Providers’ liabilities in the new EU Data Protection Regulation: A threat to Internet freedoms?

User-generated information is processed on providers’ platforms in a way resulting from the intersection of two choices: users’ choices on what to distribute, on what platforms, and with what options, and providers’ choices on how to shape their platforms, enabling what kinds of distribution, with what options to offer to their users. In the following I shall consider whether the latter choices may be sufficient to ground a responsibility of providers for violations of data protection law, focusing on the ‘Proposal for a Data Protection Regulation’ recently advanced by the EU Commission. The Proposal, currently being examined by the EU Parliament and Council, is meant to provide a new framework for data protection, substituting the Data Protection Directive (95/46/EC) and the national laws implementing it. My inquiry is limited to information freely uploaded by users and neutrally processed by providers’ platforms. Thus, I shall only address the role of providers as neutral (though self-interested) enablers of the sharing of user-generated information, in the context of web and cloud-hosting. Through serving users’ aims (eg by facilitating access to the uploaded material through indexing), providers also achieve their own purposes, and, in particular, they foster access to their websites, which may lead to additional revenue from advertisers. However, this result supervenes on an outcome that is aimed at by the users, for the sake of which users are uploading content to the platforms, namely, making the uploaded information easily accessible on the web.