The right to be forgotten: from Spain to Luxembourg and beyond

Last Friday, during a Google Advisory Council meeting in London, freedom of expression activist Article 19 once again expressed its concern over the recent decision on the right to be forgotten, and the implications of this decision.

Article 19’s submissions reflect the concerns that other organisations, including civil society representatives and civil liberties activists, have. The right to be forgotten seems like a double-edged sword: on the one hand, the reassurance that links to our irrelevant pasts may now be removed from search results has created a difficult challenge for search engines; on the other, the process is mired with concerns about freedom of expression and press freedom. To date, since 29 May 2014, Google has removed over 175 000 URLs.

The Costeja judgment

In Diplo’s September IG webinar on data protection and the right to be forgotten, Ms Nevena Ruzic from the Council of Europe explained the developments leading up to the judgment from the Court of Justice of the European Union in Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, delivered on 13 May 2014.

Ms Ruzic, who heads the Compliance Department at the Republic of Serbia Office of the Commissioner for Information of Public Importance and Personal Data Protection, explained how four years ago, in 2010, Spaniard Mario Costeja González’s request for the removal of content from a website was turned down, while his request for the removal of the links from Google search results was upheld by Agencia Española de Protección de Datos (AEPD) the same year.

When proceedings were initiated, the opinion of the Advocate General was sought. In 2013, AG Niilo Jääskinen opined that despite the EU’s Data Protection Directive (95-46-EC) being applicable to Google, the company could not be considered a data controller for the purposes of the same directive.

Ms Ruzic explained that in reaching its judgment, the Luxembourg-based Court of Justice of the European Union took into consideration three issues (in addition to the AG’s opinion and to those of the governments of Austria, Greece, Italy, Spain, and Poland):

1. Applicability. Was the Data Protection Directive applicable to this particular case, i.e., could Google Inc. be regarded as being subject to the European Union’s Acquis Communitaire? The Court decided that the directive was applicable to the company, agreeing with the AG’s opinion.
2. Definitions. What was Google’s capacity in this particular case: the controller, the processor, or the recipient? Disagreeing with the AG’s opinion, the Court decided that Google was a controller.
3. Remedy. If the directive was applicable to Google, and if under said directive Google was considered a controller, what should have Google done? The Court concluded that search engines including Google should remove search results, under specific guidelines set out in the judgment.

The aftermath

The judgment was met by mixed reactions. Most notably, as Ms Ruzic explained, one of the biggest concerns was the impact on freedom of expression, freedom of speech, and freedom of the press. For example, search engines were being placed in a ‘gatekeeper’ position of having to decide what information was ‘adequate, relevant or no longer relevant’ before proceeding to remove URLs from search engine results. In addition, the process of removing URLs could be taken advantage of to the detriment of freedom of the press.

The concerns do not stop there. Although the right to be forgotten creates a reassurance, the practicalities of removing results are more complicated. If a request for the removal of URLs linked to a particular name is upheld, what about nicknames, or variations of the same name?

And is the so-called right to be forgotten generating a false reassurance, when in reality, it is a right to be delisted from a search engine’s results, Ms Ruzic asked.

The concerns over the judgment and its implementation are being discussed in a number of forums. Google has set up an Advisory Council on the Right to be Forgotten, which is currently holding consultations in Europe, and is inviting contributions from government, business, media, academia, the technology sector, data protection organisations, and other organisations with a particular interest in the area. 

At EU level, the Article 29 Data Protection Working Party (WP29), an independent advisory body set up under the Data Protection Directive, has been in consultation with stakeholders on the implementation of the judgment. In its latest update last month, WP29 said that ‘it was decided to put in place a network of dedicated contact persons in order to develop common case-handling criteria to handle complaints by the data protection authorities.’

Ms Ruzic explained that in reply to WP29’s questionnaire analysing how search engines were complying with the judgment, Google emphasised several challenges, including: How should search engines treat court judgments in requests for the removal of URLs? While it is easy to distinguish between media representatives and non-media representatives, what about citizen journalists? How should political speeches be tackled? In addition, the judgment remained silent on timeframes. Within which timeframe should a search engine respond to requests?

There are no easy answers to these questions. As Google points out, this obligation is a new and difficult challenge, one which is currently being handled on a case-by-case basis to weigh our right to be forgotten with the public’s right to information. The key is to strike the right balance.

The full recording of the September webinar is available here:

Join our IG webinars mailing list to receive announcements and updates. The IG webinars archive is available here.