EU puts Google straight on 'right to be forgotten'

Europe's proposed 'right to be forgotten' will not affect pure hosting platforms, but it will definitely apply to search engines and social networks, the European Commission has said in response to concerns raised by Google.

The European Commission has responded to Google's concerns about the 'right to be forgotten', or the rules governing the deletion of people's personal data online.

The right to be forgotten is a key part of the EU's upcoming Data Protection Regulation, proposed in January. The Commission has said users of social networks and other online services should be able to get their personal information deleted when they ask for it, but Google argued last week that the legislation made unreasonable demands on search engines and platforms such as YouTube and Facebook.

In a blog post on Thursday, Google's privacy chief Peter Fleischer said the people who upload information online should be responsible for deleting it, not the companies that run the platform it was uploaded to, or those running the search engines that index such content.

However, in a detailed rebuttal sent to ZDNet UK this week by the office of justice commissioner Viviane Reding, who is in charge of EU data protection, the Commission said its proposals set out a clear view of who should be responsible for what.

In principle, pure hosting services have no ownership and no responsibility for the content their users let them host.

– European Commission

Whereas Fleischer had referred to YouTube and Facebook as "hosting platforms", Reding's office appeared to draw a further distinction between such services and platforms that simply host content without organising and processing it.

"In principle, pure hosting services have no ownership and no responsibility for the content their users let them host… This is independent of privacy laws, just in the definition of hosting services," the Commission said.

"However, other information services, including social networking and search engines, may exercise control on the content, conditions and means of processing, thereby acting as data controllers. If and when this is the case, clearly they have to respect related data protection obligations," the Commission continued.

Reding's office also suggested that not all social-network posts would be subject to the right to be forgotten, as some may fall under the 'household exemption'. "This is the case when, for example, privacy settings are configured so to give access only to 'friends'," the Commission said.

Republished material

One of Fleischer's key complaints was that it is very easy to copy and republish material on the internet, making it difficult for a hosting platform to demand the deletion of copied content on third-party systems, as the proposed regulations seem to require.

The Commission responded by stressing that user-generated content platforms only had to take "all reasonable steps, including technical measures" to tell third parties that the 'data subject' wants copies of their personal data — or links to that data — taken down.

"Where the controller has authorised a third-party publication of personal data, the controller shall be considered responsible for that publication," Reding's office said, suggesting that a controller will not be made responsible for unauthorised copies.

De-indexing content

Fleischer had also argued that search engines such as Google should be allowed to link to any information on the web as long as the website hosting that information had not asked for it to be de-listed by Google.

Here, the Commission and Google seem to be in agreement. "The [hosting site's] controller should take reasonable steps to inform and ask the search engine [that the user wants their data deleted]," the Commission said.

The Commission gave an example of how it sees this de-indexing working. "If you leave your football club and you want your name to be erased from the website containing the lists of the active members of the club, the owner of the website should remove your name from the website and take reasonable steps so that all potential recipients are aware of this," it said.

"This means, for instance, to configure the website so that it will be re-indexed by search engines without this data. It may also imply that the football club [makes] contact with the national football league to inform them about this change," the Commission explained.

Free expression

As for Fleischer's suggestion that the proposed regulations would not "foster free expression for all", the Commission replied that the proposals include a specific exemption for journalistic and artistic free expression.

The regulation provides for very broad exemptions to ensure that freedom of expression can be fully taken into account.

– European Commission

"The regulation provides for very broad exemptions to ensure that freedom of expression can be fully taken into account, such as for citizen journalists," the Commission said, saying that "artistic or literary expression" would also be protected.

However, the Commission added that it was not trying to bring in an EU-wide definition for free expression, as "member states are responsible for defining this area".

"Member states will be obliged to define the exemptions more precisely in line with their national laws, such as rules for the press and the media," the Commission said.

Crossing swords

Google has a thorny relationship with EU regulators at the moment. Apart from the data-protection proposals, the two parties are also crossing swords over Google's new privacy policy and allegations that it has abused its dominant position in the search market.

The new privacy policy gives users no way out of having their data shared across Google's numerous services. The Article 29 group of EU data protection advisors has asked Google to hold off bringing in the new policy — due for introduction on 1 March — until the privacy implications can be examined fully, but Google has refused to hit the brakes.

By the end of March, the Commission — competition commissioner Joaquín Almunia's department, rather than Reding's — will have also delivered a full report into various antitrust claims that have been made against Google.

The complainants include Microsoft, Microsoft's Ciao business and the UK's Foundem. Ciao, Foundem and others allege that Google had unfairly down-ranked them in its search results, while Microsoft says Google stops Bing and Windows Phones from providing the same rich YouTube functionality that Google's products can offer.