privacy-google

What is the “Right to Be Forgotten” movement all about?

It is the belief that people should have the right to have personal information about themselves removed from the internet (where it is publicly accessible), especially if  that information is incorrect or out of date.

This movement started in Europe:

the intellectual roots of the right to be forgotten can be found in French law, which recognizes le droit à l’oubli—or the “right of oblivion”—a right that allows a convicted criminal who has served his time and been rehabilitated to object to the publication of the facts of his conviction and incarceration.

The movement has since culminated in a landmark ruling by the European Court of Justice (ECJ) that requires Google to remove information about a Spanish man, Mario Costeja González:

[Mr. Gonzalez] complained about some pages originally published in January and March 1998 in a Spanish newspaper (and later republished on the internet) which announced a government-ordered real estate auction following attachment proceedings to recover social security debts that he owed.

He argued that the newspaper and Google should remove the information about the auction, which came up prominently in searches on his name, because they infringed his right to privacy – they weren’t relevant to his situation today.

The ECJ ruled that the paper can leave the information on its website, but that Google has to remove the links to those pages from its index.

So what does the law actually say?

Europe’s highest court ruled that a person who wants some of his or her personal data erased can demand so from a search engine.

a search engine like Google has a responsibility to delete links concerning personal information upon request as long as that information is not relevant or in the public interest.

What about free speech and freedom of the press? Isn’t that censorship?

The search engine must remove the links even if the original source of the information, in this case the newspaper, doesn’t have the obligation to do the same.

The court’s ruling treats Google as a data processor, not a part of the press:

Because the newspaper gets the protection of being “media” under European data protection law (which offers various protections and exemptions for journalistic work). Google has explicitly opted out of being described as a “media” company.

But the judges decided that because Google collects lots of data and then processes it, and that that data includes information about people, it is a “data controller” under the meaning of the EU data protection directive. “Data controllers” have special obligations in the EU – including the responsibility to remove data that is “inadequate, irrelevant or no longer relevant”.

What about other search engines, are they affected as well?

Yes, other major search engines, like Microsoft’s Bing, and Yahoo are affected, but only if they do business in Europe:

smaller sites (for example the US-based DuckDuckGo) aren’t affected, because they don’t have any operations outside the US, though you can get their services in Europe.

Google was the test case here because Google is so dominant in search in Europe. And this is an important decision because it recognises that it is search engines – and in Europe, Google is the most popular of those – which decide what is known about you.

Does Google have to comply with every removal request?

The ECJ’s ruling is final, and it cannot be appealed, but that doesn’t mean that every subsequent removal request will be valid:

Decisions on whether information should be removed from search engines depend “on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life”.

In other words, Google — and other search engines affected by the ECJ’s recent decision (you can read the full text of it here) — must consider the request, but they don’t have to agree.

The Court points out that the data subject may address such a request directly to the operator of the search engine (the controller) which must then duly examine its merits. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.

Who has the right to be forgotten?

This ruling only affects personal data of people from the European Union, it does not apply to people living in other countries. It also does not apply to public figures, like government officials and possibly celebrities.

 The ruling seems to give search engines more leeway to dismiss take-down requests for links to webpages about public figures, in which the information is deemed to be of public interest. But search engines may err on the side of caution and remove more links than necessary to avoid liability

So, how do I exercise my right to be forgotten?

You have to contact the search engine yourself, and hope that they agree:

The court said people should address any request for data to be removed to the operator of the search engine, which must then examine its merits.

What happens if I submit a request for removal, but the search engine doesn’t agree?

Then the case should be referred to a local judicial authority:

It will be difficult for Google to pick and choose which requests it will honor, said Eduardo Ustaran, a lawyer who specializes in privacy law in London.

If it rejects a request, “regulators in each member state would then have to fight in the citizen’s corner,” Ustaran, author of The Future of Privacy, said. “How are they going to deal with what could become tens of thousands of requests?”

If Google complies with my request and removes my data, is it completely removed from the internet?

No, and this is a crucial detail. If you request that Google remove a link to some personal information about you, and they comply, then they will prevent that search result from showing up in response to searches for your name. That does not mean, however, that Google will stop showing that result for other relevant searches that do not include your name.

Even if you are successful in having Google completely purge a result from their index, then it may still be possible for others to find the information using a different search engine; Google’s search engine is by far the most popular, but it is still only one of many ways to find information on the internet. So, your next step should be to request removal from as many search engines as you can.

Successfully removing your personal data from all of the major search engines will make it much less likely, but not impossible, that someone will be able to find the personal information when searching for you. That is because Google and other search engines are merely linking to content that is typically hosted elsewhere by another company (for example, a newspaper article that shows up in Google’s results is probably being hosted by the newspaper itself). Those companies are not impacted by the new law (especially true for the press), and are not required to remove your information. So, even if you remove your information from search engines like Google, a determined sleuth may still be able to track it down. Some critics of the new law are worried that this will create a false sense of security.

How does a European court have the authority to regulate an American company like Google?

Google is based in Mountain View, California, but they have operations in Europe as well. The court used Google’s advertising sales presence in Spain as part of reasoning

The ECJ combined the search function undertaken in the US with the advertising sales function undertaken in Spain – the activity that makes the search function economically viable – as one “inextricably linked” set of activities to find that Google Inc. were processing individuals’ personal data in the “context of an establishment” in an EU member state. This approach confirms that courts will look through attempts to structure personal data processing operations to avoid the application of EU data protection laws. Businesses based outside the EU, particularly with sales agencies in the EU, that collect personal information about EU residents should therefore review any prior determination that their processing activities fall outside the EU jurisdiction.

Will there ever be a right to be forgotten in the United States?

Probably not, because of the way the First Amendment of the United States Constitution is typically interpreted. Also, leaders in the tech industry have been very vocal in their dissatisfaction with the ruling:

Wikipedia founder Jimmy Wales has criticised the ruling, calling it “astonishing” while free speech advocates at The Index on Censorship said the court’s ruling “should send chills down the spine of everyone in the European Union who believes in the crucial importance of free expression and freedom of information”.