Google court ruling may force EU to revise privacy bill

24 July 2014. By Magnus Franklin

European capitals are weighing how a court ruling on Google that gave citizens the right to be forgotten online may force them to revise a draft EU privacy law.

The upshot might be that news organizations or social-network websites asked to delete personal information won't be required to hunt down sites that have republished the data and ask them, too, to delete the details.

Italy, which is chairing talks on the bill, has sent national data-protection experts a memo outlining preliminary thoughts on the judgment by Europe's highest court, the Court of Justice in Luxembourg.

The note explores how the ruling would affect a section of the legislation that would require data "controllers" to make every effort to comply with requests to remove personal information that has been duplicated elsewhere on the Internet. In practice, this would force a website to chase down search engines and other sites and get them to remove the data.

But that passage may no longer be necessary, because the EU court judgment gives individuals the possibility of directly asking such "secondary" controllers to remove personal data, the memo says.

"The considerable burden [that] such an obligation would put on the first controller may therefore not be justified, as there is a possibility of exercising the right to be forgotten directly against any 'second controller,' " the memo states.

The Court of Justice has acknowledged that "second controllers, such as search engines, are controllers in their own right against whom a data subject can exercise its right to erasure and to oppose processing," the note says. This raises the question of whether the clause is still needed, it says.

The memo also examines the extent to which the right to be forgotten should be "balanced" against the public's right to obtain information. The issue here is the ability of criminals and public figures, such as politicians and celebrities, and to have unwanted information erased from search results.

The court ruled that such a balancing test should be carried out, but this raises further questions. The note asks, for example, whether the right to keep information public "should be available only to (traditional) offline and online journalistic publishers or should it also extend to 'subsequent publishers' which facilitate the availability of this information."

In any event, the Lisbon Treaty doesn't allow EU law to regulate this matter in detail, the note says, meaning that the balance may be up to individual governments.

National delegations have been asked "to confirm that it shall be for member states to reconcile the right to the protection of personal data with the right to freedom of expression."

If so, the law could provoke conflicts between countries with strong safeguards for freedom of expression and those that are more sympathetic to individuals seeking to be forgotten. These disputes could, in turn, influence where a company such as Google chooses to locate its "establishment," or headquarters, under the law.

The Italian memo also asks whether the bill should require individuals seeking to be forgotten to first approach the initial publisher with a removal request, before going to "secondary" controllers. Creating such a sequence may go against the court ruling, which says that an individual "has the choice" to exercise his right "against any of the controllers involved, without regard to an order of controllers," the note says.

Europe's data-protection authorities are today discussing the judgment during a meeting in Brussels with search-engine operators, including Google, Microsoft and Yahoo.

Google's application of a system allowing EU citizens to make removal requests has come under criticism, as news organizations notified of removals have published fresh articles identifying those who have asked to be "forgotten."