## Facts

- In March 1999, the applicant, K.U., a 12-year-old boy, discovered that an unknown person had placed an advertisement on an online dating site in his name without his knowledge or consent.
- The advertisement included K.U.’s name, his age and year of birth, and a detailed description of his physical characteristics.
- It contained a link to K.U.’s personal webpage, which displayed his photograph.
- It also listed a telephone number that was almost correct (it differed by one digit).
- The text suggested he was seeking an intimate relationship with a boy of his age or older, exposing him to sexualized contact risks.
- K.U. learned of the advertisement when an adult male contacted him by email in response and suggested meeting in person.
- K.U.’s father asked the police to identify the person who had posted the advertisement so that criminal charges could be pursued (the matter was treated under domestic law as involving malicious misrepresentation and was also linked to defamation-type concerns).
- The police traced the posting to an IP address and sought subscriber/identification information from the internet service provider (ISP).
- The ISP refused to disclose the identity behind the IP address, relying on Finnish telecommunications confidentiality rules.
- The police requested a court order compelling disclosure, but the District Court refused, finding no legal authority to order release of telecommunications identification data in the circumstances.
- The District Court noted that Finnish law allowed access to identification data for certain specified offenses, but malicious misrepresentation did not qualify.
- The Court of Appeal upheld the refusal, and the Supreme Court of Finland denied leave to appeal.
- As a result, the person responsible was not identified, and the investigation could not proceed to holding the poster accountable.
- K.U. applied to the European Court of Human Rights, alleging that Finland failed to secure his right to respect for private life under Article 8 of the Convention and that he lacked an effective remedy under Article 13.

## Issues

1. Whether Finland breached its positive duty under Article 8 by failing to provide a legal framework that allowed authorities to obtain identifying information from an ISP to investigate and identify the person who posted a sexualized advertisement in a child’s name.
2. Whether Article 13 required a separate finding that K.U. lacked an effective domestic remedy for the alleged interference with his Article 8 rights.

## Decision

- The European Court of Human Rights (Fourth Section) held unanimously that Finland violated Article 8.
- The Court found that the interference with K.U.’s private life was serious, given the applicant’s age and the sexual nature of the advertisement, which made him a potential target for predatory approaches.
- The Court concluded that Finland’s legal framework gave decisive weight to telecommunications confidentiality in a way that prevented any practical possibility of identifying the offender and pursuing accountability.
- The Court held that Article 8 required a framework that allowed a real balancing between confidentiality/anonymity and the protection of a child’s private life and physical and psychological well-being.
- The Court found it unnecessary to examine the Article 13 complaint separately in light of its conclusion under Article 8.
- The Court awarded just satisfaction under Article 41, including compensation for non-pecuniary damage and an award for costs and expenses.

## Legal Principles

- Article 8 protects private life and may require the State not only to refrain from interference but also to take steps to secure respect for private life in relations between private persons.
- Where conduct seriously intrudes on private life and threatens a child’s welfare, Article 8 can require criminal-law protections and investigative tools that work in practice, not only on paper.
- Confidentiality of communications and the possibility of anonymous online expression are legitimate interests, but they are not absolute when weighed against the need to protect the rights of others, especially minors facing sexualized exposure.
- A State’s margin of choice in designing telecommunications secrecy rules is limited where the result is that grave interferences with private life cannot be investigated because authorities cannot obtain identifying data.
- The legal framework must permit disclosure of identifying information in suitable cases, subject to safeguards, so that authorities can identify and, where appropriate, prosecute those responsible for serious privacy violations.
- Effective protection under Article 8 may require a remedy that can lead to identification of the offender; where the Article 8 violation stems from the absence of any workable avenue to identify the wrongdoer, the Court may treat an Article 13 complaint as not requiring separate examination.

## Conclusion

In *K.U. v. Finland*, the ECtHR held that Finland violated Article 8 because its telecommunications confidentiality regime left the authorities without a lawful means to compel disclosure of subscriber-identifying information needed to identify the anonymous person who posted a sexualized dating advertisement in a 12-year-old child’s name, preventing an effective investigation and accountability; the Court therefore found no need to rule separately on Article 13.


K.U. v. Finland, Application No. 2872/02 (2008)