From October 2016 to March 2017 the team is joined by Guest Kats Rosie Burbidge and Eibhlin Vardy, and by InternKats Verónica Rodríguez Arguijo, Tian Lu and Hayleigh Bosher.

Monday, 19 May 2014

To Oblivion, and Beyond! Google and the Right to be Forgotten

This one contains a few thoughts on the Court of Justice of the European Union’s (CJEU’s) Google Spain decision, examined from a copyright perspective by Eleonora last week. The case is about data protection, not IP, but it is of such importance to the way the Internet works that (in this Kat’s view at least) every IP practitioner needs to be aware of it.
In essence, the decision says that Google – and by extension other search engines like Microsoft's Bing – need to comply with European data protection law when they process personal data on web pages, which is basically all the time given the number of pages search engines deal with. That includes an obligation to take down upon request links to individuals' personal data on third party web pages.
Paragraph 94 of the judgment states that obligation most clearly (emphasis added):
“…if it is found, following a request by the data subject…that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, incompatible with Article 6(1)(c) to (e) of [Directive 95/46] because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.”
WhiskyKat will be asking for this photo
to be taken down, once he's sober
Article 6(1)(c) to (e) of Directive 95/46 (on the protection of individuals with regard to the processing of personal data and on the free movement of such data) limits the processing of personal data ensuring amongst other things that it is relevant and kept for only as long as it needs to be.
The effect is that this Kat (and you) can ask for the removal of any links to pages containing personal data that come up as a result of a search for his (or your) name if that data is inadequate, irrelevant or no longer relevant or excessive. That’s a very broad right to be forgotten, and could have been much more limited – perhaps referring to a lack of “legitimate reason” or that linking to it is not “necessary in a democratic society”, to coin a few phrases. It does come with an important limit however – public figures are far less likely to be able to invoke the right to be forgotten.
Eleonora describes the judgment as “shocking”, while many commentators have denounced it as censorship. But have search engines been having it too easy for a while? Google France let them off the hook completely when it came to keyword advertising using other people’s trade marks. Svensson gave the thumbs up for search engine’s primary activity, linking.
Despite all the uproar, this Kat actually thinks the CJEU has (for once) done a good job. The mass of information available about all of us at the typing of our names is, frankly, terrifying, and all the more so for the younger kittens amongst us who have (or are) growing up with the Internet, social media and mobile data as a part of their daily lives. In the “olden days”, one might commit a crime, serve his or her time, and then move on with life. More innocently, one might do or say something a little silly while inebriated, face ridicule from friends the following day, and then move on with life. But now that’s not so easy. The demons of one’s past may be forever stored online. That poorly thought through email to a colleague that went viral. The hilarious but now regrettable stag-do shot. The thing you said on a forum when you were 12 and didn’t know what you were talking about. Should all of those things stay online to haunt your forever, available on demand for every acquaintance, romantic interest, potential employer or cyberstalker to peruse?
Buzz - as a public figure
he's unlikely to benefit here
The CJEU thinks not, and this Kat agrees. The CJEU notes that search engines allow a user by searching for a person’s name “to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him”. Thirty years ago you’d have to employ the services of a private investigator to get the same results. Now you can do it in seconds, and we should really be asking whether that is a “good” thing.
As the Google Spain decision only concerns searches for someone’s name, it is only going to be of interest to those with sufficiently uncommon monikers. There are only two Darren Meales in the world of which this Kat is aware, and the other lives in Australia. Searching suggests he’s yet to do anything silly and compared to this Kat, he’s keeping his head down. If your name is more common, like those of James Smith, Maria Garcia, Mary Smith or Robert Johnson, you’re unlikely to have anything to worry about anyway.

5 comments:

Anonymous said...

The effect is that this Kat (and you) can ask for the removal of any links to pages containing personal data that come up as a result of a search for his (or your) name if that data is inadequate, irrelevant or no longer relevant or excessive. That’s a very broad right to be forgotten ...

Not broad at all. A person usually provides certain information about himself with a specific purpose, often for a limited period of time, while later, in Google, the same information is used for a broader, more general purpose, often for undefined, for the person in question, amount of time. As far as I've understood, this is what happened in Google Spain.

Anonymous said...

"As the Google Spain decision only concerns searches for someone’s name, it is only going to be of interest to those with sufficiently uncommon monikers."

No – that definitely has to be wrong. The judgment goes much further than the right to be forgotten and search engines.

The interpretation of the Data protection directive's territorial scope – Art 4(1)(a) – is much broader than previously anticipated, and would capture most Internet companies targeting the EU or making revenue from it (so that includes all social media sites too); or maybe anything even with targeted ads, so all websites with adwords? who knows. it'll be up to national data protection authorities to decide.

And its not just about the right to be forgotten. If Google / any Internet company falling within Art 4 DPD thus falls within the DPD, it is subject to all of its obligations, absent a relevant derogation.

So all of the data quality principles, under Art 6 – limited use, no further processing, accuracy of data, etc etc etc

And the required processing conditions under Art 7.

The requirement to notify the national DPA under Art 18

And to notify the data subject that you are processing under Art 10-11

lets not even go into sensitive data under Art 8, which is a no go zone for processing, including data such as medical information, ethnic origin ... things which im sure many google webpages contain. they'll all be totally illegal to process (ie put onto Google's index) save the subject's consent – good luck getting that

and assuming Lindqvist is no longer good law, or that it can be distinguished, Google is not allowed to transfer the processed data to any third country without adequate data protection regimes – Art 25/26.

Given the nature of the internet, that would prohibit google entirely.

If you actually apply the DPD to Google now, and go beyond the right to be forgotten obligations under Arts 12 + 14, and which is trivial in comparison, you very quickly come to the conclusion that Google is basically entirely illegal.

And so would any search engine.

And probably facebook unless a derogation applies, eg Art 3(2)

That's why the judgment is mad. If enforced it destroys the Internet. Google will need to appeal


Anonymous said...

Anonymous @ 17:17,

Is there not a bigger issue with this topic with the Wayback Machine?

Fred Logue said...

@Anonymous 20:25

I think your point was similar to the AGs point. He was of the view that the role search engines play as enablers of the internet merited a form of exemption from DP liability akin to that found for intermediary information service suppliers in the ecommerce directive.

The Court took an entirely opposite view and said the role search engines play in indexing and presenting structured personal information that could not be obtained elsewhere meant that they must be subject to DP regulation in order to meet the objectives of the directive to provide strong protection for the privacy of individuals even where such regulation conflicted with the economic interests of the search engines.

Your point that whole raft of hitherto unregulated businesses both within Europe and elsewhere will now be subject to the full range of EU DP compliance responsibilities is, in my view, also correct.

Anonymous said...

I think this is an important first step in public policy regulating the internet. Google is more than capable of coping with the complexity of it. Clearly the effects on smaller businesses need to be mitigated as much as possible.

Subscribe to the IPKat's posts by email here

Just pop your email address into the box and click 'Subscribe':