The European Right To Be Forgotten Might Be A Pandora’s Box

Over the last few months, search engines around the world have been keeping an active eye on the developments of the landmark case ruled by the European Court of Justice (ECJ) requiring Google to consider individuals’ requests to remove links that they say infringe on their privacy.

While this right to be forgotten is now recognised as a European general principle by the ECJ, fears exist as to the larger worldwide implications, especially for search engines as well as the public’s right to access to information.

A summary of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González case can be found in “The Right To Be Forgotten: Balancing Conflicting Rights” published by Intellectual Property Watch.

Larger Implications For Search Engines

One of the most debated issues in Costejacase was the fact that the ECJ mandated Google – a private entity – “to make determinations which balance competing fundamental rights – freedom of expression versus right to privacy – and determine where the public interest lies,” said two lawyers at Baker and McKenzie in a press release.

In addition, Christopher Wolf, director of privacy and information management practice at Hogan Lovells in a recent article remarked that, “the ECJ did not provide sufficient instruction on how this right to be forgotten should be applied.”

However, Robin Wilton, technical outreach for identity and privacy at Internet Society (ISOC) disagreed. “It would be much harderto issue such precise guidelines” and “this may come down to jurisdiction differences,” he told Intellectual Property Watch.

Richard Hill, an independent consultant in Geneva and former senior staff member at the UN International Telecommunication Union (ITU), recalled that, “the ECJ gives preliminary rulings,” i.e., “it settles some principles which courts need to apply in the future.”

In the view of Jovan Kurbalija, director of DiploFoundation and the Geneva Internet Platform (GIP), “the principle is adopted now,” however, “how to do it in an efficient way” remains a major challenge, he told Intellectual Property Watch.

A recent New York Times article said Google had already received over 50,000 requests (now likely much higher according to sources) to take down personal information from its searches, of which nearly a third is related to violent crimes or child porn arrests, said The Telegraph in London.  [Update 3 July: According to The Independent, Google has now received over 70,000 requests.]

In terms of technological development, whether the right to be forgotten could transform the EU into what Kurbalija calls “the third world of the digital world,” should be considered too.

As illustration he explained that “only big players on the market like Google or Facebook can handle such complex legal cases,” which may prevent the development of future start-ups seeking to provide information online in EU.

On the other hand, Wilton claims “it is not be a bad thing” that companies should take on this responsibility, “bearing in mind what internet does these days – it allows very small organisations, even one person company to have an impact which is disproportionate to their size.”

Taking Down Copyright Infringing Content for Years

In a similar vein, Google last month received over 5 million requests to take down URLs on grounds of copyright infringement, according to its online statistics.

In fact, on the basis of US Digital Millennium Copyright Act (DMCA), Google has already deleted hundreds of millions of search results globally. More recently, it concluded an agreement with the White House to take punitive action globally, outside the rule of law, against online services suspected of breaching US intellectual property law, the European Digital Rights (EDRi), an international advocacy group based in Brussels said in a post.

However, “oddly” said EDRi, these common activities have never received the same level of attention.

Following the same approach, the High Court of Parislast year in the Association of cinema producers, Syndicate of digital video editors, and others v. Yahoo, Bouygues Telecom, Free, Google, and others case ordered Google, Microsoft and Yahoo to completely de-list 16 video streaming sites from their search results in order to protect the copyrights of film producers.

While some argue “if we can create a takedown system for Hollywood, we can create one for you,” for others such as Kurbalija, the Costejacase concerns “identity, integrity and personal issues, which are more complex than intellectual property.”

Threats Hanging Over Our Right to Access to Information

While Google accounts for over 3.5 billion searches per day across the world, the unprecedented ECJ’s rulings brings concerns with respect to the right to access to information for its European users.

As Nick Ashton-Hart, former representative for the Google-backed Computer and Communications Industry Association in Geneva told Intellectual Property Watch: “It is not forgotten vis-à-vis the Google index for all people, just Europeans, unless Google decides to remove it for all searches everywhere.”

However, recently the Supreme Court of British Columbia (Canada), relying, in part, on the Costeja case, ordered Google in the Equustek Solutions Inc v. Jack case to remove certain links in the search results from its global entire database, “requiring that no one, anywhere in the world, can see the search results,” explained Michael Geist law professor at the University of Ottawa in his blog.

“While the Canadian case [deals] with the sale of counterfeit products, rather than privacy, it embraces on the same logic to make its sweeping censorship demands,” Zachary Graves, director of digital marketing and a policy analyst at the R Street Institute, a non-profit public policy research organisation based in Washington DC, said in a recent post.

“The implications of the case are enormous,” said Geist, “since if a Canadian court has the power to limit access to information for the globe, presumably other courts would as well,” adding that “the possibilities are endless since local rules of freedom of expression often differ from country to country.”

Search engines may also avoid publishing certain types of information and err on the side of removing links to ambiguous cases when challenged in order to save high costs of trials or penalties, said Wolf.

As Google argued in its defence, such orders that affect search engines worldwide put them “in the impossible situation of being ordered to do something that could require it to contravene a law in another jurisdiction.”

In 2000, for instance, the High Court of Paris in Yahoo! Inc. v. LICRA case ordered Yahoo.com to remove all the sale of Nazi paraphernalia on its internet auction service on the basis of a French law. However, according to the First Amendment of the US Constitution relating to freedom of expression, this order could not be enforced in the US.

Thus, allowing any country to leverage privacy or other legal claims to limit search engine content globally “creates a dangerous precedent for continued balkanization and fracturing of the web,” said a Wall Street Journal editorial.

While internationally accepted rules relating to the right to be forgotten and privacy could address this issue of legal fragmentation of the internet, Kurbalija, for one, “is not optimistic” about achieving international consensus in these areas.

The Future General Data Protection Regulation

In January 2012, the right to be forgotten and to erasure had already been at the heart of the discussions under Article 17 in the Commission’s proposal for a new General Data Protection Regulation (GDPR) aiming to reform the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

The proposal was strongly supported by the European Commissioner for Justice, Fundamental Rights, and Citizenship, Viviane Reding, who was quick to call the Costejacase “a clear victory for the protection of personal data of Europeans,” adding that “data belongs to the individual, not to the company,” in a press release.

In the view of Hill, “it is likely that the future European directive in this area will not only enshrine what the Court has said but actually probably go even a bit further in terms of protecting personal privacy.”

In fact, according to a fact sheet by the EU Commission, “in recognising that the right to be forgotten exists, the Court of Justice established a general principle,” adding that “this principle needs to be updated and clarified for the digital age.”

Last March, a majority EU Parliament decision endorsed the proposed GDPR, calling for “an obligation for a controller who has made the personal data public to take reasonable steps to inform third parties of the fact the individual wants the data to be deleted,” said the fact sheet. They went even further by including an obligation for the controller to ensure an erasure of these data.

Importantly, the proposed GDPR leaves no legal doubt that an international com­pany which offers services to European consumers would have to comply with these rules. Penalties of up to 2 percent of their annual worldwide turnover could be imposed in a case of non-respect of the right to be forgotten, for example.

However, the proposed GDPR still needs to jump significant hurdles before being adopted in early 2015, especially the tripartite discussions – between the European Parliament’s representatives, the Commission and the Council.

Interestingly, while “the US has a very different tradition on privacy on this stage, there is evolution too” said Hill. Eventually “they may come with a more overall approach as we have in Europe, but … it is not something which will happen soon,” he added.

Joséphine De Ruyck was an intern at Intellectual Property Watch. She is currently finishing an LLM degree in intellectual property rights and ICT law at University of Leuven in Belgium. She holds a Master’s Degree in Law with honors from University of Louvain and an LLM degree from Queen Mary University of London. She has a strong interest in several intellectual property issues, especially access to health, climate change and actual challenges faced by copyright law.

Julia Fraser was an intern at Intellectual Property Watch. She is currently training to be a solicitor and will start work at an international law firm in London in 2015. She has a BSc Honours in Biology from Edinburgh University where she developed an interest in public health related intellectual property issues.