Individual privacy rights “override” Internet users’ right to free expression and access to true, public information. This was the problematic ruling by the Court of Justice of the European Union (CJEU) on 13 May 2014, in a high-profile case between Google and AEPD, the Spanish data protection authority, that dealt with the right of an individual to require a search engine to cease returning results that include factual public information about him. The ruling seems to be an almost 180-degree turnaround from the opinion of the Advocate General from June 2013. That opinion gave a clear account of why an overly broad “Right To Be Forgotten” could be detrimental to free expression and access to information.
The case pits two fundamental sets of rights against each other: privacy and free expression. Each is indispensable, and therefore the balance between them is crucially important to get right. We applauded the Advocate General’s Opinion for the way it handled this balance, but the Court’s ruling ignores its conclusions in important and problematic ways.
The Court lays down the principle that the data subject’s rights override the interests of Internet users at large: protection of personal data trumps access to information – even true, public information that is lawfully published online. The court concedes that the balance of interests may depend on a range of factors, including the role played by the data subject in public life, the nature of the information, the length of time since its publication, its sensitivity to the private life of the data subject, and the interest of the public in having that information.
If the balance of these factors tips in the direction of the individual’s privacy interest, a search engine operator can be required to delete related search results from a query that includes the data subject’s name (but apparently not other queries). Importantly, this applies to information that is publicly available (on a news website, for example), lawfully posted, non-libelous, and completely accurate.
Skewed incentives will likely lead to search engines operators erring on the side of removing content.
Search engine operators – a category of services that remains to be defined – will be tasked with making the judgment as to when the conditions for suppression of results are met. Here lies a major concern for access to information and free expression. Search engine operators will be faced with determining whether personal information is now “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine.” These are highly fact-dependent determinations, and would require the search engines to engage in a careful balancing of the rights of multiple users – a time- and resource-intensive prospect that bears no upside for the operator.
Skewed incentives will likely lead to search engines operators erring on the side of removing content. If they delete a link, there’s no consequence (other than the suppression of truthful information). On the other hand, if they continue to make the information available, they may face costly and lengthy legal disputes, and possibly fines. It would hardly be shocking for impacted companies to choose to preemptively self-censor even before they receive a complaint, and to suppress true, public, lawfully shared information from easier public access, to avoid costs and uncertainty.
The court clearly states that if the individual is not happy with the search engine’s decision – if the search engine decides that the public interest in access to that information outweighs the individual’s privacy interest – the individual can appeal to data protection authorities, and ultimately the courts. How these authorities will settle these cases, and what precedents will be set, is anybody’s guess. The CJEU gave little guidance for determining when a person can assert this right to demand search-engine-forgetting, though some EU countries have national “right to be forgotten” laws on the books already. And the task of determining when true public information about a person is “no longer relevant” enough to be returned as a result to a search query is likely to yield highly variable interpretations from operators, authorities, and courts.
We may find that a search initiated in Germany turns up different results than the same query entered in France or the UK.
Judging by EU Member States’ rather different approaches to data protection policy and enforcement, there are likely to be wide differences in how the rules are interpreted, and outcomes will vary from country to country. It is not clear how online services with a global reach will be required to implement these decisions. We may find that a search initiated in Germany turns up different results than the same query entered in France or the UK. And the ruling may have consequences outside EU territory, if search providers take the cautious route and suppress contested links globally. If search engine operators don’t take this global gag approach, we may see European citizens taking up the same clever circumvention techniques that dissidents in authoritarian regimes use to access information that falls afoul of censorship laws. Europe should be a leader in protecting privacy while promoting free expression and access to information – it shouldn’t be lending legitimacy to or creating new regimes that sanitize, edit, and distort the information their citizens access.
Yesterday’s ruling raises a number of questions about the scope and implementation of this new “right to be forgotten” from search. It is hard to imagine that there will not be a negative impact on the richness and variety of information available to the public. While the court recognizes that some sites with a “journalistic purpose” might receive exemptions from take-down requests if a national law provides for one, journalists, academics, historians, and regular citizens alike will face the same constraints when searching broadly for information, opinion, and commentary.
But in Europe, at least, the public record is no longer open to the public.
Because the court does not define what type of operator may be the target of such demands – loosely referring to the relevant activity of search engines as “processing [that] enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet” – this decision matters not just for search engines like Google, but for anyone else engaged in the effort to organize and contextualize information across the web. In-site search on social media platforms like Twitter and Facebook, social bookmarking sites like Digg, historical repositories like the Internet Archive, and user-generated content sites like Reddit and Wikipedia – all of these and millions more sites are potentially implicated by the court’s ruling. Users of these sites, and creators of the next generation of tools to locate information online, have relied on on a free and open web that supports linking and sharing of information that has been publicly posted. But in Europe, at least, the public record is no longer open to the public.