Much rejoicing was had this week amongst fans of Data Privacy and Data Protection, as the European Court of Justice (ECJ – though officially now just the Court of Justice) in its capacity as one wing of the Court of Justice of the European Union (CJEU; I know, the distinction is a bit confusing, and varies depending on who reports it) implied a “right to be forgotten” into European Data Protection Law. For example, the EU justice commissioner, Viviane Reding, welcomed the decision, saying it was a victory for the protection of personal data in the EU; “The ruling confirms the need to bring today’s data protection rules from the ‘digital stone age’ into today’s modern computing world”. Whilst the idea of giving citizens more rights to control the processing and dissemination of their personal information is a commendable one, this already exists in the form of the Data Protection Directive which was found to be applicable in this case.
What really happened here is that the court extended, in my opinion rather widely unclearly, who can be designated as controllers or processors of personal data and what sorts of information should be considered objectionable personal information and remain completely within the control of the citizen. It is of key importance to remember that Google has been forced here to remove search results linking to news reports about Mr Costeja González, which are perfectly legal and not defamatory. The danger of this ruling is that, whether or not it was “fair” in this case, the parameters for such a case to be brought by others have been left rather unclear and arguably wide open.
- To be clear, these are search results, not individually published articles or endorsements, but rather results of an algorithm or automated system.
- They simply link to content provided by another source, the pages providing information about Mr Costeja González’s past were not written, provided or hosted by Google themselves.
- The personal information in question was contained in accurate news reports about Mr Costeja González, which themselves have not been found untrue, defamatory or illegal, and were not required by the court to be removed by the newspaper’s website.
So, the reaction of some in Europe has been; “Hooray, we have a “right to be forgotten”… Who can we use it against? And for what information exactly?”, evidenced by a flood of take-down requests. And the reaction of many in the US, the tech industry and Google themselves has been one of disappointment and confusion as to how exactly this will affect the normal running of a search engine. Given the moves within Europe, particularly those supported by the European Parliament and the British and French governments towards a “right to be forgotten”, it is not surprising that this decision confirms the European trend towards privacy over freedom of expression. This is most obviously seen in the differences between how interests are balanced in defamation cases in the US and EU, with the US focus being very much on freedom of speech and expression, and the European focus moreso on protection of personal reputation and integrity. Daniel Fisher of Forbes sums up the different attitudes between Europeans and Americans thus:
Where Europeans see the “right to be forgotten,” many Americans see George Orwell’s memory hole. Where Europeans seem to have faith in the ability of regulators and de facto monopolists like Google and Microsoft to protect the privacy of private citizens, I think most Americans accept the fact that the Internet is a wide-open place where new entrants can pop up at any time.
The European court judges ruled that under existing EU data protection laws Google has to erase links form their search results, linking to two pages on the Spanish newspaper La Vanguardia’s website, containing information about a case quite some time ago, from the search results when Mr. Costeja González’s name is put into the search engine. The decision requires that Internet search services remove information deemed “inadequate, irrelevant or no longer relevant” and failing to do so can result in fines. As the Guardian’s reporting on the decision pointed out;
The European judges made clear that in their view the EU data protection directive already established a “right to be forgotten”. This appears to pre-empt lengthy negotiations within the EU over a new data protection directive which could establish a limited “right to be forgotten”.
One of the major problems with the decision of the court is that it treats search engines like publishers, as if they had power to pick and choose what other people can see when they type in a search term such as an individual’s name. Whilst search engines like Google might technically have this power, it is, for a huge number of practical as well as legal reasons, simply not how Google works. It is Google’s search algorithms which have made it such a success, algorithms which allow for the automatic searching and filtering of data, and which allow search results to be delivered in a few seconds based on relevance and popularity. Google do not employ a gargantuan team of search query technicians who answer each search individually, or who decide what should and should not be “published” as part of the search results, and as such any comparison with traditional “publishers” is completely inappropriate. It has been argued before, unsuccessfully, that search engines should be considered publishers. Similarly, the problems which really result from the court’s ruling stem from the designation of Google and other search engines as “data controllers”, as this is setting the threshold for “processing” or “controlling” of information rather low.
Without any active “processing” of the information, beyond simply how it interacts with the automatic systems behind the search engine, it is hard to see how companies such as Google should be expected to exercise quality control over such information. It is also very important to keep in mind that Google’s formula for generating search results is a totally different topic from Google Adwords and Google’s processing of actual personal data for advertising reasons. That sort of data processing is only used for targeted ads and the like, and it is not this “data controlling” about which we talk when we discuss search results from Google’s search engine. Popular dissatisfaction with companies like Google who collect and benefit from the use of personal data and preferences might have lead some to confuse Google’s data gathering for advertising practices with the workings of the algorithms used to automatically generate search results.
The law firm Mason Hayes & Curran’s Technology Law Blog gives a very good breakdown of the legal issues and difficulties of the decision. In short, they take issue with the strange way in which the court decided that Spanish law applied in the case because Google had an advertising subsidiary in Spain; they point out that on a literal reading of the decision, “[…]a German data controller, with all relevant data processing operations based in Germany, could find itself subject to French data protection law simply because it had a subsidiary engaged in promotional activities in France.” They further point out that the court came to some odd conclusions about the privacy of personal data which was available to the public in the first place, and not actually revealed in any sort of breach of confidence. They criticize that this very strict extension of the right to privacy and data protection is suggested to take precedence “as a rule” over any right of the public “[…]to access and communicate true information about an individual”, and point out the lack of weight given to European jurisprudence on the freedom of expression, from case law, Article 11 of the EU’s Charter of Fundamental Rights as well as Article 10 of the European Convention on Human Rights. They also find it odd that such a revolutionary and new “right” seems to blow more established rights out of the water;
This finding is particularly remarkable when one notes that the “right to data protection” (as distinct from a right to privacy protecting the personal sphere) is a relatively new fundamental right. While there are some precedents in the laws of other EU Member States (such as the right to “informational self-determination” in German constitutional law), data protection only became a fundamental right across Europe as a result of the adoption of the Lisbon Treaty. In contrast, free speech and the right to freely receive and impart information are core and well established human rights, well recognised in the legal orders of most EU states. Notwithstanding this, the Court appears to have found that the new right to data protection takes precedence over, and as a result erodes, the traditional protection of free expression.
The blog post is well worth a read, and goes into further detail about how this decision could have further ramifications for national Data Protection Authorities as well as wide-ranging political, economic and technical consequences. One of the key points to take away from this case in general, and a point which is dealt with clearly by the piece is that the court “found that a search engine “processes” “personal data” and acts as a “data controller”“, all of which are questionable definitions at best, given the facts of the case at hand. Finally, they sum up their view of the implications of the decision and make it worryingly clear that the decision favours deletion over uncertainty;
Crucially, the Court found:
- that a data subject does not need to show any prejudice to invoke this right to be forgotten;
- the right to be forgotten generally takes precedence over other rights, including the right to free expression; and
- content which could lawfully be returned on one day may need to later be removed due to the passage of time.
It appears that this right to be forgotten will favour the removal of content, and that such information can only be maintained “if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by a preponderant interest of the general public in having, on account of its inclusion in the results, access to the information in question.” In other words, the presumption falls in favour of deletion, and the rights of access to information and free expression appear only to be relevant as an exemption that may arise in certain cases.
In the wake of the decision Google has already been hit with a number of new take-down requests, and have scrambled to put a new automated system in place to handle these requests. It will be interesting to see exactly how successful, if even possible this approach is. I also wonder whether many of the other search engines have received such requests? Not that I have too much sympathy for ‘poor little Google’, this is what they pay their legal team for and is simply a risk that comes with being such a huge player in this market, but it is interesting that Google has once again been singled out as the focus of the whole problem. Presumably one finds similarly damning evidence of Mr Costeja González’s past when searching Bing or Yahoo?
Whatever your views on the likes of Google, it should be conceded that at the very foundation of the Google search engine is the idea of complete automation, the idea that Google itself should not have to, nor even be able to, influence what appears in the search results. There will of course be exceptions; Google Ireland will show different results than Google Deutschland, but this is again simply caused by new search criteria based on increased relevance of language and geography, the results themselves remain automatic and not individually selected or published; likewise, there are cases in which Google will try to or be compelled to remove results for certain criminally illegal practices such as child pornography or, in some jurisdictions, illegal file sharing. But requiring search engines like Google to perform this new task of removing search results which links to otherwise legal content because of “right to be forgotten” requests is not simply a slight alteration to the way such search engines provide their results, but it would rather require the introduction of an entirely new systems to deal with such requests, systems which might be much harder to implement than anything which makes up the working of various search engines at the moment. And it could at the end of all this be of little real value, as The Economist points out there exists the huge impracticality of such a right only applying within Europe;
The court’s desire to protect victims of misunderstanding and malice is understandable. But a right to be forgotten would be hard to implement. Even if Google is made to censor its search results in Europe, in America the First Amendment’s free-speech provision usually trumps privacy concerns. With modest technical know-how, European internet users will be able to make American-style searches. Europe will hardly want to build a Chinese-style firewall to prevent that.
Following similar logic one could make the claim that Twitter, by allowing users search for keywords of hashtagged phrases, is also a data controller or publisher by allowing access to, or even linking to defamatory information (or even simply information which is irrelevant or objectionable – i.e. most of Twitter). Particularly given how the Twitterverse reacts even more quickly and often disproportionately to news or rumours, it is even more likely that such undesired information could be made available through Twitter. Once again, Twitter, like Google, simply provides such information based on algorithms and systems that link keywords and popularity – they do not personally go through or “process” each detail before they make the information available. Similar worries were had by Jimmy Wales, the co-founder of Wikipedia, who asked, in a Twitter post; “When will a European Court demand that Wikipedia censor an article with truthful information because an individual doesn’t like it?”. At this juncture, it is simply hard to see exactly where and how the ECJ or other European courts might draw the line regarding similar such cases in the future. As James Ball of the Guardian points out “If there is any first law of the internet, it must surely be the law of unintended consequences.”
I should clarify by saying that I am not entirely against the idea of some form of a right to be forgotten, I think it might well be necessary, or at the least rather handy as more and more personal information about us ends up online and the removal of such information becomes harder and harder, but I really do not think this is the right way to go about it. I can only really suspect one of three outcomes for this decision;
a) It will be ineffective, due to its sheer impracticality it will simply be ignored by the search engines, or only followed in very limited circumstances. Similarly the courts in Europe may be reluctant to extend it to further cases.
b) It will be wholly overturned or otherwise done away with. This seems tricky, as unless found to be manifestly erroneous, or even if so, I do not see how likely or practical such a decision might be. Perhaps new legislation will overturn this decision, or limit the right, or this may be achieved by subsequent CJEU decisions.
c) This new right to be forgotten will be upheld and Europe will maintain its strict stance on data protection, but, having swung towards a defamation-like position where personal reputation trumps free speech and dissemination of information, Europe will be considered inhospitable territory for search engines like Google and other possible controllers or publishers of personal data (the categories of both controllers and personal data could be opened up quite a bit by this decision).
As for the individual case itself – a case pertaining to 36 words in the online version of a Spanish newspaper from a report in 1998 saying a man’s home was being repossessed to pay off debts – it seems like it might have had somewhat less than the desired effect for Mr. Costeja González. As James Ball sums it up;
The net result of such a big ruling? In 1998, Costeja González was contending with 36 words of Spanish. On Tuesday alone, 840 articles in the world’s largest media outlets were written in reference to his case, including in countries where his name would otherwise never have been heard, and where the ECJ’s ruling will never reach.
A failed attempt to suppress a piece of information leading to its global dissemination is one of the oldest and most famous internet phenomena, so well known it has a name: the Streisand effect (named after a failed attempt by Barbra Streisand to have photos of her house taken offline).
Costeja González won his fight for a right to be forgotten, or at least to disappear. Unfortunately for him, the fight was pretty damn memorable.
If this case about 36 truthful words about a relatively unknown Spanish man in a case from 1998 lead to this result, imagine the influx of requests from those who might be able to argue actual defamation or damage more easily – it could be very hard to distinguish why they too cannot censor what the internet gets to reveal about them. Like it or not, the world is becoming somewhat of a “global village” again, where everyone knows about everyone’s business. If you’re really worried about it, then there are tools and services out there for working on your online presence and reputation, as well as just tips for keeping your online presence in line. But really and truly, as long as no one is doing anything which is clearly malicious or defamatory, it’s just hard luck if you have some undesirable information about you out there in the global village. In the same way that you can’t ask for an injunction against the local gossip who keeps reminding the whole village about the time you made a show of yourself at their cousin’s wife’s brother’s daughter’s wedding, I’m not sure you should be able to stop a search engine from displaying otherwise entirely legal content about you.
Court of Justice of the European Union
PRESS RELEASE No 70/14
Luxembourg, 13 May 2014
Judgment in Case C-131/12
Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González
“An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties“, available [PDF] at http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-05/cp140070en.pdf
James Ball, “Costeja González and a memorable fight for the ‘right to be forgotten'”, 14 May 2014, Guardian News Blog, available at http://www.theguardian.com/world/blog/2014/may/14/mario-costeja-gonzalez-fight-right-forgotten
Daniel Fisher, “Europe’s `Right To Be Forgotten’ Clashes With U.S. Right To Know”, 16 May 2014, Forbes, available at http://www.forbes.com/sites/danielfisher/2014/05/16/europes-right-to-be-forgotten-clashes-with-u-s-right-to-know/
Matt Ford, “Will Europe Censor This Article?”, 13 May 2014, The Atlantic, available at http://www.theatlantic.com/international/archive/2014/05/europes-troubling-new-right-to-be-forgotten/370796/
Alexei Oreskovic, “Google gets take-down requests after European court ruling: source”, 14 May 2014, Reuters, available at http://www.reuters.com/article/2014/05/14/us-google-eu-idUSBREA4D0P820140514
Alan Travis and Charles Arthur, “EU court backs ‘right to be forgotten’: Google must amend results on request”, May 13, 2014, The Guardian, available at http://www.theguardian.com/technology/2014/may/13/right-to-be-forgotten-eu-court-google-search-results
Adrian Schneider, [German] “EuGH: Suchmaschinen und Datenschutz”, 13 May 2014, Telemedicus, available at http://www.telemedicus.info/article/2777-EuGH-Suchmaschinen-und-Datenschutz.html
“On being forgotten: The right to be forgotten sounds attractive. But it creates more problems than it solves”, The Economist, May 17 2014, available at http://www.economist.com/news/leaders/21602219-right-be-forgotten-sounds-attractive-it-creates-more-problems-it-solves-being
“Google and the “Right to be Forgotten” – What the Court Said and Why it Matters”, 15 May 2014, Mason, Hayes & Curran Technology Law Blog, available at http://www.mhc.ie/latest/blog/google-and-the-right-to-be-forgotten-what-the-court-said-and-why-it-matters