This week, a landmark ruling from the European Court of Justice held that a Directive of the European Parliament entailed that Internet search engines could, in some circumstances, be legally required (on request) to remove links to personal data that have become irrelevant or inadequate. The justification underlying this decision has been dubbed the ‘right to be forgotten’.
The ruling came in response to a case in which a Spanish gentleman (I was about to write his name but then realized that to do so would be against the spirit of the ruling) brought a complaint against Google. He objected to the fact that if people searched for his name in Google Search, the list of results displayed links to information about his house being repossessed in recovery of social security debts that he owed. The man requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results. His principal argument was that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
The case was referred to the European Court of Justice. The substance of the Court’s judgement is as follows:
Finally, in response to the question whether the directive enables the data subject to request that links to web pages be removed from such a list of results on the grounds that he wishes the information appearing on those pages relating to him personally to be ‘forgotten’ after a certain time, the Court holds that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased. The Court observes in this regard that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed. The Court adds that, when appraising such a request made by the data subject in order to oppose the processing carried out by the operator of a search engine, it should in particular be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that is the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.
The precise scope and application of this judgment will be clarified as subsequent cases are brought, and it seems there is much to clarify: how does the passage of time affect adequacy and relevance? How much time needs to pass before an individual has the right to a piece of information being forgotten? How should public interest and individual rights be weighed? How is the judgement to be reconciled with the freedom of expression?
Yesterday, the BBC reported on some of the first requests to be forgotten. According to BBC News, those making such requests to Google include: An ex-politician seeking re-election who asked to have links to an article about his behaviour in office removed, a man convicted of possessing child abuse images who requested links to pages about his conviction to be wiped, and a doctor who wanted negative reviews from patients removed from the results.
Google has not commented on the decisions made in relation to these cases and it will be some time before it becomes clear how Google will respond and how many cases will end up getting taken to court. Here, I will introduce some of the conceptual and ethical questions that the judgement raises: it is likely that future cases will prompt courts to consider questions like these.
What difference does the passage of time make?
The judgement puts an explicit emphasis on the passage of time. Indeed, it suggests that information that was once lawfully processed can become incompatible with the directive after a certain amount of time. If some piece of information were to become incompatible with the directive, then this would mean that the rights that people have in relation to that information are violated by processors of data if this data (or links to it) are not removed upon request. The right to be forgotten is not identical to a right to never be known, and past judgements will have set a precedent for what might make the processing of contemporary data unlawful. So how does the passage of time alter whether (and how) data can legitimately be processed? The key phrases pertaining to the sorts of information that might become incompatible with the directive in the judgement are ‘inadequate’, ‘irrelevant or no longer relevant’, or ‘excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed’. If it is assessed that the data does meet one or more of these criteria, it should be unlinked to the person’s name unless there are particular reasons not to do so, ‘such as the role played by the data subject in public life’.
One of the problems with this is that contemporary data can be inadequate, irrelevant or excessive and historical data can be none of these things, so decisions will not simply be made on the basis of the age of the data. There are perhaps two main motivations underlying the idea that data may become incompatible with the directive in the ways suggested over the course of time. The first is that there is the risk that people are misrepresented – i.e. that factual inaccuracies are at risk of being made – if historical data is misperceived as contemporary data. For example, maintaining links to information about a person’s previous job may confuse people wanting to learn about the person’s current position and level of skill. The worry here is that outdated links lead people to believe things about a person and their circumstances that are no longer true.
A second, more debatable motivation could be the idea that people deserve to be able to have their slates wiped clean: unless, as the judgement suggests, the interest of the public in having access to the information outweighs the person’s right to be forgotten, links to data should be removed upon request because people should be able to be able to reinvent or redeem themselves. Whether part of the right to be forgotten is in fact motivated by a conviction that people should be able to conceal historical negative information because they should be able to present themselves anew is thus far unclear.
How selective should people be able to be in their requests?
Another interesting issue is how selective people should be able to be in their requests. The doctor’s request to have links to negative reviews removed raises precisely this question. If it were the case that there were positive reviews submitted at a similar time to the negative ones, should links to all these reviews be removed or should people be able to cherry pick which links are removed and which remain. If the doctor’s argument is that the negative reviews from X number of years ago no longer accurately reflect his or her practice, then this must also be true for any positive reviews submitted at or before this time, (unless the doctor can prove to us that he has eradicated the negative elements of their practice that earned such negative reviews in the past whilst maintaining the positive elements that earned them the good reviews). Although the consistent approach would be to identify the time at which reviews become reflective of current practice and retain only these, Google’s resources are likely to be such that extensive investigations to discover all reviews may not be conducted.
How can we know whether access to data might be in the public interest in the future?
The judgement says that the person’s right to be forgotten might be outweighed if the person plays a role in society that makes it more important that links to data remain intact. One of the problems with this is that it is not always determinable in advance who may take on public roles in the future. We might imagine a budding politician requesting the removal of links before running for office. Although it will still be the case that the underlying data will remain at its original sources, a future judgement might have to be made about whether there are circumstances under which links should be reestablished.
Is it really a ‘blow to freedom of speech’?
The final big challenge will be to balance the right to freedom of expression with the right to be forgotten, and some commentators have argued that the judgement violates this right. However, many of the rights protected by the EU Charter are not absolute – they will often have to be weighed against each other. The right to freedom of expression and information is not without limits. The Charter sets out:
Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. The freedom and pluralism of the media shall be respected.
The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.
Clearly, many of these limitations are concerned with the sharing of personal data per se, regardless of whether time has passed or not. For example, if information that was given in confidence is made public, the person to whom this data relates has a right to demand that the data be withdrawn from the moment it is published: in such cases there is a right to not be known. It might be thought that the pertinent part of Article on Freedom of Expression and Information relates to ‘the protection of the reputation or rights of others’. However, it seems plausible to suggest that situations in which historical data might become more damaging to reputation than it was at the time of its publication would be far less likely than situations in which data is most damaging at the point of publication; the former (if there would be any) it seems, would be exceptions rather than the rule. Accordingly, it seems more likely that the right to be forgotten is not derived from the concern to protect reputation, but has been deemed by the court as a fundamental right in itself. Quite how this right is to be balanced against the right freedom of expression remains to be seen.