In May of this year, the Court of Justice of the European Union (CJEU) found that search engines have an obligation under Europe’s Data Protection Directive to remove links to pages containing personal information about Europeans when informed that this information is “no longer relevant” or otherwise amounts to a burden on the person’s data protection rights. While operators of major search engines, including Google and Microsoft, have announced plans for complying with this new obligation in Europe, the CJEU opinion contains little in the way of clear guidance for these companies as they attempt to develop procedures that respect both the privacy and free expression rights of their users.
This week, the Article 29 Working Party, an advisory body that includes officials from EU Member States’ Data Protection Authorities, met with representatives from the major search engine operators to discuss the implementation of the CJEU opinion. Below is the letter CDT sent to members of the Article 29 Working Party, urging them to provide clear and consistent guidelines for responding to link-removal requests and to develop procedural safeguards to prevent these “right to be forgotten” mechanisms from being abused. Courts and data protection authorities — not companies — should be making these crucial decisions.
25 July 2014
Chair, Article 29 Working Party
Dear Ms Falque-Pierrotin,
We are writing with regard to the Court of Justice of the European Union’s decision of 13 May, regarding search engines’ obligation to remove links to information lawfully posted online, which we believe will have serious adverse consequences for free expression. The Center for Democracy & Technology is a civil society advocacy organization that promotes the privacy and free expression rights of Internet users. We have been following closely the European debate around the right to be forgotten – and the balance it must strike between the fundamental rights to privacy and freedom of expression. In our writings on the issue in the context of European data protection legislation, we have stressed the need for such a rule to be clearly and narrowly defined, and strike a delicate balance between the fundamental rights at stake. We have also pointed to the complexities and difficulties in applying such a rule.
The CJEU’s decision has required search engines to engage in careful balancing of the rights to privacy and freedom of expression when responding to removal requests, but companies are not well placed to make the difficult and delicate judgments that are necessary to ensure that fundamental rights are protected. However, the CJEU opinion gives little concrete guidance to search engine operators; as we noted following the decision, key concepts of the ruling are vague and difficult to operationalize. It is the responsibility of governments, including the courts and the Data Protection Authorities, to provide clear guidelines to the companies charged with implementing the CJEU’s decision.
We understand that the Article 29 Data Protection Working Party met with representatives from major search engines on July 24th to discuss the practical implementation of the principles that underlie the CJEU decision. As the WP29 develops further recommendations on this matter, we urge you to consider the following suggestions:
- WP29 should articulate clear and specific guidance so that search engines may comply with the court’s decision in a consistent manner that puts the least possible burden on freedom of expression.
- WP29 should further develop the oversight and accountability procedures that must accompany any content takedown regime, including opportunities for the authors of content to appeal decisions to remove links to their work.
- Accordingly, WP29 should advise search engines that they may inform news outlets and other speakers when their content has been removed from search results pursuant to a removal request. WP29 should carefully consider the role that transparency can play in ensuring that link-removal mechanisms are not abused, and should advise search engines that they may identify when search results have been altered by removal requests.
- Finally, we hope that the WP29 can work to ensure that the Data Protection Authorities of each Member State are committed to fulfilling their role as the regulatory authorities best situated to responding to takedown requests.
These are challenging, yet crucial, issues that must be addressed in a careful manner that respects free expression and free press values. CDT would welcome the opportunity to further engage with the WP29 on these important issues.
President & CEO, Center for Democracy & Technology
 E.g., “On the Right to Be Forgotten: Challenges and Suggested Changes to the Data Protection Regulation,” https://www.cdt.org/files/pdfs/CDT-Free-Expression-and-the-RTBF.pdf (2 May 2013).
 Jens-Henrik Jeppesen, “EU Court: Privacy Rights Trump Free Expression and Access to Information,” https://cdt.org/blog/eu-court-privacy-rights-trump-free-expression-and-access-to-information/ (14 May 2014).