Will the European Union really protect online privacy?

On the 13th May the Court of Justice of the European Union (EU) ruled that the region’s citizens should be able to request that search engines like Google remove links to web pages with “inadequate, irrelevant or no longer relevant” information.

This so called ‘right to be forgotten’ caused a subsequent storm of reaction, and accusations of censorship. In essence it allows any of us to do a search on our name and, if we regard any of the results as meeting the description above, ask the search engine we used to remove those links.

The ruling was the end result of a long running court battle by a Spanish citizen, who had lodged a complaint against a Spanish newspaper, the national data protection agency and Google because he believed details of his repossessed home linked to through Google infringed his privacy rights. Paradoxically, the man campaigning so hard to remain anonymous, Mario Costeja González, will forever be remembered as the person that brought, and won, this action.

The ruling is based on an existing law, the EU 1995 Data Protection Directive. The new bit was the confirmation that this law applied not just to content carrying web sites, but also search engines. It was also established that the law was relevant to company servers located outside the EU and that all EU citizens have the right to require the removal of personal data held on these servers.

The EU fact-sheet issued in reference to this ruling (C-131/12) certainly makes interesting reading. It soon reveals the muddle this ruling has created for both EU citizens and any company active in the EU.

A core phrase for example, is: “individuals have the right – under certain conditions – to ask search engines to remove links with personal information about them”. This applies where the information is, “inaccurate, inadequate, irrelevant or excessive for the purposes of the data”. These sound like very loose definitions.  In the case in point, it’s hard to see how aged information about a repossession really fits any of the criteria. But clearly it does.

As if to underline this confusion, the fact-sheet also proudly cites the fact that the disputed information is still on the original web site’s (lavanguardia.com) archive. So the law rules that it’s OK to keep the information out there, but prohibits the mechanisms which help us find it.

For search engine services, this adds another burden (alongside the copyright one already extant) to vet search results, and the onus now lies with them to determine whether each individual’s request for removal are justified, with recourse to the courts only where there is disagreement. So search engines end up as de-facto police of a law they don’t agree with.

There is another side to this debate: The point has now been clearly established that a search engine is not analogous to just any old content website, and that its function carries unique responsibilities.  Search engines are typically used for a wide variety of purposes, and now have to be viewed legally, in that same wide variety of ways. Thus a search engine being used for credit checking purposes (which would be relevant for the case in question) perhaps has different responsibility of privacy and disclosure than one being used to aggregate the latest news.  Even though both are tasks undertaken on Google servers.

So it’s not just the legal eagles who are struggling with this stuff, but all of us. We are trying to define new boundaries for something which does not have clear edges, either functional or geographic.  The ruling makes it clear to web site owners (all of us), that there will be continued  uncertainty about aspects of the internet until legal precedent starts to establish new rules for the unruly.

What this particular ruling fails to account for is the reach of the internet. What will the EU courts do if a site outside its sphere of influence sets up an unblocked, unrestricted, search engine? Will we then see sites being blocked domain by domain by EU judges? Are we on a journey to full blown censorship?

Mechanisms to challenge misinformation, defamation or slander remain in place, just as they always have. Instead, this ruling appears to be a smaller and more specific instrument. Its prime effect is to make search engine suppliers (and how many of those are there really?) build better mechanisms to collect and administer the demands for removal. These have, predictably, soared followed the ruling. In just the first four days of publishing its ‘removal request form’ Google received 41,000 such requests.

Wikepedia’s founder, Jimmy Wales, is a member of the seven-member expert advisory committee Google has set up to oversee this ‘right to be forgotten’ for the company. It’s obvious why he’s there, as his view is quite simple. When asked if adults should ever have the right to have search engine remove links to stories that mention them, he replied: “Absolutely not, under no circumstances ever is it OK to use the force of law to suppress truthful speech. The very idea is disgusting and philosophically bankrupt.”

But surely one man’s philosophical bankruptcy might be another man’s chance to escape events long since past and atoned for.  Even Jimmy Wales needs to consider how such subtleties can be supported in a global environment of balanced rights, responsibilities and compromise…