Not forgotten

Google advisory council: Right to delist should only apply in EU

To help it handle the EU ruling that forces it to delist certain results about people, Google assembled a team of expert advisors that travelled the continent, seeking out various opinions on how best to implement Europeans’ data protection rights. On Friday that advisory council published its report, providing recommendations for the way forward.

The Google advisors’ report (embedded below) makes for a fascinating read, but the highlights are its assertion that the delisting should only apply in Europe, and its nuanced discussion of when publishers or webmasters should be notified of delisting.

The ruling was about data that’s inadequate, irrelevant or excessive – it’s a fundamental right in Europe that people can have such data deleted, and the Court of Justice of the European Union decided last year that this data protection right can be applied to search engines.

The global question

The advisors’ call for a limited geographical scope in applying the so-called “right to be forgotten” – Google’s favored term, but one the group strenuously objected to – directly contradicts the guidance given by the Article 29 Working Party (WP29) band of EU data protection regulators.

WP29 argued that, if the link to the data in question is only removed from Google’s European domains, it’s far too easy for people to access other Google domains, therefore the delisting should take place globally. Indeed, one of Google’s advisors, former German justice minister Sabine Leutheusser-Schnarrenberger, agreed with this in a dissenting opinion in today’s report.

Overall, though, the council said delisting should only apply in Europe. Its report acknowledged that global delisting “may ensure more absolute protection of a data subject’s rights”, but it pointed out that Google users outside Europe had the right to access information according to their own country’s laws, not those of EU countries.

It continued:

There is also a competing interest on the part of users within Europe to access versions of search other than their own. The Council heard evidence about the technical possibility to prevent Internet users in Europe from accessing search results that have been delisted under European law. The Council has concerns about the precedent set by such measures, particularly if repressive regimes point to such a precedent in an effort to ‘lock’ their users into heavily censored versions of search results.

Notifications

On the subject of whether or not to notify publishers that one of their pages is going to be delisted due to a data subject exercising their right, the council noted that it had “received conflicting input about the legal basis for such notice.” It then provided something of a fudge: “Given the valid concerns raised by online publishers, we advise that, as a good practice, the search engine should notify the publishers to the extent allowed by law.”

In other words, do what the law allows, whatever that is. In the opinion of WP29, contacting the webmasters in this way may itself involve “processing” of the subject’s data, which requires a legal basis – and there is none. However, the advisory council and WP29 did agree on one aspect of this question: If the decision to delist a particular piece of information is especially complex and difficult, it may be helpful to all concerned if the search engine could ask the publisher or webmaster for help.

The council also suggested four broad categories of criteria that Google and other search engines should apply when deciding on specific cases:

  • The data subject’s role in public life (Is the person a celebrity or do they have a special role in a certain profession?)
  • The nature of the information (Is it about the subject’s sex life or finances? Does it include private contact or other sensitive information? Is it true or false? Does it relate to public health or consumer protection or criminal information? Is it integral to the historical record? Is it art?
  • The source of the information (Does it come from journalists or “recognized bloggers”? Was it published by the subjects themselves and can they easily remove it?)
  • Time (Is the information about a long-past minor crime? Was it about a crime that’s relevant to the subject’s current role? How prominent were they at the time? Is the data about the subject’s childhood?)

The advisors recommended that Google’s delisting request form should have more fields so the subject can submit more information that will help the balancing test – for example, in which geographical area they’re publicly known, or whether their role in public life was deliberately adopted or not.

Other opinions

The dissenting opinions at the end of the report were interesting. That of Wikipedia founder Jimmy Wales was the starkest – “the recommendations to Google contained in this report are deeply flawed due to the law itself being deeply flawed” – as he entirely opposes the concept of a company being forced to adjudicate between free expression and privacy.

Frank La Rue, the former U.N. free speech rapporteur, also said this shouldn’t be down to Google, arguing that only a state authority should be establishing criteria and procedures for privacy protection. La Rue also criticized the scope of the EU’s data protection itself, saying data should only be removed or delisted if it is “malicious, is false, or produces serious harm to an individual.”

Overall, I think the report is an important document. There are of course many reasons to criticize the process that led to its drafting – it was done according to Google’s terms and timescale, and under the misleading banner of the “right to be forgotten” – and some of its recommendations don’t actually gel with current EU law:

However, I think it’s fair to say the council members were independent-minded and not all singing from the same hymn sheet. Ultimately, as a counterpart to the Article 29 Working Party’s more legalistic set of recommendations (that is their job after all), this was a valuable exercise in chewing over the deeper implications of that CJEU ruling.

Report of the Advisory Committee to Google on the Right to Be Forgotten

[protected-iframe id=”a2093e680e23c149c5ef77e8ab00270e-14960843-16988840″ info=”https://www.scribd.com/embeds/254900585/content?start_page=1&view_mode=scroll&show_recommendations=true” width=”100%” height=”600″ frameborder=”0″ scrolling=”no”]

2 Responses to “Google advisory council: Right to delist should only apply in EU”

  1. nerdrage

    If the EU wants to censor the internet, they should step up and do it directly, the way China does, by directly blocking its citizens’ access to google.com and other offending domains. But of course they won’t do this because they want to pretend what they’re doing is just “privacy” and not censorship which is why we are seeing the absurd spectacle of a profit-motivated corporation being forced into the position of deciding what is or is not in the public interest. That is not Google’s job. Google’s job is to pursue their shareholders’ interests, same as every other corporation on the planet.

  2. robisinho

    I live in the US. I agree with the basic arguments that Google should respect European laws, but mostly limited to European services, and respect the laws of other countries in those other countries (so extending a European “Right to be Forgotten” globally is an overreach). At the same time, I wish we had this same protection here in the US, and certainly wouldn’t complain if Google extended its responsibilities here.

    I also think it is a strange approach that the EU took, to require the company to adjudicate, but this I can understand. I really pretty strongly disagree that “serious harm” is a reasonable clause in any such formulation, in fact I think that fails to extend the protection any further than a “right to life”, which is ludicrous and weaker than many laws already in place throughout the world.