The right to be forgotten: Can we really trust Google to decide when our data should die?
According to the latest figures, 41,000 Europeans have asked Google stops providing links to 'outdated information' about them.
The ability to make such a request is the result of a European Court of Justice (ECJ) ruling, handed down last month, in the case of a Spanish national who filed a complaint regarding search results provided by Google to information about him.
Searches for the man's name made through the search engine returned links to two newspaper stories that contained details about a real-estate auction that was held to settle social security debts. In his view, the links highlighted details about his history that were no longer relevant.
The ECJ found in his favour, and Google must no longer provide links to the stories when its users search for the man's name (though presumably they can still return the same links for other search terms relating to the stories in question).
But the decision does not just affect the single Spanish complainant — as a result of the ruling, Google must offer all Europeans a chance to exercise their 'right to be forgotten'. It began allowing them to do so last week by opening an online form where individuals can request outdated links about them are no longer returned when others search for their names. Tens of thousands of people filed such requests in a matter of days.
Now, Google will have to wade through those requests, decide which have merit and which are spurious, malicious, or unwarranted, and remove the links from search results where appropriate. Alternatively, it must decide where the right to know outweighs the right to privacy, and which links should stay.
Making those decisions is a big job, and an important one. Under UK law, criminal convictions can be spent — after a period of time, those convicted do not have to disclose their previous offences when applying for a job, for example.
Now Google will have to decide when mentions of them are no longer relevant to an individual, and allow them to be 'spent' on the internet too. Should it take six months, a year, a decade for that to come to pass? How should the nature of the offence be factored into its current relevance? How should a person's right to move on from their past be balanced against other individuals' right to know?
For the moment, Google is flying blind on where the right to be forgotten should come into play. While the ECJ gave some guidance in its ruling, the practicalities now need to be thrashed out.
Yesterday, European privacy watchdogs met in Brussels to begin working on guidelines for how Google, and other online companies, should handle 'right to be forgotten' requests.
According to the Wall Street Journal, those guidelines are expected to be ready in September, with the aim of making sure the process of handling removal requests, and appeals against any that are rejected, is consistent across all member states of the European Union.
Until those guidelines are published, Google will have to use its own judgement. Or rather, the judgement of a council of advisers including Wikipedia founder Jimmy Wales and Luciano Floridi, a philosopher at the Oxford Internet Institute, who will be part of the team that will shape Google's policy following the ECJ ruling.
Sitting alongside the collection of independent experts will be Google's chief legal officer David Drummond and its chairman Eric Schmidt, both of whom expressed their disappointment with the ECJ's initial ruling: Drummond said it "went too far. It didn't consider adequately the impact on free expression," while Schmidt added the case was "a collision between the right to be forgotten and the right to know", and the court had struck the wrong balance between the two.
A form of censorship?
Those who oppose the ruling have chiefly done so on the grounds that it poses a threat to the freedom of expression and the public's right to know — they consider it a form of censorship.
Whether they're correct is a difficult question to answer. In the case of the Spanish national, the two newspaper articles at issue remain online and likely to have been more widely read as a result of the ECJ ruling than if he had brought no case before the court. The information it contains is not inaccurate, remains available on the site on which it was published, and can be searched for, and returned as a result, if terms other than the man's name are used in Google, or if his name is searched for in other search engines, or Googled outside of the European Union. In that sense, the information about the man is not censored.
Yet, for many people, Google is the gatekeeper of the web — their first and last stop in finding information. The infamous 10 blue links will largely be the only things a user sees when they're looking for any given piece of information online. If Google stops returning particular links in its search results, that means a great section of the online population won't ever see them. But those decisions are ones it makes already — by consigning a particular website to the fifth page of results, it's censoring much in the same way as removing it under a right to be forgotten request.
So, if Google is to stop linking to certain web pages, it's a serious decision, and requires due consideration.
And with 41,000 requests already made and more to come, that's a lot of due consideration. Google said it will either redeploy workers to process the flood of requests, or hire more staff to handle them, a source told the WSJ.
It's difficult to see how Google could deal with thousands of requests seriously without extra resources — even if each request takes only an hour to deal with, Google would still need a team of 20 people working full time for a year to deal with the 41,000 requests it's already received.
There is no word yet on who these new or existing staff — who will be making the decisions every day on how that tricky balance between the right to know and the right to be forgotten should be struck for individuals — will be. There's a strong case for saying those decisions should be taken out of Google's hands altogether.
For Google, adjudicating on such matters is the regulatory equivalent of asking a teenager to tidy their room — a task they do with no enthusiasm and to the minimum standard possible to keep the higher authorities off their back. It raises the possibility that far more of these requests will be granted than should be just to speed up clearing the backlog and saving the time and money spent on appeals.
Doubtless, soon Microsoft, Yahoo and others will gradually receive the same sort of requests as Google is now doing. Like Google, it will be free to choose to remove or keep links as it sees fit. Such a situation could potentially result in a patchwork quilt of the same request being accepted and rejected by different search providers, for example, with an individual forgotten by Bing and remembered by Google.
Rather than have the search providers decide, each as they see fit, on the cases, it would seem wise to have an independent body do it for them — an adjunct to the local data protection authorities who can rule on an individual's request, disseminate the verdict to the affected search providers, and handle any appeals directly. It must also be financed by the industry itself — search companies should bear the brunt of policing themselves, as they do with copyright takedown requests.
Copyright vs the right to be forgotten
EU commissioner Vivianne Reding told the BBC that Google will get thousands of 'right to be forgotten' requests but millions of copyright takedown demands. "This is a small thing as compared to the copyright things. It is possible to handle the copyright question, so it should also be possible to handle the takedown requests on personal data questions," she said.
Reding is half right — the volumes are small — but there is a large difference between the two. Ownership of copyright is rarely disputed, and those making takedown requests are often large TV companies or record labels with the lawyers and advertising heft to make Google sit up and take notice. The law is fairly clear on copyright, but it's still muddy on the right to be forgotten — for a start, there is no absolute right for a search engine to forget you, just to consider your request.
Most of those requests will come from those who lack the monetary might and legal representation to present a challenge to Google, or from those with both seeking to hide information that should remain in the public domain.
For the sake of those who want to be forgotten and those who believe certain information shouldn't be hidden, these requests should be taken seriously, considered properly, and granted sparingly. The only way to do that is to take the decisions out of Google's hands.