The right to be forgotten

The Right to Be Forgotten: Europe Leads on Internet Privacy

In June 2014, Google was forced to begin removing certain search engine query results in Europe after a ruling by the Court of Justice of the European Union (CJEU), Europe’s highest court. The ruling gives individuals the right to request that certain links to personal information found through a search of their names be removed. The CJEU’s ruling has come to be known as the “right to be forgotten” (sometimes given the acronym RTBF, or sometimes referred to as the “right to delist”). In an age where it seems there are no limits on the ability or willingness of private Internet firms to collect and disseminate personal information, regardless of the user consenting to or knowing of its collection and use, the CJEU’s ruling is possibly the beginning of a new era of digital privacy based on the simple idea that individuals have a right to manage their online personal information and public image. Google, Facebook, Twitter, and many other U.S. Internet-based firms whose business models depend on virtually no limitations on the collection and use of personal information have lobbied strongly against the idea that individuals have a right to manage their personal online information. However, the CJEU’s decision is final, and Google, along with Yahoo, Microsoft, and others, have begun to implement the ruling. While simple in concept, the right to be forgotten can be devilishly difficult and expensive to implement in practice. The CJEU’s decision was based on a 2010 lawsuit brought by a Spanish citizen,

Mario Costeja Gonzalez, against a Spanish newspaper, and against Google Spain and Google Inc. (the American parent firm), which had linked his name with an auction notice in a newspaper that his house had been repossessed and was being sold in order to pay off debts. A Google search on Gonzalez’ name returned a link to the newspaper notice as the most prominent link. Gonzalez’ suit said that issues of his debt and foreclosure had been resolved years ago, and that the reference to this event was irrelevant and an invasion of his privacy as defined in the European Union Data Protection Directive—Europe’s digital era privacy legislation that governs personal information in the 28 countries that make up the European Union. Gonzalez requested that the newspaper remove or alter the pages it posted on the Web and that Google Spain and Google Inc. be required to remove the link between his name and the auction notice in the newspaper. Gonzalez

said he was not worried about his online image as much as the impact on his work and reputation as a lawyer, and the potential of the notice to injure his law business. There had also been thousands of other requests by Europeans asking Google to remove links to their names that they claim are inappropriate, inaccurate, no longer relevant, and interfere with their privacy. Google and the newspaper argued that because the server providing the results for

Google searches in Spain was located outside Europe, the E.U. rules and privacy legisla-tion did not apply. Google also argued that it was a search engine that simply provided links to information stored by others, not a data repository, and that it was not responsible for the accuracy or relevance of information stored by other organizations. Consequently, Google claimed that it should not be subject to the E.U. Data Protection Directive because it pertained only to data repositories. Finally, Google argued that under European law, individuals do not have the right to request that their personal data be removed from ac-cessibility via a search engine. In public statements, Google also said it would be difficult or impossible to respond to thousands or millions of requests to eliminate links; granting these rights would allow criminals, fraudsters, sexual predators, and corrupt public of-ficials to rewrite history; and that it would be very expensive to respond to requests and would potentially limit innovation in the future. In 2014, the CJEU ruled that E.U. data protection policies were not limited by

territory and that they apply to search engines no matter where the servers are located. Second, the CJEU found that search engines are “controllers” of individual personal data within the European Union and therefore must comply with E.U. rules. Prior to this ruling, search engines like Google had been considered merely processors of online data, and therefore exempt from data protection rules in Europe. Finally the CJEU found that Europeans do indeed have a right to ask search engines to remove links to personal information about them (the “right to be forgotten”) when that information is inaccu-rate, inadequate, irrelevant, or excessive. The economic interests of the search engine to provide unfettered access to personal information did not justify interfering with the individual’s right to be forgotten and personal privacy. The CJEU also clarified that the right to be forgotten is not absolute, but would

have to be balanced against other rights and obligations such as freedom of expression, freedom of the press, and the broader public interest. For instance, the CJEU’s ruling did not require the newspaper to change any of the pages in its archives. The original auction notice remains. In other cases, the public has an interest in ensuring that convicted criminals not be allowed to escape their criminal records, which are public records in most jurisdictions. Rather than a blanket right granted to whomever applies to have informa-tion removed from search engines, instead the CJEU required a case-by-case assessment that examines the type of information, its potential for harm to the individual’s private life, and the interest of the public in having access to that information. Also, for “public figures,” those who have thrust themselves into public roles, such as politicians, celebri-ties, or business leaders, the public interest in knowing may trump the private interest in being forgotten. In February 2016 the French data protection authority fined Google $111,000 for not deleting web search results worldwide, rather than simply the E.U. In 2017 Google appealed the fine, and the matter is under judicial review.

As of October 2017, Google said it had received over 720,000 requests from people who wanted, in aggregate, 1.89 million links to online information about them removed, and that it had removed about 43% of those links based on internal guidelines that they have developed. However, the process has proved to be problematic. Google has been criticized by various European privacy regulators for its practice of informing websites that their links are being removed from its search results, noting that this may result in even more attention to the links. Other critics complain that the decisions should not be left in the hands of a private company. In 2016, in response to a ruling from France’s data protection authority, Google

began filtering delisted links across all of its domains, even its flagship Google.com domain, when searches originate within Europe. Previously, Google had enforced the right to be forgotten only on search results from European domains, allowing residents from European countries to simply use Google’s .com domain to obtain information and links that had been purged from searches on its European domains, like Google.co.uk and Google.fr. Microsoft followed suit with its Bing search engine several months later, hoping to avoid potential hefty fines and penalties. Google is appealing the ruling, arguing that one country’s rulings should not apply to a country globally and in 2017, the CJEU agreed to hear the case. As of October 2017, a date for the hearing had not yet been set. The reactions to the CJEU’s rulings and France’s efforts to extend the right to forget beyond the boundaries of Europe reflect a deep digital divide between Europe and the United States when it comes to privacy and the balance between managing personal information (privacy) and freedom of expression and the press. In Europe, many nations celebrated the ruling as a victory over arrogant U.S. Internet companies and their cava-lier attitudes towards user privacy. U.S. newspapers and technologists emphasize the importance of a free press and warn against making it possible for individuals to hide their past misdoings. There is little doubt that European views on privacy, and the idea that data belongs first and foremost to the individual, will have an impact on U.S. privacy claims and laws, especially if France’s requirement that Google remove links from all its sites around the world, not just in Europe, prevails. Ultimately, it may have an even greater impact. In the United Kingdom and the E.U.,

the concept that people have a right to control their personal information, as if it were their own property rather than belonging to the companies that collect the data, is gaining ground. For instance, in the United Kingdom, there is legislation under consideration that aims to go far beyond simply removing links in search engines, but also to give people the right to delete all their personal data related to the time before they were 18 (including social media posts, IP addresses, and Internet cookies) collected by any company, includ-ing ad agencies and data brokers, not just social networks or search engines.

1