The term revenge porn already poses a problem in terms of definition. Since introduced, the term has been used in public discourse as an acronym for unconsented distribution of sexual or intimate material, often with personal information attached, and intent to inflict harm or damage to the person depicted.  [4] The material can have been produced with or without the consent or knowledge of the person depicted, it´s sharing intended for personal use and not wider distribution, and with or without malicious intent of the distributor. This wide variation in circumstances has led to criticism of the term claiming it to be misleading,  [5] resulting in calls for a different terminology such as, “non-consensual pornography” (NCP).  [6] The Oxford dictionaries definition: “revealing or  sexually   explicit  images or  videos  of a person posted on the Internet, typically by a former sexual partner, without the  consent  of the subject and in order to cause them  distress  or  embarrassment ”,  [7] shows that revenge is not always a key component of the act. However, cases show that the underlying intent to harm sometimes comes from an ex-lover scorned by the end of an intimate relationship with the person depicted.  [8] The definition also refers to revenge porn as a phenomenon of the internet. It could be argued that this is unprecise terminology. Most of the acts and expressions that the internet provides us access to have been a part of human society for a long time. They just took place in a narrower frame with a more limited geographical and mass distribution compared to the internet. In the 1970s, the US magazine Hustler dedicated a specific section in their publications to the publishing of photos sent in by its readers and depicted naked women along with personal information such as their names and addresses, and as cases showed, sometimes without the consent of the women depicted. The publishing of such photos in the magazine ceased in the 1980s after one of the women featured sued the magazine as she had not given her consent for publishing.  [9] This differs only from online revenge porn in terms of the platform the material is shared on, not the nature of the act, highlighting that not all components of the dictionary definition are precise.

Although the internet did not alter the concept, it has effected the amount. Material that could become revenge porn is increasingly digitally captured and stored on smartphones, now ubiquitous amongst teenagers,  [10] such devices have made video recording and photographing ourselves and others, with or without their knowledge, an everyday event. Young people only know a connected world where the internet serves as a general platform for information, entertainment and social interaction, and generally embrace evolving dynamics in social media platforms even before their parents or carers have heard of them. Today’s young will also become of age in a connected world, something that differs from today’s professionals, researchers and policymakers. Mistakes and misbehavior that have been a part of teenagers’ and young people’s growth from the dawn of time are no longer left as a memory of younger times. Today, the memories of teenagers are stored on computer clouds, on hard drives and uploaded to social media platforms accessible to everyone, anywhere, at any time.  [11] A recent study from the Internet Watch Foundation found that young people make and share self-generated sexual material  [12] from an even younger age than previous research showed. During the three month period of the study, 269 cases of material depicted children deemed in the age-group of 7-10.  [13] Almost 90% of the cases examined in the report detailed that the content had been forwarded or re-disseminated in cases where the child had shared the material with someone they trusted.  [14] Such dissemination entails the risk of the material becoming revenge porn.

The common denominator distinguishing revenge porn from other sexual material online is that the dissemination is not consented to by the person depicted. Due to the lack of consent, the material can be used to pressure the individuals depicted or cause them harm, as the publishing of revenge porn can have serious reputational and academic/professional consequences for those portrayed.  [15] Even if the material may have been shared with a partner as part of an intimate relationship, that does not mean that the material has been made available to the general public, nor does it imply consent that the material can be posted online.  [16] Another common denominator is that due to the borderless nature of internet, domestic legislation and enforcement has struggled to fully grasp the phenomenon leaving those who fall victim to such acts feeling unprotected and let down by their domestic justice system. Indications suggest that revenge porn affects women disproportionately - or in 90% of the cases.  [17] In her 2014 book, Hate Crimes in Cyberspace, Citron compares views towards revenge porn and online harassment of women to dominant views on domestic violence and sexual harassment in the work place being a private matter that could not be regulated which existed up until the mid- to late 1970s.  [18] Her claim that online harassment of women, including revenge porn, must be criminalized has gained traction on both sides of the Atlantic.  [19]

On 14 October 2014, the UK Crown Prosecution Service issued guidelines on how to prosecute cases of revenge porn. It stipulated that such acts could fall within the scope of existing legislation even if there was not a specific act criminalizing revenge porn.  [20] The same applied in many European countries, where the posting of revenge porn could constitute a breach of civil law, and in certain cases lead to criminal charges such as, harassment, decency and defamation, without specific reference to revenge porn. Out of 149 cases on file from eight police precincts in England and Wales during the time of the issuance of the guidelines until April 2015 when revenge porn was criminalized in the UK, six cases resulted in charges or police caution.  [21]

In March 2015 a District Court in Iceland convicted the 18 year old ex-boyfriend of a 17 year old girl for publishing naked photos of the girl on his Facebook page for a few minutes before deleting them from the social media platform. The girl had taken the photos in question herself and sent them to the defendant during their relationship. He confessed to the act and was sentenced to 60 days suspended imprisonment, for a violation of the decency and defamation clauses of the General Penal Code,  [22] causing her harm and distress under the Tort Act,  [23] and found in violation of the Child Protection Act.  [24] He was ordered to pay the victim damages and to bear all costs for the court proceedings.  [25] On 10 December 2015, the Icelandic Supreme Court upheld the judgement.  [26] A month later, in January 2016, a bill was re-introduced to the Icelandic parliament proposing a legal amendment to the General Penal Code criminalizing revenge porn. The commentary to the draft bill states that it draws on the UK Criminal Justice and Courts Law enacted in April 2015.  [27] As laid out in the commentary to the draft bill, it’s presentation to parliament is rooted in the notion that such serious attacks on a person’s personal integrity, protected under human rights, could not be overlooked by the criminal legislation, and despite the current legislation being applicable, further legislative actions were needed in order to provide victims of revenge porn sufficient protection to personal integrity and privacy as enshrined in the ECHR.  [28]

This view corresponds with the picture Citron unveils concerning the application of a legal framework and remedies for victims of revenge porn in the United States of America.  [29] The author claims that the current civil law remedies under tort and the copyright framework do not provide sufficient protection for individuals, as the financial cost of civil suits makes them an unrealistic choice for some.  [30] Citron additionally claims that current criminal legal remedies will not protect victims of revenge porn sufficiently, as even in cases where criminal charges could be pursued against the distributor of the material, the lack of police capacity and outdated views towards online activity resulted in cases not being processed properly through the US justice system.  [31] She argues that in order for states to protect victims of revenge porn, civil rights law should be amended to penalize online harassers.  [32] Citron, alongside Professor Mary Ann Franks, has also drawn on social condemnation arguments in favor of criminalization of revenge porn  [33] and has emphasized that invasion of privacy amounting to criminal liability is not a new notion. In their article Revenge Porn Should be Criminalized, Citron and Franks draw on Warren and Brandeis argument published in 1890 stating “[i]t would doubtless be desirable that the privacy of the individual should receive the added protection of the criminal law.”  [34]

A critique on the legal and executive frameworks in respect to revenge porn has gained global media attention with a string of high profile cases,  [35] reports of justice systems failing to protect victims of revenge porn, and the formation of advocacy groups and Non-Governmental Organizations (NGOs) that have pushed for the criminalization of revenge porn both in the US and in European countries.  [36] These efforts have been somewhat successful, resulting in legal amendments in 26 US states, Israel  [37] and a number of European countries, notably England and Wales in April 2015.  [38] Draft bills have been presented recently to the Scottish  [39] and Icelandic  [40] parliaments respectively to criminalize the posting of revenge porn, and preparatory research work has taken place in Sweden  [41] .

The first specific criminal legislation on revenge porn was passed in the US State of New Jersey in 2003.  [42] Since then, 25 more States in the US have enacted legal reforms criminalizing the publishing of revenge porn. In most cases the perpetrator has to have had an intent to inflict harm and should have known that publishing the material was non-consensual.  [43] This is the case in California, which is a relevant judicial precinct as many of social media sharing platforms operate under California law.  [44] The legal amendments made to the UK Criminal Justice and Courts Law enacted in April 2015 are similar as the provision demands that the person was acting in bad faith and had the intention to inflict harm to the individual exposed.  [45] Following the amendment  [46] in April 2015, UK police authorities saw 200 cases of revenge porn reported from England and Wales.  [47]

The NGO ‘End Revenge Porn’ states that the revenge porn legislation put in place in the U.S. state of Illinois provides the best protection for individuals harmed by revenge porn and at the same time provides a balanced approach to the freedom of expression protected by the First Amendment to the US Constitution.  [48] In particular it is emphasized that the legislation not only applies to the person that posts the material initially, but also to subsequent distributors that should have known the material was not posted with the consent of the individual portrayed. The aim is to try and limit the distribution of the harmful material.

It is generally undisputed that states are the main guarantors of human rights within their borders.  [53] Their obligations have been described as threefold: the obligations to respect; to protect; and to fulfil human rights.  [54] The responsibility to protect  [55] has been described as a duty to protect individuals from human rights violations, entailing a responsibility to proactively prevent individuals from within their jurisdiction to not suffer human rights violations by third parties, be that individuals, groups or legal persons.  [56] This includes ensuring preventive measures in place in order for threats of violation of rights of individuals not to materialize. An example of this is providing for a functioning police force that has balanced investigative powers. Under the classification, state responsibility also extends to situations where safeguards fail, and violations are caused by non-state actors, effectively necessitating that states shall ensure effective remedies for those who are violated against.  [57] This is further stipulated through various regional  [58] human rights instruments.

In the Council of Europe’s 2014 Recommendation Guide to human rights for internet users,  [59] it is emphasized that states have to ensure that individuals can enjoy their rights effectively and that the obligations of states to respect, protect and promote human rights “include the oversight of private companies.”  [60] The Council of Europe’s 2001 Cybercrime Convention  [61] and recent human rights instruments, such as the Lanzarote Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse  [62] explicitly address State obligations to tackle online activity through legislation and “other effective means”.

In the case of K.U. v. Finland of 2 December 2009 (Application No.   2872/02), the European Court of Human Rights was presented with the case of a child whose information was posted by an anonymous person to a dating website insinuating that the child was interested in sexual relations with a grown man. No effective means were in place in order for the police to obtain information from relevant Internet Service Providers as to who posted the information, resulting in no one being found responsible for the harm caused to the child. In its findings the Court stated (Para. 42) that:

“…although the object of Article 8 is essentially to protect the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in an effective respect for private or family life…” and that “…these obligations may involve the adoption of measures designed to secure respect for private life even in the sphere of the relations of individuals between themselves…”(Para. 43).

The Court further noted that there were “difficulties involved in policing modern societies”, but a positive burden on the state to take measures in order to protect the applicants rights to privacy under Article 8 must be “interpreted in a way which does not impose an impossible or disproportionate burden on the authorities or, as in this case, the legislator…” while at the same time ensuring that “powers to control, prevent and investigate crime are exercised in a manner which fully respects the due process and other guarantees which legitimately place restraints on criminal investigations and bringing offenders to justice […]”  [63]

Before ruling in favor of the applicant in the case, the Court noted a general principle (Para. 49) stating that:

“Although freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others. […] [I]t is nonetheless the task of the legislator to provide the framework for reconciling the various claims which compete for protection in this context …”

The Court’s findings in the case highlight the competing rights that come into play when examining revenge porn in the context of human rights – the freedom of expression on one hand, and the rights to privacy and personal integrity on the other.

Freedom of expression is closely linked to the fundamental elements of democracy and democratic principles.  [64] The scope of state interferences on actions of individuals and legal persons on the internet has revolved around the core issue of freedom of expression. One of the main arguments against states setting up legal safeguards as described in Section A.II., is that categorical restrictions on the freedom of expression will undermine the free nature of the internet leading to its fragmentation and, subsequently, collapse. The general argument goes that, although well intentioned, it could prove to be a slippery slope towards censorship on the internet.  [65] Some governments have tried means such as internet censorship to create “national” intranets in line with national borders to maintain their legal and sovereign powers online as well as offline.  [66] This has proved challenging in practice but has not dissuaded states from pursuing such initiatives on a domestic and international level.  [67] That does not alter the scope of obligation of states, as the UN Human Rights Council and the Council of Europe´s Committee of Ministers  [68] have both specifically declared that human rights shall apply equally online and offline.  [69]

The core human rights document of the United Nations is the Universal Declaration of Human Rights adopted in 1948.  [70] Article 19 of the declaration stipulates that the freedom of opinion and expression applies regardless of the medium used and irrespective of frontiers. The importance of the right is further stated in Article 19 of the subsequent International Covenant on Civil and Political Rights where conditions for interference with the freedom of expression are laid out.  [71] Furthermore, according to Article 20, states are obliged to restrict expression that can threaten peace and security.  [72]

Regional cooperation and conventions in the field provide additional stakes in the safeguards of the competing rights. States that are subject to the European Convention System can rely on the Convention text  [73] but also extensive case law from the Strasbourg Court for guidance in the balancing act between freedom of expression and the factors that can be limiting to it, such as the rights of others and societal interests.  [74] The Court has established that the protection provided to the freedom of expression under Article 10 does not apply to all expression as the Court has found that expressions that go against the fundamental values of the Convention will not be tested before the Court and will be deemed under the scope of Article 17, prohibiting the misuse of the Convention.  [75] Nevertheless the Court has stated that Article 10 protects not only “‘information’ or ‘ideas’ that are favorably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population.”  [76] Thus, offensive expression can enjoy the protection of the Convention under Article 10, although it may be subject to limitations under paragraph 2, such as in the interests of the rights of others. Rights of others includes among other things the rights protected under Article 8. The borders between these rights have been tested in a number of cases regarding defamation and media freedom of expression. In the case RUSU v. Romania of 8 March 2016 (Application No. 25721/04) the Court stated:

“[…] Lastly, in cases which require the right to respect for private life to be balanced against the right to freedom of expression, the Court considers that the outcome of the application should not, in theory, vary according to whether it has been lodged with the Court under Article 8 of the Convention by the person who was the subject of the news report, or under Article 10 by the publisher. Indeed, as a matter of principle these rights deserve equal respect […]” (Para. 24).

From the above it could be established that in states bound by the ECHR, freedom of expression does not exist without limitations neither online nor offline. This indicates that there exists no such right as to exercise freedom of expression without any regard to a wider context such as the rights of others. John Stuart Mill argued: “[…] even opinions lose their immunity, when the circumstances in which they are expressed are such as to constitute […] a positive instigation to some mischievous act.”  [77] Although written in another time, the principle seems to still apply. The dissemination of expression such as a photo depicting a naked person can be a perfectly valid action that deserves the full protection of the freedom of expression. But the context that such dissemination takes place in is of utmost importance when examined from a human rights perspective. In the context of revenge porn, the rights of others (the person depicted) weighs heavily against the disseminator’s freedom of expression.

The role of the state in a democratic society is a topic of endless discussion and the subject of many more disciplines than law. The digital dimension does not simplify the matter. Law provides only a part of the picture. Framed in national constitutions and described in international and domestic legislation, the solutions legislation provides is bound by the notion of the nation state and both its application and enforcement limited to state jurisdictions. Human rights obligations provide principles for the states, but their application depends on various factors such as political stability and culture. States’ varied compliance of fundamental values further add to the lack of coherence. This colorful palette framed within the human rights framework raises the question of how much is enough for states to do in order to uphold their responsibility to protect?

The measurement for success in terms of effective human rights protection has usually ensued in application or enforcement of legislation. As discussed above, reports indicate that very few cases have been decided on the basis of the recent revenge porn legislation in the UK, so the effectiveness of the legislation is yet to be determined. Experience from the US shows that although some legal safeguards are in place, they may not be effective.  [78] In 74% of Web Index countries, the Web Foundation found that domestic justice systems are failing to take appropriate actions for violence against women online - revenge porn being listed as an example of such violence.  [79] A recent study on crimes committed via the internet by The Swedish National Council for Crime Prevention states that 96% of cases reported to the police will not go further within the justice system.  [80] Out of the cases that the police examined but were found to have insufficient evidence to proceed, the main reason was that technical information was lacking to establish who the perpetrator was. According to the police, the main reason was that the social media and ISPs holding the information were not willing to provide the police with the information despite such evidence being a necessary component of the investigation. Police expressed that the biggest problem was when dealing with companies outside of Swedish jurisdiction; in particular companies that were under US jurisdiction.  [81] The Icelandic police claims that it faces the same problem in dealing with sites set up to share naked photos of women and girls, and despite using the international legal assistance scheme, they have run into the same barriers as their Swedish counterparts. An Icelandic Police officer summed up the situation stating: “cases like these are difficult for the police, in particular when the websites are foreign. We cannot control the internet.”  [82]

Following legal uncertainties with respect to liability and responsibilities of intermediaries, legislative means were taken on both sides of the Atlantic. In the US a legal framework established with the Communications Decency Act and the Digital Millennium Copyright Act, describes that intermediaries will not be held accountable for user generated material on their sites unless they were notified of the material being a copyright infringement or a criminal act and did not have in place an effective notice and takedown system to relieve an infringement.  [100] With respect to defamatory content, the same does not apply as section 230 of the Communications Decency Act states: “The Act provides that no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. No cause of action may be brought and no liability may be imposed under any State or local law.”  [101] Similarly, the EU adopted the e-Commerce directive  [102] that has been transposed in domestic legislation within the Single Market in a fairly uniform manner making intermediaries who run a merely technical operation not liable for third party content and describes a notice and takedown system to be in place regarding “illegal activities” but in line with freedom of expression as protected under Article 10 in the ECHR. While the directive prohibits member states from imposing a monitoring obligation of a general nature on intermediaries, the ECJ has found that the liability exemptions under the directive do not preclude states from enacting legislation entailing civil liability for defamation for online news outlets. The Court stated that:

“The limitations of civil liability specified in Articles 12 to 14 of Directive 2000/31 do not apply to the case of a newspaper publishing company which operates a website on which the online version of a newspaper is posted, that company being, moreover, remunerated by income generated by commercial advertisements posted on that website, since it has knowledge of the information posted and exercises control over that information, whether or not access to that website is free of charge.”  [103]

These findings were cited in a recent judgement from the ECHR in the Delfi vs. Estonia case, when the Grand Chamber of the Court upheld the findings of the Estonian Supreme Court, stating that the internet news outlet Delfi could be held liable on civil grounds for a defamatory comment posted on the site by a third party. The Court did not base the findings on the e-Commerce directive, as the Estonian Supreme Courts found the relevant domestic legislation transposing the E-Commerce directive inapplicable and based its findings on the company’s breach of the Obligations Act.  [104]

Both the cases concerned the civil liability of a private entity operating in a wider capacity than merely technical, meaning that they could be held liable for defamatory material generated by third party. Up until recently most states applied defamation clauses in cases of revenge porn. In light of the findings of the above mentioned cases from the ECJ and ECHR it is interesting that case law from European countries does not indicate that service providers have been challenged to bear liability in revenge porn cases. That may also suggest that most of the providers in question do not operate under the jurisdiction of European states, but rather US states, freeing them from possible liability for third party content that may be in breach of defamation clauses. Further, it remains to be seen what effect the criminalization of revenge porn will have with respect to possible liability of intermediaries in such cases.

Online anonymity and the use of pseudonyms can be immensely valuable for individuals and underlying societal, democratic, or economic interests. This can be the case for people that disseminate information with an intent to expose corruption or violations. The posting of revenge porn has no such grander goals.

The acquisition of essential information in order to establish responsibility in revenge porn cases is reliant on cooperation with private entities that control the information in connection with their operations. Swedish police report that they have found an effective way to cooperate with some major social media platforms, while others are not as willing to cooperate.  [105] Requests from European police forces in cases of revenge porn are both based on criminal charges and breach of civil code within their jurisdiction. This entails that the charges are based on a legal framework formed and enactment under legal and societal orders that in general are democratic and are a part of the European Convention System. It is somewhat paradoxical to claim that states that are subject to an effective human rights monitoring system would demand that the companies interfere with information contrary to human rights. Yet cases show that the companies are often faced with a complex situation as not all states are based on a democratic order, and democratic states have put forth unbalanced requests for information about individuals to companies.  [106] Recent revelations show that some states engage in invasive practices in cyberspace in the interest of anti-terrorism without what seems to be a proper balance to human rights.  [107] Further, the companies that hold information due to their operations that are based within US jurisdiction are not altogether bound by the same legal framework, even though some also operate partly under EU legislation.

It has proven problematic to have revenge porn content removed from the internet.  [108] In cases where the victim is the author of the material, such as in the cases of nude “selfies”,  [109] the victim could claim copyright over the content and thus oblige website operators to delete the content on those grounds. Such action will only apply to the website in question so the content might still be accessible on other platforms. Cases also show that victims can seek redress from those responsible for the publishing and dissemination of the content on tort grounds such as defamation and distress.  [110]

Some companies have built efforts against revenge porn into their terms and conditions. Google issues and updates its Transparency Report  [111] with information on requests the company receives from governments, copyright owners, and individuals that want their information removed from Google’s search results.  [112] In June 2015 Google revealed that revenge porn will also be removed from search results upon request stating that:

“[…] revenge porn images are intensely personal and emotionally damaging, and serve only to degrade the victims—predominantly women. So going forward, we’ll honor requests from people to remove nude or sexually explicit images shared without their consent from Google Search results. This is a narrow and limited policy, similar to how we treat removal requests for other highly sensitive personal information, such as bank account numbers and signatures, that may surface in our search results.”  [113]

The efforts by Google are likely to limit the harm caused by revenge porn, but they will not remove the content from the relevant websites, social media platforms or forums where originally posted and thus they would be subject to further distribution online.