The European Court of Justice shook up the privacy and Internet world
last week by ruling that European data protection law includes a right
to be forgotten with respect to search engine results that are
"inadequate, irrelevant or no longer relevant." As a result of the
decision, search companies such as Google will be required to remove
results from its index that meet this standard upon request.
My weekly technology law column (Toronto Star version, homepage version) notes that as people flock to remove content from the Google search index - reports
indicate that the company began receiving removal requests within hours
of the ruling - there remains considerable uncertainty about how to
implement the decision, whether it will migrate to Canada, and if a new
right to be forgotten will serve the cause of privacy protection or harm
free speech and access to information.
The decision arises from a 2010 complaint by a Spanish man who was
upset to find that searching his name in Google yielded links to a
1998 announcement in a newspaper on a real estate auction designed
to generate proceeds to pay back social security debts. The
information was both factual and readily accessible online, yet the
man felt that the now-outdated information was a violation of his
privacy.
As the case made its way through the courts, several European
countries waded into the issue. The Spanish and Italian governments
sided with the confirmation of a right to be forgotten, while
Austria, Greece, and Poland supported Google’s position that it
should not be required to remove lawful content from its search
index.
In ruling against Google, the court reached two key conclusions.
First, it ruled that it could assert jurisdiction over the search
giant, despite the fact that the processing of the data took place
outside of Spain. That aspect of the decision should not have been
particularly surprising, since most countries take the position that
a real and substantial connection (Google has a Google.es site and
actively markets its services in Spain) is sufficient to assert
jurisdiction over an out-of-country entity. For example, Canada
maintains that its privacy laws apply to organizations outside the
country that collect, use or disclose personal information of
Canadians.
Second, the court ruled that Google could be compelled to remove
links to personal information that is "inadequate, irrelevant or no
longer relevant." While the court suggests that this akin to a right
to be forgotten, it is really a right to digital obscurity since the
actual content is not removed from the Internet.
Companies may be focused on the practical costs associated with
content removal, but many already remove content if served with a
valid court order, notification of defamation, or copyright
infringement notice. Adding privacy removals may generate additional
costs, but they do not raise significant technical challenges.
The legal challenges are far more troubling, however. First, the
ruling vests enormous power and responsibility in the hands of
search companies and other intermediaries. Rather than leaving
difficult questions on the validity or harm of information to
impartial courts, the ruling requires search engines to make the
call. Given the potential for liability if they refuse to
remove the links, the search engines will likely err on the side of
removal.
Second, the ruling does not lead to the removal of the underlying
content itself, which in many instances may be both legal and
accurate. If there are concerns about third party content (no one
doubts the right of an individual to delete content they posted
themselves), surely there is a need to address that issue, rather
than targeting intermediaries such as search engines.
Third, the Supreme Court of Canada recently ruled
that the law must sometimes balance important rights such as privacy
and freedom of expression. Yet the European ruling suggests that
privacy trumps freedom of expression and the right to information.
By eliminating the need for balance, the ruling shockingly
undermines important speech rights in return for a bit of online
obscurity.