The European Court of Justice’s recent decision granting EU citizens a right to be forgotten by search engines is a major blow to free expression on the Internet. Reaction from media outlets like the New York Times and the Financial Times has been harshly critical and rightly so. The key thing for Internet users and for public policymakers in Europe is to understand how this ruling might reduce the amount of accurate information available on the Internet.
The decision did not spring from any impulse to censorship, but from an honest attempt to vindicate the fundamental right to privacy in a digital age. That’s why any comparison to authoritarian government censorship of the Internet is just overblown rhetoric. But unless it is modified or re-interpreted through further jurisprudence or legislation, this decision might well be the turning point where free expression on the Internet begins to recede from its current high water mark.
What’s the threat to free expression? The court attempts to balance the interest of search engine users in access to information and the privacy interests of individuals who are the subject of lawfully published material available on the Internet. In making that balance, however, the court says: “the data subject’s rights… override, as a general rule, that interest of internet users…” That’s the problem in a nutshell: under the decision privacy trumps free expression on the Internet.
The court envisages a process in which a person who thinks that search results are an intrusion into his private life presents a complaint to the search engine stating that one or more links in the search results refer to data that appear to be “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.” The search engine then must “duly examine” this complaint and if it finds that the links meet this standard of “inadequacy, irrelevance or excessiveness” it must delete these links from its search result. This must be done even if the data are accurate and their initial publication lawful. An exception from this general requirement to delete links allows the search engine to retain the links in search results when “there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.”
This process is heavily weighted in favor of a complainant, and allows free expression to function only as a defense against a finding of a privacy violation.
The particular case before the court illustrates the process. A Spanish man incurred certain debts many years ago, which was reported accurately in a newspaper at the time. He has since cleared up the debts. But a search of his name today returns the original story in a prominent place, thereby recirculating true but outdated information about him. He asked the search engine to remove these links. Under the new regime, the search engine would be required to go through the above process using the new standard and if it finds that the information is inadequate, irrelevant or excessive it must consider whether the role played by the physician in public life gives the public a preponderant interest in access to the information. If not, it must delete the links.
Search engines must assess what this ruling means in terms of their internal policies and practices and seek to bring them into compliance with the ruling. The cost and burden to these companies are important and might make operating an effective search engine in Europe a nearly impossible task.
But the real impact of the ruling is that is it likely to reduce the amount of accurate information available on the Internet.
Even a preliminary review of the decision reveals substantial challenges:
What do the new standards mean? Are there really three different bases for deleting search results – irrelevance, inadequacy or excessiveness? A standard of excessiveness is particularly troubling and could potentially require search engines to assess whether a publisher gathered too much accurate information about a person.
What role do other interested parties have in a complaint? The original publisher, for instance, might not want links to his stories suppressed in search results. Other people and organizations are typically mentioned in published stories. What if they want links to the stories available and think their rights are violated by suppression? Are the search engines supposed to convene a process to allow all interested parties to present evidence as if they were a court?
How broadly does the ruling apply? It covers search engines, but many companies are in the business of aggregating lawfully acquired accurate information from a variety of public and private sources and making it available to the public. The same story that the search engine would have to delete is also available in thousands of commercially available databases throughout the world. Are those providers of information services subject to deletion demands from EU data subjects even if they are not based in the EU?
These are just preliminary questions that must be clarified going forward. But a new day of privacy-based deletion requests is dawning. Unless EU policymakers intervene, the new day is likely to be a dark one for free expression.
Mark MacCarthy, Senior Vice President, Public Policy at SIIA, directs SIIA’s public policy initiatives in the areas of intellectual property enforcement, information privacy, cybersecurity, cloud computing and the promotion of educational technology. Follow Mark on Twitter at @Mark_MacCarthy.