And, when we analytically compare these two rights we all care about, no matter how attached we are to the idea of absolute ownership, it is possible to realize that we wouldn’t want to be put in positions that would equate to giving up to our private life. The employee status would be such a position, if we considered that the employee gives up private life when arriving at the office. Or that the employee must bring his/her own equipment from home in order to keep in touch with the world during office hours. And, as the legal regulations are made also to ensure social balance, this time the employer is sacrificed, finding itself in the situation of not being able to use its property solely as desired. This was pretty much the thinking that generated the regulations mentioned herein.
If you are an employer, you have two options – to be outraged by the pressure of these restrictive regulations that you cannot change, or to be prepared.

You are an employer. What to do to be prepared:

• Develop a policy regarding the acceptable use of IT resources, indicating how long, in which manner and under which terms is the employee allowed to use them, instead of imposing an absolute interdiction on the use of IT&C equipment;
• Implement an IT equipment handover – receipt procedure when the employee leaves the company, which foresees the obligation of the employee to take over and delete all personal data from the company’s media, including correspondence, photos, etc., instead of looking for hundreds or even thousands of emails in the archive after the employee’s departure, in response to their request for access. On a side note – an EU Court recently ruled that the request for access to the employee’s email archive may be excessive, but that does not mean that things could not be seen differently by other Courts.
• Establish in the internal regulations the employee’s obligation of labelling private correspondence or other personal data with the word “Personal”, which will ease the rapid identification of personal data during the process of handover – receipt;
• Establish in the internal regulations the conditions in which you can access the employee’s equipment in his/her absence, in order not to be exposed to accusations of violation of privacy. In the case of Libert v. France, it was established that the employer can access the employee’s electronic files in his/her absence, having a legitimate interest in verifying whether they were used in accordance with the contractual stipulations and the company rules. If the files have not been labelled as “personal”, the presumption is that they are for professional use.
• Inform the employees on any monitoring of the IT resources that you wish to undertake, before doing it. Whether it is about monitoring the traffic volume or the content of the correspondence, the monitoring is possible if and to the extent in which the employer can prove a legitimate interest in doing so, and if the employee has been previously informed about the employer’s intention. The idea is that the employers should try to prevent the employees’ inadequate behaviour, rather than securing more intrusive means for fighting against them.

Whether we are an employee, or an employer, in the age we live in we are united by a common denominator – We’re worth what our data’s worth. Let’s treat it wisely.

How important is a positive review and how a negative review can hurt

Online trade has proven to be one of the big winners of the pandemic. Because we couldn’t go to the store to do our shopping for the week, the green leaf bag from the organic store and the fleece pyjamas (because telework also changed fashion), came to our house in a few clicks.

We, like 93% of consumers, probably use the internet to look for a local business. As 87% of consumers, we also read reviews to assess a business and it is possible to fit in the percentage of 48% of customers who do not buy from a business that has less than 4 stars.

The above percentages, determined from a study conducted in the US, most likely remain, with small variations, for the rest of the world connected to the Internet. The figures are staggering, and no matter how conservative you are, you can’t help but realize that the future of commerce is online. The future is a way of saying, because Amazon mogul Jeff Bezos has been, for many years, off and on, in first place in the World Hall of Fame of billionaires, not as a result of any innovation that has revolutionized the world, but because of this simple, old-fashioned, trade – put online. The Silk Road, therefore, has long carried its caravans through the fertile plains of the online, and only those who did not want to see did not see it. In the pandemic, the practice also showed those who did not know what to believe, that whoever moved online not only survived, but also thrived and that the online will slowly swallow what was happening until recently through fairs, shops, markets, and other relics of the 20th century.

While a one-star increase in the review rating is correlated with a 5-9% increase in revenue for certain industries, according to research from Harvard Business School, receiving negative reviews can have a significant impact on consumer behaviour, causing 92% of them to be less inclined to turn to a business, according to studies.

So the question of how important a positive review is and how a negative review can hurt remains a rhetorical one, with about 90% of consumers buying online and reading reviews before that, about half of whom don’t even look at what a business that has a rating of less than 4 stars has to offer.

The review, as valuable as the recommendation from a friend

72% of those who ordered online chose to post a review for a local business in 2020, a considerable jump from just 66% in 2019.

Interestingly, studies found that 78% of consumers have as much confidence in an online review as they do in a recommendation from a friend, colleague or family member.

Consumers’ growing desire to help others by sharing their experience, on the one hand, and the fact that the public relies overwhelmingly on reviews are two factors that can no longer be ignored by businesses, which are becoming more and more attentive to what their customers post on Facebook and Google. Especially since the majority of the public does not seem to have activated the fake review detector and is inclined to believe anything written on the internet.

Why it doesn’t help to disable reviews

Until now, when a business received a negative review, usually someone from a department that was unlucky enough to be caught working at night would quickly search Google for ”disabling Google reviews” or ”disabling Facebook reviews.”

But because a stone cast into the water requires a relatively large number of wise men to remove it, things are not so simple. Because, if we look at the Google My Business support page (and we look at it, because Google is both the game and the player in this modern parable), reviews, together with the owner’s response to them, contribute to the degree of trust that consumers can have in a business, showing how much it cares about the customer.

Yes, stopping a wave of false negative reviews from competitors or a malicious agent can be a temporary solution to avoid ruining a business’s ranking from 5 to 3 in a matter of hours, as I’ve heard it happened before, given that the purchase of negative reviews is possible today at low prices.

What options does a business have in the face of a negative review with a certain degree of veracity, which indicates a credible connection between the author and the business

Studies show that not enough consumers can spot a fake review. Millennials seem more competent at this, perhaps because it’s about surviving in the online jungle where they grew up. But if the review does not come from a suspicious or anonymous profile and the author of the review provides enough details about his/her interaction with the business, many consumers will be tempted to believe it.

The business may request that the review be removed. After patiently reading the categories, points, and subpoints of Facebook’s and Google’s policies to find out what an inappropriate review means from their point of view, you’ll find that even if a review is malicious or simply untrue, deleting the review is far from being guaranteed. Google, for example, “is not involved in misunderstandings between companies and customers, because there is no sure way to determine who is right about a particular customer experience.”

If neither the option to delete the review, nor the other tools recommended by the platforms hosting the review (report abuse, disable reviews, post a response) lead to results, the business has the possibility to notify the author of the negative review to delete it and may even sue them in case of refusal. However, it must be borne in mind that we live in a democratic society, in which freedom of expression is highly valued, and notifications should not be abused unless the review is clearly out of place or simply untrue.

The courts have been awarding significant damages for negative reviews lately

• An Australian Court ordered a woman to pay damages in excess of $ 500,000 and legal expenses following a negative review she posted on Google. Evidence in the trial showed that it was a false review, which harmed the clientele of the plastic surgeon who had been accused in the review of performing a failed procedure to remove buccal fat;
• A couple in Florida was ordered to pay $ 350,000 for a series of defamatory reviews they left to a divorce lawyer on Avvo and advocates.com. All the reviews stated that the lawyer lied to his clients about the fee, and one of the reviews explicitly stated that the lawyer forged a contract. The couple’s statements were factual allegations, and the evidence turned out to be false, the Florida Court with three judges noted in its decision;
• The Supreme Court of South Australia awarded $ 750,000 in 2020 to a lawyer whose business was slandered by false negative reviews. In the case of Cheng v Lok [2020] SASC 14, Mrs. Lok posted multiple defamatory reviews of attorney Cheng, warning his clients to stay away from his law firm due to his misconduct. Although Mrs. Lok had never been a lawyer’s client, in fact she did not even know him, she continued to post negative reviews about him, despite the lawyer’s notifications and reports to Google. The reviews were viewed by over 1500 people within 2 months, and Mr. Cheng showed that he lost 80% of his customers and money and began to suffer from anxiety and depression;
• The 6th District Court in Bucharest, Romania, by a final decision in 2019, forced the customer of an online store to remove a negative review she had posted, finding that “she acted in bad faith, thus exceeding the limits of her right to free speech and in breach of the applicant’s right to good repute as she made allegations concerning the defendant which would be liable to damage its good repute without having any evidence to that effect”.

The author of the review was exempt from damages only because the online store failed to prove the amount in which the sales suffered as a result of the review. ”Although the occurrence of the damage is obvious, being unnecessary to prove its existence, as it implicitly results from the commission of the wrongful deed, however the plaintiff did not provide any evidence to quantify the damage it has suffered” the court noted. Because in Romanian law there is no such concept as punitive damages, the payment of which would be incurred by the mere finding of a damage, courts can reject the claims for damages even if the damage is obvious, if it cannot be quantified. 

What we need to understand from the practice of the Courts

In its practice, the European Court of Human Rights distinguishes between facts and value judgments. If the concreteness of the first ones can be proved, the accuracy of the following ones cannot be demonstrated, as it was noted in the Resolution of October 14th, 2008 in the Case of Liviu Petrina against Romania (Application no. 78060/01).

Therefore, the review based on statements of fact must be true and provable. So, it’s not enough to be right, you have to be able to provide evidence for it. Statements such as ”the online store did not” or ”did x, y, z” are factual statements, which can and must be demonstrated if necessary.

Reviews based on value judgments, such as those in which you say how you felt in relation to the online business, your opinion about the services received, do not need, in principle, to be proven. The Courts have traditionally considered that such statements cannot be censored because that would infringe on freedom of opinion (acc. Lingens v. Austria of July 8th, 1986, paragraph 46 and Ivanciuc v. Romania, (Decision) No. 18624/03, September 8th, 2005).

BUT, it is no less true that the fact of accusing certain persons implies the obligation to provide a sufficient real basis and that even a value judgment may prove excessive if it is totally devoid of any real basis (acc. the case of Ivanciuc cited above, Cumpănă and Mazăre versus Romania (Application no. 33.348/96) of 17.12.2004 (paragraphs 98-101) or “if it has no factual basis” (acc. the case against Jerusalem versus Austria (Application no. 26958/95 of February 27th, 2001)

How far can the consequences of a ”harmless” value judgment review go, is evidenced by the case of a German citizen sued by a four-star hotel in Austria for claiming in an online review that a portrait of two characters decorating the hotel lobby represented a ”Nazi grandfather”, since he was sporting a swastika adorned uniform.

In order to defend himself, the German citizen had to do research on the identity of the two men in the photos at the German National Archives in Berlin, finally managing to prove that both men had been members of the Nazi party.

Things to bear in mind while posting a negative review so that you don’t end up being sued

1. Consider if the facts you are going to criticize are real and verifiable, or it’s rather you, having a bad day.
2. You have the right to express your negative feelings about your experience with a business, but make sure you have a real enough base to provide if needed.
3. Google and Facebook reviews are considered public statements, so it’s advisable to express them in a civilised manner, no matter how great your dissatisfaction.
4. Do not rely on the fact that a business would have a hard time proving the link between their damage and your actions. If other users say they did not order product X after reading your review, it could be enough for you to end up paying for it as damages. Likewise, buying clicks might suffer an overall decrease that could be assigned to your review.
5. Ask yourself whether you never made a mistake when someone else expected you to be “the professional”. And what was the treatment you should have received to better yourself – to be publicly ridiculed or to be treated with understanding? Before posting an acid review, keep in mind that your existence may well depend on what others say online about you one day. Analyse if you could not get a better result by talking directly to business owners.
6. Avoid using personal data in the review. Although the GDPR does not apply, in principle, to the processing of personal data by natural persons, the condition is that the processing be carried out in the course ”of a purely personal or household activity and thus with no connection to a professional or commercial activity”. The vague wording of the data protection regulation leaves room for interpretation and you may want to avoid defending the prevalence of your right to free speech over the right to private life of the person you exposed – it is a conflict that even today has no predictable solution before courts.
7. Consciously inhale and exhale while reading points 1-6. If after reading & breathing you are still determined to post the review, equip yourself. With endurance and evidence, such as print-screens and correspondence archives (that capture the date, sender, and content of the conversation), offers, contracts, invoices, acknowledgements of receipt and proof of delivery, without other foreign matter (parts of other documents, pictures, websites, etc.).

If you honestly believe that the business you have interacted with cannot be redressed or stopped from harming others other than by exposing it, be prepared to face any challenge with your head held high. After all, the world was changed only by people who fought for what they believed in, regardless of the risks involved.

2. The data transmission via the plugin to Facebook is done without the visitors being aware of it and regardless of them being members of the Facebook network or having clicked the “Like” button

3. The status of joint controller is acquired because the admins have their own economic interest in promoting the business by inserting the plugin in the site

4. The status of joint controller is acquired even if the admins do not have access to data and have no influence on the processing of the data transmitted to Facebook

5. The admins are considered joint controllers only for the actions in which they participate – the collection and transmission of data, and not for other processing operations from Facebook, previous or subsequent

6. The responsibility for obtaining consent and informing the user rests primarily with the admins, with whom the user first comes into contact

7. It is not clear how Facebook, in turn, will inform visitors who are not members of the network

8. If relying on consent, it is not clear how sites will be able to obtain it in a “prior” fashion, as long as Facebook seems to start processing immediately after accessing the site, irrespective of the user’s clicking the “Like” button

9. According to the press release following the CJEU decision, should the basis of the processing be legitimate interest, both joint controllers must justify a legitimate interest for the processing

10. Conclusion – for data collection and transmission operations through Facebook (or other social networks) plug-ins, sites must quickly change their privacy policies by assuming the role of data controllers and by fully informing users, according to GDPR. As for the legal basis for processing, legitimate interest might not be expected solution. Consent we already know that doesn’t really work. I will soon resume the topic with more in depth insight.