By Blanca Escribano Cañas, Partner at Olswang Spain and Ellen Martinez, Associate at Olswang Spain
Last January Google faced off against the Spanish Data Protection Agency (“Agencia Española de Protección de Datos –”AEPD–“) in the Spanish National Court (“Audiencia Nacional“). The reason: five decisions issued by the AEPD ordering Google to remove from its indexes certain links to websites containing information allegedly affecting individuals’ privacy.
The referred decisions were issued following the request of five individuals who wanted Google not to associate their names with negative events which had occurred years ago and that were published in the online editions of newspapers and regional official gazettes.
While AEPD argues that the right to delete “data trails” in the Internet should be understood as an extension of the right to have data deleted and the right to object, the search giant states that information made available by third parties is public and its removal should be considered someone else’s task.
In particular, Google believes that Spanish and European law rightly hold the publisher of material responsible for its content. Furthermore, from Google’s perspective, requiring intermediaries such as search engines to censor material published by others would have a profound chilling effect on free expression without protecting people’s privacy.
This case feeds the current debate about the so-called “right to be forgotten”, also known as the “right to oblivion”, which enables people to control information about them available on the Internet.
Blocking or censoring certain search results is nothing new for Google (e.g. Google China is known to censor certain search results to the request of the Chinese government). However, what we are talking about here may be a little more complex, as when there is an infringement of mandatory law, the power to delete certain information lies in data subjects.
The European Commission has recently put its eyes on this matter. One of the objectives of next European data protection framework will be “clarifying the so-called ‘right to be forgotten’, i.e. the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes. This is the case, for example, when processing is based on the person’s consent and when he or she withdraws consent or when the storage period has expired.”
The European Data Protection Supervisor has stated that “a newly codified “right to be forgotten” would ensure the deletion of personal data or the prohibition to further use them, without a necessary action of the data subject, but at the condition that this data has been already stored for a certain amount of time. The data would in other words be attributed some sort of expiration date. This principle is already affirmed in national court cases or applied in specific sectors, for instance for police files, criminal records or disciplinary files: under some national laws, information about individuals is automatically deleted or not to be further used or disseminated, especially after a fixed period of time, without need for a prior analysis on a case by case basis”.
However, Article 29 Data Protection Working Party has already put what may be understood as a question mark on the need to regulate this issue. The Working Party considers that “more elaboration of this right would indeed be necessary. It should be clearly explained what the added value of such a right would be over and above the existing rights, such as the right to have data deleted or the right to object, and in which context such a right would be most useful.”
Laws in Germany and Switzerland have already been used to obtain rulings recognizing this right. In France, however, they have only achieved the creation of a code of practice which establishes the right of data subjects to be informed by the search engines about the indexing of their personal data. So far, apparently, the only search engine signatory is Microsoft’s Bing, which has committed itself to working with publishers to facilitate the removal of certain content from its index and to update its cache when a modification is made or information de-indexed.
It seems that there should be a difference on the treatment of the information a person uploads of themselves (which is clearly the case with social networking or blogging) and the information uploaded by newspapers and official gazettes.
In the first scenario it seems logic to have the right to delete the information you don’t want to appear on the Internet, as what a person discloses at one stage of their life may not be something they want everyone to have available forever.
However, what happens when the right to be forgotten collides with the right to information, the freedom of expression or with the obligation to inform established by the legislation (which is the case with the official gazettes)? What if the information is accurate or a final decision has been held? Should we have the power to rewrite our digital history as it is told by the search engines? To what extent should data subjects have the right to make themselves disappear from the Internet?
In the case of social networking, let’s think about the scenario where someone posts a picture with a couple of friends. Later on, for one reason or the other, one of the persons on the photo decides he doest want that picture to be available on the Internet anymore. But what about the rights of the rest of the people in the picture who may want the picture to be displayed? Should that person then ask to block his image in the picture? In this case, whose responsibility should this be?
In Professor Chris Conley’s opinion, four separate areas must be identified where the right to be forgotten might be limited or a process to resolve disputes could be established: conflicts with freedoms of speech and of the press; interactions with the right to contract; records associated with multiple individuals; and situations where deletion is impossible, infeasible, or socially harmful.
In the case at hand, is Google, in any event, the right subject to address to? The AEPD argues that an injunction against search engines is the only way to block access to sensitive data published by these sites as newspapers could legally refuse to comply with more informal requests.
This is an interesting point, given that even when Google blocks the information requested, this information would still be in the servers of newspapers and official gazettes, meaning the information is not actually being erased.
What seams to be clear is that a ruling confirming AEPD’s decisions will create an avalanche of claims, not only in Spain, but also in other countries where the debate has already started.
It was made public at the end of February that, in dealing with Google’s appeal against the AEPD decision, the Audiencia Nacional might be planning to request a preliminary ruling from the Court of Justice of the European Union on the following matters:
- If Google’s activity as a third parties’ content searcher, may be considered to be data processing as defined in Article 2.b) of Directive 95/46. If so, whether Google must guarantee the rights to have data deleted and the right to object referred to in Articles 12.b) and 14.a) of the referred Directive. Also, if the request of data subjects may invoke the right to object referred to in Article 14.a), in conjunction with Article 7.e) and f) of the referred Directive.
- If the AEPD, under the second paragraph of Article 28.3 of Directive 95/46/EC or Article 13.1.e) of Directive 2000/31/EC may require Google to delete or block the information, even if its preservation at the site of origin is lawful, but the applicant considers that its appearance in search results threatens their privacy, dignity or right to oblivion.
- If the AEPD, in connection with the referred Directives, may require the search engine directly, without previously or simultaneously directing itself to the webmaster, to request the withdrawal of the information.
Should this preliminary ruling finally be issued, it would have a great significance as an eventual decision of the Court of Justice will be binding not only to the Audiencia Nacional but also to all of the national courts of the Member States.
Let’s see what the result will be, in particular, how the European Commission is going to address this matter in the modification of the European data protection framework.
Last Wednesday 16 March, Justice Commissioner Viviane Reding unveiled further details on the future regulation of the “right to be forgotten”. For more information, please click here.
See also the article “Non-EU Websites Must Operate Under EU Privacy Laws” published last Wednesday 16 March in The Wall Street Journal.