Yesterday the European Court of Justice, based in Luxembourg, passed a landmark ruling that has caused a lot of jubilation among data privacy advocates: the Google US and Spain versus the Spanish Agency for Data Protection and a brave Spaniard who sued Google for listing information on his repossessed home in its search results.
It has been hailed as the precedent that will secure individuals the "right to be forgotten" from the internet, if they so wish. Drunken pics of you and your mates on Facebook? Looking for a job? Ask for those photos to be taken down before the HR guy discovers them 30mins before your interview! Sorted! Or is it?
Sifting through the legalese, let's concentrate just on the actual ruling, i.e. Points 1-4 at the very end of the document / webpage. If you don't get distracted by the article numbers and opening and closing paragraphs, the ECJ has actually ruled the following:
1. Article 2(b) and (d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are to be interpreted as meaning that, first, the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d).
Search engines will practically act as Gatekeepers of the internet ("Controllers"). Translation: Google, Bing, and Co. decide what should be listed in the search results and what not, so say Goodbye to Net Neutrality, transparency and freedom of speech!
3. Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
Search engines have got the obligation - yes, that's nice - but - crucially as Controllers - they also have the right to omit "sensitive" search results. This introduces censorship through the backdoor! If it's up to Google to decide what is sensitive or private or compromising or inaccurate or unfair data, then what will happen to freedom of speech, freedom of information, open data and transparency?
Remember, Google or Bing won't make the sensitive data disappear off the internet completely; it will just be scrubbed out of the search results you and me see. The controversial data will still remain on whatever 3rd party website it was indexed from, potentially forever, whether or not you have volunteered it to said 3rd party website. Think of the public records kept at Companies House; they contain a lot of sensitive and private information on company directors, such as DoB and full postal address. It's the same for any business, whether it's got a turnover of £5 million or just £5K. These 2 data fields can, in principle, be used to impersonate someone and even to commit fraud.
The company records are typically purchased and resold by Yellow Page-type of websites to anyone interested. If an individual who happens to be a company director wants their DoB redacted, Google or Bing may take it down all search results, but it will still be further available, listed, and sold to whoever wants it through the 3rd party Yellow Pages websites.
4. Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, when appraising the conditions for the application of those provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.
Only private individuals have got the right to get their personal data off search results, public figures don't have this right. That's nice, but still, it's then up to Google or Bing now to decide which "subject plays a sufficiently large role in public life" and which doesn't.
This introduces a lot of subjectivity and even more covert censorship and lack of transparency into the whole process. What if some vocal, politically engaged individuals or Union traders need to be "silenced" and have references to their names and blog posts redacted from the search results? You will never know of them or the fact. And what if a corporation or big lobby decides they want to get all negative comments on their products or services on social media conveniently redacted from all internet search results? Who could stop them? Would we even know it's happened? The freedom of speech championed by Social Media and the Word-of-Mouth principle will be both eroded. And the Search Engines will have both absolute control and be susceptible to getting controlled by individuals and companies with enough pulling power.
This ruling seems to have taken 1 step forward and 2 back. It seems to be a victory just for the Search engines who will now be permanently taken off the hook, i.e. will have limited liability in the case of future libel or data breach court cases. So no more Google vs Mr. Gonzalez!
2. Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.
And I left Article 2 last: The ruling has also been hailed for bringing EU control over US companies. Erm, wrong!
Foreign search engines a) have to have an EU-based subsidiary in order to be bound by these rules, meaning that if they don't, they are not! And b) the foreign company with a European subsidiary will only be bound to the laws of the EU member state where said subsidiary is based. So, control and data sensitivity will be open to even more interpretations!
In short, this ECJ ruling is a safety net for Search engines and a can of worms for more private sector control over our personal data and for more censorship of the open, free and transparent internet that we all love and wish for.
This is not the right to be forgotten, it's the right to be ungoogled.