the relative import in individual cases of these values; none of them is an absolute, and democratic integrity is not an end in itself, but rather is instrumental in serving the effectiveness of popular sovereignty and the democratic principle. [12] This is why the Portuguese Constitutional Court has recognized that the protection of freedom of expression ceases "where it may jeopardize the essential content of another right or intolerably affect social morality or the fundamental values and principles of the constitutional order". [13]

9

It is accordingly crucial to ensure that the democratic principle is not undermined by the abusive exercise of freedom of expression through disinformation practices – an actual risk in liberal democracies, as shown by the examples mentioned above and as was already noted by Hannah Arendt more than 70 years ago:

"Propaganda is one, and possibly the most important, instrument of totalitarianism for dealing with the nontotalitarian world." [14]

10

It was in the context of some of the experiences alluded to above that the European Union adopted in 2018 the European Action Plan Against Disinformation.  [15]

11

Recognising the threat that disinformation poses to democratic processes and other public goods, such as the environment or the health and safety of Union citizens, this document sets as its fundamental objective the formulation of a coordinated response to disinformation, articulated around four pillars: (a) improving the capabilities of Union institutions to detect, analyse and expose disinformation; (b) strengthening coordinated and joint responses to disinformation; (c) mobilising the private sector to tackle disinformation; and (d) raising awareness and improving societal resilience.

12

Each of these pillars is in turn broken down into separate projected actions by the EU institutions and the Member States aimed at mitigating the risks of misinformation.

13

The plan is, in any case, a programmatic text, from which no rules directly applicable to concrete situations capable of being characterised as acts of disinformation can be extracted. It is rather the expression of a policy, which needs to be translated into legal instruments of European or national scope. The latter will be addressed in the following.

14

Among the statutes adopted by the Member States of the European Union with incidence on the matter under discussion is the Portuguese Charter of Human Rights in the Digital Era, approved during the Portuguese presidency of the Union by Law No. 27/2021, of 17 May 2021.

15

This law enshrines several individual rights related to access to and use of digital media. Among them, the following stand out: (a) The right of access to the digital environment, under which the State is responsible for promoting, among other things, the creation of a social tariff for access to Internet services applicable to economically vulnerable users; (b) The guarantee of access to and use of the Internet: the intentional interruption of Internet access, whether partial or total, or the limitation of the dissemination of information or other content are prohibited, except in circumstances provided for by law; (c) The right to privacy in a digital environment: everyone has the right to communicate electronically using encryption and other forms of identity protection or to avoid the collection of personal data, namely to exercise civil and political liberties without censorship or discrimination; (d) The use of artificial intelligence and robots is to be guided by the respect for fundamental rights; (e) The right to Internet neutrality: content transmitted and received in the digital environment should not be subject to discrimination, restriction or interference in relation to the sender, recipient, type or content of the information; (f) The right to be forgotten; (g) The right to cybersecurity; (h) The right to creative freedom and content protection in the digital environment; and (i) The right to protection against abusive geolocation.

Several provisions of the Charter, as has been noted, [16] seem redundant in the light of the Constitution and ordinary law, which regulates, for example, the protection of personal data, as well as copyright and related rights against their misuse in the digital environment. It is true that, according to Article 16(1) of the Portuguese Constitution, the fundamental rights enshrined therein do not exclude any others set out in applicable international laws and legal rules. However, most of the fundamental rights enshrined in the Constitution extend to the digital environment. A specific regulation of the exercise of those rights in this area would not therefore seem strictly necessary.

16

Nevertheless, an exception to this redundancy is found in Article 6 of the Charter, which enshrines the right to protection against disinformation, which Paragraph 2 of that provision defines in the following terms:

"any demonstrably false or misleading narrative created, presented and disseminated for obtaining an economic advantage or deliberately deceiving the public, and which is likely to cause public harm, namely a threat to democratic political processes, public policy-making processes and public assets."

17

Disinformation would include, according to Paragraph 3, "the use of manipulated or fabricated texts or videos, as well as practices for flooding electronic mailboxes and the use of networks of fictitious followers".

18

Under Article 6(1), the State is to ensure compliance in Portugal with the European Disinformation Action Plan, in order to protect the society against de jure or de facto natural or legal persons who produce, reproduce or disseminate a narrative considered to be disinformation.

19

Furthermore, according to Paragraph 5, everyone is entitled to submit complaints against the entities that perform the acts referred to in Article 6 of the Charter, and have them examined by the Media Regulatory Authority. In those cases, also in accordance with Paragraph 5, the means of action referred to in Article 21 of the Charter (which regulates popular action for defence of the provisions of the Charter) and the provisions of Law No. 53/2005, of 8 November 2005, which created the said Authority, concerning complaints and sanctions, are applicable.

20

The State was also charged, under the terms of Paragraph 6, to support the creation of fact-checking structures by duly registered media organs and to encourage the attribution of quality seals by trustworthy entities endowed with the status of public utility.

21

Were it accepted that, under Article 6 of the Charter, the Portuguese Media Regulator (“Entidade Reguladora da Comunicação Social”) would be authorised to order the rectification or removal of information classified by it as disinformation, then that provision would permit a restriction, of indefinite scope, on freedom of expression.

22

However, under the terms of Article 18, Paragraphs 2 and 3, of the Constitution, such a restriction – like that of any other fundamental right –, since it is not expressly provided for in the Constitution, is only permissible under strict conditions. [17] These include the requirement that restrictions on fundamental rights be justified by the need to safeguard other constitutionally protected rights or interests; that they be proportionate; that they be defined by law; and that they do not reduce the extent and essential content of the rights, freedoms and guarantees.

23

It is therefore not surprising that, on 29 July 2021, the President of the Republic asked the Constitutional Court to review the constitutionality of Article 6 of the Charter. [18] Among the reasons invoked by the President of the Republic for the potential unconstitutionality of this provision was the deficient legal definition of the concept of disinformation. According to the President, the concepts used in the law for this purpose were too vague and indeterminate and could, as a result, restrict the content of freedom of expression disproportionately, this in violation of Article 18 of the Constitution and the parliamentary law reserve established therein. Article 6 would, on the other hand, involve the risk of censorship: the use of vague and indeterminate concepts to define disinformation could, in effect, have a censorial result, which would also be unconstitutional. Finally, it was noted in the request for a constitutionality review of the provision in question that it failed to indicate the scope of action and the attributions of the structures that would be responsible for supervising the verification of the veracity of facts reported in the media in order to confer "quality seals".

24

On 18 May 2022, the Portuguese Ombudsperson (“Provedora de Justiça”) also requested the Constitutional Court to review the constitutionality of Article 6, Paragraphs 5 and 6, of the Charter. [19] As stated in the respective request:

"[W]ithout legal criteria for its action, a specification of the concrete measures that, in this field, it may adopt, as well as a specifically designed architecture for the control of the exercise of these new powers that would minimally protect and safeguard the exercise of freedom of expression and information, the legal provision for the intervention of ERC [Entidade Reguladora da Comunicação Social] in the field of the fight against disinformation is intolerable in a democratic State based on the rule of law."  [20]

25

On the other hand, the Ombudsperson stressed that the law did not ensure that fact-finding structures, which may benefit from support from the State, would be in a position to guarantee their independence from the Government, the Administration, and other public powers. [21]

26

On 17 June 2022, the Liberal Initiative Party proposed to Parliament that Article 6 be repealed, on the grounds that the risks of censorship that it allegedly entailed. [22] On the same date, the Socialist Party submitted a more limited proposal for amendment, which was eventually approved by Parliament. [23] Following these initiatives, Law No. 15/2022, of 11 August 2022, amending Law No. 27/2021, was adopted. As a result of that amendment, Article 6(1) of the Charter now reads as follows:

"The State shall ensure compliance in Portugal with the European Disinformation Action Plan in order to protect society against natural or legal persons, de jure or de facto, who produce, reproduce or disseminate narratives considered to be disinformation."

27

All remaining paragraphs of Article 6 were repealed. The title of the provision retains the reference to a "right to protection against disinformation". However, the current Paragraph 1 enshrines, at most, a duty of the State to protect society against disinformation. Thus, no specific substance is given to that right by the provision as it stands. Moreover, no specific means are provided to enforce it. In particular, no public entity is entrusted with monitoring and curbing specific acts of disinformation. The position of Portuguese law in this respect is now therefore fundamentally the same as before the Charter was approved.

28

Private enforcement of a right to protection against disinformation is, in principle, permitted. Information society service providers, in particular those providing virtual hosting services on online platforms, storing therein and disseminating to the public information produced by the recipients of those services, may therefore adopt their own policies in that regard, which are often set out in their terms and conditions. These are important forms of self-regulation of the activity developed by these economic agents.

29

However, significant doubts arise regarding the extent to which it will be possible to ensure effective protection against disinformation if this task of the State is delegated to the providers of information society services – not least because there would appear to be no consensus among the proprietors of the companies that operate those platforms as to the admissibility and scope of a control of the exercise of freedom of expression through the aforementioned policies. [24]

30

Even when such control is implemented by companies operating online platforms and social networks, general contractual terms enshrining such control may prove to be inconsistent with core rules of the legal system, as is illustrated by a recent judgment of the German Federal Court. [25] This ruled that the provider of a social network is, in principle, entitled to require that users of its network respect objective and verifiable communication standards which go beyond legal requirements, and also may reserve the right to take certain measures in case of violation of those standards, including deletion of individual contributions and blocking access to the network. However, the Court added in this respect:

"[The] social network provider must undertake in its terms and conditions to inform the user of the removal of its contribution, at least immediately thereafter, and of a possible blocking of its user account in advance, to inform it of the reason for this and to give it the opportunity to make a counterclaim, which is followed by a new decision with the possibility of making the removed contribution accessible again. If there is no clause to this effect in the terms and conditions, these are ineffective pursuant to § 307 Paragraph 1, sentence 1, of the Civil Code." [26]

31

This was precisely the case under discussion in the judgment, which found that Facebook's Terms and Conditions provided for no such a possibility.

32

One may moreover ask whether liability in tort can be invoked against perceived disinformation.

33

Article 37(4) of the Portuguese Constitution enshrines the principle according to which everyone is guaranteed the right to be compensated for damage suffered as a result of offences committed in the exercise of freedom of expression. But such a compensatory claim can only be granted if the general requirements of tort liability are met.

34

In light of Article 483, Paragraph 1, of the Portuguese Civil Code, only the following variants of unlawful acts give rise to tort liability: (a) The infringement of a subjective right of another person (for example, a right of personality); (b) The infringement of a protective legal provision (which must specifically protect private interests, as is the case, for example, with rules on unfair competition, and not only public interests); and (c) The abuse of rights, whose unlawfulness is provided for in Article 334 of the Civil Code. [27]

35

Except to the extent that it may be construed as an abuse of freedom of expression, [28] disinformation, in the sense mentioned above, will hardly fall into any of these categories.

36

In particular, it would not seem possible to construe disinformation, for the purposes of the first variant of unlawfulness provided for in Article 483(1) of the Civil Code, as a violation of a subjective right to protection against disinformation – which, as seen above, the revision of the Portuguese Charter of Human Rights in the Digital Age carried out by Law No. 15/2022, of 11 August 2022, has eradicated from that normative text.

37

But even if this were not the case, it is important to bear in mind that the Portuguese Law on Electronic Commerce (Decree-Law No. 7/2004, of 7 January 2004), which implemented the European Union Directive on the same subject, [29] establishes important exemptions from liability for information society service providers that host harmful content in their infrastructures.

38

In fact, pursuant to Article 12 of that Law, online intermediary service providers are under no general obligation to monitor the information that they transmit or store, nor to investigate possible offences practised within their scope; and under the terms of Article 16, Paragraph 1, an intermediary provider of the server storage service will only be liable for the information stored, under the common rules, where it has actual knowledge of an obviously illegal activity or information and fails to act expeditiously to remove or to disable access to such information.

39

This reflects the fundamental rule that, for a quarter of a century, has governed this matter across the Atlantic and which has been said to be "one of the most valuable tools for protecting freedom of expression and innovation on the Internet", [30] even if, paradoxically, it is inserted in a statute originally intended to limit that freedom – section 230 of the US Communications Decency Act, of 1996, according to which:

"No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."

40

This provision resonated, in what concerns copyright infringements, in the US Digital Millennium Copyright Act, enacted in 1998, section 512 of which protects compliant Internet service providers against liability arising from the making available online of copyright-protected material, while adding to it a notice and take down mechanism that is regulated as follows:

“A service provider shall not be liable for monetary relief, or, except as provided in subsection (j), for injunctive or other equitable relief, for infringement of copyright by reason of the storage at the direction of a user of material that resides on a system or network controlled or operated by or for the service provider, if the service provider—

(A) (i) does not have actual knowledge that the material or an activity using the material on the system or network is infringing; (ii) in the absence of such actual knowledge, is not aware of facts or circumstances from which infringing activity is apparent; or (iii) upon obtaining such knowledge or awareness, acts expeditiously to remove, or disable access to, the material;

(B) does not receive a financial benefit directly attributable to the infringing activity, in a case in which the service provider has the right and ability to control such activity; and

(C) upon notification of claimed infringement as described in paragraph (3), responds expeditiously to remove, or disable access to, the material that is claimed to be infringing or to be the subject of infringing activity.”

41

This knowledge-based approach to liability of hosting service providers later found acceptance in the European Directive on Electronic Commerce, whose Article 14, Paragraph 1, states that:

"Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information."

42

Albeit not always peacefully accepted, [31] the rule in question is justified, as this author has noted elsewhere, [32] by the need to render the Internet and the development of e-commerce viable, which otherwise would be significantly impaired if the service providers in question were to be held liable without limitation for financial losses caused by the contents they host on their servers, but fail to control. [33]

43

Protection against misinformation through tort liability of the providers of such services is thus excluded in a wide range of situations, in Portugal and in several other countries.

44

It is of interest, in this regard, to inquire whether the recent European Union Digital Services Act, [34] which will apply from 17 February 2024, will alter the situation described above.

45

This European legal instrument, which took the form of a Regulation, also aims to combat disinformation. [35] However, it preserves, albeit amended, the approach underlying the liability exemptions provided for in the e-commerce Directive, Articles 12 to 15 of which are replaced by Articles 4, 5, 6 and 8 of the Regulation. [36]

46

Such is the purpose notably of Article 6(1), according to which the virtual hosting service provider will not be liable for the information it stores at the request of the recipients of its services, provided that: (a) it has no actual knowledge of illegal activity or illegal content and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or illegal content is apparent; or (b) upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the illegal content. [37]

47

Article 8 of the Regulation states that there is to be no general obligation to monitor the information which providers of intermediary services transmit or store, nor will an obligation actively to seek facts or circumstances indicating illegal activity be imposed on those providers.

48

However, the Regulation enshrines a number of new ancillary duties for the service providers concerned, which seek to mitigate the risks of their infrastructures being used for disinformation purposes. [38]

49

These include the requirement for providers of very large online platforms and very large online search engines to diligently identify, analyse and assess all systemic risks arising, in the European Union, from the design or functioning of their service and its related systems, including algorithmic systems, or from the use of their services (Article 34(1)). This risk assessment includes, according to point (c) of the same provision, "any actual or foreseeable negative effects on civic discourse and electoral processes, and public security".

50

Under Article 35(1), the same service providers must put in place reasonable, proportionate, and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, taking into account in particular the impact of such measures on fundamental rights. These measures may include, according to point (c), “adapting content moderation processes, […] and, where appropriate, the expeditious removal of, or the disabling of access to, the content notified”. Service providers must nevertheless, pursuant to Article 14(1), include in their terms and conditions information on any restrictions that they impose in relation to the use of their services in respect of information provided by the respective recipients, notably any policies, procedures, measures or tools used for the purpose of content moderation.

51

In addition, under Article 45(1) of the Regulation, the Commission and the European Board for Digital Services are to encourage and facilitate the drawing up of voluntary codes of conduct at Union level to contribute to the proper application of this Regulation, considering in particular the specific challenges of tackling different types of illegal content and systemic risks. A co-regulation model on disinformation is thus enshrined in the Regulation. In order to implement it, a strengthened Code of Practice on Disinformation was adopted in 2022. [39]

52

The Regulation also contains significant measures to ensure compliance with the obligations it imposes on information society service providers. To this end, according to Article 49, Member States must designate one or more authorities responsible for the supervision of intermediary service providers and for the enforcement of the Regulation. Article 74(1) empowers the European Commission to impose fines on providers of very large online platforms or very large online search engines of up to 6% of their total annual worldwide turnover in the preceding financial year if it finds that those providers have intentionally or negligently infringed the relevant provisions of the Regulation, failed to comply with a decision ordering interim measures pursuant to Article 70, or failed to comply with a commitment made binding on them by a decision of the European Commission adopted pursuant to Article 71.

53

Notwithstanding the said exemption from liability in respect of information transmitted or stored at the request of a recipient of the service, intermediary service providers are liable, as pointed out in Recital 121 of the Regulation, for the losses suffered by recipients of the service that are caused by an infringement of the obligations set out therein. Compensation for such damage is established in accordance with the applicable national law, to be determined in accordance with common conflict-of-law rules. These include those contained in the Rome II Regulation, which in principle subjects such liability to the law of the country where the damage occurred. [40]

54

In Portugal, a breach of the provisions of the Digital Services Act – namely those relating to content moderation – may give rise to tort liability of service providers towards the recipients of their services to the extent that they qualify as rules imposing specific European duties of care for the protection of private interests.

55

Open societies are particularly vulnerable to disinformation, which has an enormous potential to undermine democratic processes. However, in these same societies, the legal regulation of disinformation raises, as follows from the above, difficult problems regarding the reconciliation of freedom of expression with the protection of the public and private interests affected by it.

56

Recent developments in Portuguese legislation reflect these difficulties. In any case, primacy has been given in Portugal to freedom of expression; restrictions of it remain exceptional.

57

A subjective right to protection against misinformation is thus far from being effectively recognised in current law and is even less likely to be protected by tort liability.

Except when it comprises illegal information, disinformation hardly fits, in fact, into the categories of unlawfulness provided for in Portuguese law as possible grounds for tort liability; and in any event the exemptions from liability on which, for more than two decades, the legal framework for e-commerce has been based, apply to intermediary providers of information society services that convey it.

58

Only to the extent that the provisions of the Digital Services Regulation can be classified as rules for the protection of private interests will the breach of the duties of diligence enshrined therein give rise to liability of service providers, and only towards the recipients of the services.

59

Within the European Union, protection against disinformation thus appears today to be largely dependent on compliance by information society service providers with their duties of care in relation to the content they disseminate and, in particular, on their capacity to self-assess the “systemic risks” inherent in their activity, and to take preventive measures to mitigate them, in particular through content moderation procedures, as well as on the ability of the competent public bodies to monitor and sanction non-compliance with such duties.

60

Whether this will be a sufficiently robust response to the challenges currently posed by disinformation to democratic societies remains, for the time being, an open question.

* Dário Moura Vicente; Full Professor at the Faculty of Law of the University of Lisbon. President of the Portuguese Intellectual Property Law Association.