This past May, the Court of Justice of the European Union approved “the right to be forgotten” in a case brought by Mario Costeja against a newspaper and Google, a move which fundamentally changed our notions of Internet privacy. More than a decade earlier, Costeja had posted two notices about an auction of his property to pay off debt, and the links to the notices were still appearing in the search results when Googling his name. Costeja brought suit in an effort to remove the links from the search results. The court said the links could be removed if they were found to be “inadequate, irrelevant or no longer relevant.” Under the right to be forgotten, only searches that include a person’s name will provoke the search result removal, which means that the articles or website can still show up in the results if the search is under a different keyword.
The European Union’s right to be forgotten has spurred much concern for free speech campaigners, who claim the ruling unjustly limits what can be published online. Privacy advocates, however, are praising the ruling for allowing people some exercise of power over what content appears about them online. This new right creates a process for people to remove links to embarrassing, outdated, and otherwise unwanted content from Google and other search engines’ results. Courts are directed to balance the public’s interest in access to the information in question and the privacy interests of the person affected by the content.
As of now, the ruling applies only to Google’s local European sites, such as Google.de in Germany, Google.fr in France, and other search engines. This leaves an easy loophole because the content is still available by searching from Google.com. European data protection representatives are, of course, eager to apply the right to be forgotten worldwide in order to make the ruling more effective. Europe’s Article 29 cross-European panel of data protection watchdogs recently announced: “de-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented.” The Article 29 Working Party is comprised of data protection representatives from across Europe and it has very recently published guidelines on the implementation of the right to be forgotten ruling.
The guidelines note, “a balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public will be significantly greater if the data subject plays a role in public life.” They also address concerns of how this will impact free speech: “in practice, the impact of the de-listing on individuals’ rights to freedom of expression and access to information will prove to be very limited. When assessing the relevant circumstances, [Data Protection Authorities] will systematically take into account the interest of the public in having access to the information. If the interest of the public overrides the right of the data subject, de-listing will not be appropriate.”
The representatives ask search engines to apply this new right to be forgotten to all of their websites, including Google.com, for enforcement worldwide. Privacy advocates allege Google has been undermining the new right by limiting its application to local European sites, while free-speech advocates say the rule is “a gateway to Internet censorship that would whitewash the Web.” It is up to the data regulators in individual countries to decide whether to enforce the panel’s guidelines, and it remains unclear whether Google will move to implement the rule.