European court's Google ruling provides a blunt instrument to rewrite history

We do have a ‘right to be forgotten’ according to Europe’s highest court today, in a ruling that has international privacy ramifications that will cause problems and rising compliance bills for many businesses.

The ruling (here)  from the European Court of Justice (ECJ) is in response to a 2010 complaint from Spanish citizen Mario Costeja Gonzalez, concerning an old notice detailing his social security debts which had been placed in a newspaper to announce a property auction being held to recover debts.

Gonzalez argument was that as he had since resolved those debts, the information was no longer relevant, but kept coming up in Google search results which he claimed infringed his right to privacy.

Hugo Guidotti, a Madrid surgeon, also asked Google to remove a link to a 1991 report in a newspaper about a malpractice lawsuit against him after an allegedly botched breast surgery. The link turned up in Google searches of his name.

The stance of both complainants was backed by the Spanish privacy watchdog, which ruled that Google should remove the link to the newspaper article from its search results.

This position was of course challenged by Google, first in Spain and then in the higher European court. Its case was that it was merely hosting the information and that any removal of data needed to happen at the originating website level.

Gone against Google

But in a surprise ruling this morning, the ECJ has decided that Google is actually the “controller” of the data and as such it is responsible for removing unwanted links if and when requested to do so.

The ECJ ruled:

An Internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties.

If, following a search made on the basis of a person's name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.

The ruling is surprising as it directly contradicts the opinion of the European Union's advocate general last year who supported Google’s case that operators were under no obligation to honor data removal requests.

The decision is going to have interesting implications not only for Google, but any provider offering search capabilities on third party data. The ECJ consists of 28 judges, one from each of the European Union (EU) member states. As such, its pronouncements and rulings carry considerable weight within the EU.

While providers will not have to comply automatically with every request for deletion, the ruling gives weight to complainants to take their case to national data protection authorities.

That’s likely to lead to a bucket of pain all round as the ECJ ruling is vague on what would be deemed to be a legitimate request and what could turn into activist campaigning against corporates by filing mischievous requests for data deletion that then need to be challenged.

The ECJ also noted a need for a balance to be struck between private rights and public interest to prevent public figures using the ruling to delete evidence of previous actions or statements:

This balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject's private life, which may vary, in particular, according to the role played by the data subject in public life.

All of which woolliness suggests that the people happiest with today’s ruling will be the legal profession!

For its part, Google says:

"This is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the Advocate General's opinion and the warnings and consequences that he spelled out."

The wider impact

In the end, this ruling will be seized upon by privacy activists and the more fervent supporters of beefing up pan-European data protection principles in the post-Edward Snowden environment.

Sure enough, first out of the starting gates was Viviane Reding, European Commissioner for Justice and a lady who’s been ruthlessly exploiting PRISM paranoia in a bid to lay down the law to Washington and demanding the US falls in line with Europe’s definition of data protection. Reding is delighted by the ruling:

“Today's Court Judgement is a clear victory for the protection of personal data of Europeans! Companies can no longer hide behind their servers being based in California or anywhere else in the world.

“No matter where the physical server of a company processing data is located, non-European companies, when offering services to European consumers, must apply European rules. The data belongs to the individual, not to the company. And unless there is a good reason to retain this data, an individual should be empowered – by law ¬ to request erasure of this data.

“The ruling confirms the need to bring today's data protection rules from the "digital stone age" into today's modern computing world where data is no longer stored on "a server", or once launched online disappears in cyber-space. This is exactly what the data protection reform is about: making sure those who do business in Europe, respect European laws and empowering citizens to take the necessary actions to manage their data. Big data need big rights!”

But beyond a nakedly transparent political agenda from a Commissioner rapidly running out of time in office, from a commercial - and societal - standpoint, this ruling may end up doing more harm than good. Luca Schiovani, analyst at Ovum, makes the point:

“This move may sound reassuring for individuals and their personal freedom; however, it also looks difficult to enforce on a large scale, and may be very disruptive for the functioning of search engines going forward.”

“Policy makers in the EU have long advocated for the introduction of a clear “right to be forgotten”, which is included in the draft of the new Data Protection regulation under discussion in the EU Parliament and Council.

”However, these provisions should only apply to the direct controllers of personal data (e.g. a social network complying with the request to fully delete information related to an account).

“Involving search engines for something they are not directly responsible for is likely to entail a burdensome cost, especially if the amount of requests of erasure should escalate in the future.”

Mark Brown, Director of Information Security at Ernst & Young, reckons that the ruling just gave many businesses a severe headache to which they will need to respond:

"The announcement fundamentally changes how companies collect, aggregate, store, retain and ultimately dispose of consumer data and has significant implications.

“At present, most businesses cannot confidently say what data they hold on a consumer and what they have done with this data. There are a number of reasons for this complacency including the rise in companies that outsource data collection which complicates the supply chain.

"We would not be surprised if businesses are quaking in their boots at the thought of responding to a consumer ‘right be to be forgotten’ request. Ultimately, many have very little understanding of their own IT architecture which means compliance with this announcement would be very difficult until processes are changed.

"This announcement shows the EU believes end users should have control of their data. It is a very loud wake up call to all those businesses that are hovering up consumer data and hoarding it for their own benefit."

The ruling was also blasted by freedom of speech lobbyist group Index on Censorship which raged:

The court’s ruling means that, under certain circumstances, information can be removed from search engine results even if it is true and factual and without the original source material being altered. It allows individuals to complain to search engines about information they do not like with no legal oversight.

This is akin to marching into a library and forcing it to pulp books. Although the ruling is intended for private individuals it opens the door to anyone who wants to whitewash their personal history.

With all that in mind - and with the likes of Microsoft et al yet to comment - this one is unlikely to be done and dusted just yet.

Verdict

Bad news about a bad ruling,  made worse by the wooly nature of its wording that leaves too much room for exploitation.

This is a decision made by purist interpretation of legalese and without consideration for the wider societal and commercial impact it will have.

Given the number of revisionist regimes Europe has known across the centuries, providing a blunt instrument for those who would rewrite history to suit their own ends in the present,  is hardly in keeping with the supposed ethos of the European Union.