Google has outlined the complexities and costs it faces when handling European 'right to be forgotten' requests, throwing a spotlight on the difficulties smaller rivals may face with the process.
The last thing Google wanted when the EC proposed including a 'right to be forgotten' in data protection legislation back in 2012 was for such a law to apply to search engines. Publishers, yes; hosting platforms, not really; search engines definitely not, appeared to be its stance.
Now, thanks to a ruling by the European Court of Justice handed down in May, Google is having to contend with the introduction of just such a right. The court's decision stipulated that European citizens can ask search engines to remove particular links from results returned for a search on their name, if the material is deemed to be out of date, no longer relevant, or excessive.
After starting to process the first 'right to be forgotten' requests in June, it set out in a letter to Europe's privacy watchdogs this week the difficulties it's faced, including the "significant hiring effort" it had to undertake to handle the requests.
Of the 91,000 requests Google received by 18 July, the company's global privacy counsel Peter Fleischer said that Google had knocked back around 32 percent of requests, asked for more information for 15 percent requests, and removed 53 percent of them.
"We generally have to rely on the request for information, without assurance beyond the requester's own assertions as to its accuracy. Some requests turn out to have been made with false and inaccurate information," Fleischer wrote in the letter.
"Even if requesters provide us with accurate information, they understandably may avoid presenting facts that are not in their favour. As such, we may not become aware of relevant context that would speak in favour of preserving the accessibility of a search result."
Because requests are not automated, processing them has cause Google to draft in new workers. "We are not automating decisions about these removals. We have to weigh each request individually on its merits, and that is done by people. We have many people working full time on the process, and ensuring enough resources are available for the processing of requests required a significant hiring effort," the letter said. The response raises questions about the economic burden on smaller companies who may receive such requests. However, with Google having over 90 percent market share of search in Europe, it's unlikely other search providers will face a similar deluge of complaints as the one facing Google.
According to the company, there are no short cuts that can be taken to make it easier for other search engines to handle requests. Currently, Google doesn’t know what the average time for processing each request is, however does envisage it will be faster once it has cleared its current backlog.
Asked whether Google had considered sharing delisted search results with other providers, Fleischer said Google had not and would find it problematic to do so.
"We would note that sharing the delisted URLs without further information about the request would not enable other search engine providers to make informed decisions about removals, but sharing this information along with details or a copy of the complaint itself would raise concerns about additional disclosure and data processing."
Google's letter was sent to the EC's Article 29 Working Party, which last week asked Google for information on ahead of drafting guidelines on how the 'right to be forgotten' ruling should be implemented in practice.
Questions that Google's advisory council on the 'right to be forgotten' has thrown back to Europe's Article 29 Working Party to answer include:
Fleischer also explained the legal basis for Google notifying publishers when it delists a story. That practice came to light after several publishers, including the Guardian and BBC, were notified by email that Google had delinked stories.
According to Fleischer, Google doesn't need any justification under European data protection law to notify publishers since it's not sharing any personal data with the webmaster and in any case isn't in control of content found at a particular URL.
"We are simply notifying the webmaster about a partial removal of search results for a specific URL on his/her domain… Any personal data that can be found at the specific URL is not part of the data that is processed by Google."