Right to be Forgotten – The European ruling and its extra-EU implementation

Summary

(Note: The report can be downloaded free of charge [1] by WAN-IFRA members and non-members alike.)

Almost two years after the decision of the Court of Justice of the European Union that is considered to have “invented” the Right to be Forgotten, a lot of misinformation still animates the debate. WAN-IFRA comes to the rescue of those who are still unclear on what really happened with a report that goes back to basics and that hopes to contribute to a better-informed discussion, and to a deeper investigation of the next steps. Bottom line: right now newspapers have less to fear from the Right to be Forgotten than what conventional wisdom suggests. 

It was May 2014 when the Court of Justice of the European Union (CJEU) [2] rendered the decision that is considered to have “invented” the Right to be Forgotten (#R2BF). The news of the CJEU ruling on Google Spain and Google Inc v. Agencia Espanola de Protección de Datos (AEPD) and Mario Costeja González caused strong reactions first in the press, then among the general public, and the polemic seems to be regularly rekindled.

WAN-IFRA noticed that some of the most belligerent opinions on the ruling appear to be largely based on misinformation: we therefore decided to write a whole report on the topic looking into what was really decided in May 2014 and what are the potential implications. We hope that this report will contribute to a better-informed debate, and to a deeper investigation of the next steps. The report analyses in detail the specificities of the judgment, and subsequently examines its extraterritorial implementation. A chapter is dedicated to the principles that traditionally enabled the extraterritorial enforceability of law, as well as their application in the EU Privacy Directive and in the CJEU ruling. The conclusion proposes certain reflections on the aftermath of the decision, which could constitute the starting point of a process that brings the protection of privacy forward into the new millennium.

With this piece we intend to provide a quick summary of the essential notions that any commentator who wishes to speak of #R2BF should be familiar with. To access the full report click here [3].

Court decision, not law

First of all, it is important to point out that we are talking of a court decision, and not of legislation, as some commentators still insist in saying. This will be true at least for another 2 years and 20 days following the final adoption of the new Data Protection Regulation [4] by the European Parliament on April 14 [5]; at that point the Right to be Forgotten will in fact be explicitly provided by law, at Article 17.

Not applicable to news outlets

Secondly, even under the new Data Protection Regulation the #R2BF should not bear consequences to news media in the least. Nevertheless, the misconception that #R2BF is something journalists should worry about [6] persists. In reality, in one of the few clear points of its decision, the Court explicitly said that newspapers are not concerned with link removals on the basis of Right to Be Forgotten, as the existing Privacy Directive, just like the upcoming Regulation, provide for an exception for journalistic use of data. In plain English, this means that if private data that should be erased following the EU legislation are in a news piece, they can stay published. In addition, even if the liks to an article are erased on grounds of #R2BF for searches on the basis of the complainant's name, any different query will still lead to that content.

We did receive word from a few news outlets that they are nevertheless receiving #R2BF removal requests: if you know of such cases, and specifically of media that are effectively committing self-censorship, by amending their pieces on the basis of these requests even if they don’t have a legal obligation to do so, please let us know at mediapolicy@wan-ifra.org [7]

One undisputable merit

The decision had the merit of sparking a global debate on a subject – privacy – that is often dismissed as plain boring, and which was generally overlooked as a fundamental human right by a large part of the general public. It was interesting to observe the evolution of the opinions in the 18 months since the ruling. Some of the scholars, journalists and civil-society advocates who originally reacted with outrage to a decision mainly perceived as an attempt at censorship, are now shifting towards positions that take into consideration the possibly acceptable reasons why a person could wish to “unlink” their name from specific information. It should now be clear to anybody who talks of #R2BF that privacy is a human right just as much as freedom of information and expression is, that both are proclaimed as “ a common standard of achievement for all peoples and all nations” in the Universal Declaration of Human Rights [8] respectively at Article 12 and 17, and that a “hit parade” of rights does not exist.

It follows that any conflict between privacy and freedom of information and of expression is a delicate matter of balancing fundamental rights, and we agree with Article 19 [9] that only courts or independent adjudicatory bodies should retain the power to determine that balance.

What was actually decided by the Court

In its version contained in the ruling, the #R2BF applies to results of Internet searches performed on the basis of a person’s name. For that person to be granted de-linking of those results, these must contain data that is inaccurate, inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they are processed. The search results that should be de-listed on this basis might be (and remain) lawfully published in the original source.

The implementation: the question of territorial extension of #R2BF

The CJEU was silent about this topic. It did not suggest that search engines should limit the implementation of the ruling to specific websites or areas, nor did it explicitly require a global de-linking. It indeed extended EU law to the activity of a non-EU based operation, when itrecognised that the search activities which are sanctionable under #R2BF are carried out by Google Inc in the US, and that the Court’s jurisdiction, and the application of Spanish and EU law, were justified by the “inextricable link” between Google’s Spanish operations and the US search activities.

The first 18 months after the ruling saw Google and the European Data Protection Authorities (DPAs) engaged in a relentless dispute over the territorial extension of the #R2BF enforcement. Google resolved to erase only the European links of successful #R2BF requests, making them unreachable for searches performed on its European domains. The DPAs and Article 29 Working Party, the supreme European advisory body on data protection and privacy in Europe, insisted that the erasure had to affect searches performed on every single one of Google domains, irrespective of their location.

On 4 March 2016, Google confirmed [10] taking a long awaited step towards global delisting of #R2BF granted requests through implementation of geolocating filters. [11] The announcement was made through a blogpost, the same medium that was used by the same person, Peter Fleischer, Global Privacy Counsel on 30 July 2015 to resolutely refuse to comply [12] with the order of performing global delisting that came from the French Data Protection Authority. To be precise reports like this [13], announcing in the headline that #R2BF is being extended to all Google domains, are misleading. In reality the change is not so groundbreaking: for a #R2BF request granted to a Spanish citizen, until February the whole of the European versions of Google search would not return search results on the basis of a query on the complainant name. Now, in addition to that criterium, also none of the Google domains will, but only for searches originated from Spain. 

In the new Data Protection regulation [4], expected to come into force in 2018, the territorial scope is expressed in pretty vague terms, but it is surely widened. The applicability of European privacy rules, including #R2BF, is expressly extended to non-EU based businesses [14] and to any data controller that either: (1) offers goods or services to EU residents, even gratuitously; or (2) monitors the behaviour of EU residents.

In this context, it can be expected that the concept of “inextricable link” of CJEU will represent the precedent at the basis of the interpretation of the rule of law, both by doctrine, and by the European data protection agencies.  

What the Ruling did NOT do, and what it did instead

For an in-depth analysis refer to Chapter 1 of the Report [3].

The rule that allows a data subject to request “rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data” is Article 12 (b) of the Data Protection Directive, in force in Europe since 1995.

What changed following the ruling, is that search engines – Google but also Yahoo, Bing etc - were declared to be data controllers, and thus subject to the Directive’s provisions.

Google has for several years been implementing mechanisms of links takedown.. According to a source within Google, interviewed in September 2015, the link removals performed by Google are roughly 1.6 million per day, with 50 million in August 2015 alone.

The novelty introduced by the ruling was the fact that since May 2014 the de-linking requests connected to a much wider range of data protection concerns joined the bulk of existing claims, which mainly referred to copyright infringement, antitrust, defamation etc. 

It is to a judicial body (the Spanish Superior Court) that the CJEU indicated the criteria to be followed when balancing the right to privacy with other fundamental rights. But it is true that Google decided to adopt a proactive approach, and to make preliminary determinations on the de-linking requests based on the criteria outlined in the ruling.

Various [15] press [16] outlets [17] have written about the fear of possible misuse of the #R2BF by politicians, criminals or shady public figures to clear the Internet slate of their offences. These fears, as far as the CJEU ruling is concerned, are largely unjustified.

As regards public figures, the CJEU clearly stated that the interest of private subjects to the defence of their privacy would not justify the de-linking of news on grounds of #R2BF. On the other hand, the ruling served indeed as inspiration for pieces of legislation adopted outside of the European Union, that could give rise to abuse from influential personalities. In July 2015, for example, Russian President Vladimir Putin signed into law a version [18] of the #R2BF that is specifically extended to public figures. The legislation, which came into force on 1 January 2016, has reportedly been slightly modified [19] on a few controversial points.

The content that is de-linked from a Google search remains published in its original location on the Internet. The only thing that changes is the impossibility to reach that information through a search originated from Europe and based on the name of the specific person to whom the request of de-listing was granted: a different query will still lead to that content. Of course, doubts remain on the effect that de-listing has on the Freedom of Information, as the ability to reach a de-indexed piece of news is undoubtedly reduced. In addition, it was rightfully noted [20] that “While the target of the search might be a European citizen or resident, one cannot exclude the possibility that this person is of interest to the constituents of other States”.

Another important myth to dispel is the one regarding alleged repercussions on journalism in general. While motivating its decision that the responsibility of a search engine shall be entirely independent from that of the original publisher of the information (read “news” in this case), the Court rightfully referred to the existence of an exception for journalism purposes, which exempts news publishers from the respect of Article 12 (b), or, as it is now known, the #R2BF. For the same reason, it seems unlikely that the CJEU would ever apply in the future this rule directly to archives of newspapers.

> Download the full report free of charge < [1]