A lot of people have some skeletons in their Internet closet. Things they’ve done or said that they wish hadn’t been made public. Social networks have made it easier to share posts and pictures without much thought given to their future consequences. And the Internet makes it easy for anyone, including prospective employers, to discover this information long after you’ve forgotten about it.
A recent ruling by Europe’s top court now makes it easier for the Internet to forget about it too. On 13 May, the court ordered Google to remove results for queries that include their name where those results are “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed.” The decision of the European Union’s top court, which affects 500 million citizens, in 28 member states, cannot be appealed. According to ZDNet, more than 10,000 Europeans have requested the company take down information about them via a Web form Google posted on 30 May. The form is the company’s attempt to comply with the law and asks some personal information about the individual as well as the URLs that should be removed.
The court’s decision was in response to Google’s appeal to an order by the Spanish Data Protection Agency, an agency of the government of Spain, to remove links to articles about an individual published in a Spanish newspaper in 1998. According to the New York Times, the case started in 2009 when Mario Costeja, a Spanish lawyer, complained that entering his name in Google led to legal notices dating back to 1998 of an online version of a Spanish newspaper that detailed his debts and the forced sale of his property. Costeja said the debt issues had been resolved many years earlier and were no longer relevant so he asked the newspaper that had published the information, La Vanguardia, to remove the notices and Google to expunge the links. When they refused, Costeja complained to the Spanish Data Protection Agency that his rights to the protection of his personal data were being violated. The Spanish authority ordered Google to remove the links in July 2010, but it did not impose any order on La Vanguardia. Google challenged the order, and the National High Court of Spain referred the case to the European court.
The right to be forgotten is a key part of the EU’s upcoming Data Protection Regulation, proposed in January. The European Commission said users of social networks and other online services should be able to get their personal information deleted when they ask for it, but Google argued that the legislation made unreasonable demands on search engines and platforms such as YouTube and Facebook.
At Google’s recent annual shareholder meeting, its chairman Eric Schmidt said the case was “a collision between the right to be forgotten and the right to know.” The UK’s Information Commission’s Office said the ruling was well-balanced, since it doesn’t give an absolute right to be forgotten and does reflect the role search engines play in facilitating access to information. Prior to the ruling, it was unclear whether Google and other search engines were accountable under European law for search results that affected the privacy of individuals. The ruling applies to search engines and social networks.
The form asks for a user’s details, the links to the ‘outdated information,’ and an explanation of why the person should be removed. Anyone wanting to use the form will also need to provide a scan of their photo ID to deter fraudulent attempts to remove information.
“We will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information,” it says. “When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information—for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials.”
The company published no timeline on when users can expect their requests to be dealt with. Google doesn’t have to remove results simply because it receives a request. The person can also take their case to data protection authorities.
Should the right to be forgotten trump the right to know? What are your thoughts about this ruling, and should it be expanded beyond the EU?