The “right to be forgotten” (RTBF) is a weird term. We cannot make people “forget” things, but we can require database operators to “forget” content by deleting it or making it more obscure.

Europe has done exactly that. In Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, Case No. C-131/12 (2014), the European Court of Justice (ECJ) reached four important conclusions.

1) Privacy Directive Applies. First, the ECJ concluded that “the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference” constituted “the processing of personal data,” so as data “controllers,” search engines must comply with the 1995 European Data Privacy Directive (95/46/EC).

This conclusion represents search engine exceptionalism. Search engines are subject to the RTBF, while other online media enterprises aren’t. The court made this ruling because Google argued it wasn’t a media enterprise, presumably to navigate away from other unwanted regulatory consequences. Still, a legal distinction between search engines and other media enterprises doesn’t make sense to many folks. See Eric Goldman, Search Engine Bias and the Demise of Search Engine Utopianism, 8 Yale J. L. & Tech. 188 (2006).

2) Sales Office Confers Jurisdiction. Second, the ECJ concluded that Google’s advertising sales office in Spain meant that Google was processing personal data (its search database) within the European Union.

3) Search Results De-Indexing. The ECJ concluded that search engines must “remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person,” even if that information remains on the third party website, and even if the third party lawfully published the information.

4) Limit to De-Indexing Right. The right of people to erase search results about them “override…not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name.” However, this right can be trumped by the “preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question,” such as the person’s role “in public life.”

The court’s inscrutable language, and its failure to specify the exact grounds on which a person may request erasure of search results, baffled everyone trying to figure out exactly what the court wanted, including search engines and the data protection authorities who will hear complaints about the search engine’s decisions. Google [FN1] has interpreted this ruling to mean that individuals can ask Google to remove links to “irrelevant, outdated, or otherwise objectionable” information from search results for the individual’s name; but Google won’t de-index a search result if “there’s a public interest in the information,” such as information “about financial scams, professional malpractice, criminal convictions, or public conduct of government officials.”

Read original article


Tags: