The right to be forgotten: Can we really trust Google to decide when our data should die?

The right to be forgotten: Can we really trust Google to decide when our data should die?

Summary: A recent 'right to be forgotten' case at the European Court of Justice has opened up the floodgates for requests to bury data. Who should decide when those demands are legitimate?

TOPICS: Privacy, Google, Legal, EU
The European Court of Justice recently ruled that internet users have the right to ask Google to delete links to 'outdated information' about them. Image: Court of Justice of the European Union

According to the latest figures, 41,000 Europeans have asked Google stops providing links to 'outdated information' about them.

The ability to make such a request is the result of a European Court of Justice (ECJ) ruling, handed down last month, in the case of a Spanish national who filed a complaint regarding search results provided by Google to information about him.

Searches for the man's name made through the search engine returned links to two newspaper stories that contained details about a real-estate auction that was held to settle social security debts. In his view, the links highlighted details about his history that were no longer relevant.

The ECJ found in his favour, and Google must no longer provide links to the stories when its users search for the man's name (though presumably they can still return the same links for other search terms relating to the stories in question).  

But the decision does not just affect the single Spanish complainant — as a result of the ruling, Google must offer all Europeans a chance to exercise their 'right to be forgotten'. It began allowing them to do so last week by opening an online form where individuals can request outdated links about them are no longer returned when others search for their names. Tens of thousands of people filed such requests in a matter of days.

Now, Google will have to wade through those requests, decide which have merit and which are spurious, malicious, or unwarranted, and remove the links from search results where appropriate. Alternatively, it must decide where the right to know outweighs the right to privacy, and which links should stay.

Making those decisions is a big job, and an important one. Under UK law, criminal convictions can be spent — after a period of time, those convicted do not have to disclose their previous offences when applying for a job, for example.

Now Google will have to decide when mentions of them are no longer relevant to an individual, and allow them to be 'spent' on the internet too. Should it take six months, a year, a decade for that to come to pass? How should the nature of the offence be factored into its current relevance? How should a person's right to move on from their past be balanced against other individuals' right to know?

For the moment, Google is flying blind on where the right to be forgotten should come into play. While the ECJ gave some guidance in its ruling, the practicalities now need to be thrashed out.

Yesterday, European privacy watchdogs met in Brussels to begin working on guidelines for how Google, and other online companies, should handle 'right to be forgotten' requests.

According to the Wall Street Journal, those guidelines are expected to be ready in September, with the aim of making sure the process of handling removal requests, and appeals against any that are rejected, is consistent across all member states of the European Union.

Until those guidelines are published, Google will have to use its own judgement. Or rather, the judgement of a council of advisers including Wikipedia founder Jimmy Wales and Luciano Floridi, a philosopher at the Oxford Internet Institute, who will be part of the team that will shape Google's policy following the ECJ ruling.

Sitting alongside the collection of independent experts will be Google's chief legal officer David Drummond and its chairman Eric Schmidt, both of whom expressed their disappointment with the ECJ's initial ruling: Drummond said it "went too far. It didn't consider adequately the impact on free expression," while Schmidt added the case was "a collision between the right to be forgotten and the right to know", and the court had struck the wrong balance between the two.

A form of censorship?

Those who oppose the ruling have chiefly done so on the grounds that it poses a threat to the freedom of expression and the public's right to know — they consider it a form of censorship.

Whether they're correct is a difficult question to answer. In the case of the Spanish national, the two newspaper articles at issue remain online and likely to have been more widely read as a result of the ECJ ruling than if he had brought no case before the court. The information it contains is not inaccurate, remains available on the site on which it was published, and can be searched for, and returned as a result, if terms other than the man's name are used in Google, or if his name is searched for in other search engines, or Googled outside of the European Union. In that sense, the information about the man is not censored.

Yet, for many people, Google is the gatekeeper of the web — their first and last stop in finding information. The infamous 10 blue links will largely be the only things a user sees when they're looking for any given piece of information online. If Google stops returning particular links in its search results, that means a great section of the online population won't ever see them. But those decisions are ones it makes already — by consigning a particular website to the fifth page of results, it's censoring much in the same way as removing it under a right to be forgotten request.

So, if Google is to stop linking to certain web pages, it's a serious decision, and requires due consideration.

And with 41,000 requests already made and more to come, that's a lot of due consideration. Google said it will either redeploy workers to process the flood of requests, or hire more staff to handle them, a source told the WSJ.

It's difficult to see how Google could deal with thousands of requests seriously without extra resources — even if each request takes only an hour to deal with, Google would still need a team of 20 people working full time for a year to deal with the 41,000 requests it's already received.

There is no word yet on who these new or existing staff — who will be making the decisions every day on how that tricky balance between the right to know and the right to be forgotten should be struck for individuals — will be. There's a strong case for saying those decisions should be taken out of Google's hands altogether.

For Google, adjudicating on such matters is the regulatory equivalent of asking a teenager to tidy their room — a task they do with no enthusiasm and to the minimum standard possible to keep the higher authorities off their back.  It raises the possibility that far more of these requests will be granted than should be just to speed up clearing the backlog and saving the time and money spent on appeals.

Doubtless, soon Microsoft, Yahoo and others will gradually receive the same sort of requests as Google is now doing. Like Google, it will be free to choose to remove or keep links as it sees fit. Such a situation could potentially result in a patchwork quilt of the same request being accepted and rejected by different search providers, for example, with an individual forgotten by Bing and remembered by Google.

Rather than have the search providers decide, each as they see fit, on the cases, it would seem wise to have an independent body do it for them — an adjunct to the local data protection authorities who can rule on an individual's request, disseminate the verdict to the affected search providers, and handle any appeals directly. It must also be financed by the industry itself — search companies should bear the brunt of policing themselves, as they do with copyright takedown requests.

Copyright vs the right to be forgotten

EU commissioner Vivianne Reding told the BBC that Google will get thousands of 'right to be forgotten' requests but millions of copyright takedown demands. "This is a small thing as compared to the copyright things. It is possible to handle the copyright question, so it should also be possible to handle the takedown requests on personal data questions," she said.

Reding is half right — the volumes are small — but there is a large difference between the two. Ownership of copyright is rarely disputed, and those making takedown requests are often large TV companies or record labels with the lawyers and advertising heft to make Google sit up and take notice. The law is fairly clear on copyright, but it's still muddy on the right to be forgotten — for a start, there is no absolute right for a search engine to forget you, just to consider your request.

Most of those requests will come from those who lack the monetary might and legal representation to present a challenge to Google, or from those with both seeking to hide information that should remain in the public domain.  

For the sake of those who want to be forgotten and those who believe certain information shouldn't be hidden, these requests should be taken seriously, considered properly, and granted sparingly. The only way to do that is to take the decisions out of Google's hands.

Read more on the right to be forgotten

Topics: Privacy, Google, Legal, EU

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • "Take the decisions out of Google's hands."

    I'm amazed that an interesting and fair article has a conclusion - and a headline - that insinuates this is Google's fault!

    I know that Google-bashing is all the rage right now (Looks like Microsoft's payments to Burson Marstellar weren't entirely wasted), but Google neither asked for this, nor wants it - neither the responsibility, nor the work and expense.

    This ridiculous ruling by the EU - like blaming a map-maker for accidents, because they published a map indicating accident black spots - has put Google in this position, not Google.

    The EU has created a charter for thieves, pedophiles and stalkers, and forced Google to be the Internet Police. This one isn't bad Google - it's bad law.
    • Agreed

      You should either have the "Right to be Forgotten" AT SOURCE or not at all
      • logicial

        This would have been the logical decision, but something the EU could not do since Google was a US based company. I wonder if they will apply the same standards to Baidu. Anyway, Google will eventually be inundated with so many of these requests from "reputation repair" groups, that they will have no choice but to say "yes" to all of them. Access to information will disappear, and all the EU will be left with is a sanitized, happy place, no longer able to find negative reviews about restaurants or doctors, or negative views about politicians. They will deserve to get what they have asked for.
        Harlon Katz
    • Of course Google doesn't want this

      this is cutting into their cash cow, and the less money the get, the less bribes they get to offer.

      Nice try at the "blame it all on MS" spin there, Heenan73, but it looks as though you're getting backed into a corner anymore, with no way to protect Google from the mistrust they are earning lately....
      • Truth hurts, you, doesn't it Farrell

        You can't bring yourself to admit that this one isn't Google's fault - and you delude yourself that Google deserves distrust more than your god, Microsoft.
        • Truth or lack there of from scroogle

          hurts the scroogle hive. As the truth comes out more and more people see scroogle for that they really are, an advertising company that rigs their search results and lies about how they use peoples information.
          • sheesh....

            Google is the number one search engine by returning more relevant search results than their competition. This in spite of the many people like yourself who attempt to malign their reputation of being number one. They could not have made it to number one nor could they maintain it if they "rigged" their search results.

            Microsoft on the other hand definitely rigged theirs in the past. Several years back, I compared search results from several search engines. When searching for "OpenOffice" Sun's Open office project page was ranked number one on Yahoo and Google as well as having several other sites that were talking about it. On MSN search however, it was buried more than 5 pages deep behind office furniture and all sorts of other results that were unrelated... not a single reference to the competing office suite in the first five pages of hits (or should I say misses).
      • 41000 individuals are not much cash cow.

        This will apply to Microsoft as well unless there just piggy backing Google. Actually the anti Google thing is from Microsoft. I guess there not proud of that campaign I note the Scroogled items have been removed from the store but the spider with a tricolor abdomen is what remains. Looks like there is enough mistrust to go around don't poison the well if your thirsty and Microsoft is withering. Bribes? Mmmm Google brings up so so many results when Microsoft and bribes are entered. Interesting. Living in a glass house? Microsoft has no scruple reading e mail does it? Actually Microsoft has a lot to answer for. Oh the cost of this will be tax deductible yes?
    • Google bashing appears to be orchestrated

      I don't think there are a lot of people out there outraged by Google's influence and how it's exercised.

      Who would do such a thing and why is left as an exercise for the student.
      John L. Ries
  • Google should not have to shoulder this

    1. It costs resources: money, personnel, and time to do this. Google gets no compensation from the EU, other countries or the individuals themselves. Which means the EUJ effectively stole from Google.
    2. It's a useless ruling. As noted in the article, all the other search engines in the world still return the information.
    3. It's censorship.
    4. It's against natural order. Google doesn't link things until they become publicly known. The articles in question being requested to be forgotten are already in the public's knowledge. Nobody in their right mind can tell a family, a community, a nation, or the world to forget something happened and expect any of them to comply; except the mentally deficient who claim the Holocaust never happened.

    Which brings up a good point. If it's a crime to deny the Holocaust happened, then it should be just as much a crime to force a company to remove truthful information about other happenings. Which means the EUJ themselves are all guilty of crimes and therefore not competent to render justice to anyone, or demands on Google.
    • Public Info

      The problem is two-fold: public records are as available if one goes to the source and there are various disclosure requirements for individuals when making various applications (jobs, credit, etc.). The first has to do with all public records are available to the public with varying degrees of effort required such as going to the courthouse. The second allows individuals to not report criminal convictions for many crimes if the the conviction was far enough in the past. The second is an attempt to realize many people do grow up and at some point many are harmed by judgemental abuse of an old record.

      Another issue is the antics of data aggregators who often ignore the sunset provisions of the law. I think this will be the problem area. It is fairly easy to time limit a search for news articles or public records but data aggregators may not set their data up so it easy to spot an old record.
    • Just because something is true

      Does not mean it should be publicly accessible. Think about this, in all its applications.
      Iman Oldgeek
  • It should be independant...

    That way all search engines can make a consistent response.

    Even so, it will still fail - as small search engines won't be under the control of the body... And they will become more private - meaning they will supply data only to registered users, and these search engines will then be able to collect the same data and provide it to their users. The individuals that may WANT to be forgotten won't be.

    And this will make those search engines more valuable to employment agencies and personnel departments.
  • Right to know?

    Show me where it's written in stone that anyone has a "right to know". Where did that fiction come from? How did it come to the point where people casually throw the term into blog articles as though it were some kind of natural law? What is the fundamental moral principle from which this alleged "right to know" derives? Name it.
    • You could start by Googling for "Right to know"

      You might be surprised...
      • That's what I thought

        So, you can't name the principle. That's what I thought.

        BTW, I'm not a holocaust denier, nor do I think there's any rational or moral basis for this stupid legal requirement to make Google shoulder the burden. What's more, as you correctly pointed out in your post (below), the information will still reside at the original source, and Google can't do anything about that.

        My comment pertained to the casual use of the term "right to know", as though it's some kind of fundamental principle. It's not. And the claim that it's somehow connected to freedom of speech is a perfect example of the kind of convoluted thinking that is typical of people who love to make excuses for minding other people's business.
        • So you haven't tried Googling for it.

          "So, you can't name the principle. That's what I thought."

          This is a tedious rhetorical ploy. By all means, show us all that *you* can recite where every single one of your rights is enshrined.
    • Information still there...

      If you don't want someone to know something, it should be removed at the SOURCE, not just Google which is pointing to the information. Once the information is removed at the source, it will be removed from Google search results.
      Harlon Katz
  • Agreed - Google is just an index.

    "According to the latest figures, 41,000 Europeans have asked Google stops providing links to 'outdated information' about them."

    By the very nature of the WWW, those links *need to point to something*. Which means that the "outdated information" must be hosted by another server. Not only that, but this server will presumably continue to provide this information regardless of whether Google links to it or not.

    Why not require that the hosting server be updated instead? That way, *no* search engine could link to it - not just Google.
    • Because that might make sense...

      This is one of many boneheaded decisions the EU has made. It may not be the stupidest but it has got to be up there with the worst of them. Requiring that any search engine comply with user requests to remove webpages from search results that the user feels is "outdated" would require manual investigation for every request which would mean that practically all web search results could eventually be up for review. This is not practical or sustainable and would completely undermine the web. If the data exists on a public website it should be able to be indexed and search-able. Disallowing this is not practical or sustainable and it fundamentally breaks the web and takes back nearly two decades worth of progress that has been made in Internet search.