The decision of the European Court of Justice on the Google case has re-opened the debate on the importance of remembering and forgetting in the digital age. For this reason, the decision induces to reconsider the provisions of the Article 17 of the EU Proposal for a General Data Protection Regulation.
The future EU regulation should consider the peculiar nature of search engines and introduce an “ad hoc” legal provision, which excludes the direct enforcement of the right to erasure carried out by data controllers and requires a complaint direct to a court or data protection authority (DPA).
At the same time, this provision should also impose to data controllers the temporary removal of the links in dispute, which will be reactivated if the data subject does not take legal action within this time.
The decision of the European Court of Justice on the Google case has re-opened the debate on the importance of remembering and forgetting in the digital age.
Legal scholars, columnists and experts have either agreed with the position of the court on the right to be forgotten or, on the contrary, criticized the decision as an attempt to limit the freedom of expression.
Now, the dust is settling and the “transparency report” published by Google shows a limited effect of removals on freedom of expression, although the report presents only a few aggregated data.
For this reason, the time has come to assess the long-term effect of the decision.
From this perspective, the consequences should not be overestimated.
This is not a decision on the right to be forgotten, since the news is still available in newspaper archives. It concerns the worldwide access via search engines to online information.
Nor is it a decision against the freedom of expression, since the court explicitly required a balancing test between individual rights and access to information.
Nevertheless, it is a controversial decision. It transforms each search engine into a judge, which should decide when the freedom of expression prevails and in which cases “the publicity goes to unreasonable lengths in revealing facts about one who has resumed the private, lawful and unexciting life led by the great bulk of the community” (Restatement 2d, Torts,SS 652D, Comment k).
The critical aspect is not the private nature of the company that makes the balancing test.
In a number of legal systems across Europe, the same balancing test is used by media companies in cases regarding privacy, right to be forgotten or defamation. However, in those cases, the test is made by journalists, who take responsibility for checking the facts they publish and have the professional skills to make the above-mentioned test.
On the contrary, Google, as well as any other search engine, neither investigates and checks the facts, nor has the professional expertise of a media company.
For this reason, I consider this mainly a “political” decision, in the sense it pertains to citizens (from Greek polítes “citizens”). Remembering and forgetting are fundamental aspects of our individual and social life, and the balance between remembering and forgetting has a substantial impact on our digital society.
In spite of that, the decision has pointed to the direction, but has not built the path.
The direction is represented by the strong support to data subject’s rights (“the data subject’s rights protected by those articles [7 and 8, Charter of Fundamental Rights of the European Union] also override, as a general rule, that interest of internet users [in having access to information]”) and, more specifically, by the support to the right to erasure of personal information that have not been ”fairly and lawfully” processed. This is not a new right, as it has been represented in various comments, but an already existing right, which has been recognized both by European law and national courts in Europe.
Even though the direction has been defined, the technical solution provided by the courts (the “path”) is still inadequate.
It should be noted that the reason for this lies in the fundamental inadequacy of the existing legal framework. This was written during the 90’s and now it has to address the issues arising from a completely different digital environment.
From this perspective, the decision puts the trade-off between remembering and forgetting at the center of the debate and it (hopefully) induces to reconsider the provisions of the Article 17 of the EU Proposal for a General Data Protection Regulation. This is the “political” value of the decision.
In the light of the above, the future EU regulation should consider the peculiar nature of search engines as data controllers. It should introduce a specific legal provision, which excludes the direct enforcement of the right to erasure carried out by data controllers and requires a complaint direct to a court or data protection authority (DPA). This avoids that search engines play the (improper) role of judges in these cases.
At the same time, this provision should also impose to data controllers the temporary removal of the links in dispute, when they receive a motivated request from a data subject. This “freeze” of the link will be maintained for a short period of time (e.g. 20–30 days). If the data subject does not take legal action within this time, the link will be reactivated and no legal action can be made in the future for the same link, except in the case of change of the surrounding circumstances.
The added value of this approach is represented by the fact that it combines a short temporary restriction to information access with a model based on a decision adopted by a court or DPAs, not by a private entity.
On the contrary, there are still some aspects that need to be further investigated and improved. They regard the above described process and the related need to track the requests. Nevertheless, this seems to be an easy-to-solve problem considering that the solution should be implemented by the major IT companies.