Liability for public wifi

Offering free wifi is a nice gesture towards customers. Tourists in particular really appreciate it, but a free wifi network is always handy for business partners or external visitors too. However, providers often have a number of questions, especially when it comes to liability when visitors do illegal things on their wifi network. This page describes the situation in the Netherlands.

Liability for visitors who do illegal things on the network

How liability is arranged depends largely on whether the internet connection is offered actively or passively. This distinction follows directly from article 6:196c of the Dutch Civil Code (Burgerlijk Wetboek, BW). A passive provider is someone who simply offers an internet connection and does not monitor it any further. Such a provider bears little responsibility and is therefore not easily liable. Fortunately so, because otherwise parties such as Ziggo would face damage claims every day and would quickly go bankrupt. This so-called access provider does not even need to have a notice-and-take-down policy to avoid liability on the internet.

An active provider, on the other hand, is someone who also monitors the connection and regulates its use. This goes further than merely blocking certain sites or filtering content (for example blocking erotic websites or piracy websites). Such an active provider will more readily be liable for the illegal acts carried out on the network.

Confirmation by the European Court of Justice

In 2016, the European Court of Justice confirmed this as well (CJEU 15 September 2016, C-484/14, Mc Fadden). It stated that the provider of a public wifi network is not liable for the illegal acts carried out on the wifi network. The court did state that a number of conditions apply. The provider must not initiate the transmission of illegal data, the provider must not have modified or selected the transmitted information, and the final recipient of the data must not be determined by the provider. In effect, the European Court of Justice is therefore saying that anyone who merely opens up their network and does not otherwise interfere with the data is not liable for users' conduct.

Even so, the European Court of Justice adds an important caveat. It states that providers, including passive providers, must take reasonable measures to prevent infringements. One of these reasonable measures is securing the network with a password that cannot be obtained anonymously, for example by using it in combination with a unique login or by requiring users to sign in with an email address. A poster with a shared password is therefore not enough. And incidentally, it is not safe for users either. Hackers can create a network that looks just like the real wifi network, while simply watching the internet traffic.

Monitoring users and privacy concerns

For the active provider, it becomes extra complex because they may also be infringing visitors' privacy, which automatically brings them within the scope of the General Data Protection Regulation (GDPR, in Dutch AVG). You can also be liable for privacy breaches, and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) can even impose hefty fines.

For example, the provider must have a valid legal basis for monitoring users' internet behaviour. Consent can be sufficient, if it has been given in a sufficiently specific and clear way. Terms can be communicated on first use, which the user can accept or refuse. Moreover, the monitoring must then still be proportionate and comply with the principle of subsidiarity. This means that monitoring internet traffic must be done as anonymously as possible, but also must not go further than necessary.

An example of an invalid provision is the right to monitor internet traffic at all times. What is allowed is a provision that gives the provider the right to investigate why an excessive amount of data traffic is being used. Automatic and anonymous interventions, such as filtering or blocking websites, are also always permitted because this is done anonymously.

Liability for damage suffered by users

Offering wifi is not only about liability for what the users of the network do, but also about liability in case they themselves suffer damage because the network was not adequately secured. This form of liability is completely separate from the distinction between an active and a passive provider. A passive provider can also be liable for damage caused by an unsecured network and therefore benefits from adequate security. Think again of the example of a poster with a shared password, which is an interesting opportunity for cybercriminals.

Both for reasons of privacy and for limiting liability, drawing up good terms of use is advisable. Make sure, however, that these terms of use are easy to view and to save, especially for private individuals. A PDF file is therefore preferable to a small window in which you have to scroll endlessly.

Liability of the IT supplier

Finally, attention must also be paid to the situation of the IT supplier. Take a shopkeeper, for example. Such a shopkeeper may be a layperson and therefore outsources the management and maintenance of the IT infrastructure to an IT supplier. The IT supplier then has a duty of care and can be held liable in its relationship with the shopkeeper. As a result, liability claims that reach the shopkeeper can ultimately be passed on to the IT supplier. That is why the IT supplier had better provide the necessary security and, if necessary, refuse the assignment.

Also read: The liability of internet providers, Liability and the use of passwords and Liability for posting content.