How much should a website owner tell the police?

Here's a bit of a situation for which I need some advice.

I run a whole pile of sites where users can submit photo content. I've just received an email about a picture on one of those sites, from the police in another country (I check the mail headers and it holds up under scrutiny).

They're investigating "abuse of personal data" and a few other things, revolving around someone posting a Facebook photo of someone else. They request that I remove the photo (which is not a problem, since I operate a "no quibble" removal system anyway) and also ask for a bunch of information about the poster.

That's the hard bit. I assume my members' privacy comes before anything else unless the police in question (in Bavaria, the Germans are really twitchy about privacy) go and get an official, written request backed by a court - which would also probably need to be an international court, since I'm not in Germany and the server is in a third country.

I just wanted to ask anyone with appropriate knowledge where things stand: I don't want to protect people doing wrong but I also don't want to bandy their details around to the first person who asks.

Thanks in advance for any pointers.

 

Unless we are talking child porn or something of that scope, never tell the cops shit, period, ever. Certainly not about site users or comment related matters. I would be interested to know what the issue is actually about and why someone is upset about this(sort of a hobby). Off the top of my head the UK has some pretty hardcore data retention laws. Releasing that sort of info may have worse implications then cooperating does.

Where is the complaint originating from? Folks in different jurisdictions likely have zero influence over you in the first place.

With that said... http://www.brighthub.com/internet/security-privacy/articles/108482.aspx


Facebook’s Attitude on Your Photos

According to Facebook’s Statement of Rights and Responsibilities (found at https://www.facebook.com/legal/terms.php anyone that has uploaded images is giving away all rights to the image for the duration of their time on the site:

Based on that you can't exactly exert copyright on something you already waived your rights to.
9 times out of 10 the only reason someone tries to pull this sorta shit is because its unflattering in some sense or another and the end result is to stifle free speech.(Sound about right?)

Hope that helps a bit. I am not a lawyer but I am glued to IP and trademark related matters several hours a day.

Nigel

 

I would use your best judgement on the situation. If the image contains something illegal than I would remove it per their request. If not, its completely up to you but be weary about releasing users personal information.

 

I would do exactly as the law says to do. So unless you legally have to give it over then do so. If not, then do not.

You do not want to get into the middle of handing over details / images to someone else for whatever reason - just stick to the law to the very letter. Remember that the police and what not is used to doing things legally - they are not going to be that bothered that you don't hand out information when asked as long as you work with them where the law says you have too.

In terms of a foreign police force doing research and what not - there is a system in place for those police to contact your country legal system. Unless you are told too co-operate by law, you do not have to do anything and I would advise you not too.

In terms of finding illegal photos etc, I would delete them but make sure you have everything logged so if someone uploads a photo you know who, when, where and what was uploaded.

Do as the law says and you have little to worry about. Start handing out details could get you into further issues.

 

Thanks very much for the responses, guys: it's nice to know my gut reaction was pretty much on target, and to have some specifics, opinion and feedback. I'll answer some of the specifics below, but wanted to start with the "Thank you!"

They should put that phrase on all "citizens' rights" sites: just about sums things up perfectly.

OK, the specifics are that it's one of about 20 sites I have where people post pics. I'm in the erotica niche, which already makes my life difficult due to the astounding lack of ability people have in reading T&C documents, even when the important bits are in red. Basically, they're open to photo posts but everything gets moderated so that no really sick shit gets through. In the case of child porn, I already have a note in the T&C that tells people I'll report them.

In this case, it was a selfpic photo of a girl. Basically a black-and-white portrait, taken from her Facebook. Nothing even slightly dodgy about it: just a photo of a pretty young lady. The email is from the Bavarian police, saying that the guy is investigating (quote) "a case of abuse of personal data, sexual harrassment [sic] and an offense against protection of private rights."

It does - the Data Protection Act of 1984 and its revisions - and I'm VERY aware of them, having previously worked in IT for a couple of decades (and having been interested in them, anyway). I'm well aware of what rights a company has to hold personal data, but I'm less familiar with the release side.

My guess is that it's someone who's annoyed at having pics posted on what could be considered an adult site, even though the picture is perfectly family-friendly. This is a common hypocrisy in the areas of both erotica and young adults (and especially the two together): I regularly get advertisers who won't partner because of the content, even though they'll happily plaster xxx hardcore skin-on-skin ads all over their own site. It's stupid, but that's the way it is.

If I'd wanted legal precision, I'd have sought counsel: your thoughts and details were very helpful, thank you!

The problem here is that there are two or three jurisdictions and I'm not a lawyer, so I'm not clear on the letter. But yes, totally agreed.

That's a very useful thought, thank you: I hadn't considered that they'd be used to these things, mostly because I was still caught up in my side of the issue. Reassuring and appropriate.

Everything's moderated and I have a "no quibble" removal process - someone asks, I take it down - so I'm covered from most angles. I think I'll look into a more in-depth logging setup, though. I guess it takes an incident to act as a wake-up call.

Excellent advice, thank you.

 

The cops job is to investigate; This is why we have a justice system, if they require
more info, then they need to submit a court order....

So removing content is one thing, but I would go no further
without some type of official court order, and that just seems
very unlikely, even more so coming from another country, even
then you may not have to comply, now we are talking about
international law; I would think you may not even have
to comply unless the court order come from your own jurisdiction....

Too me it simply sounds like someone fishing for info....

 

My first instinct was the same, but the mail headers really do point to a police domain (not the visible ones, the real ones). Always best to take things like that seriously, even if it's nonsense.

 

You should always keep clients information / visitors and viewers information and content confidential. Don't share any information unless you see a court order from who ever it is that wants to see this information. The case they got you on they may not be able to do anything due to the fact that what ever is uploaded to facebook loses copyright and that person no longer owns what they uploaded. Its a public site and once they upload their photo or what ever then that content is no longer there's but open to te web.

 

You should avoid offering legal advice since you clearly do not have a clue what you are speaking about.

 

The Bavarian police can get a search warrant or request judicial assistance from the police in your own country if they actually have a legal basis to compel you to hand over the information that they are seeking. Otherwise, you are not obliged to assist them.

On a moral level, though, if a girl's copyrighted photograph was taken and posted on what you describe as an "adult site" without her permission, I would just give the information to the police voluntarily. I would not waste time protecting the privacy of a user who violated the intellectual property and privacy rights of another person, which I assume is prohibited by your website's Terms of Service anyway.

 

This is pretty much the tack I'm taking, although I have asked for a stamped, certified request to prove that it's not just some ass pretending to be a policeman (yes, I've had that before). As long as it's an official request, I have no issue with helping, especially since all I can really provide is an email address and an IP.

 

Don't Speak to the Police. If you give a crap about your users' privacy stick to a strong privacy statement and only respond when legally required to under served subpoenae. Respect your users and they'll respect you

 

What about the ones who break the law? And the terms of service in the process? And who show no respect in doing so?

I'm intrigued by the instant response to the Police as always being the bad guy.