The European Court considered the case under Article 8 ECHR (right to respect for privacy) considering the "the potential threat to the applicant's physical and mental welfare brought about by the impugned situation and to his vulnerability in view of his young age." (para. 41). It held that the state had failed in its positive obligation to effectively protect the applicant by failing to take steps to identify and prosecute the perpretrator. Let me cite two relevant passages from the judgment:
The Court notes at the same time that the relevant incident took place in 1999, that is, at a time when it was well-known that the Internet, precisely because of its anonymous character, could be used for criminal purposes. Also the widespread problem of child sexual abuse had become well-known over the preceding decade. Therefore, it cannot be said that the respondent Government did not have the opportunity to put in place a system to protect child victims from being exposed as targets for paedophiliac approaches via the Internet. (para. 48)In conclusion, the Court unanimously found a violation of Article 8. Thus the judgment offers important pointers on the extremes within which the state's balancing exercise in these matters should take place. A welcome development!
Although freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others. Without prejudice to the question whether the conduct of the person who placed the offending advertisement on the Internet can attract the protection of Articles 8 and 10, having regard to its reprehensible nature, it is nonetheless the task of the legislator to provide the framework for reconciling the various claims which compete for protection in this context. (para. 49)
To Finland's (albeit late) credit, new legislation has come into force which does permit for disclosure of identity in comparable cases.
The press release in this case can be found here.