The GULS Law Review

Getting you through the GU law degree!

header photo

“Remind me, what’s your name again?”

 This article looks at the new EU "Right to be forgotten", its conflict with the Freedom of Expression and the misleading nature of its name 

 Written by Christopher Lewis-Laverty, fourth year LLB and European Union law sub-editor.

 

 

The internet (nearly) never forgets. Following the ruling earlier this year EU citizens now have a “Right to be Forgotten” on the internet. Since the European Court of Justice’s ruling back in May, nearly half a million links from Google’s search engine have been removed.

This new found right has progressed rapidly since the original case (C-131/12)[1] was ruled in 2010 concerning a Spanish citizen lodging a complaint against a newspaper with the national Data Protection Agency and against Google Spain and Google Inc.

He complained that information concerning an auction notice of his house which was repossessed was entirely irrelevant, breaching his privacy rights as this out-of-date information had been fully resolved several years ago. Yet whenever anyone typed his name into Google this embarrassing information would come up, causing the applicant distress.

The Court therefore ruled in this case that, under certain conditions, individuals have the right to request for search engines to remove links with personal information about them, or more commonly called: the right to be forgotten. But how truly is this new practice working out?

 

How it works:

Any EU citizen can request for data held on the internet about themselves to be removed permanently, of which the online service provider must adhere to, unless “legitimate reasons” exist to do otherwise[2]. The Court in its judgement made clear the request for erasure has to be assessed on a case-by-case basis, showing an element of proportionality is required.

The main providers affected by this have been YouTube, Facebook, and of course, Google[3]. The majority of requests have been directed towards links to content on Facebook in response to people wanting material removed to protect their privacy[4].

The extent of this new Right to be Forgotten is effective only to a certain extent however: the recent European Court of Justice’s decision only allows search requests based on someone’s name to be the subject of an erasure request – meaning all the other content of the source will remain untouched. Therefore this judgement shows that unwanted articles certainly would not be deleted from the Internet – they simply would not appear in search results.

Another criticism is that if a request is successful then the links will not appear in search results on the company’s European domains – yet they will still remain public on global sites such as Google.com. Therefore there really is no hiding once information is made public on the internet.

Currently the UK is the third highest amongst its European counterparts for making full use of this Right to be Forgotten (behind France and Germany)[5]. So far over 63,000 pages (I.e. 1 in 10 of all requests)[6] have originated from the UK, but not all requests are always granted approval.

In a recent transparency report published by Google, all sorts of weird and unusual requests were shown to be turned down. For example a former British clergyman’s request to have links describing an investigation into sexual abuse claims made against him was rejected.

 

Freedom of expression complications:

The Right to be Forgotten has encountered many difficulties since its debut. Recently Justice ministers met in Luxembourg to argue whether this new right was truly reasonable as critics said it breached Article 10 of the European Convention on Human Rights, that of Freedom of Expression.

The Court eventually concluded the Right to be Forgotten was in fact acceptable in allowing search engines to remove people’s names provided that either the data is an invasion of privacy, irrelevant, out of date, or simply inaccurate[7].

Fighting for greater rights of expression founder of Wikipedia, Jimmy Wales, calls this right to be forgotten “one of the most wide-sweeping internet censorship rulings… ever seen”[8]. Campaign group Index on censorship concurs with Mr Wales, stating the decision “violates the fundamental principles of freedom of expression”[9].

On the contrary EU justice commissioner, Martine Reicherts argues it “will strengthen legal certainty, both for search engines and individuals, and will guarantee coherence”[10].

It should be noted that in Europe neither the right to be forgotten nor the right to freedom of expression are absolute rights, meaning an equitable middle-ground should be sought when trying to balance the two in opposition. In fact both of these rights are placed almost on equal footing. Interestingly in the United States however, the First Amendment protects freedom of speech above privacy rights, showing Europe has a much different approach when it comes to Data Protection.

 

Updates brought by the case-law:

Before this ruling was passed the 1995 Data Protection Directive was the main source of law in this domain[11]. It already included ways to allow people to request for personal data to be deleted provided it was no longer necessary (Article 12 of the Directive). This demonstrates that the newer more stringent rules are by no means ground-breaking.

Google was founded 3 years after the 1995 Data Protection Directive was passed, and since then a “digital revolution” has occurred, with the amount of online data increasing exponentially. Therefore new regulation in this area was more than welcomed in order to update this 19 year old legislation.  

Further, this “Right to be Forgotten” judgement emphasises that the rights of the individual are paramount in the EU when it comes to their control over their personal data, although there is a public interest defence when it comes to people in public life.

Even for such a large global corporation such as Google it is a massive burden to be processing on average 1,000 erasure requests per day across Europe. The problem however comes when smaller corporations start to handle increased amount of erasure requests and they don’t have the facilities to do so. Some believe in this instance smaller search engines will simply have to withdraw links to any material complained of, thereby damaging the fundamental right of freedom of expression.

The threat comes to corporate entities when they don’t follow new Data Protection Regulation. Data protection authorities are hereafter allowed to impose fines of up to 2% of annual worldwide turnover where entities do not abide by the rights of others, such as the right to be forgotten.

Lastly this Spanish case (C-131/12) successfully proved that EU data protection legislation goes beyond its borders, to that not only of organisations within Europe but also to those outside the EU which have operations within it, such as Google Inc in this specific case.    

 

Conclusion:

The phrase “Right to be Forgotten” is largely misleading and inaccurate. Information cannot be “forgotten” and it will certainly still be available on the Internet following this new legal update. This right at best will make information less easily accessible; it still however, will be available.

In any event this is not ground breaking regulation for the likes of Google or other large search providers. Google already has a system in usage to handle deletion requests such as for national identification numbers, bank account numbers, images of signatures and credit card numbers.

The Right to be Forgotten will be largely controlled by Google or search engines themselves which is controversial to say the least. This new found responsibility seems unwanted however from the likes of Google who will now need to spend a lot of time handling the waves of erasure requests that can be expected.

In the future search engine providers will no doubt develop this procedure further to make requests for erasure more accessible and available to all interested. Currently you’d need a legal expert to help process an erasure request with a search provider. If the EU has its way the whole process will become far easier and an automated process will be set up, costing Google both time and money to handle.

With further EU regulation coming into force soon concerning Data Protection provisions, this domain is likely to get much more rigid and controlled with particular data protection authorities in place. For the time being however, if you’re unhappy about your name published on the internet, you can make your (online) self disappear by almost just a click of a button.



[1] Judgment (OJ), 20/06/2014, Google Span and Google.

[2]Europea Factsheet on the “right to be forgotten”; date: 13th October 2014; http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf

[3] 12th October 2014; http://www.bbc.co.uk/news/uk-29586700

[4] Ibid

[5] 13th October 2014; http://www.wired.co.uk/news/archive/2014-10/10/google-right-to-be-forgotten-transparency

[6] Ibid

[7] C-131/12; Judgment (OJ), 20/06/2014, Google Span and Google.

[8] 14th October 2014; “Google ruling ‘astonishing’, says Wikipedia founder wales”; http://www.bbc.co.uk/news/technology-27407017

[9] 14th October 2014; http://www.bbc.co.uk/news/world-europe-27388289

[10] 14th October 2014; http://euobserver.com/justice/126011

[11] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data 

Go Back

Comment