Do we remember the point of the “right to be forgotten”?

When the CJEU’s ruling in the Google Spain case (Google Spain SL, Google Inc v Agencia Española de Protección de Datos (AEPD), Mario Costeja González) appeared on 13 May 2014 it sent shockwaves through the internet. Almost no-one had expected it, partly because it was almost the diametric opposite of the opinion of the Advocate General a little less than a year before, but more because it seemed, to some at least, to have enormous implications not just for Google but for the whole balance between privacy and freedom of expression.

To recap, Mario Costeja GonzÃ¡lez found that information from 1998 about property sales for the settlement of social security debts, published in the Spanish newspaper La Vanguardia, appeared prominently when Google searches were made for his name. After his initial failure to have the information deleted by La Vanguardia – it was legally published, as part of the public record – Costeja sought to have Google “delist” the information from searches made using his name. To the surprise of almost all observers, the CJEU supported him.

Their ruling was relatively simple and decisive, on the three points referred to them by the Audiencia Nacional. Firstly, that Google Inc. was within the scope of EU data protection law – through the advertising operations of Google Spain. Secondly, that Google should be considered data controller of the search results. Thirdly, specifically, that as a consequence, where appropriate according to data protection law, a subject should have the right to have this information no longer linked to their name.

All three parts are significant – but much of the focus of the debate that has followed has been on the third part, seen as many as being an acknowledgment of the existence of a “right to be forgotten” under existing data protection law. Where information is old and irrelevant, a person has a right to prevent it appearing when a search is made under their name.

The response to the Google Spain ruling

The reaction to the ruling was swift and dramatic. More than 100 pieces were written by academics in the first couple of months after the ruling – blog posts, journalistic articles and more. After initial distress, Google themselves rumbled into action faster and more decisively than many expected – and in a way that many questioned. Their response had four main parts. Firstly, they set up an online form through which people could request to have information “delinked” from searches under their names. Secondly, they added a notification to searches made on all people’s names – except where those people were public figures – to the effect that some information may not have appeared on the search results as a result of the Google Spain ruling, drawing attention to that ruling. Thirdly, they began notifying media organisations when they had delinked stories that they had published – resulting in a series of stories on news websites such as the Guardian and the BBC complaining about what they saw as censorship. Fourthly, they established an Advisory Council including such luminaries as Wikipedia’s Jimmy Wales, to advise them on how to implement the ruling, and how to achieve the best balance between privacy and freedom of expression.

The combined effect of these actions looked at first as though it might be designed to undermine the ruling – demonstrating that it was either unworkable or disproportionately damaging to freedom of expression. This impression was emphasised by the nature of some of the stories that appeared to have been delinked – stories that on the face of it did not fit at all within the letter or the spirit of the ruling. Google strenuously denied this interpretation of their reaction: in the months that have followed, as more information has emerged, it is still not clear whether or not that that denial holds water.

The Google Advisory Council and Transparency Report

Over the last month, Google’s Advisory Council has been touring Europe, through Madrid, Rome, Paris, Warsaw, Berlin and London, finishing the tour, appropriately enough, in Brussels. At each place they have listened to and questioned carefully selected witnesses – many of them real experts – and to coincide with this they have started providing a transparency report on “European privacy requests for search removals”. The transparency report provides headline figures – by 29 October 2014, Google had received 157,255 requests and evaluated 524,159 URLs, removing links to 41.3 per cent of them – as well as a list of the websites about which the largest numbers of requests had been made, and a series of 14 highlighted examples.

Listening to the hearings and examining the transparency report gives some insight as to what is happening, but still leaves more questions than answers. The numbers look large – but pale into insignificance besides the number of pages delisted in response to copyright-holders’ requests: as at 29 October, there had been nearly 35 million URLs requested for removal on this basis. Moreover, though Google reports how many requests they have received and how many evaluations they have made, and of those that have been successful they don’t say on what basis. The examples they provide, and the resolutions that Google have come to in each case, seem eminently sensible, for example:

“A woman requested that we remove a decades-old article about her husband’s murder, which included her name. We have removed the page from search results for her name.”

“A victim of rape asked us to remove a link to a newspaper article about the crime. We have removed the page from search results for the individual’s name.”

“We received multiple requests from a single individual who asked us to remove 20 links to recent articles about his arrest for financial crimes committed in a professional capacity. We did not remove the pages from search results.”

There are 14 examples provided – but how representative of the 157,255 requests made is hard to tell. Google has chosen them, and without any imputation of bad faith it might be said to be naÃ¯ve to believe that they have chosen them for reasons that are entirely altruistic. Moreover, when the other information provided is examined it is difficult to believe that they are entirely representative. An examination of the sites for which the most requests have been received does not make it look as though the “right” is being used to erase critical news stories. Top of the list is Facebook, next profileengine.com, a site which amongst other things archives old social media profiles, including Facebook profiles that their users have subsequently deleted. Third is YouTube, fourth another social network, Badoo.com. No news or media sites appear in the top sites listed in the transparency report – and yet most of the examples provided by Google appear, on the face of it, to relate to news stories.

Questions and answers

All this leaves a great deal to be answered. Should we be worried by what we have learned from the transparency reports? Do they, and the other information that is gradually emerging, demonstrate that the Google Spain ruling has produced something that is unworkable, or indeed results that are undesirable? Has Google, as some have suggested, deliberately overreacted to the ruling in the hope of its enforcement being abandoned, or the ruling somehow reversed – though the legal opportunities for that reversal are hard to see as it was a ruling by the Grand Chamber of the CJEU. This is Google – but the ruling definitely applies to other search engines, and its application to other systems such as Facebook, Wikipedia and others is far from clear. How will these others react? Will we have a stream of further cases to look forward to?

At this stage it is very difficult to be certain of anything, but there do seem to be some things emerging. It does not look as though this ruling has broken the internet. The figures for requests, though on the face of it large, do not suggest an intractable problem – and, what is more, the sites for which many (or perhaps even most) of the requests have appeared are actually social media sites. That brings us back to the point of the right to be forgotten, as it was originally put forward by Viviane Reding, back in 2010, something which seems to have been forgotten in the excitement of the Google Spain ruling. When Reding presented it, as a pillar of the proposed reform of the data protection regime, it was triggered by the difficulty that people had in deleting their social media profiles. Hidden amongst the furore over the news media, Google Spain may have almost inadvertently brought a little of this into existence. There is of course a long way to go, and the final stages of the data protection reform process may either support or undermine this. Nevertheless, the signs are not altogether negative – and neither is the impact of the Google Spain ruling. There are still problems and questions to answer, not least a right of appeal for publishers of those rare news stories delinked, but there is no reason to believe that these should prove insurmountable.

Dr Paul Bernal is a lecturer in IT, IP and Media Law at the UEA Law School. He specialises in internet privacy issues and is the author of Internet Privacy Rights: Rights to Protect Autonomy, published by Cambridge University Press in March 2014. He blogs at paulbernal.wordpress.com.

Email paul.bernal@uea.ac.uk. Twitter @PaulbernalUK.

Image by Sara Biljana on Flickr.

Internet Privacy Rights: Rights to Protect Autonomy by Paul Bernal was published by Cambridge University Press in March 2014. Hardback £75.