Sophos Cloud Optix
People have the right to be forgotten online, an EU court ruled on Tuesday.
The ruling, handed down by the European Union’s Court of Justice (ECJ), went against Google in a case concerning the removal of links to two pages published in 1998 by Spanish newspaper La Vanguardia.
The court said in its ruling that under existing EU data protection laws, search engine operators must be held responsible for processing personal data that appear on web pages published by third parties, so if the subject of a search doesn’t want said data to pop up, he or she has the right to ask that they be taken down.
From the ruling:
If, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.
The case, brought by Spanish national Mario Costeja González in 2010, concerned links to two newspaper pages from January and March 1998.
The pages contained an announcement for a real-estate auction held to recover social security debts owed by Costeja González: he was in hot water financially, and his home was repossessed.
The pages were showing up in Google search years after the debts were resolved, in spite of the search results no longer being relevant, he said.
The Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) rejected his request that La Vanguardia take down the pages, given that the newspaper was within its rights to publish the information.
But the AEPD did agree with Costeja González when it came to his second request: that Google Spain or Google Inc. be required to either remove the data and links from search results or bury them.
The AEPD asked the two companies to make it happen, but Google fought back, bringing two actions before the Audiencia Nacional (National High Court, Spain) to get the AEPD’s decision annulled.
In its Tuesday ruling, the ECJ pointed out that the information a search engine returns on a person “potentially concerns a vast number of aspects of his private life” that might previously never have been stitched together in the manner that search engines conveniently do – or, at least, without a search engine, a structured overview of a person’s information could only be achieved “with great difficulty.”
And once it’s out there, it’s everywhere, the court pointed out:
The effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous. In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing.
The court noted that it was aware that removing links from results could affect the legitimate interests of people potentially interested in having access to the information.
Accordingly, the ruling held that the legitimate interests of internet users have to be balanced with the privacy rights of an individual, and that the sensitivity of given data will come under consideration in order to achieve a “fair balance” between the two.
But in a nutshell, these are the new rules of the game – at least, until opponents potentially challenge the ruling:
... the Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. The Court makes it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
Why would anybody be against the right to be forgotten? As it is, some privacy advocates are calling this great news:
With historic #Google & #dataretention judgements #ECJ takes global lead in judicial protection of fundamental rights in the digital age.
— Paul Nemitz (@PaulNemitz) May 13, 2014
In a Facebook post, EU justice commissioner Viviane Reding called the court decision a clear victory for the protection of the personal data of Europeans:
The ruling confirms the need to bring today's data protection rules from the 'digital stone age' into today's modern computing world.
The decision apparently preempts lengthy negotiations within the EU over a new data protection directive which could establish a limited “right to be forgotten”.
In fact, the EU judges made clear they interpreted the EU data protection directive as having already established a “right to be forgotten”.
Google referred to those prior negotiations in a statement that said the ruling is “disappointing” for search engines and online publishers in general, that it differs “dramatically” from the advocate general’s opinion and the warnings and consequences that he spelled out, and that the company needs time to digest the implications.
As The Guardian’s James Ball points out, the idea of “putting the genie back into the bottle” when it comes to search results is attractive, but the reality is going to be a “quagmire.”
Some of the issues that could arise:
- The ruling affects Google because it’s got an established operation in Spain, but search engines based in the US will likely be covered by the First Amendment, which could protect them from being forced to restrict search results.
- A slew of questions, such as: Does it matter if the subject is a celebrity or a politician? Who determines the shelf life of data? Do people have a right to bury heinous crimes, such as murder? What if a person runs for office after hosing down their search results?
The right to be forgotten is obviously a complicated issue. It pits individuals’ privacy rights against the rights of internet users to have access to uncensored information.
What do you think – privacy win or quagmire? Please share your thoughts in the comments section below.
I strongly believe the EU Courts ruling against Google seemingly, in part at least, establishing a persons “right to be forgotten” online is not in the public interest. In my experience publishing and circulating evidence of a person’s (and or corporation’s) wrong-doing is a very effective and cost-effective means of correcting wrond-doing.
In other words, this is your livelihood… you make money from the information that’s “out there”… regardless of how it got there?
Completely agree with Bryan. Furthermore in this case the information was true and published in a respected media. Not only that, the information was from newspaper pages from 1998, so anybody finding it knew that it was old.
Or in other words, they Court is impeding us the possibility to judge by ourselves the relevancy and accuracy of the information we find in the web (and yes, people have the right to make mistakes in their judgments).
It seems the ECJ is treating European citizens as children that need to be protected from pernicious content in the web, what reminds me of the excuses of some other countries, not very respectful with human rights, in other parts of the world to “protect” their citizens censoring the web. Well, it seems now we are at their very same level…
Quagmire, nightmare! Very expensive to administer and implement. Plenty of opportunities for misrepresentation. What happens where, as is commonly the case, there are multiple people with the same name and Joe Smith (1) claims to be unreasonably tarnished by the misdeeds of Joe Smith (2) so JS1 would like those misdeeds of JS2 to be hidden? How will Google et al ever be able to satisfy themselves that the misdeeds were of JS2 rather than JS1?
The opportunities for politicians to white-wash their records are legion and would render the internet virtually useless for checking on such people. Perhaps once a person stands for any political or public office they should be regarded as a non-personal entity and therefore unable to benefit from this ruling. Same for film and music stars.
I think it’s a good thing overall. I can construct cases where it might cause problems. (Would sex offenders be allowed to suppress results on sex offender list sites? If you say those sites are exempt from being suppressed, what happens if your name is wrongly included on one?) I think it’s better to have it than not, though.
If you are wrongly listed for any wrong-doing, it would be considered libel/slander and the listing site should be held responsible – not the search engine.
Not even if the search engine’s purpose in linking to the libel (I think slander is when you say it, not when you write it) is for its own commercial benefit?
If search engines had stayed dumb and just did a raw search with a big barely sorted list of results, this ruling would be unfair.
But search engines have gotten into the business of optimizing and weighting results. They put some things higher up than others for reasons of their own whether someone paid for it or because they are linking it to the other information they have about your habits.
They have the infrastructure in place to selectively expose or bury search hits.
They are just being asked to use it for “free” this time around. They are being asked to do something in the best interests of the people who use the service, not their customers, not themselves.
I agree. The search bubble is the worst thing that could have happened to peoples ability to find accurate information on the internet. Unfortunately it already happened under our noses, without much notice. Google particularly can no longer be relied upon as a source of unbiased information. While I don’t believe this court ruling is in the best interest of the general public or the future of the internet, I don’t think it will make so much difference as Google has done much of this themselves.
I was wondering, why is the First Amendment mentioned here? That applies in the States as far as I know. If any US company (or Chinese for the matter) wants to operate in EU territory must abide by the EU law (in more mundane words, check what Google itself was doing in China and Hong Kong)
Of course, as in this case, they are not obliged to like it and they have the right to challenge it in court or in the press
How is a person’s identity to be verified when a company such as Google receives a request to be forgotten? There are already many instances of identity theft – what if sufficient personal details were stolen then fraudulently used to remove a person’s existence from an online service. The criminal may not gain financially from such fraud, but being malicious is enough for some.
Nemo, very good point. This ruling really seems to open a pandora’s box…
This is not a matter of actually removing the information, but rather changing where it is placed in the results. Search engines do this all the time, according to their algorithm and calculation of what is ‘relevant’. All this decision does is toss a term into the calculation that affects relevance.
The information about which the original complaint was made was 16 years old; that should have already “timed out” as far as relevance is concerned. After all, a bankruptcy is removed from your credit record after ten years, by law. Why should search results circumvent the intent of that law?
The information is not being magically erased; it just won’t appear at the top of search results. It seems to me that this is a relatively minor tweak that could be introduced into the relevance algorithm of search engines fairly easily.
I partially agree but I think there is one very important point that seems quite wrong. Why the information should have timed out? I am not a public figure at all, so there are not many pages with info about me in the web. 8 years ago I participated in a project to help in IT developing in a couple of countries in Africa, sponsored by a cooperating agency. We created a report, published it in the web, participated in an exposition… and that info appeared for the next 4 years as first (and only “real”) result when I looked up my name in internet. It just disappeared when the web page was archived.
So “time out” should be based on relevance, yes, as defined by a neutral algorithm (and to define neutral here would be another battle, maybe…). If nothing comes new that is more relevant, then, what?
Actually if you check the name of the person that originated all this it will be quite difficult now to find the “offending” pages, and not because Google has done anything (the ECJ just replied to a question of the High Spanish Court, this has yet to take a decision) but because now you find plenty of references to this “case”, as the technical algorithm has continued its normal job unbothered by all this ado.
Of course, not yet mentioned the Streisand effect here…
The information should have timed out because… it’s 16 years old.
Sure, if you search for the dude’s name the fact that he had is house taken by the social security no longer comes up, but that only happens because newer stuff has happened to the dude, so there’s more relevant stuff to show.
The thing is, if you’re not “socially active” on the web (say by having a public blog or whatever) very little stuff with your name will end up in a search engine, so even very old stuff will come up as the most revelant, not because it actually is, but because it’s the only thing the search engine knows about you.
And that is the whole point: old stuff about random people isn’t really relevant to anybody anymore, probably not even to the actual random person.
What I’m seeing is a right to have the outdated/no longer relevant material removed from the searches.
So that would NOT give a child sex offender the right to have searches suppressed when there was still a risk.
My suspicion is that google’s reluctance is not motivated by a desire to protect us all – don’t forget this is the same google that intends to inform child molesters & others that the police have requested information about them.
My guess is that the cost of employing enough staff to handle all the requests is the prime issue for google. That could be a lot of requests, EU wide, with a risk that it will spread to other jurisdictions.
I anticipate appeals and/or a reorganisation to base ‘google Spain’ outside the EU
Well, how bout if when one finds something online about his/herself that’s really out of date like old articles, there be a way for them to contact the article’s rights holder and request the holder update the information, like with him, the debts were paid, so couldn’t there be an update or addition that’s say something along the lines of “as of such and such date, these matters have been cleared up”. But only do it if the person the info relates to contacts the contents owner.