The “Right to be Forgotten” *

The ECJ Ruling

The ruling of the European Court of Justice (the “ECJ”) on 13 May 2014 regarding the “right to be forgotten” 1 has been one of the hottest topics in the global privacy arena in the past months.

In brief, the ECJ case was concerned with the continued public availability through Google search of a newspaper announcement in 1998 about a Spanish national’s real-estate auction in connection with proceedings for the recovery of his social security debts. The announcement was accurate at the time and had been legitimately published. However, as the debt had been resolved, the information became irrelevant and misleading. The ECJ thus ruled in favour of the complainant and required Google to remove or conceal the information so that it no longer appears in search results based on his name.

The European Commission’s Data Protection Reform

To put things in context, we should note that the “right to be forgotten” is a component of the European Commission’s data protection reform proposals formulated to ensure more effective control of people over their personal data, and to make it easier for businesses to operate and innovate in the European Union (“EU”) market. The proposals were endorsed by the European Parliament on 12 March 2014. They have yet to be adopted by the Council of Ministers.

The ECJ ruling is therefore to some degree an affirmation of the “right to be forgotten” before it is transposed into national laws. The rationale behind this right is that citizens should be empowered to control their own identity online. If an individual no longer wants his or her personal data to be processed or stored by a data controller (the EU equivalent of “data user” in Hong Kong’s Personal Data (Privacy) Ordinance (the “Ordinance”)), and if there is no legitimate reason for keeping it, the data should be removed from their system.

Opposition Against the Right

Specifically, the test adopted by the ECJ to invoke this right is whether the personal data is “inadequate, irrelevant or no longer relevant, or excessive” in relation to the original purpose for which the data was collected or processed, and in the light of the time that has elapsed since the original publication. The court decision recognises that the universal diffusion and accessibility of such controverted information by search engines has a disproportionate impact on privacy. It has since generated much controversy.

Google, which has since the ECJ decision received more than 190,000 requests to remove links to personal information on its search engine, called the court decision “disappointing”. Not surprisingly, many advocates for freedom of information have spoken against the verdict. Some of them expressed worries that the “right to be forgotten” could spell the end to a free Internet. There were also fears that the exercise of the right would hinder free speech, or inhibit the right to access information. In many ways, these reactions are overblown.

Not Erasing History

First, the scope of the exercise of the “right to be forgotten” is narrow. It involves the de-listing of search results for only searches performed on the basis of the person’s name, eg, “John Smith”. If a search is performed based on other search terms (for example, “car accident in London” in which John Smith was involved), the information, inclusive of the person’s name, will not be de-listed.

The “right to be forgotten”, though a convenient label, is a misnomer as no published material is required to be deleted through exercise of the right. It empowers individuals to control the online dissemination of information about them and involves the de-listing of Internet search results only. The original information continues to exist at the source and can be accessed online directly or by search using other search terms. The public record of a newspaper perpetuates regardless of the removal of the link to it from a search website. Hence any assertion that the exercise of the right will erase past events or rewrite history is misguided.

No Absolute “Right to be Forgotten”

Secondly, the right is not meant to take precedence over freedom of expression or freedom of the media. There is no absolute right to have links removed. Each removal request has to be determined on its merits.

In late November 2014, a working party comprising EU data protection authorities released a set of guidelines (the “Guidelines”) on how the “right to be forgotten” is to be implemented in Europe. They recognised that a balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the personal data in question and on the interest of the public in having access to that particular information.

The Guidelines articulated 13 criteria2 which need to be considered when deciding whether a request to de-list information should be accepted. They include:

  • whether the person plays a role in public life (for example, being a politician, senior public official or member of the [regulated] profession), and whether public access to that information will protect them against his public or professional improper conduct (for example, malpractice litigation against a doctor, dishonest behaviour of a politician or businessman are unlikely to be de-listed);
  • whether the information relates to the exercise of a public figure’s official functions rather than genuinely private information such as information about their health or family members (if affirmative, there will be a strong argument against de-listing); and
  • whether the information is sensitive (for example, information about a person’s health, sexuality or religious belief) and thus has a greater impact on the data subject’s private life (if affirmative, de-listing requests should be favourably considered).

Based on these criteria, it should be obvious that contrary to the assertions of many critics, the “right to be forgotten” will not allow public figures to “whitewash” their unflattering personal titbits. Nor will it allow professionals or public officials who owe a duty to the public to cover up their past misconduct.

Applicability of the ECJ Ruling to Hong Kong?

The ECJ ruling, of course, does not bind Hong Kong courts. Prima facie, the approach it has taken is not applicable under the Ordinance. In the landmark case of Eastweek3, the judgment of the Court of Appeal pointed out that “It is … of the essence of the required act of personal data collection that the data user must thereby be compiling information about an identified person or about a person whom the data user intends or seeks to identify.” As such, Google is not a data user as it does not collect personal data in this manner. Rather, it acts as an intermediary that only provides a facility for web users to gather information dispersed in various websites.

Further, Google entertains requests to remove links from only nationals of EU-countries and four other non-EU-countries (Iceland, Liechtenstein, Norway and Switzerland).

Territorial Effect of a De-Listing Decision

Hitherto, Google has responded to justifiable de-listing requests by removing search results from all its European websites but not its google.com site. Hence anyone using the google.com version of the search engine will be able to circumvent the ECJ ruling and see the complete search results.

To address this anomaly, the EU data protection authorities have stated in the Guidelines that de-listing decisions must be implemented by search engines in such a way that they guarantee the effective and complete protection of data subjects’ rights. In practice, this means that de-listing should not be limited to EU domains; it should be applied to all relevant domains, including .com.

Revealing Facts and Figures

Certain pertinent statistics concerning Google’s implementation of the requests to de-link are very revealing. For example, Google has removed 40 percent of requested URLs but refused to remove the remaining 60 percent. This suggests that, contrary to the speculation of many opponents of the right, Google has not taken the easy way out by erring on the side of acceding to requests.

Further, 90 percent of the requests are pretty much a no-brainer in terms of the decision to accept or decline. Only the remaining 10 percent of cases required some fine balancing between the right to privacy and the public’s right to know. Of these minority cases, some appeals against Google’s decisions were lodged with the respective EU data protection authorities but the number is small. For example, the Information Commissioner’s Office of the United Kingdom has received some 130 such appeals. This is minuscule and falls far short of the Internet-apocalypse that doomsayers have been foreboding.

At one end of the spectrum are accepted cases where the prejudice against the requester is obvious and disproportionate, and privacy must prevail, for example,

  • a victim of physical violence wanted references to the assault removed;
  • a victim of rape requested removal of a link to a newspaper article about the crime;
  • a girl requested removal of a link to explicit photographs of her taken by her ex-boyfriend;
  • a woman requested the removal of a decades-old article about her husband’s murder, which included her name; and
  • a victim of a crime which occurred decades ago requested to remove links to articles which discussed the crime.

The greatest number of removal requests was in respect of materials on social media platforms, such as Facebook, Profile Engine, Google Groups/+, Badoo and YouTube. Although they are not “newsworthy” publications and have no public interest value, they do affect ordinary people’s private lives and the de-listing of the search results did lessen the prejudice against them.

At the other end of the spectrum are rejected cases where the public’s right to know clearly overrides the individual’s right to privacy, for example:

  • a sex offender who wanted recent information about his conviction de-linked;
  • a person made multiple requests to remove 20 links to recent articles about his arrest for financial crimes committed in a professional capacity; and
  • a public official requested removal of a link to a student organisation’s petition demanding his removal.

The Way Forward

The “right to be forgotten” is still a very fluid concept and rapid developments are expected in the short and medium terms.

First, although the ECJ ruling does not bind courts outside EU, cases involving the exercise of similar rights have recently been heard outside EU and the outcome could have implications on the exercise of the right on a worldwide basis.

Secondly, search engines other than Google have either commenced or will commence to handle the de-listing requests they have received and it would be interesting to watch how all the search engines respond to the Guidelines issued by the EU working party of data protection authorities, particularly those guidelines that require removal of search results to apply globally, not just EU domain search results.

Thirdly, the appeals against the search engines’ decisions, once decided by the EU data protection authorities, will set important precedents.

Finally, Google has appointed a council (comprising privacy experts and advocates of freedom of information) to advise on how to implement the ECJ decision. They are going to release a review report soon.

Meanwhile, I appeal to the opponents of the “right to be forgotten” to keep an open mind and re-consider the issues in their proper perspective. I believe it is of paramount importance to appreciate that fundamental human rights such as freedom of expression and privacy are neither absolute nor in any hierarchical order, hence the need to strike a balance between them in any specific circumstances. 

 


* This article is an abridged and modified version of two blog posts published by the Privacy Commissioner for Personal Data on his website at http://www.pcpd.org.hk on 26 June 2014 and 30 December 2014 respectively.

1Google Spain SL, Google Inc v Agencia Espanola de Proteccion de Datos, Maria Costeja Gonzalez (Court of Justice of the European Union, Case C-131/12, decision 13 May 2014. English text at http://tinyurl.com/qggvndl.

2The 13 criteria are appended to the end of the Guidelines: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp225_en.pdf.

3Eastweek Publisher Limited & Another v Privacy Commissioner for Personal Data [2000] 2 HKLRD 83.