Very few people can claim to lack a digital footprint. This can often be a mix of social media and information about us from events we’ve participated in, things we’ve accomplished and, on occasion, news reports about us. All of this information can be easily found through search engines.
It was Mr Costeja González’s dissatisfaction with his digital identity, which led to the European Court of Justice ruling that we have a right to be forgotten.
Mr. González objected to the fact that using Google to search for his name led to the appearance of two notices for the auction of his house, which was being sold to cover his social security debts. These notices had been listed on a Spanish newspaper more than 10 years before his complaint and the debts had been settled. However due to their prominence on Google, these notices were causing him professional problems.
Mr. González made two requests to the Spanish Data Protection Authority in 2010. Firstly to take down the notice from the newspaper’s website, the second to require Google Spain and Google Inc. to take down the link from their search engine.
The Spanish Data Protection Authority refused his request to order the newspaper to delete the notice, as it had been posted lawfully, but agreed with him that the links should be deleted from the Google search. Google Spain and Google Inc. appealed the case to Spain’s highest court, which asked the European Court of Justice to rule on the issue.
On the 13 May 2014, the European Court of Justice firmly ruled that we have a right to be forgotten and agreed with the Spanish Data Protection Agency that Google Inc. and Google Spain should delete the links of Mr. González.
The judges did not require that data is deleted automatically after a certain time, but instead that we each have a right to have links to information deleted when that information is “inadequate, irrelevant or no longer relevant, or excessive.”
In practical terms, the Google case led the company, and several others like Bing, to launch a new de-listing request system. An online form has been made available to individuals of the 28 EU Member States where Internet users can request the removal of a link to certain information they consider “inadequate, irrelevant or no longer relevant.” Google has appointed a team of legal experts to assess the validity of each individual case, depending on criteria such as age of the material and the interest of the public to access the content. If the request is approved, then Google sends a notice to the Webmaster for the site informing them that the article will be de-linked to a person’s name in Google. The information remains online and may still be found through a search engine based on a different query. For example, a document entitled “Alexander Dalkirk questioned over burglary at 94 Old Road” may be removed as a result under “Alexander Dalkirk” but would still appear under a search for “burglary at 94 Old Road.” Contrarily to what the name suggests, therefore, an article is not “forgotten,” it is just made a little more difficult to find. So far, Google has had over 230,000 requests to remove information, of which around 60% have been rejected.
Legal criticism has focused around the lack of clarity of the ECJ ruling with regard to the “right to be forgotten”, which creates many uncertainties when enforcing the ruling. The Court’s overly broad definition of “data controllers” and the court’s balancing test, which seems to prioritize- and not “balance”- the right to privacy over other fundamental rights, have been highlighted as areas of concern.
The ruling is also unclear about the obligations of search engines and intermediaries other than Google. What exactly constitutes a “search engine”? Google currently controls almost 90% of the market place for search operators but the ruling is sufficiently broad that it could affect other smaller companies, sometimes with a more specialized search focus, who have fewer resources to deal with the “right to be forgotten”. Similarly, the ruling asserts that the “right to be forgotten” may be limited “according to the role played by the data subject in public life,” but again this boundary between a public and private figure is difficult to ascertain.
Beyond legal criticism, the criticisms focus on the potential negative impact of the ECJ ruling. Critics fear that the ECJ’s ruling will lead to “silent encroachment.” The ability of individuals to request delisting has raised concerns that this might lead to an airbrushing of information which is of interest to the public, for example inconvenient facts relating to public officials. Since anyone is entitled to request information to be de-linked, fears of auto-censorship and the re-writing of history have been raised.
The difficulties associated with the implementation of the “right to be forgotten” have also been highlighted, from dealing with the avalanche of potential requests to determining a coherent stance with rest of the world on the “right to be forgotten”. With the Court’s decision, the role of search engines has been substantially redefined to become adjudicators of fundamental rights. Google has ceased to be a mere “intermediary” immune from data protection obligations, and instead has to play an active role in ensuring that individuals can have some control over their digital identity.
On the other hand, the decision was welcomed by individuals who have been critical of the way the internet magnifies part of our lives through search engines, at the expense of other parts of our lives. It has also been welcome by NGOs and the European Commission for the role it could play in enabling teenagers to control their digital identity.
Read more on the case here.