Wednesday, June 4, 2014
Is “The Right to be Forgotten” a Misnomer? More on the Recent Decision of the European Court of Justice
For blog readers interested in how the "right to be forgotten" is playing out in Europe, I'm providing the following as a further description of the recent decision of the European Court of Justice (ECJ) delightfully discussed in Nic Terry's recent post.
The recent ECJ decision about the so-called “right to be forgotten” has been hailed as highly privacy protective and condemned as “censorship.” It is neither. Rather, it is a decision about the indexing practices of search engines. It concludes that search engines are data processors with independent obligations under European privacy law; that the rights of individuals to privacy and the protection of personal life must be balanced against rights to information; and that if information is inaccurate or irrelevant because of the passage of time, the balance should be struck in favor of protecting the individual. The balance may be different for web sites originally publishing the information--a question not at issue in the ECJ decision. And it may be different for public figures, also not at issue in the ECJ decision.
The actual case, Google Spain SL v. Agencia Espanola de Proteccion de Datos, was initiated with a complaint to the Spanish data protection authority brought by Mr. Costeja González against Google Spain and the newspaper La Vanguardia Ediciones. In 1998, the paper had published notice of a sale of property to satisfy social security debts. The publication was legal—indeed, was legally required as a method to obtain publicity for the sale at auction. Costeja González contended that the proceedings had been fully resolved for many years and that therefore the information about the debt should no longer be publicly available. There were two aspects of this question: whether the newspaper should continue to make the information available on its website and whether search engines should be able to pick up the link to the information from the newspaper web page. The Spanish data protection authority concluded that the newspaper should be able to continue to have the information on its web site, as it was a lawfully published record, but that operators of the search engines against the wishes of the data subject violated the dignity of the person and the fundamental right to data protection. Google sought to block the ruling in Spanish court, and the court referred the questions presented to the ECJ.
The case involved a number of issues about the interpretation of the European Union’s data protection directive, 95/46/EC. These included whether Google Spain was within the jurisdiction of Spain’s data protection authority as an “establishment” (yes) or a “use[r] of equipment” (answer unnecessary), whether search engine location and prioritization of data was “data processing” (yes), and whether an entity performing search engine functions was a “data controller” (yes).
With respect to the right to be forgotten, the initial question was whether responsibilities attached only to the website publishing the information—in this case, the newspaper—or to the search engine as well. Google contended that any questions about removal should be address to the web site, the entity in the best position to determine whether publication of the material was lawful. In addition, Google contended, to require search engines to remove links to lawfully published material would violate the rights of the web site publishers and internet users. Costeja González contended that individuals should be able to approach search engines directly, and that the obligations of the search engine were independent from the obligations of the web site. On this point, the ECJ interpreted Directive 95/46/EC in light of the Charter of Fundamental Rights of the European Union Article 7 right to respect for private life and Article 8 right to the protection of personal data. The ECJ agreed with Costeja González that each data controller had obligations to determine whether its form of processing of the data was permissible under Directive 95/46/EC and the Charter. Determining the legitimacy of processing, the ECJ determined, requires balancing the rights and freedoms of the data subject with the legitimate interests of the data controller; this balance may not be the same for search engines and web page publishers. With respect to search engines, use of algorithms that search by individual name are particularly problematic for the fundamental right to privacy because of the way they permit easy assembly of structured profiles of individuals. The mere economic interests of the search engine cannot override this fundamental right. However, legitimate interests of other internet users in obtaining information about the individual must also be considered and “a fair balance should be struck between [those interests] and the data subject’s fundamental rights.” In the words of the ECJ, “Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.” (¶ 81) In contrast, publication of the information on the web site is both less intrusive and may be legitimate. Web site publication may also come within the exception for journalism in Directive 95/46/EC.
Finally, the ECJ analyzed the scope of the data subject’s rights against search engines. Here, the question was whether the data subject has the right to request search engines to remove links to lawfully published, true information. Costeja González contended that his interest in protecting his privacy from the publication of prejudicial information overrode the interests of the search engine and the general interest in freedom of information. The ECJ determined that under Directive 95/46/EC, information may over time become inadequate or no longer relevant. Such was the case with information about long-resolved old debts for an ordinary individual. In such cases of outmoded information, the data subject should have the right to request limits to its processing. For more public figures, however, the rights to information might override the rights of the data subject. (¶ 97)