15 May 2014

Wrong to be forgotten? New data protection ruling could leave us all in the dark

While the European Commission, European Parliament and Council prevaricate over the introduction of a new Data Protection Regulation, and a "right to be forgotten" enshrined within it, the Court of Justice of the European Union has marched boldly in and proclaimed that such a right already exists.

The case brought by Mario Costeja Gonzalez against Google has attracted much publicity (see, for example, the Channel 4 News report and our comment) for the ruling that existing data protection legislation confers a right on individuals to oblige search engines to erase information and links to articles about them from search results.

The right is not an absolute one. An individual can request the deletion of material where it is inadequate, irrelevant or no longer relevant or excessive, but, according to the Court, the right may be outweighed by public interest if the individual plays a particularly prominent role in public life.

Nevertheless the ruling would be anathema to The Circle, the fictional Google-like entity depicted by Dave Eggers in his novel of the same name, for whom "Privacy Is Theft", and the ultimate goal is that everyone should know everything, whether personal data or not.

Google itself was reported to be "disappointed" by the judgment, but this is probably as much for prosaic and practical reasons, as for idealistic ones. Leave aside for the moment the fact that the judgment arguably calls into question the whole legitimacy of Google as a data processor indexing information about individuals without consent: if the Gonzalez ruling leads to a flood of individuals demanding Google remove their personal data, then unless Google is simply going to accede (which seems unlikely) it is going to be tasked with devising a whole new notice and take down procedure that is somehow able to take into account all of the various nebulous factors identified by the Court of Justice and arrive at a defensible decision.

Whether you think the right to be forgotten as a general principle is good or bad, questions have to be asked about the desirability of making Google liable as an intermediary for indexing information which is published on third party websites. It is inconsistent with e-commerce law, which provides that Google is not liable as an "information society service" for acting as a conduit, hosting or caching. It attaches liability to Google for reasons of expediency, in that Google is in the EU jurisidiction whereas the third party website it is indexing may not be.  

It also does nothing to address the issue of the data subject's information being processed on the underlying third party websites which Google is indexing. To use an analogy, if you rip out the contents page and index from an encyclopedia, it doesn't mean that the information referenced is no longer there. And in the process you make the encyclopedia unusable for the majority of readers.

So this decision risks damaging the functionality of a tool on which we all rely to navigate the internet. Is that in the public interest?

No comments:

Post a Comment