The Right To Be Forgotten: Balancing Conflicting Rights

In a widely publicised case last month, the European Court of Justice (ECJ) applied the “right to be forgotten,” requesting that internet search engines, under certain circumstances, delist links to personal data upon request. The court’s decision establishes a contentious balance between the right to privacy and the public’s right to access to information. The ECJ left this balance to search engines to implement on a case-by-case basis. While some argue in favour of these decisions, others fear the larger worldwide implications that cases are leading to.

In the ECJ case C‑131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, the court ruled that Google was responsible for removing, from name-based search results, any links to personal information that are “inadequate, irrelevant or no longer relevant, or excessive.” This applies even where the information was lawfully published by a third party – in this case by a newspaper – and where that third party is not itself obliged to take down that information at the source.

The court applied the law under Directive 95/46 on the “protection of individuals with regard to the processing of personal data.”

A summary of the facts and the judgment can be found in the ECJ press brief.

Two other key findings by the court included that Google – this now applies to all search engines – is a “controller” under the Directive, on the grounds that it “determines the purposes for which and the manner in which any personal data are… processed.”

Secondly, the court found that Google Spain is a subsidiary of Google Inc. on Spanish territory and therefore an ‘establishment’ within the territorial scope of the directive. And the data processing by Google Search is sufficiently linked to the profitable advertising activities carried out by the ‘establishment’ in the country.

Right to Privacy and Knowledge Availability

Under the European Convention on Human Rights, a European citizen has an explicit right to “private and family life, his home and his correspondence” under Article 8. This needs to be balanced with Article 10 on the Freedom of Expression, which includes the right to receive information.

In a press release, two lawyers from Baker and McKenzie called the reasoning of the court “surprising”. The court did not undertake “a balancing exercise between the privacy rights of the data subject; the legitimate interests of Google and the rights of others to receive information,” they remarked. Rather, it concluded that the individual’s rights “override, as a general rule” the interest of the general public in having access to that information.

In the view of Richard Hill, an independent consultant in Geneva and former senior staff member at the UN International Telecommunication Union (ITU), in addressing this balance, the court “correctly applied the existing European law.”

This is not a new issue, Hill told Intellectual Property Watch. The same issue actually came up in 1890 when small photography machines became available and questions arose as to when people may or may not be photographed and whether the photographs could be published. Substantive laws “are not exactly the same in all countries,” he said, “but everybody recognises that you have the right to protect your image in some way.” And the current judgment is a step towards updating the law to strike this right balance in the context of new technologies.

Jovan Kurbalija, director of DiploFoundation and the Geneva Internet Platform, told Intellectual Property Watch: “When it comes to the European context and European human rights law it creates the right balance.” But it probably went “too far” in terms of the global context or majority global views in protecting privacy, he said, especially from the US point of view, “which has a different balance between right to privacy and other rights.”

However, in response to whether he thought this judgment is likely to be followed elsewhere, Kurbalija said the EU is “the only powerful global international body that can put checks and balances on the activities of the internet industry. What is happening in Brussels can influence not only the EU but also the rest of the world.”

“I think more countries should follow the judgment,” Hill said. “I think it is important to protect this.”

However, there has been some extent of “misinformation” surrounding this case said the Brussels-based European Digital Rights (EDRi) group in a post. The term “right to be forgotten”, contrary to what it might imply, does not mean Google is deleting data, they said.

“Simply making some information less easy to find – and only for Europeans – does not actually mean anyone or anything is forgotten,” added Nick Ashton-Hart, former representative for the Google-backed Computer and Communications Industry Association in Geneva. “Taking a reference out of Google’s index doesn’t mean it is forgotten, especially in the case of very public sources like newspapers.”

“I think it’s likely the future European directive in this area will not only enshrine what the court has said but actually probably go even a bit further” in terms of protecting personal privacy, Ashton-Hart told Intellectual Property Watch.

Google’s Role in the Balancing Process

According to the decision, following a request to remove links to websites from name-based searches, the search engine must assess whether the data subject has a right, under articles 7 and 8 of the European Convention on Human Rightsrelating to privacy, for those links not to appear.

If so, these must be delinked from the data subject’s name, unless for “particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public” of access to that information.

In response to the judgment, Google has set up a platform to assess such requests from individuals via an online form.

In this form, Google has said: “in implementing this decision, we will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information. When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information – for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials.”

This raises some “delicate” issues, said Kurbalija, regarding the role of industry in making human rights-related decisions.

However, as Hill indicated, there are two steps in the evaluation. “As a user, you can request Google to take it down, then Google either will or will not and give an explanation as to why they did not. If you’re not satisfied with Google’s explanation then you can take them to court in your national jurisdiction,” he explained. An independent review “is in the mechanism,” and he thinks this is an appropriate way of dealing with requests.

Kurbalija agrees that it should be left to the companies to deal with requests due to the sheer number of cases, but that “there should be simple and effective second level of revisiting of the decision, some sort of appellation court.”

However, Ashton-Hart disagreed. “Search engines – and any online service – cannot solve social issues, which is what this ruling would like Google to do.” The issue remains the same – in the analogue world, the information is still available but difficult to find.

“In the digital world, that same information is far more accessible, but the underlying issue remains the same, and given that it is online in the newspaper’s website and searchable (and findable) there means it is still vastly more accessible than it was in the analogue world,” explained Ashton-Hart. “The ECJ’s ruling is, at best, a Band-Aid.”

“There’s a trend in the world to ask technology to solve social problems – people solve social problems, not machines. This is definitely one of those situations,” he said.