Home / Our news and views / Google and France, European DPAs exchange tough words over privacy

Google and France, European DPAs exchange tough words over privacy

By PATRICK STEPHENSON

BRUSSELS – Sparks flew at the “Computers, Privacy and Data Protection” (CPDP) 2017 conference here late January, when a Google privacy lawyer and representatives from European data protection authorities (DPAs) squared off on a critical issue: the global ‘right to be forgotten.’

Participants on the panel — “The Right to Obscurity: Implementing the Google-Spain Decision” — were asked to comment on the EU Court of Justice’s (CJEU) 2014 decision that individuals in the EU have the right to demand that search engines remove links to their personal information when the information is “inaccurate, inadequate, irrelevant, or excessive.”

The court qualified its decision by stating that this “right to be forgotten” must be balanced against other rights such as freedom of expression and of the press, and thus judged on a case-by-case basis. But rather than ruminate on the past, the panel became a skirmish over the larger, future battle between Google and France’s Commission Nationale de l’Informatique et des Libertés (CNIL).

Most European DPAs interpreted the CJEU ruling as pertaining only to Google’s servers located within Europe and to associated national sites such as google.fr. Last March, however, CNIL asserted that the ruling applies globally, and fined Google EUR 100,000 euros not de-listing eligible Europeans from all its national sites across the world. Google appealed the ruling to France’s supreme administrative court, the Council of State where a decision is expected in spring 2017.

Peter Fleischer, Google privacy counsel, led off the discussion by laying out how Google has so far complied with the CJEU ruling. “I’m a believer in the quaint notion that facts are relevant to the political debate,” he said. He described how Google initially fought the Spanish case that led to the Court, but once the judgment was made, Google formed a team and set to work sorting through complaints that Europeans submitted via the company’s web site.

Over nearly two years, Google evaluated 675,624 requests and 1,865,610 associated URLs, he said. The company rejected 43 percent of applicants, in part because in many cases, thee objections were actually defamation claims — a category the CJEU decision did not protect.

“When we say no to someone, we tell them that you can appeal to their national DPA,” Fleischer said. “Less than 1 percent of our no’s get appealed…[and] when there is an appeal, a significant majority of the time the DPAs agree with our original determination.”

According to Fleischer, CNIL’s global approach would “dramatically complicate” Google’s business model and threaten the freedom of expression upon which the internet depends.

“The CJEU right is a European right. It is not the law in the rest of the world,” he said. The Chilean government, for example, has found that the ‘right to be forgotten’ does not exist. There, de-listing European information on Chilean websites would constitute a violation of free speech. But a global ‘right to forget’ would also present a fundamental danger to internet communication, he said: “If the CNIL’s approach to global removals were to be embraced as the standard for Internet regulation, in the end the world of the internet would only be as free as the world’s least free place.”

CNIL President Isabelle Falque-Pierrotin did not agree. “The right to be forgotten is just the application through the search engine of all the rights that have existed for years regarding data controllers,” she observed. “So it’s the decision of the court to apply to all new types of actors – i.e., the search engines – the rights that already exist.”

For her, Google signed up to European laws when it decided to operate in Europe so it is compelled to delete links to Europeans who wish to be forgotten, wherever those links may be found — even if the same right may not be enjoyed in other countries.

The company and its search engine are submitted to European law, in her view. “What is the treatment of Google in Europe? It is a worldwide treatment. If ‘Mr Smith’ is a Chinese [citizen] in China, he won’t have the benefit of this right. It only applies to a European citizen subject to European law,” said Falque-Pierrotin, adding that it is “absurd” that a French citizen can have their information de-linked on the French version of Google only to switch over, with a few keystrokes, to Google’s Chilean site to find the information again.

Despite her rejection of Google’s argument, Falque-Pierrotin was optimistic about the ruling’s implementation. “Is the system working? I would say, yes. In 99 percent of the cases, it’s just Mr and Mrs Nobody who wants the material from their private lives de-listed.”

Others were not quite so optimistic. Jens-Henrik Jeppesen of the Washington-based Center for Democracy and Technology had reservations about the ruling’s potential to curb existing freedoms. “When the court said the rights of the individual should, as a rule, override not only the economic interests of the company involved but also the interests of the general public in finding information, that was a matter of great concern to us,” he said.

Jeppesen was also sceptical about the ruling’s expansive mandate. “We have concerns when jurisdictions try to apply local or national laws globally,” he said. “The right to be forgotten is not a global norm.”

Julia Powles of Cambridge University pointed to the possible consequences, noting that if Europeans have global rights, then others will demand them as well. “I’m not so convinced that a Chilean or a Mexican couldn’t apply [to be forgotten] when information about them is published in a European newspaper [since] it’s not relevant and it’s not of public interest,” she said. “If we lay the seeds for global de-listing, then we would rely on every single decision being justified on a global basis, and I just don’t think we’re yet at that point.”

     THE UPSHOT: Falque-Pierrotin seemed to have a point in her rebuttal to Google’s lawyer. It would be absurd if, after spending months of effort getting Google to de-link your private information, you have merely to change the web address to “google.cl” to see that information again.
     But the CNIL official’s assertion was wrong. Last year, in a blog posted shortly after CNIL’s fine was levied, Google pledged to use IP-geolocation methods to prohibit de-listed links from appearing in any of Google’s sites, if accessed from a European server. It seems, then, that CNIL truly does want a ‘global’ right to be forgotten. But many Europeans would be up-in-arms about free speech if a Chilean citizen demanded that information about him or her be de-linked from European newspapers or blogs.
     There is something a bit silly about this discussion. The CJEU’s ruling does not remove actual content; that would be impossible. It merely removes links from the two or three most popular search engines, without deleting the content from servers. One suspects that technically sophisticated web users – such as those employed by governments or corporations – would find other ways to access the personal data. So the true meaning of this decision is not that anyone is ever ‘forgotten.’ It’s that Google pretends it doesn’t know you, EU institutions pretend to be politically relevant in the matter, and far more savvy actors pretend that they still can’t find out everything they want to know about you, when they probably can.

     ps@securityeurope.info

Check Also

The EP pushes for international ban on the use of killer robots

By BROOKS TIGNER, with KYLE ATTAR
BRUSSELS – Members of the European Parliament (MEPs) are demanding a ban on weapons that have no “meaningful human control”.The resolution, passed overwhelmingly on 12 September by a majority of the MEPs (566)  is non-binding, however, on the 28 member states but is supported by Federica Mogherini, the EU’s policy chief for security and defence policy. She has already begun an international dialogue to try and bring the world into consensus as to the direction of autonomous warfare. The resolution notes that lethal autonomous weapons (LAWs) are machines without the ability or capacity to make human decisions and, as such, remote operators must take responsibility for life or death decisions. Much like drones, these weapons bring up strong ethical and moral dilemma regarding...