On May 13, 2014, the Court of Justice of the European Union issued an opinion in a Spanish privacy lawsuit against Google. Media attention to the court’s action boldly proclaimed the creation of a “Right to be Forgotten.” The opinion has been controversial and has led to widespread concern that requiring search engines to take down links to information will have a dramatic impact on free expression and access to information. The Washington Post Editorial Board recently published an editorial titled “UnGoogled: The disastrous results of the ‘right to be forgotten’ ruling.” In that editorial the Post quoted Britain’s justice minister, Simon Hughes, stating that the court’s action could “close down access to information in the E.U. which is open in the rest of the world.”
These sweeping statements are both inaccurate and unhelpful. Given the concern about the Court’s opinion, I took some time to analyze the case. The language in the rulings section of the opinion actually does not include the phrase “The Right to be Forgotten”. The rulings do not even include any reference to the concept of “forgetting”. Instead, the court creates a limited ability to obscure some information from being displayed in the results of an internet search of an individual’s name. The court does not require the information to be taken down from the internet. The court does not prohibit the search engine from linking to the information as the result of a different query. For example, a search request including a name and another data element, such as “david hoffman Intel”. What the opinion does do is make it slightly more difficult to learn inadequate, irrelevant or excessive information. This is an impactful and an important ruling, but it is neither surprising, nor “forgetting”.
The opinion is a straight forward application of existing European law, substantially limited to the facts of the case. The court does not establish a right to delete any information on the internet that an individual does not like. Instead, the opinion applies the existing legal obligation that processing of personal data should be “adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed”. (Article 6(1)(c) of the 95/46 Data Protection Directive). The court’s opinion is limited to interpreting search results when the query is just an individual’s name. This is far short of “forgetting” or any affirmative obligation to delete information from the internet.
Determining when data processing is “adequate”, “relevant” and “not excessive” could be a highly subjective process. Further, sorting out the impact of those determinations on (a) free expression, (b) access to information, (c) a European system that allows each member state to implement and interpret privacy law differently, and (d) the legal standards of information intermediary liability immunity, will be a complicated exercise. The case raises important questions about how we optimize protecting individuals, while also furthering the collective need for information and knowledge by the general public. Those questions deserve careful and thoughtful analysis, instead of hyperbole and invective.
Some privacy experts are asking thoughtful questions about the Court’s opinion. Marty Abrams recently published a blog post noting that concerns about providing information relating to searches of an individual’s name have existed for decades. Profs. Woodrow Hartzog and Evan Selinger have written convincingly of the benefits to similar “obscurity approaches” to privacy, and I have also written on that topic in this blog. The U.S. Federal Trade Commission raises many of the same issues in their recent report, Data Brokers: A Call for Transparency and Accountability. I have attempted to contribute to the analysis of these issues in a draft paper, The Right to be Relevant, about the Court’s opinion. Given the great number and complexity of the issues at play in the case, I am interested in your thoughts. Please send me comments, which I will address in future blog posts, and will use to improve the paper.
The post Europe’s New Right to be Forgotten: Not New and Not Forgetting appeared first on Policy@Intel.