The Court of Justice for the European Union has upheld the EU’s “right to be forgotten” (PDF) on the Internet, ruling against Google in a case brought by a Spanish man seeking to have links to a 1998 newspaper article about past financial troubles removed from search results. The case is being heralded as a victory for individual rights on the Internet; at the same time, it could significantly complicate business for online companies, and raises significant questions about freedom of expression.
Briefly, the EU right to be forgotten is not the same as a right to privacy. Privacy concerns information about an individual that was never public, while the right to be forgotten concerns information that was once public, but is no longer occurring. The idea is to let people delete old or irrelevant information about themselves. That way, a newspaper story about a bank auctioning a foreclosed home — or a revenge Web site filled with particularly embarrassing pictures — doesn’t pop to the top of search results every time someone searches for a particular name for all eternity. If search engines or other service operators don’t comply with valid removal requests, individuals can take them to court.
In this particular case, Google argued that it was not holding personal data on the plaintiff: it was merely pointing to a factual article in a Spanish newspaper. However, Europe’s highest court disagreed, finding Google was processing the plaintiff’s personal data by indexing and serving search results, and thus the plaintiff could go to Google to have it removed.
Note that the plaintiff did not (and cannot) request the original newspaper article be deleted under the right to be forgotten. That’s a rather narrow definition of “forgotten” — it’s not that past public information would actually disappear from the Internet, just that it would become much less public.
The decision opens a can of worms for Internet companies doing business in the EU. Right now, there is almost no legal guidance on what sorts of takedown requests are valid, and how Internet companies must validate and act upon requests. This could create opportunities for abuse, perhaps with unscrupulous individuals wreaking havoc on others’ Internet histories with fraudulent takedowns. Similarly, brokers will almost certainly offer services to continuously monitor (and scrub) users’ Internet histories from all manner of search engines, archives, and social media sites. The costs of complying with the right to be forgotten could make doing business in the EU more complicated and expensive for companies like Google, Facebook, Twitter, and Amazon, not to mention social startups hoping to get off the ground.
Also uncertain is how Internet companies would deal with the ever-shifting nature of Internet content. Let’s say Google scrubs its search results to remove the link to the article about the Spanish man’s financial troubles. Google could presumably avoid indexing that particular page again, but what if someone else were to write a blog post about it and Google’s Web robots were to index that? Or if the Spanish newspaper were to change its format, be acquired, or otherwise serve content in a manner Google wouldn’t recognize? And if social media sites were required to scrub their archives too, what would happen if someone tweeted or posted material covered by a previous takedown?
Adding even more complication, the EU right to be forgotten is currently a “directive,” meaning each EU member state decides how to implement it. The EU Commission is currently pushing the Data Protection Regulation, which would be the same throughout the EU. That might happen by the end of 2014 (PDF), but my contacts describe that date as “aspirational” at best.
Will a right to be forgotten come to the United States? Probably not in the same form. In the EU version, companies might be required to take down information about individuals regardless of the source, which could impinge on freedom of expression or (in practice) even be difficult to distinguish from censorship. If the U.S. were to move ahead with a right to be forgotten, it would likely apply only to material people post themselves. California may have taken the first step with a new law enabling minors to delete old Internet postings that are embarrassing or even career-limiting: the law goes into effect in 2015.