You have the right to be forgotten

Some memories can be deadly

Everyone has something to hide. It can be something innocuous, like a mild Farmville addiction, a guilty enjoyment of the directorial efforts of Michael Bay, or an embarrassing video singing “Let It Go” in the shower. Some things can be more serious, such as a sexting session that was made public, an incriminating picture that may seriously hinder future employment efforts, information about one’s sexual orientation while living in a community that has low thresholds of tolerance. What if a link to that personal information was made available online for all the world to see? Could you have a legal recourse to remove it?

This is in a nutshell the right to be forgotten, and now the European Court of Justice has produced a landmark ruling (C‑131/12) which enacts a limited version of the right.

The case involves Mario Costeja González, a Spanish national, whose name was mentioned in some pages from the Spanish newspaper La Vanguardia detailing a real-estate auction connected with attachment proceedings for the recovery of social security debts. These pages always came up when there was a search of his name. Mr Costeja Gonzalez filed a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), seeking the removal or alteration of the pages from La Vanguardia, and he also requested Google Spain to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to La Vanguardia. The AEPD denied the request for La Vanguardia, but it was upheld with regards to Google, and required that search engine results involving Mr Costeja Gonzalez should not include the link to the offending pages. In a 2010 decision, the AEPD considered that “operators of search engines are subject to data protection legislation given that they carry out data processing for which they are responsible and act as intermediaries in the information society.”  Unsurprisingly Google appealed the ruling to the national high court (Audiencia Nacional), which referred several questions to the ECJ asking for clarification as to the application of the Data Protection Directive 95/46.

These questions can be resumed in the following postulation: are search engine operators  under an obligation to protect personal data of persons concerned who do not wish that certain information, which is published on third parties’ websites and contains personal data relating to them that enable that information to be linked to them, be located, indexed and made available to internet users indefinitely?

The ECJ decided that:

1. Search engines are to be classified as processing personal data, and therefore are to be considered data controllers.
2. As such, they will be deemed to operate in a territory if they have a branch or subsidiary that sells advertisement in that country.
3. As a data controller, the search engine will have an obligation “to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person”, even if the information displayed in that page is lawful.
4. When analysing a data subject’s request to remove links to a search result, authorities should balance the interest of the subject in accordance to her rights under the European Convention on Human Rights, the economic interest of the service provider, the role played by the data subject in public life, and the public’s interest to have access to the information.

The decision has been universally heralded by the press as the rise of the “right to be forgotten”, which is technically incorrect. The ECJ has not created a new right, it has simply applied to search engines the existing rights to rectification, erasure, blocking and objection which are present in the DP Directive. The advocate general stated as much when he comments in his opinion that “the Directive does not provide for a general right to be forgotten in the sense that a data subject is entitled to restrict or terminate dissemination of personal data that he considers to be harmful or contrary to his interests.” However, the Advocate General was of the opinion that the court should not extend these rights to search engines.

This case seems to pit privacy against freedom of speech, but in my view the ECJ has completely bypassed that discussion and has made it strictly a privacy issue. The Court comments:

“Indeed, since the inclusion in the list of results, displayed following a search made on the basis of a person’s name, of a web page and of the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person concerned and may play a decisive role in the dissemination of that information, it is liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page.”

In other words, there may be a privacy violation in a web page, but that is not important, what is important is that such a page shows up in search engine results. However, the court has left open the possibility of a case-by case appraisal by data protection authorities when asked to grant an order to remove search results:

“In the light of the potential seriousness of that interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing. However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”

As many people around the world, I am conflicted about this result. On the one hand, I oppose anything that may interfere with free access to information, and I suspect that we are about to see an abuse of these amendment orders, even if the court has specified that authorities should take into consideration the public interest aspect of the linked data.  On the other hand, I understand that there are valid reasons why a person would like some personal data not to show up when her name is searched, and that there should be a legal recourse to those whose privacy is being severely affected.

I would like to see this issue revisited after a couple of years to see how it is being applied in practice, and if the fear of abuse is justified.