Europe's 'Right to Be Forgotten' echoing around the world

20 February 2018 6:04pm
Delete Key

16 February 2018.

In a North American democracy with a strong tradition of valuing free expression rights, the recent declaration by Canada’s top privacy official that existing law bestows Canadians with online privacy rights similar to Europe’s “Right to Be Forgotten” is a significant one.

But the recommendation of the draft Canadian report is hardly isolated.

In Europe, Google has combed through more than 2 million requests to delist search results following a seminal 2014 decision by the EU’s top court that allows people to challenge search results that are inaccurate or for which there is no overriding public interest to publish.

Nearly four years later, a growing number of nations in Latin America and Asia have begun to consider whether their citizens should also have the right to ask search engines to remove — or at least to obscure — search results that are inaccurate, incomplete, or out of date.

Collectively, the changes will likely mean that in more countries, Google, Microsoft and other search companies will be forced to assume the quasi-judicial role of balancing the rights to privacy and free expression in many of the world’s biggest Internet markets.

And as the "right to be forgotten" — also called the “right to erasure” — evolves and spreads around the world, online social media platforms such as Facebook, Twitter, YouTube or Dailymotion would be wise to expect that not just search engines, but they too, may soon face similar demands.

“There are various questions about whether it is appropriate that the private sector be the one to balance these important rights” of privacy and free expression, Canada’s privacy commissioner, Daniel Therrien, told MLex last month. “I think, though, when you look at the European experience, that large corporations have done this fairly well.”

Global expansion

In India and Brazil, the world’s second- and fourth-largest Internet markets, respectively, with more than 600 million Internet users, courts or lawmakers appear poised to confront that question of balancing.

They are not alone. In 2016, the Korea Communications Commission implemented guidelines that allow Internet users to request that online service providers and search engines limit public access to content that could affect their private lives or careers. The guidelines are voluntary, but they are being used by South Korea’s Internet users. The KCC says there have already been more than 22,000 requests.

In some cases, national courts have tailored a custom solution. Rather than requiring a search engine to edit its results or a website to take down content, Colombia’s Supreme Court ruled in 2015 that an online news archive must block search engines from indexing links to a story that named a woman in connection to a crime for which she was not convicted.

Indonesia was the first Asian country to have a "right to be forgotten" enshrined in law in 2016, allowing citizens to seek a court order to have information that compromises their privacy or unjustly damages their reputation removed from the Internet.

Hong Kong Privacy Commissioner Stephen Wong told MLex that there have been requests for a specific right to be forgotten to be introduced in the Special Administrative Region. Wong plans to watch global developments and “assess whether there is a pressing need for any reform,” with a view to striking “the proper balance between data-privacy protection and other rights and interests.”

Japan’s Supreme Court, in its first-ever ruling pertaining to the issue of an individual's right to be forgotten, found that the legality of search engines providing sensitive information must be weighed against the public good of having such information available. While other recent cases have touched on the issue, however, Japanese courts remain reluctant to address the right to be forgotten.

Brazil doesn’t have a “Right to Be Forgotten” law. But in a case pending before Brazil’s Supreme Court, the family of a woman who was murdered in 1958 is asking for damages and a right to be forgotten, after media conglomerate Globo aired a TV show on the killings in 2004.

While the case doesn’t specifically involve online search results, the high court has said the case will apply broadly, including to Internet search. Google has joined the lawsuit as a friend of the court, arguing that the right to be forgotten is a shortcut for judicial censorship and would allow the removal of accurate information from the Internet just because it displeased someone.

The lead justice on the case, Dias Toffoli, is analyzing the facts and arguments in the case. Once Toffoli decides his position, the lawsuit will be ready to be argued in session with the full body of 11 justices.

A “Right to Be Forgotten” is also likely to be included in data protection draft bills under discussion in the Brazilian Senate and House of Deputies. The approval of these bills is unlikely to happen this year, however, because of presidential and legislative elections.

The path forward in India is even less clear, but the right to be forgotten was referred to in the historic Indian Supreme Court ruling last August that privacy was a fundamental right.

The court declined to come down for or against its introduction, but noted that if India had such a right, it would be permissible for a data subject to seek to remove personal information stored about him or her if the data were no longer necessary, relevant, correct or served legitimate interest.

In a hint the idea is gaining credibility in India, a recent White Paper issued by a government committee drafting a data-protection framework sought feedback on a "right to be forgotten" among its “individual participation rights.” The paper made reference to the position in the EU, Canada and South Africa.

“The recognition of the right to privacy envisages within its contours the right to protect personal information on the Internet. Consequently, from this right, it follows, that any individual may have the derivative right to remove the shackles of unadvisable past things on the Internet and correct past actions,” the paper said.

Key decision in Europe

In Europe, the question of whether "right to be forgotten" delisting search entries should extend to all Google domains across the world — not just websites targeting the EU — is at the heart of a lawsuit between the search engine and the French data-protection regulator, the CNIL. The case escalated to the European Court of Justice last July and is expected to be heard later this year.

In its judgment seeking guidance from the EU Court of Justice in Luxembourg, the French Council of State said that delisting results, following a search for someone’s name, from all of Google’s national domain extensions “poses a difficult question of interpretation of European Union law.”

“If they say yes, we can demand global compliance, I think the fallout from that will be enormous,” said Daphne Keller of the Center for Internet and Society at Stanford Law School in California, who tracks RTBF cases around the world. “I don’t know what Google will do, or whether the US State Department might respond or not bother responding, or how other countries will respond.”

Whatever the ECJ decides, Keller believes it’s only a matter of time until a European regulator or court decides that like search engines, social media platforms should be classified as “data controllers” bound to observe the right of erasure. “I think the inevitable answer will be yes. What regulator would forgo that type of power?” said Keller, a former Google lawyer.

In Europe, Google and Microsoft reject most petitions for erasure. Of the 2 million requests to delist search results, it has received since 2014, Google said it had delisted about 894,000 links, or 43 percent. Microsoft has similar numbers, removing links 39 percent of the time.

It might be cold comfort for Google, but fewer Europeans are asking to disappear themselves from its search results. The pace of requests for erasure that Google has received has fallen off significantly in recent years, according to data the search giant publishes online.

During the first year after the ECJ ruling, Google received about 816,000 delisting requests, usually more than 4,000 requests each day. But over the one-year period that ended Feb. 15, Google received just 443,401 requests, a 46 percent decline from the first year.

Google received the fewest daily requests for erasure it has ever received on Dec. 23, 2017 — a mere 1,456 pleas to be forgotten.

—This story was reported by Mike Swift, Toko Sekiguchi, Phoebe Seers, Ron Lubosco, Rodrigo Russo, Ana Paula Candil, Xu Yuan and Vesela Gladicheva. It was written by Swift.

CCPA Report