In a groundbreaking judgment delivered in Milan, a court has convicted three senior executives at Google of violating Italian privacy law, after a video was allowed to be posted on YouTube showing a boy with Down's Syndrome being bullied by classmates. The three executives are Google’s chief privacy counsel Peter Fleischer; the senior vice president and chief legal officer David Drummond, and the retired former financial executive George De Los Reyes.

Google acquired the YouTube site in 2006, shortly before the offending video was uploaded. The video was only removed after a complaint was made by the Vivi Down association, which represents people with Down's Syndrome. Prosecutors alleged that the company had not done enough to ensure the video was removed quickly.

Italian law allows the criminal courts to hold company executives responsible for their employer's offences. This case is significant as it appears to be the first time that a criminal conviction has been handed to individuals for a breach of data protection laws, and even more significant because the alleged offences were committed on behalf of a company. Google has accused the Italian court of setting a "chilling precedent", due to the potential liability for internet content providers worldwide, as well as their employees. Google had argued that it would be impossible to screen the thousands of videos uploaded to the site every day, and that the executives charged had no direct involvement in the recording or uploading of the video.

The executives were each given six-month suspended sentences but were acquitted, along with a fourth individual (Google Video Europe's Arvind Desikan) of separate defamation charges. Google intends to appeal the decision.

Despite this case occurring in Italy, the ramifications of the judgment could spread across the world, not simply because of the threat to foreign internet content providers whose sites are available in Italy, but also because Italy is not the only country advocating the use of criminal prosecution for breaches of data protection or privacy laws. The UK's Ministry of Justice, for example, has completed a consultation on the introduction of prison sentences for individuals convicted of obtaining, procuring or disclosing personal data, and it is likely that such individuals will face a sentence of up to two years in prison.

If the Google appeal is unsuccessful, this ruling could mark a dramatic shift in the way internet sites providing uploading facilities operate, as website hosts seek to protect themselves from prosecution.