EU puts Google straight on 'right to be forgotten'
The European Commission maintains that services such as YouTube and Facebook should usually be responsible for deleting content that the uploader wants removed, in a response to concerns raised by Google
Europe's proposed 'right to be forgotten' will not affect pure hosting platforms, but it will definitely apply to search engines and social networks, the European Commission has said in response to concerns raised by Google.
The European Commission has responded to Google's concerns about the 'right to be forgotten', or the rules governing the deletion of people's personal data online.
The right to be forgotten is a key part of the EU's upcoming
Data Protection Regulation, proposed in January. The Commission
has said users of social networks and other online services should be
able to get their personal information deleted when they ask for it,
but Google argued
last week that the legislation made unreasonable demands on search
engines and platforms such as YouTube and Facebook.
In a blog post on Thursday, Google's privacy chief Peter Fleischer said
the people who upload information online should be responsible for
deleting it, not the companies that run the platform it was uploaded to,
or those running the search engines that index such content.
However, in a detailed rebuttal sent to ZDNet UK this week by the
office of justice commissioner Viviane Reding, who is in charge of EU
data protection, the Commission said its proposals set out a clear view of
who should be responsible for what.
In principle, pure hosting services have no ownership and no responsibility for the content their users let them host.
– European Commission
Whereas Fleischer had referred to YouTube and Facebook as "hosting
platforms", Reding's office appeared to draw a further distinction
between such services and platforms that simply host content without
organising and processing it.
"In principle, pure hosting services have no ownership and no
responsibility for the content their users let them host… This is
independent of privacy laws, just in the definition of hosting
services," the Commission said.
"However, other information services, including social networking
and search engines, may exercise control on the content, conditions
and means of processing, thereby acting as data controllers. If and
when this is the case, clearly they have to respect related data
protection obligations," the Commission continued.
Reding's office also suggested that not all social-network posts
would be subject to the right to be forgotten, as some may fall under
the 'household exemption'. "This is the case when, for example,
privacy settings are configured so to give access only to 'friends',"
the Commission said.
Republished material
One of Fleischer's key complaints was that it is very easy to copy
and republish material on the internet, making it difficult for a
hosting platform to demand the deletion of copied content on
third-party systems, as the proposed regulations seem to require.
The Commission responded by stressing that user-generated content
platforms only had to take "all reasonable steps, including technical
measures" to tell third parties that the 'data subject' wants copies of
their personal data — or links to that data — taken
down.
"Where the controller has authorised a third-party publication of
personal data, the controller shall be considered responsible for that
publication," Reding's office said, suggesting that a controller will
not be made responsible for unauthorised copies.
De-indexing content
Fleischer had also argued that search engines such as Google should be allowed to link to any information on the web as long as the website hosting that information had not asked for it to be de-listed by Google.
Here, the Commission and Google seem to be in agreement. "The
[hosting site's] controller should take reasonable steps to inform and
ask the search engine [that the user wants their data deleted]," the
Commission said.
The Commission gave an example of how it sees this de-indexing
working. "If you leave your football club and you want your name to be
erased from the website containing the lists of the active members of
the club, the owner of the website should remove your name from the
website and take reasonable steps so that all potential recipients are
aware of this," it said.
"This means, for instance, to configure the website so that it will
be re-indexed by search engines without this data. It may also imply
that the football club [makes] contact with the national football league
to inform them about this change," the Commission explained.
Free expression
As for Fleischer's suggestion that the proposed regulations would
not "foster free expression for all", the Commission replied that the
proposals include a specific exemption for journalistic and artistic
free expression.
The regulation provides for very broad exemptions to ensure that freedom of expression can be fully taken into account.
– European Commission
"The regulation provides for very broad exemptions to ensure that
freedom of expression can be fully taken into account, such as for
citizen journalists," the Commission said, saying that "artistic or
literary expression" would also be protected.
However, the Commission added that it was not trying to bring in an
EU-wide definition for free expression, as "member states are
responsible for defining this area".
"Member states will be obliged to define the exemptions more
precisely in line with their national laws, such as rules for the
press and the media," the Commission said.
Crossing swords
Google has a thorny relationship with EU regulators at the moment.
Apart from the data-protection proposals, the two parties are also
crossing swords over Google's new privacy policy and allegations that
it has abused its dominant position in the search market.
By the end of March, the Commission — competition
commissioner Joaquín Almunia's department, rather than Reding's
— will
have also delivered a full report into various antitrust claims
that have been made against Google.
The complainants include Microsoft, Microsoft's Ciao business and
the UK's Foundem. Ciao, Foundem and others allege that Google had
unfairly down-ranked them in its search results, while Microsoft says
Google stops Bing and Windows Phones from providing the same rich
YouTube functionality that Google's products can offer.
Get the latest technology news and analysis, blogs and reviews
delivered directly to your inbox with ZDNet UK's
newsletters.