Abstract
In the landmark decision Google Spain v AEPD and Mario Costeja González, the Court of Justice of the European Union has declared that individuals have a so-called ‘right to be forgotten’, that is, the right to demand search engines to erase search results obtained through searches for their names. The ruling has been praised by many and seen as a welcome relief for individuals who were gradually losing all control over the private information stored about them online. However, because the court has failed to provide proper guidance as to the application and scope of the new right, the ruling has opened risks to freedom of expression and the right to receive and impart information as well as introduced questions as to the legitimacy, fairness and international scope of the delisting process. Taking a closer look at the problems currently surrounding the right to be forgotten, this paper will attempt to narrow down and define the scope of the application of the new right. In order to do so, it will first argue that personal information should be predominantly protected by reliance on existing laws rather than through the creation of an ambiguous right to delist search results. It will then advocate for a rejection of the court’s broad formulation of the right to be forgotten and suggest that, in order to attain a fairer balance between the fundamental rights at stake, the right should be only permitted to apply in three, clearly defined and limited circumstances.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
‘Personal data’ is defined in Directive, Art. 2(a) and GDPR, Art. 4(1). ‘Processing’ is defined in Directive, Art. 2(b) and GDPR, Art. 4(2).
- 2.
‘Controller’ is defined in Directive, Art. 2(d) and GDPR, Art. 4(7).
- 3.
See, e.g. the website http://hiddenfromgoogle.afaqtariq.com/ which archives deleted links and displays them together with the relevant search term and the source that revealed the de-listed information.
- 4.
Charter of Fundamental Rights of the European Union, Art. 11(1); European Convention on Human Rights, Art. 10.
- 5.
Note that the European Convention on Human Rights does not contain a right to data protection but the ECHR largely includes such right in the Art. 8 right to respect for private life.
- 6.
The EU Justice Commissioner stated that the RtbF must not ‘take precedence over freedom of expression or freedom of the media’ [20].
- 7.
See also GDPR, Recital 65.
- 8.
- 9.
The further retention of the personal data will be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.
- 10.
- 11.
- 12.
Since Google Spain, Google has evaluated over 1,835,005 URLs [34].
- 13.
- 14.
Note that the term ‘RtbF’ is not used, even once, in that document.
- 15.
See Sect. 2.2.
- 16.
See also Shoor [26]; Code Civil (French Civil Code), arts. 9-10 and Grundgesetz für die Bundesrepublik Deutschland (Basic Law for the Federal Republic of Germany), §1–2.
- 17.
See, e.g. the Rehabilitation of Offenders Act 1974. Note also the existence of the so-called ‘Mary Bell injunctions’ protecting the identity of offenders discussed, e.g. by Whitehead [48].
- 18.
See also Graux, Ausloos and Valcke [58].
- 19.
See also Rosen [66].
- 20.
- 21.
See also Microsoft’s report on revenge porn removal requests on Bing [75].
- 22.
See criteria 4.2.1.3 and 4.2.1.6 of the report prepared by The Advisory Council to Google [26].
- 23.
This appears to be an apt conclusion considering that Google accounts for 93% of online and mobile search traffic worldwide [77].
- 24.
See also the recent decision of the Brazilian courts not to recognise a RtbF, as discussed by Sganzerla [79].
References
Internet Live Stats. http://www.internetlivestats.com. Accessed 28 Nov 2016
Case C-131/12 Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. EMLR 27 (2014)
Brock, G.: The Right To Be Forgotten: Careless, Muddled And Risky (European Journalism Observatory, 13 October 2016) (2016). http://en.ejo.ch/media-politics/the-right-to-be-forgotten-careless-muddled-and-risky. Accessed 15 Nov 2016
Siry, L.: Forget me, forget me not: reconciling two different paradigms of the right to be forgotten. Ky LJ 3(103), 311 (2015)
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. OJ L281/31 (1995)
de Azevedo Cunha, M.V., Itagiba, G.: Between privacy, freedom of information and freedom of expression: is there a right to be forgotten in Brazil? CLSR 32(4), 634 (2016)
House of Lords: European Union Committee, 2nd Report of 2015, ‘EU Data Protection law: a ‘right to be forgotten’?’, HL Paper 40 (2015)
Posner, E.: We All Have the Right to Be Forgotten (Slate, 14 May 2014) (2014). http://www.slate.com/articles/news_and_politics/view_from_chicago/2014/05/the_european_right_to_be_forgotten_is_just_what_the_internet_needs.html. Accessed 14 Nov 2016
Bradley, P.: Data, data everywhere. LIM 14(4), 249 (2014)
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). OJ L 199/1 (2016)
van Alsenoy, B., Kuczerawy, A., Ausloos, J.: Search engines after Google Spain: internet@liberty or privacy@peril? KU Leuven Interdisciplinary Centre for Law & ICT. https://ssrn.com/abstract=2321494. Accessed 8 Oct 2016
Guadamuz, A.: Who Wants to be Forgotten? (Society for Computers & Law, 14 October 2014) (2014). http://www.scl.org/site.aspx?i=ed38893. Accessed 24 Oct 2016
Peguera, M.: In the aftermath of Google Spain: how the “right to be forgotten” is being shaped in Spain by courts and the Data Protection Authority. IJLIT 23, 325 (2015)
Kulk, S., Borgesius, F.Z.: Google Spain v. González: did the court forget about freedom of expression? EJRR 5(3), 289 (2014)
Case C-73/07 Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy. ECR I-9831 (2008)
Case C-101/01 Lindqvist v Aklagarkammaren i Jonkoping. ECR I-12971 (2003)
Case No 24061/04 Aleksey Ovchinnikov v Russia (2011)
Case No 35841/02 Österreichischer Rundfunk v Austria (2006)
Case No 39954/08 Axel Springer AG v Germany (2012)
Reding, V.: The EU Data Protection Reform 2012: Making Europe the Standard Setter for Modern Data Protection Rules in the Digital Age’ (European Commission, 22 January 2012) (2012). http://europa.eu/rapid/press-release_SPEECH-12-26_en.htm. Accessed 12 Oct 2016
Article 19: Policy Brief – The “Right to be Forgotten”: Remembering Freedom of Expression. https://www.article19.org/resources.php/resource/38318/en/policy-brief:-the-right-to-be-forgotten. Accessed 5 Oct 2016
Sartor, G.: The right to be forgotten: balancing interests in the flux of time. IJLIT 24, 72 (2016)
Korenhof, P., Ausloos, J., Szekely, I., Ambrose, M., Sartor, G., Leenes, R.: Timing the right to be forgotten: a study into “Time” as a factor in deciding about retention or erasure of data. In: Gutwirth, S., Leenes, R., de Hert, P. (eds.) Reforming European Data Protection Law. LGTS, vol. 20, pp. 171–201. Springer, Dordrecht (2015). doi:10.1007/978-94-017-9385-8_7
McNealy, J.: The emerging conflict between newsworthiness and the right to be forgotten. N Ky L Rev. 39, 119 (2012)
Article 29: Data Protection Working Party, ‘Guidelines on the implementation of the Court of Justice of the European Union judgement on “Google Spain and INC v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González” C-131/12’. WP225, 26 November 2014
The Advisory Council to Google on the Right to be Forgotten, 6 February 2015. https://www.google.com/advisorycouncil. Accessed 12 Oct 2016
Fraser, D.: You’d better forget the right to be forgotten in Canada (Canadian Privacy Law Blog, 28 April 2016) (2016). http://blog.privacylawyer.ca/2016/04/youd-better-forget-right-to-be.html. Accessed 25 Oct 2016
Lee, D.: Google reinstates ‘forgotten’ links after pressure (BBC News, 4 July 2014) (2014). http://www.bbc.co.uk/news/technology-28157607. Accessed 4 Oct 2016
Gratton, E.: Challenges with the Implementation of a Right to be Forgotten in Canada (Eloïse Gratton, 28 April 2016) (2016). http://www.eloisegratton.com/blog/2016/04/28/challenges-with-the-implementation-of-a-right-to-be-forgotten-in-canada/. Accessed 25 Oct 2016
Trillmich, P., Hickman, T.: UK ICO recommends personal liability of directors for breaches of data protection law (Lexology, 27 October 2016) (2016). http://www.lexology.com/library/detail.aspx?g=45767c9b-1759-456b-b77c-8e4100302fa3. Accessed 9 Nov 2016
Shoor, E.: Narrowing the right to be forgotten: why the European Union needs to amend the proposed data protection regulation. Brook J. Int. L. 39(1), 487 (2014)
Lee, E.: Judge Google: Why the EU Should Embrace Google’s Role in the Right to Be Forgotten (The Huffington Post, 5 July 2015) (2015). http://www.huffingtonpost.com/edward-lee/judge-google-why-the-eu-s_b_7232688.html. Accessed 24 Oct 2016
Kuner, C.: The Court of Justice of the EU Judgement on Data Protection and Internet Search Engines, LSE Law, Society and Economy Working Papers 3/2015. https://www.lse.ac.uk/collections/law/wps/WPS2015-03_Kuner.pdf. Accessed 12 Oct 2016
Google: Transparency Report: European privacy requests for search removals’ (Google, 26 December 2016) (2016). https://www.google.com/transparencyreport/removals/europeprivacy/?hl=en>. Accessed 26 Dec 2016
Kerr, J.: What is a search engine? The simple question the court of justice of the European Union forgot to ask and what it means for the future of the right to be forgotten. Chi J. Int. L. 17(1), 217 (2016)
Kaye v Robertson. FSR 62 (1991)
OBG Ltd. v Allan. UKHL 21 (2007)
Peck v UK. ECHR 44 (2003)
CTB v News Group Newspapers Ltd. EWHC 1326 (2011)
Murray v Big Pictures (UK) Ltd. EWCA Civ 446 (2008)
Campbell v MGN Limited. UKHL 22 (2004)
Applause Store Productions Ltd. v Raphael. EWHC 1781 (2008)
Prince Albert v Strange. 47 ER 1302 (1849)
Lachaux v Independent Print Ltd. EWHC 620 and the Defamation Act 2013 (2015)
Edmund Irvine v Talksport Ltd. 2 All ER 414 (2002)
Ratcliffe v Evans. 2 QB 524 (1892)
Pagallo, U., Durante, M.: Legal memories and the right to be forgotten. In: Floridi, L. (ed.) Protection of Information and the Right to Privacy - A New Equilibrium?. LGTS, vol. 17, pp. 17–30. Springer, Cham (2014). doi:10.1007/978-3-319-05720-0_2
Whitehead, T.: Venables protected by rare identity ban (The Telegraph, 4 March 2010) (2010). http://www.telegraph.co.uk/news/uknews/law-and-order/7361451/Venables-protected-by-rare-identity-ban.html. Accessed 3 Dec 2016
Information Commissioner’s Office: Information Commissioner’s Office, ‘Bankruptcy’. https://ico.org.uk/for-the-public/bankruptcy/. Accessed 12 Oct 2016
Conway, L.: Discharge from bankruptcy (House of Commons Library, 8 October 2015) (2015). http://researchbriefings.parliament.uk/ResearchBriefing/Summary/SN03043. Accessed 12 Oct 2016
Klug, F., Starmer, K., Weir, S.: The Three Pillars of Liberty: Political Rights and Freedoms in the United Kingdom. Routledge, London (1996)
Public Order Act 1986
Obscene Publications Act 1959
Obscene Publications Act 1964
Protection of Children Act 1978
Terrorism Act 2006
Ambrose, M., Ausloos, J.: The right to be forgotten across the pond. J. Inf. Policy 3, 1 (2012)
Graux, H., Ausloos, J., Valcke, P.: The Right to be Forgotten in the Internet Era (ICRI Working Paper, 12 November 2012) (2012). https://ssrn.com/abstract=2174896. Accessed 27 Oct 2016
Mosley v News Group Newspapers Ltd. EWHC 1777 (2008)
Facebook: How do I hide or delete posts I’ve shared from my Page? https://www.facebook.com/help/252986458110193. Accessed 12 Nov 2016
Korea Communications Commission: KCC Takes Measures to Guarantee “Right to be Forgotten”. http://eng.kcc.go.kr/download.do?fileSeq=43299. Accessed 14 Oct 2016
California Penal Code. §647 (2014)
Bolton, R.L.: The right to be forgotten: forced amnesia in a technological age. J. Marshall J. Inf. Technol. Priv. L. 31, 133 (2015)
Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) COM. 11 final (2012)
Charter of Fundamental Rights of the European Union. Art. 1
Rosen, J.: The right to be forgotten. Stan. L. Rev. Online 64, 88 (2012)
Sellars, S.: Online privacy: do we have it and do we want it? A review of the risks and UK case law. EIPR 33(1), 9 (2011)
Tabuchi, H.: Facebook Wins Relatively Few Friends in Japan (The New York Times, 9 January 2011) (2011). http://www.nytimes.com/2011/01/10/technology/10facebook.html. Accessed 8 Dec 2016
Madden, M.: Privacy management on social media sites (Pew Research Centre, 24 February 2012) (2012). http://www.pewinternet.org/2012/02/24/privacy-management-on-social-media-sites. Accessed 30 Nov 2016
Mayer-Schönberger, V.: Delete: The Virtue of Forgetting in the Digital Age. Princeton University Press (2009). or Weber, R.: The right to be forgotten – more than an Pandora’s Box? JIPITEC. 2, 120 (2011). http://www.jipitec.eu/issues/jipitec-2-2-2011/3084. Accessed 12 Oct 2016
Ambrose, M.: It’s about time: privacy, information life cycles, and the right to be forgotten. Stan. Technol. L. Rev. 16(3), 101 (2013)
BBC News: Internet trolls targeted with new legal guidelines (BBC News, 10 October 2016) (2016). http://www.bbc.co.uk/news/uk-37601431. Accessed 14 Oct 2016
Garsd, J.: Internet Memes and “The Right To Be Forgotten” (NPR, 3 March 2015) (2015). http://www.npr.org/sections/alltechconsidered/2015/03/03/390463119/internet-memes-and-the-right-to-be-forgotten. Accessed 24 Oct 2016
Google: Remove “revenge porn” from Google. https://support.google.com/websearch/answer/6302812. Accessed 4 Dec 2016
Microsoft: Content Removal Requests Report. https://www.microsoft.com/about/csr/transparencyhub/crrr/. Accessed 10 Dec 2016
Angelo, M.: You Are What Google Says You Are (Wired, 2 November 2009) (2009). https://www.wired.com/2009/02/you-are-what-go. Accessed 12 Nov 2016
eMarketer: How Much Search Traffic Actually Comes from Googling? (eMarketer, 13 January 2015) (2015). https://www.emarketer.com/Article/How-Much-Search-Traffic-Actually-Comes-Googling/1011814. Accessed 30 Nov 2016
Yan, M.N.: Protecting the right to be forgotten: is mainland China ready? Eur. Data Prot. L. Rev. 1, 190 (2015)
Sganzerla, T.: Brazil Superior Court Rules in Google’s Favor, Against “Right to Be Forgotten” (advox, 21 November 2016) (2016). https://advox.globalvoices.org/2016/11/22/brazil-superior-court-rules-in-googles-favor-against-right-to-be-forgotten/. Accessed 12 Dec 2016
Toobin, J.: The Solace of Oblivion - in Europe, the right to be forgotten trumps the Internet (The New Yorker, 29 September 2014) (2014). http://www.newyorker.com/magazine/2014/09/29/solace-oblivion. Accessed 12 Oct 2016
Cunningham, M.: Free Expression, Privacy and Diminishing Sovereignty in the Information Age: The Internationalization of Censorship. Arkansas Law Review (2015). https://ssrn.com/abstract=2706730. Accessed 14 Oct 2016
Werro, F.: The right to inform v the right to be forgotten: a transatlantic clash. In: Ciacchi, A.C., et al. (eds.) Liability in the Third Millennium. FRG (2009)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendix
Appendix
1. Directive 95/46/EC
Article 12 - Right of Access
Member States shall guarantee every data subject the right to obtain from the controller:
-
(a)
[…];
-
(b)
as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
-
(c)
notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.
Article 14 - The Data Subject’s Right to Object
Member States shall grant the data subject the right:
-
(a)
at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data; […].
2. Google Spain v AEPD and Mario Costeja González
94. Therefore, if it is found, following a request by the data subject pursuant to Article 12(b) of Directive 95/46, that the inclusion in the list of results displayed following a search made on the basis of his name of the links to web pages published lawfully by third parties and containing true information relating to him personally is, at this point in time, incompatible with Article 6(1)(c) to (e) of the directive because that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine, the information and links concerned in the list of results must be erased.
3. Regulation (EU) 2016/679
Recitals
(65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ […]. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. […]
Article 17 - Right to Erasure (‘right to be forgotten’)
1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
-
(a)
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
-
(b)
the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
-
(c)
the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
-
(d)
the personal data have been unlawfully processed;
-
(e)
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
-
(f)
the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. […]
Article 19 - Notification Obligation Regarding Rectification or Erasure of Personal Data or Restriction of Processing
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Sobkow, B. (2017). Forget Me, Forget Me Not - Redefining the Boundaries of the Right to Be Forgotten to Address Current Problems and Areas of Criticism. In: Schweighofer, E., Leitold, H., Mitrakas, A., Rannenberg, K. (eds) Privacy Technologies and Policy. APF 2017. Lecture Notes in Computer Science(), vol 10518. Springer, Cham. https://doi.org/10.1007/978-3-319-67280-9_3
Download citation
DOI: https://doi.org/10.1007/978-3-319-67280-9_3
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-67279-3
Online ISBN: 978-3-319-67280-9
eBook Packages: Computer ScienceComputer Science (R0)