Belgian Court: Yahoo not obliged to cooperate with identification requests

Last summer, the Ghent Court of Appeal recalled the Belgian Public Prosecution Service (PPS) in a lawsuit against U.S. webmail service Yahoo. The PPS demanded identifying data of the holders of several Yahoo email addresses, which Yahoo refused. Initially, the Belgian regional Court of Dendermonde sided with the PPS, but later this year the Court of Appeal in Ghent straightened it out.

The Belgian PPS based its claim on article 46bis of the Belgian Code of Criminal Procedure (Sv.), of which article 46bis states that an operator of an electronic communications network or a provider of electronic communications services must cooperate with an identification request from the Belgian PPS during the investigation of a criminal case.

The PPS argued before the court of Dendermonde that a webmail service like Yahoo falls under the definition of an electronic communications network or a provider of electronic communication services: "Yahoo is not just a portal or a search engine, but also offers a (free) email service. (…) It is clear that the in drafting the obligations under article 46bis Sv., the legislature also had such operators or providers in mind. This would also be logical given the importance of these providers of such free email services on the internet (cf. Hotmail, Gmail, belgacom.net etc.)."

A not very satisfactory interpretation from a legal perspective. Not surprisingly Yahoo appealed the verdict. June this year, the Court of Appeal found that article 46bis Sv., as far as ISPs are concerned, only addresses access providers, not hosting providers such as Yahoo and Gmail’s webmail services. The substantive requirements of article 46bis Sv. were thereby not fulfilled and Yahoo consequently was not held to cooperate with the PPS’ identification request.

But how could the Belgian PPS obtain the identity of these Yahoo e-mail addresses? According to Yahoo the PPS should in a criminal case first contact the U.S. Department of Justice or start a civil "John Doe lawsuit". Also an option is to track that users IP-adress. The IP-address will lead to the user’s access providers and the PPS can serve them with an identification request. A Belgian access provider would surely fall within the scope of article 46bis Sv.

Source: Regional Court Dendermonde, Court of Appeal Ghent