Europe’s Highest Court Upholds Internet “Right to Be Forgotten”
The Court of Justice for the European Union has upheld the EU’s “right to be forgotten” (PDF) on the Internet, ruling against Google in a case brought by a Spanish man seeking to have links to a 1998 newspaper article about past financial troubles removed from search results. The case is being heralded as a victory for individual rights on the Internet; at the same time, it could significantly complicate business for online companies, and raises significant questions about freedom of expression.
Briefly, the EU right to be forgotten is not the same as a right to privacy. Privacy concerns information about an individual that was never public, while the right to be forgotten concerns information that was once public, but is no longer occurring. The idea is to let people delete old or irrelevant information about themselves. That way, a newspaper story about a bank auctioning a foreclosed home — or a revenge Web site filled with particularly embarrassing pictures — doesn’t pop to the top of search results every time someone searches for a particular name for all eternity. If search engines or other service operators don’t comply with valid removal requests, individuals can take them to court.
In this particular case, Google argued that it was not holding personal data on the plaintiff: it was merely pointing to a factual article in a Spanish newspaper. However, Europe’s highest court disagreed, finding Google was processing the plaintiff’s personal data by indexing and serving search results, and thus the plaintiff could go to Google to have it removed.
Note that the plaintiff did not (and cannot) request the original newspaper article be deleted under the right to be forgotten. That’s a rather narrow definition of “forgotten” — it’s not that past public information would actually disappear from the Internet, just that it would become much less public.
The decision opens a can of worms for Internet companies doing business in the EU. Right now, there is almost no legal guidance on what sorts of takedown requests are valid, and how Internet companies must validate and act upon requests. This could create opportunities for abuse, perhaps with unscrupulous individuals wreaking havoc on others’ Internet histories with fraudulent takedowns. Similarly, brokers will almost certainly offer services to continuously monitor (and scrub) users’ Internet histories from all manner of search engines, archives, and social media sites. The costs of complying with the right to be forgotten could make doing business in the EU more complicated and expensive for companies like Google, Facebook,
Twitter, and Amazon, not to mention social startups hoping to get off the ground.
Also uncertain is how Internet companies would deal with the ever-shifting nature of Internet content. Let’s say Google scrubs its search results to remove the link to the article about the Spanish man’s financial troubles. Google could presumably avoid indexing that particular page again, but what if someone else were to write a blog post about it and Google’s Web robots were to index that? Or if the Spanish newspaper were to change its format, be acquired, or otherwise serve content in a manner Google wouldn’t recognize? And if social media sites were required to scrub their archives too, what would happen if someone tweeted or posted material covered by a previous takedown?
Adding even more complication, the EU right to be forgotten is currently a “directive,” meaning each EU member state decides how to implement it. The EU Commission is currently pushing the Data Protection Regulation, which would be the same throughout the EU. That might happen by the end of 2014 (PDF), but my contacts describe that date as “aspirational” at best.
Will a right to be forgotten come to the United States? Probably not in the same form. In the EU version, companies might be required to take down information about individuals regardless of the source, which could impinge on freedom of expression or (in practice) even be difficult to distinguish from censorship. If the U.S. were to move ahead with a right to be forgotten, it would likely apply only to material people post themselves. California may have taken the first step with a new law enabling minors to delete old Internet postings that are embarrassing or even career-limiting: the law goes into effect in 2015.
Whatever else the “right to be forgotten” may be, it will make biography and history more difficult.
The intention is understandable, but the wrong folks are being asked to take responsibility for this situation. This isn't Google's problem to fix. If citizens feel that bits of ancient history being easily available on the internet are a problem, they need to address it at the sources and demand that government agencies exert a modicum of control over dissemination of public records.
Keep in mind that outside of the U.S.A., libel laws are often far more narrowly defined, making the pursuit of a libel case very difficult. Thus they serve as much less of a deterrent to malicious use of random personal info. Perhaps this is part of why Europeans are not as tolerant of easy access to one's personal history as we are in the U.S. That, or we are just a bunch of tolerant sheep.
Ars Technica has an interesting piece on what Google requires to request a takedown, along with some details about the requests that have already come in.
http://arstechnica.com/tech-policy/2014/05/googles-right-to-be-forgotten-response-is-disappointingly-clever/