Where does the 'right to be forgotten' end?

By Graeme Burton
28 May 2014 View Comments
European Union red tape

The two lawyers were almost apoplectic at the way the latest innovations were eroding personal privacy: recent "inventions and business methods", they opined, such as "photographs and newspaper enterprise[s] have invaded the sacred precincts of private and domestic life".

Their solution? Privacy laws to put such infernal inventions back in their proper place. The lawyers were Samuel D. Warren and Louis D. Brandeis, writing in the US Harvard Law Review in December 1890, expounding for the first time the concept of a legal right to privacy.

Further reading

The subject has been open to debate ever since. In the age of Facebook, the Tesco Clubcard, Twitter, identity cards, marketing databases and biometric identification, their attempts to roll back "modern" infringements on personal privacy seem ultimately to have proved futile.

They may, though, have approved of the recent judgment in Google v. AEPD at the European Court of Justice (CJEU), the highest court in the European Union, over the "right to be forgotten" of Mario Costeja Gonzalez.

Gonzalez had complained to Spain's data protection registrar that Google's indexing of a 36-word article in his local newspaper about the repossession of his home in 1998 was an infringement of his personal privacy. Anyone searching his name would be prominently directed to that newspaper article. He had moved on, and didn't see why Google shouldn't too.

At the heart of the decision is the extension of the definition of a "data processor", a concept at the core of EU data protection law.

"The CJEU has, in a very matter-of-fact way, found that Google processes data, a fact that is difficult to deny, [and] that the data which it processes through its search engine usually contains information that identifies people and information that does not identify people," said Pinsent Masons technology lawyer Luke Scanlon. In particular, this personal data is 'processed' in order to serve relevant advertising.

He added: "On this basis Google is a controller of personal information in the search lists in the Court's judgment and its subsidiary in Spain that promotes the advertisements that appear next to search lists is responsible for the legal implications of users accessing those lists."

However, this broad interpretation of what constitutes a 'data processor' could theoretically draw in more than just Google and Microsoft (via the Bing search service). Conventionally, organisations have had to register under the Data Protection Act if they held and processed electronic data about individuals.

Furthermore, the judgment did not draw any clear distinctions between when people (or potentially organisations) do or don't have a right to demand that search engines (or any organisation operating an online service) remove or de-link information.

The UK's Information Commissioner's Office has already said that it will give internet companies time to work out how they will to abide by the ruling. Some may choose to take their operations offshore, while most will no doubt make applicants leap through bureaucratic hoops, on the one hand, but comply without argument when they have done so.

Where the judgment seems to be most inconsistent is that, while it demands that search engines, such as Google's, cease serving information that people might claim is irrelevant, following a request, the 'right to be forgotten' that it pioneers doesn't actually touch the vast database of personal information that Google is collecting, to which it adds every time someone makes so much as a simple Google search.

In other words, it isn't so much a right to be forgotten as a right not to be remembered. For Google, though, it may be an inconvenience but it will still be business as usual.

More ominously, perhaps, 'reputation management' companies will be able to extend their activities and offer services to help cleanse the internet of undesirable information, in the same way that fraudster Robert Maxwell kept so many critics quiet with the threat of the UK's draconian libel laws.

What the judgment does not address is the conflict between one person's 'right to know' with another's right to be forgotten.

Reader comments
blog comments powered by Disqus
Newsletters
Windows 10 - will you upgrade?

Microsoft has made an early version of Windows 10 - its next operating system - available for download. The OS promises better integration and harmonisation across platforms, including mobile and desktop. Will your business be upgrading?

21 %
50 %
12 %
17 %