HomepageCommercial LawPrivate LawPublic Law & Human RightsCriminal LawEU & International LawCareers

Accessibility

Have Irlen Syndrome, or need different contrast? Click the button below for options.

Background Colours

Subscribe

Enter you email address below to subscribe to free customisable article notifications.

Alternatively, click the button below for our various RSS Feeds (available journal wide, or per section).

Is There Really a ‘Right’ to be Forgotten?

About The Author

Chris Bridges (Executive Editor)

Chris is an IT and Data Protection solicitor at a top 20 full service firm and the founder of Keep Calm Talk Law. He also contributes to Computers and Law and other sector specific publications.

[Read More]

The European Court of Justice (ECJ) has this week ruled that natural persons have ‘the right to be forgotten’ by search engines where the information in question is "inadequate, irrelevant or no longer relevant”. However, is what the ECJ has created really a right to be forgotten?

Regardless of the answer to this question, the decision is a seismic moment that will cause glee for people with a past that they would like to be forgotten and serious ache for companies that operate search engines.

The case in question, Google Spain v AEPD [2014] has remarkably simple facts. The initial claimant, Mario Costeja Gonzalez, made a complaint to Agencia Española de Protección de Datos, the Spanish data protection agency (AEPD) regarding a number of articles in a Spanish national newspaper, La Vanguardia, dated 1998 but still obtainable over the internet. These articles concerned the auctioning of Mr. Costeja Gonzalez’s real estate to pay outstanding social security debts. Understandably, he did not want these stories showing up on Google; the articles were clearly very old and were no longer relevant to his current position. He therefore felt the articles in question were an invasion of his Article 7 right to privacy, and Article 8 right to protection of his data (Charter of Fundamental Rights of the European Union [CFREU]).

The complaint was made against both the newspaper and Google Spain SL / Google Inc. The agency decided to uphold the claim against Google, but not the newspaper; the newspaper escaped due to its ‘media’ status, which provided it protection under Article 9 and Article 17 Directive 95/46/EC (the Directive), the currently applicable data protection directive.

Google appealed this decision to the Audiencia Nacional, The Spanish High Court, who felt they were unable to decide on the issue properly without consulting the ECJ.

The Law

A number of questions were referred to the ECJ, covering territorial application, the activity of search engines in cases such as this, and the right to be forgotten (which sounds so much better in Spanish, “derecho al olvido”). However, the questions of territorial application are of less interest, so these will not be covered.

The Activity of Search Engines

These questions essentially concerned whether search engines fall under data protection law: does what they do with data constitute ‘processing data’ (QA), if so, are they a data controller (QB)? If the answer to both of these is yes, can a data protection agency such as AEPD ask such a controller to remove said data without addressing the original creator of the data (La Vanguardia) (QC)? If yes, may they (the agency) do so even where the initial publication of said data was lawful (QD)?

The actual activity of Google (and thereby other search engines) is summarised by the court as such:

…finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference…

Google argued in relation to QA that they were not processing data, as search engines process all data found on the internet, regardless of whether it is personal data or otherwise. In relation to QB, they argued that even if they are processing data, they cannot be a data controller as the process is automatic; Google have no knowledge of the data nor do they have control over it.

The ECJ judgement quickly negated Google’s argument in relation to QA. By exploring the internet automatically, a search engine still collects, retrieves, records and organises data, stores it, and makes it available in the form of search results. The fact that they did the same with non-personal data was of no relevance, or the fact that the data had already been published and not altered by the search engine (para 28 - 29). Furthermore, in relation to QB, it was decided a search engine must be a data controller, as it determines the purpose and means of processing the data (para 33).

In relation to QC and QD, Google suggested that due to the principle of proportionality, it should be the original publisher of data that any request is addressed to, as he is responsible for making the information publically available, and has the least restrictive means of removing data.

The issue many are having with this judgement is that the information regarding Mr. Costeja Gonzalez was not inaccurate, and therefore could not be caught by Article 12(b) of the directive. Article 12(b) provides that a data subject should have the right to obtain data held on him from the controller, and have data rectified or erased should it not compliant with the directive, by virtue of its incomplete nature or inaccuracy. (In the UK, this is found in the Data Protection Act 1998).

However, the ECJ highlighted Article 6 of the directive, which requires data controllers to:

  • Process data ‘fairly and lawfully’;
  • Ensure data is ‘collected for specified, explicit and legitimate purposes’;
  • Ensure data is ‘adequate, relevant, and not excessive in relation to the purposes for which they are collected’;
  • Ensure data is ‘accurate, and where necessary kept up to date’; and
  • Keep data ‘in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected’.

If data does not meet these requirements, the controller should take every reasonable step to erase or rectify the data.

There is undoubtedly a balancing act that must occur here: Article 7 of the directive permits the processing of data where necessary for the legitimate purpose of the controller or the third parties to which the controller discloses the data. However, only where such interests are not overridden by the fundamental rights and freedoms of the data subject. In this case, Article 7 and Article 8 CFREU are the very rights that the directive seeks to embody.

However, the ECJ are quick to highlight the serious affect search engine results may have on the fundamental rights of a person to privacy and protection of data (para 80). This is by virtue of its very nature. Search engines draw together and structure information in such a way that exposes a much greater picture of the subject than each individual piece might do. Without a search tool, this would be very difficult to do. The ECJ place even greater weight on this point considering the role search engines play in modern society.

Despite this seriousness, the ECJ qualify their position that in some cases, the Article 7 and 8 CFREU rights may not override the rights of internet users at large; it greatly depends on the sensitivity of the data and the interests of the public in having the information. They specifically mention the role played by the data subject in public life as a key factor, which thankfully eradicates the possibility of this decision being used by politicians and other public figures to ‘perfect’ their online profile. Therefore, thankfully, we will still be able to enjoy horrendous pictures of our least favourite euro-sceptic politicians.

As search engines have this additional affect on the data subject which would otherwise not be felt if the data existed only at the original source, the court found it appropriate that a search engine operator must ensure compliance itself with data protection legislation. In other words, enforcement against Google is permissible due to the different consequences the data processing has on the data subject; the original publication would have little relevance online but for the search engine.

Derecho al Olvido (‘The Right to be Forgotten’)

Interestingly, this was not supported by many, despite the outcome. Google Spain, Google Inc., the Greek, Austrian and Polish Governments and the Commission all believed there should be no such right:

Google Spain, Google Inc., the Polish Government and the Commission submit in this regard that Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 confer rights upon data subjects only if the processing in question is incompatible with the directive or on compelling legitimate grounds relating to their particular situation, and not merely because they consider that that processing may be prejudicial to them or they wish that the data being processed sink into oblivion. The Greek and Austrian Governments submit that the data subject must approach the publisher of the website concerned.

Only the Spanish and Italian governments supported the right.

However, is this ‘new right’ really such a big deal? From a legal point of view, I think not. The ECJ judgement spends only 11 paragraphs covering this issue (para 89-99). But, there is more to it than that. The ECJ justify this right, by referring back to the law I have discussed above. They do not ‘create’ a right to be forgotten in the literal sense, as much of the mainstream media may lead you to believe. Splitting hairs? Maybe. Nevertheless, the right is certainly not as strong as it sounds.

To do this, they refer back to Article 12(b) and Article 6(1) and the processing of data being incompatible with the directive, which may result:

…not only from the fact that such data are inaccurate but, in particular, also from the fact that they are inadequate, irrelevant or excessive in relation to the purposes of the processing, that they are not kept up to date, or that they are kept for longer than is necessary unless they are required to be kept for historical, statistical or scientific purposes.

The court suggests that it follows from this that what may initially have been lawful processing of data may over time become incompatible by virtue of it no longer being necessary in light of the original purpose of the data. This would happen where the data became “inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed.” If this is found be true, the data controller must erase the data. Furthermore, the court highlight that the data need not be prejudicial for this to be so, but do qualify their decision with the same point about the public standing of the data subject being a relevant consideration to override the data subject’s Article 7 and Article 8 rights.

Therefore, it is apparent this is not a free standing right, as many seem to believe. It is simply a construct built on top of ‘old law’. I do not see this as a right to be forgotten. It is a right to have old data that is no longer relevant removed. Unfortunately, this is not a headline-making right, but it is more accurate. The right to be forgotten implies that you can have data deleted no matter how old it is, or how relevant it is. This is simply not the case.

Interestingly, the judgement includes the wording ‘right to be forgotten’ only in its introduction to the question, and do not use such wording in their conclusion; the court frames their answer using only Articles 12(b) and 6(1). In fact, the word ‘forgotten’ appears only three times in the entire judgement, and every time it is in quotation marks. To me, this suggests the presiding judges were not particularly fond of the idea of creating such a right, and simply dodged the bullet by framing their answer in a way that utilises existing law.

Impact

Whether a true right to be forgotten or not, what will be the actual impact of the decision be?

It has been reported that search engines are already being flooded with takedown requests following the ruling, and it is therefore no wonder that they are irate about the decision. Allegedly, over 1,000 such requests have already been made. In the UK, some of these requests have allegedly come from convicted criminals, including a paedophile, and a former MP standing for re-election who wants to hide former unfavourable stories.

As big a fan of privacy as I am, even I question whether any of these requests should be honoured. The electorate have the right to know about the past of a prospective MP, which at least the ECJ seem to have recognised in their judgement when they refer to public figures. However, they do not address the issue of convicted criminals, and in light of the judgement, it seems criminals could have such requests honoured if sufficient time has passed since the conviction. Do citizens have the right to know about previous criminal convictions, especially where the crime was as heinous as paedophilia? Whilst there is a sex offender’s register, would this similarly be subject to being removed from search results? This is a separate debate entirely, but it is one that must be considered when forming an opinion on ‘the right to be forgotten’. Are search engines, or even data protection agencies, the right bodies to be deciding on whether a paedophile should have his past erased? In my opinion, this should only ever be under the purview of a court, and in an ideal world, a jury (who better to judge the relevance than a representative body of society).

From a business perspective, investigating and honouring these requests is going to be extremely resource intensive for search engines. However, as the judgement highlights, economics should never take precedence over a person’s right to privacy and data protection. Whilst these requests may be vast in number for now, I have no doubt that they will dwindle as time goes by.

Businesses wanting to erase their past are not so lucky. Data protection law applies only to natural persons. Therefore, if a business is trading as a partnership or limited liability company (public or otherwise), they will continue to be burdened by their past.

Finally, there may be a ‘real’ right to be forgotten just around the corner, making this decision and its impact academic. The new Data Protection Regulation was approved by the European Parliament in March this year, and is set to include a formal ‘right to be forgotten’:

A right to be forgotten: When you no longer want your data to be processed and there are no legitimate grounds for retaining it, the data will be deleted. This is about empowering individuals, not about erasing past events or restricting freedom of the press.

Whether this will actually be included is another matter. This decision may be an opportunity for the Commission to test the water, to see if such a right is practicable, necessary, or wanted, and backtrack if necessary. It is unsurprising this has not been reported in the media, since only half of UK businesses are even aware there is data protection reform looming.

For the latest articles straight to your inbox, you can subscribe for free. Alternatively, follow @KeepCalmTalkLaw on Twitter or Like us on Facebook.

Tagged: Commercial Law, European Union, Human Rights, Privacy Law, Technology

Comment / Show Comments (0)

You May Also Be Interested In...

GDPR: Challenges for Businesses, Eighteen Months On

3rd Dec 2019 by Kerry Gibbs (Guest Author)

Dead on Arrival: The Investigatory Powers Act 2016

29th Sep 2017 by Alexios Ektor Koursopoulos

Misuse of Private Information: The Failure to Protect the Right to Privacy

10th Feb 2017 by Connor Griffith

Politics in Competition Law

3rd Feb 2015 by Matt Bogdan

It's not the end of the line for data retention

10th Apr 2014 by Chris Bridges

Google to get a slap on the wrist for ‘stalking adverts’?

25th Jan 2014 by Chris Bridges

Section Pick September

Cherry v AG for Scotland, Part I: Is a No-Deal Brexit Necessarily Implied?

Editors' Pick Image

View More

KCTL News

Keep Calm Talk Law: Moving Forward

3rd Sep 2019

Changing of the Guard: Moving Keep Calm Talk Law Forward

12th Aug 2018

An Anniversary or Two: Four Years of Keep Calm Talk Law

11th Nov 2017

Rising from the Ashes: The Return of Keep Calm Talk Law

18th Nov 2016

Two Years On, Keep Calm Talk Law’s Legacy is Expanding

11th Nov 2015

Twitter

Javascript must be enabled for the Twitter plugin to function. Click below to visit us on Twitter.

Free Email Subscription

Subscribe to Keep Calm Talk Law for email updates, and/or weekly roundups. You can tailor your subscription on activation. Both fields are required.

Your occupation / Career stage is used to tailor your subscription and for readership monitoring.

Uncheck this box if you do not want to receive our monthly newsletter.

By clicking the Subscribe button, you agree to our privacy policy and terms of service. Please ensure you read these in full.

Free Subscription