Incyder news

 

10 July 2014


Subscribe

“Right to be Forgotten” or “Right to Know”?

While the European Union is struggling with the comprehensive reform of the EU's 1995 data protection framework1 the Court of Justice rules on a landmark case reinforcing the European Union citizens’ right to be forgotten by search engines.

In a case of a Spanish citizen lodging a complaint against a Spanish newspaper, Google Spain and Google Inc. the citizen complained that an auction notice of his repossessed home that appeared on Google’s search results infringed his privacy rights because the proceedings concerning him had been fully resolved for a number of years and hence the reference to these was entirely irrelevant.2 The citizen requested, inter alia, that Google Spain or Google Inc. should remove the personal data relating to him, so that it no longer appeared in the search results.3 The request triggered debates on the applicability and interpretation of the “right to be forgotten”, a principle of the EU Data Protection Directive that allows a person to ask for personal data to be deleted once that data is no longer complete or accurate.4 

Accordingly, the Court of Justice firstly analysed the applicability of the EU law, namely the 1995 Data Protection Directive5 to the search engine Google Spain, especially given that the company’s data processing server is located in the United States. The Court found that search engines are “processing” personal data and should be viewed as “controllers” in respect of that processing.6 Regarding the territorial scope of the EU rules, the Court affirmed that even in the case where the physical server of a company that is processing data is located outside Europe, EU rules still apply to search engine operators if they have a branch or a sub­sidiary in a Member State which is “intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State”.7

Secondly, the Court scrutinized whether an individual has the right to request that his or her personal data be ceased to be accessible via a search engine, the so-called “right to be forgotten”. The Court confirmed that in order to comply with the Data Protection Directive, the operator of a search engine is “obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful”.8 This underlines that “even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed” and therefore “appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed.”9 It was also highlighted that the right to be forgotten is not absolute but will always need to be balanced against other fundamental rights, such as the freedom of expression and of the media, and that therefore it cannot be ruled out that in certain circumstances the data subject is capable of exercising the “right to be forgotten” against that operator but not against the publisher of the web page.10

Challenges in implementing the decision

The Court’s ruling has raised many questions regarding the practical applicability of the right to be forgotten for search engines. According to the judgement, a search engine will have to delete information when it receives a specific request from a person affected, thus affecting any company or website that holds European customers’ digital information. The search engine will then have to assess the deletion request on a case-by-case basis and apply the criteria determined in the EU law and the Court’s judgment. Should the search engine decline the request, the person can still turn to national data protection supervisory authori­ties or to national courts.11

The burden of fulfilling the judgement will fall largely on Google, which is by far the dominant search engine in Europe, having more than 90 percent of the search business in France and Germany.12 In order to follow the Court’s guidance, Google has opened an initial online system handling the requests that assesses each individual request and attempts to balance the privacy rights of the individual with the public’s right to know and distribute information.13 As of July 2014, more than 70,000 requests have been made through that online form.14

However, the Court’s decision gives only very vague direction on which data should be removed and on what bases, and thus the criteria to be applied by Google or any other search engine in deciding which data will be removed are opaque.15 Google has reported that each application is reviewed individually, in most cases with limited information and almost no context,16 and that Google cannot be specific about why certain information is removed because that could violate an individual's privacy rights under the court's decision. Since the reporting system is still in its initial phase, mechanisms for reversing a search engine’s decision about certain data are yet to be developed.18 Given these challenges, it should not be the role of a search engine company to decide what information is relevant.19 Importantly, some claim that the ruling “opens the door to large-scale private censorship in Europe”20 and even that it can be used by individuals trying to hide information not flattering to them but which is publicly available.21

While attempting to comply with the Court’s ruling, Google is initiating a public debate22 about how to balance one person's right to privacy with another's right to know.23 It is clear that without further guidance from the European Union this complex issue will continue to be fraught with uncertainty regarding the practical implementation of the Court’s ruling.

EU