In a landmark ruling on May 13, the European Court of Justice made it mandatory for internet search engines like Google to remove links to outdated information about European users for privacy reasons. The ruling applies to all 28 member states of the European Union.
Background: Right to be forgotten
The right to be forgotten is a legal concept in Europe that maintains that a person has a right to leave his or her past behind. The concept originated from the French droit à l’oubli or right of oblivion.
In 2010, Spanish lawyer Mario Costeja González complained to the Spanish Data Protection Agency that Google had indexed pages in a Spanish newspaper (La Vanguardia) about an auction notice placed on his home in 1998. He argued that since the matter had been resolved, it should no longer be linked to him. He wanted both Google and the newspaper to remove the offending pages. The newspaper escaped further action as it was protected under press rights, but Google’s refusal to comply saw the case referred to the European Court of Justice (ECJ).
On May 13, the ECJ decided that Costeja’s right to be forgotten outweighed the importance Google places on linking to publicly available information. The decision was based on a 1995 directive,that: “EU’s members have an obligation to make sure personal data is accurate and up to date.”
Google complies quickly
Despite it’s unhappiness with the court’s decision, Google acted quickly to set up a webform where European users could request removal of objectionable personal information. Google maintains that it will:
“…balance the privacy rights of the individual with the public’s interest to know and the right to distribute information. “When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information — for example, we may decline to remove certain information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials.”
After assessing the requests individually, Google has started removing search results. They also notified the people whose requests were turned down. Searches for people’s names in Europe now include a message at the bottom of the results page that says ‘results may have been removed under data protection law in Europe.’
Microsoft search engine Bing too has launched a similar webform and process to address right to be forgotten requests.
Should the internet forget?
Reactions on social media show that people are divided on the issue. Some, like EU justice commissioner Viviane Reding, welcomed the court’s decision saying it was a clear victory for the protection of the personal data of Europeans.
Others, like founder of Wikipedia Jimmy Wales, criticized that that the ruling is against the freedom of expression, and gives individuals (not to mention search engines!) the power to decide what should be censored.
Google’s CEO Larry Page too highlighted a serious cause for concern. In the first two weeks of launching the webform, Google received over 41,000 requests to remove sensitive data. Of this, Page said,
“Nearly a third of the 41,000 requests received related to a fraud or scam, one fifth concerned serious crime, and 12% are connected to child pornography arrests.”
Removal from Google does not mean removal from the Internet
Since links will be removed only in EU, there is a high possibility that the censored information can be found on a non-EU version of a search engine in an EU country, or accessed through a proxy server (a common trick people already use to access content that is blocked in their countries). Some companies may even create new search engines that help surface information that others have tried to cover up.
Impact on Businesses unclear as debate continues
Beyond search engines the ruling may also affect online businesses like social media sites and blogs. Beyond online businesses, some brands too may need to watch out for any requests that may involve them. More clarity may come as the EU and search engines Google, Bing and Yahoo! debate the details of the ruling, and as the EU considers a new EU General Data Protection Regulation that will replace the current directive.
This post is part of the People’s Insights monthly brief for June + July.