By PATRICK STEPHENSON
BRUSSELS – Sparks flew at the “Computers, Privacy and Data Protection” (CPDP) 2017 conference here late January, when a Google privacy lawyer and representatives from European data protection authorities (DPAs) squared off on a critical issue: the global ‘right to be forgotten.’
Participants on the panel — “The Right to Obscurity: Implementing the Google-Spain Decision” — were asked to comment on the EU Court of Justice’s (CJEU) 2014 decision that individuals in the EU have the right to demand that search engines remove links to their personal information when the information is “inaccurate, inadequate, irrelevant, or excessive.”
The court qualified its decision by stating that this “right to be forgotten” must be balanced against other rights such as freedom of expression and of the press, and thus judged on a case-by-case basis. But rather than ruminate on the past, the panel became a skirmish over the larger, future battle between Google and France’s Commission Nationale de l’Informatique et des Libertés (CNIL).
Most European DPAs interpreted the CJEU ruling as pertaining only to Google’s servers located within Europe and to associated national sites such as google.fr. Last March, however, CNIL asserted that the ruling applies globally, and fined Google EUR 100,000 euros not de-listing eligible Europeans from all its national sites across the world. Google appealed the ruling to France’s supreme administrative court, the Council of State where a decision is expected in spring 2017.
Peter Fleischer, Google privacy counsel, led off the discussion by laying out how Google has so far complied with the CJEU ruling. “I’m a believer in the quaint notion that facts are relevant to the political debate,” he said. He described how Google initially fought the Spanish case that led to the Court, but once the judgment was made, Google formed a team and set to work sorting through complaints that Europeans submitted via the company’s web site.
Over nearly two years, Google evaluated 675,624 requests and 1,865,610 associated URLs, he said. The company rejected 43 percent of applicants, in part because in many cases, thee objections were actually defamation claims — a category the CJEU decision did not protect.
“When we say no to someone, we tell them that you can appeal to their national DPA,” Fleischer said. “Less than 1 percent of our no’s get appealed…[and] when there is an appeal, a significant majority of the time the DPAs agree with our original determination.”
According to Fleischer, CNIL’s global approach would “dramatically complicate” Google’s business model and threaten the freedom of expression upon which the internet depends.
“The CJEU right is a European right. It is not the law in the rest of the world,” he said. The Chilean government, for example, has found that the ‘right to be forgotten’ does not exist. There, de-listing European information on Chilean websites would constitute a violation of free speech. But a global ‘right to forget’ would also present a fundamental danger to internet communication, he said: “If the CNIL’s approach to global removals were to be embraced as the standard for Internet regulation, in the end the world of the internet would only be as free as the world’s least free place.”
CNIL President Isabelle Falque-Pierrotin did not agree. “The right to be forgotten is just the application through the search engine of all the rights that have existed for years regarding data controllers,” she observed. “So it’s the decision of the court to apply to all new types of actors – i.e., the search engines – the rights that already exist.”
For her, Google signed up to European laws when it decided to operate in Europe so it is compelled to delete links to Europeans who wish to be forgotten, wherever those links may be found — even if the same right may not be enjoyed in other countries.
The company and its search engine are submitted to European law, in her view. “What is the treatment of Google in Europe? It is a worldwide treatment. If ‘Mr Smith’ is a Chinese [citizen] in China, he won’t have the benefit of this right. It only applies to a European citizen subject to European law,” said Falque-Pierrotin, adding that it is “absurd” that a French citizen can have their information de-linked on the French version of Google only to switch over, with a few keystrokes, to Google’s Chilean site to find the information again.
Despite her rejection of Google’s argument, Falque-Pierrotin was optimistic about the ruling’s implementation. “Is the system working? I would say, yes. In 99 percent of the cases, it’s just Mr and Mrs Nobody who wants the material from their private lives de-listed.”
Others were not quite so optimistic. Jens-Henrik Jeppesen of the Washington-based Center for Democracy and Technology had reservations about the ruling’s potential to curb existing freedoms. “When the court said the rights of the individual should, as a rule, override not only the economic interests of the company involved but also the interests of the general public in finding information, that was a matter of great concern to us,” he said.
Jeppesen was also sceptical about the ruling’s expansive mandate. “We have concerns when jurisdictions try to apply local or national laws globally,” he said. “The right to be forgotten is not a global norm.”
Julia Powles of Cambridge University pointed to the possible consequences, noting that if Europeans have global rights, then others will demand them as well. “I’m not so convinced that a Chilean or a Mexican couldn’t apply [to be forgotten] when information about them is published in a European newspaper [since] it’s not relevant and it’s not of public interest,” she said. “If we lay the seeds for global de-listing, then we would rely on every single decision being justified on a global basis, and I just don’t think we’re yet at that point.”
But the CNIL official’s assertion was wrong. Last year, in a blog posted shortly after CNIL’s fine was levied, Google pledged to use IP-geolocation methods to prohibit de-listed links from appearing in any of Google’s sites, if accessed from a European server. It seems, then, that CNIL truly does want a ‘global’ right to be forgotten. But many Europeans would be up-in-arms about free speech if a Chilean citizen demanded that information about him or her be de-linked from European newspapers or blogs.
There is something a bit silly about this discussion. The CJEU’s ruling does not remove actual content; that would be impossible. It merely removes links from the two or three most popular search engines, without deleting the content from servers. One suspects that technically sophisticated web users – such as those employed by governments or corporations – would find other ways to access the personal data. So the true meaning of this decision is not that anyone is ever ‘forgotten.’ It’s that Google pretends it doesn’t know you, EU institutions pretend to be politically relevant in the matter, and far more savvy actors pretend that they still can’t find out everything they want to know about you, when they probably can.