OGH: Provider Obligations in the Case of Domain Name Abuse

Sept 30, 2022 Benn-Ibler Rechtsanwälte

In the case at hand, the Austrian Supreme Court (Oberster Gerichtshof, OGH) ruled that if the injured party, after having presented relevant information to the domain registry, demands intervention, the domain name provider can be held liable for any unlawful acts by direct perpetrators, provided that any such violation is obvious even to a juristic layperson without that person having to conduct any further research.

The plaintiff, an international law firm based in Vienna, runs a website. The defendant is a company based in Paris, whose main business activity is the registration of domain names as an issuing authority (registrar) for customers (registrants/domain holders). As an additional service, the company also provides email services, which allows domain holders to send emails with their registered domain name.

In spring of 2020, several domains containing the plaintiff's name (in different spellings) were registered with the defendant company by a third party. In doing so, the third party also subscribed to the email service, which enabled the company to send emails with the corresponding domain identifiers. The third party then used these domains to commit criminal offences on the model of CEO Fraud. The law firm is now seeking a prohibition against the defendant to register or participate in the registration of any domain name for third parties, such as was done for the plaintiff.

The Austrian Supreme Court assessed the specific obligations of the defendant company and affirmed the injunctive relief on the basis of previous judgments:

The defendant is being charged with having ignored the objectively unlawful circumstances and thus having deliberately avoided knowledge of domain name violation. Despite repeated notifications by the plaintiff and the fact that the defendant had the necessary technical means at its disposal, the defendant did not investigate if other registrations had been made under the plaintiff's name. The defendant evidently breached its duty to look into what was happening after an additional name registration was done by a natural person with a French address and, apparently, unrelated to the original name registered by the plaintiff. Also, the unusual name with no connection whatsoever to goods or services provided by the plaintiff, as well as the plaintiff repeatedly informing the provider of something unusual going on, support the fact that the defendant was under obligation to investigate the situation.

OGH 4 Ob 44/22g (29 March 22)