Google picks holes in EU's 'right to be forgotten'
The search giant has asked EU regulators to clarify proposed rules forcing social networks and hosting services to remove people's photos and data on request, saying they place unreasonable demands on providers
Google has complained that the terms of Europe's proposed 'right to be forgotten' make unreasonable demands on search engines and hosting platforms such as YouTube and Facebook.
Google has taken issue with the European Commission's proposals on the 'right to be forgotten', which grants gives citizens the right to ask for their personal data to be deleted from social networks.
The search giant set out its argument in a
blog post on Thursday, in which global privacy counsel Peter
Fleischer said
Google supports the principles behind the right, but wants it to be
implemented "in a way that not only enhances privacy online, but also
fosters free expression for all".
Fleischer suggested the regulation does not take into account
the distinction between hosting platforms and search engines, nor the
nuances of both.
"Responsibility for deleting content published online should lie
with the person or entity who published it," he said in the blog post. "Host providers
store this information on behalf of the content provider and so have
no original right to delete the data. Similarly, search engines index
any publicly available information to make it searchable. They too
have no direct relationship with the original content."
Fleischer suggested that Google already includes many of the tenets
of the regulation in its privacy principles and practices. These include
"improved transparency, providing clear information to people and
giving them fine-grained privacy choices — including the ability
to remove data they uploaded to our services", he said.
Deleting data
However, Fleischer continued, the EU needs to clarify
how the right to be forgotten would be applied. In the case of hosting
platforms such as Facebook and YouTube, he argued, the responsibility
for deleting data should rest with the person who uploads it.
Responsibility for deleting content published online should lie with the person or entity who published it.
– Peter Fleischer, Google
"A user should be able to delete an individual post, photo or video
that he or she stored with the hosting platform," Fleischer said. "The
user should also be able to delete his or her entire account with a
given hosting platform, thereby deleting all the materials he or she
had published and which was stored in that account."
The hosting platforms themselves should not have to
delete that information instantly, he said.
"There are practical reasons why
some delay should be permitted —for example, to prevent the abusive
deletion of content when an account has been compromised. Other
limits, including legal or contractual obligations, may also
legitimately delay deletion in certain circumstances," Fleischer
said.
In recent weeks, Google has crossed swords with EU officials over its revamped privacy policy, which is set to
be applied in March. Under the revamp, people will not be able to opt
out of having their data shared across Google's services and products,
and then used in targeted advertising.
The right to be forgotten is outlined in Article 17 of the
proposed EU regulation (PDF). One clause says that when someone requests deletion of an item, the service's data
controller must
"inform third parties which are processing such data, that a data
subject requests them to erase any links to, or copy or replication of
that personal data".
If the original data controller has authorised a third party to
publish that information, the original controller is responsible for
that publication, the clause adds.
Google's privacy chief pointed out that any material published
online could be copied and re-published anywhere, so it is unreasonable of EU regulators to expect providers such as Facebook and YouTube to keep control
over those republished versions.
"Fundamental responsibility for information available online must
rest with the party that put that particular copy online, rather than
with the hosting platform. This is consistent with the premise of
existing European law, namely, the E-commerce Directive," Fleischer
said.
Similarly, Fleischer argued that the right to be forgotten should
not interfere with search engines' ability to point consumers to
information published around the web. However, he added that search
engines should "respect the standard ways in which websites instruct
search engines whether to crawl and index particular pages, such as
header meta tags and robots.txt files".
"Search engines should also provide a means for webmasters to
accelerate removal of their site from search results," he continued.
"As with hosting platforms, the fundamental responsibility for
information available online must rest with the publisher of that
information, rather than with a search engine or other similar
intermediary."
ZDNet UK has asked the European Commission for comment on Google's
argument, but had received none at the time of writing.
Get the latest technology news and analysis, blogs and reviews
delivered directly to your inbox with ZDNet UK's
newsletters.