The document discusses the "right to be forgotten" ruling by the European Court of Justice that search engines like Google must remove inadequate, irrelevant or excessive personal information from search results upon request. It provides background on the case that prompted the ruling involving a Spanish man seeking removal of outdated information about debts. The ruling has been both praised and criticized for its implications on privacy rights versus free expression. There is debate around whether similar laws could exist in the United States given its different legal framework around privacy and data protection.

1. A Presentation by
Bill Hannay
Charleston Conference 2014

2.  The right to privacy has been a hot topic for
several years, but in the past six months the
hottest privacy topic in Europe – and to only a
slightly lesser extent in the United States and
elsewhere around the world – is the
enforcement of a “right to be forgotten.”
 It is also known as “the right to oblivion.”

3. On May 13, 2014, the European Court of Justice
held that the operator of a search engine (Google)
is obliged to remove from the list of results
displayed – following a search made on the basis
of a person’s name – links to web pages,
published by third parties and containing
information relating to that person, if such
information is “inadequate, irrelevant or no
longer relevant, or excessive” in relation to the
purposes for which the data was collected or
processed and in the light of the time that has
elapsed (even if the information is true).

4. Google-iath
Mario

5.  In Google Spain SL and Google Inc. v. Agencia
Española de Protección de Datos (AEPD) and
Mario Costeja González, CJEU Case C-131/12
(13 May 2014), the European Court of Justice
established a major legal precedent that a
search engine company like Google is
responsible for the data that it displays because
it is a “processor” of that data, not just a
passive conduit, and thus a “controller” of it.
 The Court’s ruling came in response to a series
of questions from a Spanish court.

6.  In 2009, Mr. Costeja González discovered that a
Google search of his name pulled up two
newspaper articles from 1998, describing the
forced sale of his home to pay overdue debts.
 He asked the newspaper and Google to remove
the articles on the ground of irrelevancy
because the debts had long ago been resolved.
 When they refused, he filed a complaint with
Spain's data protection agency. It concluded
that Google had violated EU privacy laws.
 Google appealed to Spain’s high court, which
referred several legal questions to the ECJ.

7.  Technically, the case involved interpreting
Directive 95/46/EC of the European
Parliament and of the Council of 24 October
1995 on the protection of individuals with
regard to the processing of personal data and
on the free movement of such data.
 Quite a mouthful, no?
 So it’s referred to as the “EU Data Directive”
 The result in the case was foreordained by the
Directive’s provisions.

8.  6(1). Member States shall provide that personal data
must be: (c) adequate, relevant and not excessive in
relation to the purposes for which they are collected
and/or further processed; [and] (d) accurate and,
where necessary, kept up to date . . . .
 12. Member States shall guarantee every data
subject the right to obtain from the controller: . . . (b)
as appropriate the rectification, erasure or blocking
of data the processing of which does not comply with
the provisions of this Directive, , in particular
because of the incomplete or inaccurate nature of the
data . . . .

9.  The ECJ held that “processing of personal
data . . . carried out by the operator of a search
engine is liable to affect significantly the
fundamental rights to privacy and to the
protection of personal data . . . since that
processing enables any internet user to obtain . . .
information which potentially concerns a vast
number of aspects of [an individual’s] private life
and which, without the search engine, could not
have been interconnected or could have been
only with great difficulty . . . .”

10.  The court emphasized that “the effect of the
interference with those rights of the data subject
is heightened on account of the important role
played by the internet and search engines in
modern society, which render the information
contained in such a list of results
ubiquitous . . . .” BUT . . .
 “A fair balance should be sought . . . between
[the legitimate] interest [of internet users in
having access to information] and the data
subject’s fundamental rights.”

11.  Balance “may . . . depend on the nature of the
information in question and its sensitivity for the
data subject’s private life and on the interest of
the public in having that information, an interest
which may vary, in particular, according to the
role played by the data subject in public life.”
 In the case of Mr. Costeja González, the balance
tipped in his favor, overriding the economic
interest of the search engine operator and the
general public’s interest in the data about him.

12.  On request of an individual to remove
information about him/her, a data
“Controller” must balance the individual’s
privacy rights against the public’s interest in
the information at issue and remove the data if
the individual’s rights outweigh the public’s.
 Google has now published an online form for
EU citizens to request removal of data links.
 On its first day of service, Google received
12,000 requests to remove links about them.

13.  Google has mounted a publicity campaign,
holding seminars in major cities in Europe.
 Wikipedia co-founder Jimmy Wales is reported
to have described the EU's Right to be
Forgotten as “deeply immoral” and warned
that the ruling will “result in an internet
riddled with memory holes".
 A legal commentator characterizes the
judgment as “profoundly harmful to the
operation of the internet and a betrayal of
Europe's legacy in protecting freedom of
expression.”

14.  A Conservative MP in the UK said: “This
ruling is a draconian attack on free speech and
transparency. It highlights the increasingly
authoritarian dimension to the EU.”
 An anti-censorship spokesman called the
ruling “retrograde” and said “This is akin to
marching into a library and forcing it to pulp
books.”

15.  A leader in the UK Parliament praised the
decision, saying “The presumption by internet
companies . . . that they can use people’s
personal information in any way they see fit is
wrong, and can only happen because the legal
framework in most states is still in the last
century when it comes to property rights in
personal information.”
 A privacy advocate has argued that "Without
the freedom to be private, we have precious
little freedom at all.”

16.  I think that it is a great decision … a careful and
correct application of the EU Data Privacy law,
recognizing the need for balancing all interests.
 More than that, it is a vital first step in trying to
bring the insanity of the Internet under control. It’s
already destroyed legitimate newspapers and is
now gutting libraries. It’s easier to find porn and
libel than Shakespeare on the Internet.
 It’s all well and good to worship “free expression”
but you can’t yell fire in a crowded movie theater
just ‘cuz you’re “expressing” yourself.
 We need to take control of this Wild West now
before it gets worse.

17.  Europe, schmeurope … What about the U.S.?
 Could Google happen here? Maybe, maybe not.
 We don’t have a broad-based law anything like
the Data Directive. Nothing in the Constitution
says that a data controller has to remove or
take down data that is irrelevant or inaccurate.
 But we do regulate data use and content in one
notable area: credit reporting. The Fair Credit
Reporting Act imposes certain rules on
accuracy, relevance, and obsoleteness.

18.  We do recognize a hazy kind of “invasion of
privacy,” but it’s very spotty.
 Some state laws prohibit use of a name or
likeness for advertising without consent.
 Of course, there are defamation and slander
laws, but they require intent and damages.
 Intrusion upon seclusion? See Restatement 2d
of Torts, § 652B. Kind of a trespass theory.
 Best shot? Restatement 2d of Torts, § 652D –
public disclosure of embarrassing private facts.

19.  In June 2014, a judge in British Columbia
ordered Google to block a group of websites
from its worldwide search engine.
 It is not a privacy case. It is a trade secret case,
where the plaintiff sought an injunction to
prevent the defendant from selling its services
over the Internet. Court held it had the power.
 Plaintiff persuaded the court that Google was
(unwittingly) facilitating the violations by
linking users to defendant’s website.

20.  You are dedicated to preserving information.
 Printed information in books and periodicals …
information captured on CDs and DVDs … as
well as e-books … and now every library is filled
with computer terminals for patrons and
scholars and students to access e-info online.
 It tears your heart out to have to discard “old”
books and magazines into the dumpster.
 But what about “bad” or “private” info? What
do you say when someone asks you to help them
takedown false, old or embarrassing info?

21. Lethe
(n.) a river in the Greek underworld that, when drunk
from, made souls forget the sufferings of life; oblivion or
something to make you enter oblivion and forget.

22.  In the U.S., many online hosts offer procedures
for requesting that they voluntarily remove (or
take down) material from their websites.
 They are basically used to respond to copyright
infringement claims, and less often involve
libel and other illegal content. See, e.g.,
www.youtube.com/t/community_guidelines.
 Notice and takedown is mandated as part of
the safe harbor provision for online hosts in the
Digital Millennium Copyright Act 1998 .

23. Forget him ‘cuz he doesn't want fame.
Forget him ‘cuz it isn’t fair.
Don't let them search for his old data
'Cause they can't find the dirt that isn't there.
Google guy, I am asking politely,
Remove those links so they can’t see.
Oh don’t you cry now, just be a good guy now;
Forget him and guard his privacy.