ITsecurity
twitter facebook rss

There is no ‘right to be forgotten’; and Google won’t forget you anyway

Posted by on June 2, 2014.

A lot of guff has been written about last month’s ECJ ruling that search engines must abide by European data protection laws. Much of this centres around the world’s media claiming that a right to be forgotten now prevails in Europe. Here are just three examples from the last few days:

  • Google sets up ‘right to be forgotten’ form after EU rulingBBC
    The move comes after a landmark European Union court ruling earlier this month, which gave people the “right to be forgotten”.
  • ‘RIGHT TO BE FORGOTTEN’Businessday
    The European Court of Justice in its ruling confirmed that an EU law exists which allows citizens to claim a “right to be forgotten” stating that Google is bound to obey this law and must enforce it.
  • How Google’s New “Right To Be Forgotten” Form Works: An ExplainerSearch Engine Land
    Google has taken a big step forward in complying with the European Union’s new “Right To Be Forgotten” that was established after a court ruling earlier this month.

The Americans have particularly got it wrong. NBC reports Stewart Baker, former assistant secretary for policy at the U.S. Department of Homeland Security, as commenting, “Americans will find their searches bowdlerized by prissy European sensibilities. We’ll be the big losers. The big winners will be French ministers who want the right to have their last mistress forgotten.”

The confusion comes from the contentious proposal in the EU’s General Data Protection Regulation (which is not yet law) that EU citizens should have a right to be forgotten. But the ECJ’s ruling is only about existing European data protection laws, where there is no ‘right to be forgotten’. And in fact, the ruling specifically implies that you do not have a right to be forgotten. The reports that you object to can remain; only the links to them may have to be removed from the search engines. And even then a public interest argument can allow the search engines to retain them.

Furthermore, this ruling only applies to EU countries. In the US, the reports about the French minister’s latest mistress will remain complete with search engine links. So using google.com rather than google.co.uk or google.fr may well find the links. Even if Google hides the links based on the user’s IP, use of a US proxy will find them.

The issue is front page news again because Google has published its new form for European users to request the removal of offending links. There are several points to note. Firstly, at least Google has got it right — there is no mention of a right to be forgotten. This is a “Search removal request under European Data Protection law”.

Secondly, it is a request, not a right. Google will decide. If a user objects to Google’s decision he or she will have to appeal to the local data protection regulator.

Thirdly, A German regulator is already concerned about the amount of personal detail required by Google in this form. Out-Law reports,

However, the data protection authority in Hamburg has challenged Google’s requirement of applicants to provide proof of identity from those who file a request for deletion. It has highlighted concerns about the copying and processing of scanned passports and German ID cards, which is highly restricted under German laws.
German watchdog expresses concern over Google’s ‘right to be forgotten’ mechanism

Fourthly, Google’s search removal request form is already proving popular. Reuters reported on Friday,

After putting up the online form in the early hours of Friday, Google received 12,000 requests across Europe, sometimes averaging 20 per minute, by late in the day, the company said.
Google in quandary over how to uphold EU privacy ruling

But lastly, a successful takedown request might merely highlight rather than disguise the issue. Google will likely flag the removal of a link in the same way it currently does with DMCA takedowns. It might also provide more details to the Chilling Effects Clearinghouse.

In other words, if someone searched for an individual in the UK, Google’s search results under its procedure to comply with the ECJ ruling could include a statement that is something like: “In response to a complaint, we have removed some links”. This is a message to the searcher to go to Google.com site in the USA, and repeat the search on the data subject to obtain the links that have removed from Google’s European companies.

Clearly, therefore, a data subject who wants to be forgotten is not even half-forgotten. Indeed, if there exists a flag that says the data subject wanted to be forgotten then this might be more damaging (e.g. to the data subject’s employment prospects) than a URL that the data subject wants removed. After all, some employers will argue, as there is no smoke without fire and we don’t want to take an employment risk.
If Google remembers whom it has forgotten, has it complied with the ECJ Judgment?

In many cases it might simply be better for EU citizens to let sleeping dogs lie…


Share This:
Facebooktwittergoogle_plusredditpinterestlinkedinmail

Leave a Reply

Your email address will not be published. Required fields are marked *

Submitted in: News, News_privacy | Tags: , , , , ,