On May 13th, the European Court of Justice ruled on the case between the Spanish citizen, Mario Costeja González and Google Spain, regarding the Spanish Data Protection Authority requests for the search engine to withdraw personal data relating to Mr Costeja González from its index and to prevent access to the data in the future.
This court ruling has been portrayed as the establishment of online censorship. Indeed, the very concept of the “right to be forgotten” has long been a sore spot for many who fear that privacy would be used to remove legitimate speech from the web. However, a closer reading of the Court’s ruling leads to a substantially narrower outcome. Indeed, nowhere in the ruling does it say that Google has to “deindex” or “completely remove” search results. Here are the three things you should keep in mind when discussing this controversial ruling.
What does the court ruling say?
1. Search engines will neither be deleting nor de-indexing information
Immediately after the ruling, press reports (e.g. here and here) reported that Google would now be forced to “remove,” “delete,” or “de-index” online content, leading to fears that legal content would be “wiped” from the web.
However, the CJEU never asked search engines to de-index information but “to remove [it] from the list of results displayed following a search made on the basis of a person’s name links to web pages” (our emphasis added). Asked about this point at a public event in Brussels on June 5th, Google said that indeed it will not de-index any information, contrary to what has been announced in the press.
Through its new online form created to implement the ruling, Google will first request citizens to provide the links to the information they would like removed from a search based on their name. The information will not be removed from the web or the link de-indexed, Google will only alter the search result on the basis of the person’s name for the contentious link to not appear.
2. This ruling isn’t actually about the “right to be forgotten”
This court ruling is based on the interpretation of the 1995 Data Protection Directive’s right to erasure and right to object, as this piece of legislation does not include any so-called “right to be forgotten.” The proposed new Data Protection Regulation includes a so-called “right to be forgotten,” which was renamed “the right to erasure” in the text that passed the European Parliament in March 2014.
The proposal allows users to have information about them deleted by companies or governments (so-called “data controllers”) when it is no longer needed. However, this right to erasure included in Article 17 only asks for the deletion of a user’s own personal data, not third-party links or publications.
Article 17 has long been a controversial and highly misunderstood aspect of the data protection reform package. The Data Protection Reform has been the object of some of the heaviest lobbying Brussels has ever seen, both by the US government and major internet companies. While the Data Protection Regulation is still to be concluded and is currently being considered by the European Council, any misunderstandings about the content of the ruling and the interpretation of present and future EU privacy rights could be used to undermine the EU data protection reform effort.
It did not take long for the UK representative, known for being one of the countries deterring progress on this reform, to take advantage of this strategy. During a June 6th Council meeting, the UK expressed concern that despite two and a half years of work on this file, the Council was progressing too fast and asked for a thorough review of the definition of the right to be forgotten.
3. Google de-indexes and alters search results for other purposes
There is an important point to be addressed as to the wisdom of the Court to leave it in Google’s hands to assess whether a complaint should be upheld or not, putting them in a position of “balancing” rights on content over which they are not the original publishers of, without providing any type of guidance. This is, and remains, one of Access’ primary concerns with this ruling. Any determinations about the availability of content online should be determined by a competent judicial authority; private companies should not be in the position of playing judge, jury, and executioner over the availability of information online.
Nevertheless, as Google and other companies will not have to delete information to comply with this ruling, it is important to remember that Google in fact does remove content, de-indexes links, and otherwise alters search results for a wide range of purposes. Google indeed de-indexes information based on domestic US copyright law, the Digital Millennium Copyright Act, which it applies internationally. It also maintains an agreement with the White House to take punitive action globally, outside the rule of law, against online services suspected of breaching US intellectual property law.
Google also removes information for the Internet Watch Foundation in order to take down child abuse content from the web and has several other ad hoc arrangements at national level to remove content without any judicial oversight.
It should be noted that there are numerous documented cases of content removals on the basis of alleged copyright infringement and child abuse being overly broad leading to the unnecessary and unlawful blocking of online sites. Given that the CJEU ruling doesn’t actually require the removal of content, but rather the alteration of search results for searches based on an individual users’ name, this ruling appears far more limiting in impact than these other existing arrangements.
Next steps
While the court decision might not be perfect, the scope of the ruling is much more narrow than what has been reported. This CJEU ruling is about providing individual with greater control over their fundamental right to data protection and privacy, and not about establishing online censorship.
In late June, Google started implementing this court decision on a case by case basis. The company has been notifying newspapers when information on their websites was being removed from specific search results, leading to further confusion regarding the search engine’s obligation under the CJEU ruling.
As the mechanism used by the company to assess the request is still unclear, Access strongly encourages Google to work closely with the relevant data protection authorities and working parties in order to ensure full compliance with the current privacy framework in the EU.