The Internet Doesn't Forget - Can You Really Have The 'Right to Be Forgotten'?

You may have heard that the EU Court of Justice recently announced that people have the "right to be forgotten". This announcement comes after a court case involving a Spanish man who originally complained to the Spanish Data Protection Agency about an old newspaper article detailing his past debts. The article was an advertisement for a property auction that was held in 1998 to cover the man's debts and, according to him, was no longer relevant and should no longer be linked to from searches of his name. After it was originally ruled that Google must remove the article link from its results, Google challenged the ruling and the case made its way to the EU's top court, the EU Court of Justice, which yesterday announced its ruling.

According to the ruling, Google can now be required to remove data that is "inadequate, irrelevant or no longer relevant, or excessive [...] in the light of the time that has elapsed." Viviane Reding, the EU Justice Commissioner, called the decision a "clear victory for the protection of personal data of Europeans." The case is very interesting because the court deemed Google the "controller" of information and put the responsibility of removing unwanted online information on them, not the source of the information, which in this case would have been the newspaper who published the article. Google had previously argued it was only hosting the data and that it was up to the individual websites to remove the data, but the judges disagreed saying, "an Internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties." Basically they are saying that since Google makes it so easy to find information that is outdated or inaccurate, it is their responsibility to remove the information, even if the source doesn't have the same obligation.

Google called the ruling "disappointing" for "search engines and online publishers in general" and went on to say how surprised they were that the ruling differed so dramatically from the advocate general's opinion. The advocate general's had previously stated that he believed "an Internet search provider is not a 'controller' of personal data on third-party source web pages." The advocate general went on to outline the reasons why he doesn't consider search engines to be "controllers", pointing out that search engines are "merely supplying an information location tool [and do] not exercise control over personal data included on third-party web pages." He concluded that, "a national data protection authority cannot require an Internet search engine service provider to withdraw information from its index" with the exception of two scenarios, neither of which are "pertinent for the present preliminary reference."

This case comes two years after the EU Commission proposed a law that says people should have the "right to be forgotten" online. The law aims to allow people the ability to request that online data about themselves be deleted. It would be an update of the 1995 Data Protection Directive, which Reding says is from the "digital stone age." The Directive says the EU's member states have an obligation to ensure personal data is accurate and up to date for its citizens, though it does not specifically apply to Internet data. The proposed law still needs acceptance from the EU's 28 member states, so it is unclear what affect this case will have on it, though it is bound to have some impact. Not surprisingly, many tech firms, including Google, have expressed their concerns with the law, but they aren't the only ones. The UK's Ministry of Justice said the law "raises unrealistic and unfair expectations."

This case is just one of many similar cases with requests for Google to remove personal information from search results. If people are allowed to make these requests by law, this could add a lot work for Google and other search engines. In addition to the possibility of receiving many of these types of requests, they will be left to try and figure out which requests are reasonable while trying to balance privacy rights with freedom of speech. We can assume the proposed law will provide guidelines, but what we don't know is where the line will be drawn between privacy and censorship.

Post by Robyn Norgan