Google picks holes in EU's 'right to be forgotten'

Google has complained that the terms of Europe's proposed 'right to be forgotten' make unreasonable demands on search engines and hosting platforms such as YouTube and Facebook.

Google has taken issue with the European Commission's proposals on the 'right to be forgotten', which grants gives citizens the right to ask for their personal data to be deleted from social networks.

The search giant set out its argument in a blog post on Thursday, in which global privacy counsel Peter Fleischer said Google supports the principles behind the right, but wants it to be implemented "in a way that not only enhances privacy online, but also fosters free expression for all".

The right to be forgotten is covered by a key rule in the European Commission's long-awaited Data Protection regulation, which it proposed last month. It would allow people to get the organisations that handle their personal data, such as the photographs they post to social-networking sites, to delete it when asked to do so.

Fleischer suggested the regulation does not take into account the distinction between hosting platforms and search engines, nor the nuances of both.

"Responsibility for deleting content published online should lie with the person or entity who published it," he said in the blog post. "Host providers store this information on behalf of the content provider and so have no original right to delete the data. Similarly, search engines index any publicly available information to make it searchable. They too have no direct relationship with the original content."

Fleischer suggested that Google already includes many of the tenets of the regulation in its privacy principles and practices. These include "improved transparency, providing clear information to people and giving them fine-grained privacy choices — including the ability to remove data they uploaded to our services", he said.

Deleting data

However, Fleischer continued, the EU needs to clarify how the right to be forgotten would be applied. In the case of hosting platforms such as Facebook and YouTube, he argued, the responsibility for deleting data should rest with the person who uploads it.

Responsibility for deleting content published online should lie with the person or entity who published it.

– Peter Fleischer, Google

"A user should be able to delete an individual post, photo or video that he or she stored with the hosting platform," Fleischer said. "The user should also be able to delete his or her entire account with a given hosting platform, thereby deleting all the materials he or she had published and which was stored in that account."

The hosting platforms themselves should not have to delete that information instantly, he said.

"There are practical reasons why some delay should be permitted —for example, to prevent the abusive deletion of content when an account has been compromised. Other limits, including legal or contractual obligations, may also legitimately delay deletion in certain circumstances," Fleischer said.

In recent weeks, Google has crossed swords with EU officials over its revamped privacy policy, which is set to be applied in March. Under the revamp, people will not be able to opt out of having their data shared across Google's services and products, and then used in targeted advertising.

The result — an integrated user identity across Google — has implications for the right to be forgotten and other privacy issues. EU officials have asked Google to hold off from implementing the policy refresh until they have had time to assess it, but the company has refused.

Right to be forgotten

The right to be forgotten is outlined in Article 17 of the proposed EU regulation (PDF). One clause says that when someone requests deletion of an item, the service's data controller must "inform third parties which are processing such data, that a data subject requests them to erase any links to, or copy or replication of that personal data".

If the original data controller has authorised a third party to publish that information, the original controller is responsible for that publication, the clause adds.

Google's privacy chief pointed out that any material published online could be copied and re-published anywhere, so it is unreasonable of EU regulators to expect providers such as Facebook and YouTube to keep control over those republished versions.

"Fundamental responsibility for information available online must rest with the party that put that particular copy online, rather than with the hosting platform. This is consistent with the premise of existing European law, namely, the E-commerce Directive," Fleischer said.

Similarly, Fleischer argued that the right to be forgotten should not interfere with search engines' ability to point consumers to information published around the web. However, he added that search engines should "respect the standard ways in which websites instruct search engines whether to crawl and index particular pages, such as header meta tags and robots.txt files".

"Search engines should also provide a means for webmasters to accelerate removal of their site from search results," he continued. "As with hosting platforms, the fundamental responsibility for information available online must rest with the publisher of that information, rather than with a search engine or other similar intermediary."

ZDNet UK has asked the European Commission for comment on Google's argument, but had received none at the time of writing.