“Some results may have been removed under data protection law in Europe.”
This sentence is new to the eyes of the average American, but Europeans who use Google have become accustomed to seeing these 12 words or a similar set of words at the bottom of online searches. This difference stems from a case brought before the Court of Justice of the European Union (CJEU) last spring that fundamentally changed online search engines in Europe—Google, Inc. v. AEPD and Mario Costeja González—known by most as the Google Spain case.
The case began when Mario Costeja González searched his name on Spain’s version of Google, www.google.es, and found two articles from the Spanish newspaper La Vanguardia that discussed his financial troubles. The articles concerned the announcement of a real estate auction that was held 16 years ago to recover social security debts owed by González . After seeing the articles, González made a request to the Spanish Data Protection Agency asking that La Vanguardia and Google Spain remove the articles, claiming that the proceedings were resolved years ago and were irrelevant. The Spanish Data Protection Agency rejected his claim in regards to La Vanguardia but asked Google to remove the links from its search index in Spain. Google appealed this request and sought review from the CJEU, the highest court in Europe.
Summing up the CJEU’s opinion, the Court interpreted Directive 95/46/EC, which is a legal act in the EU governing the processing of personal data, to mean that in certain situations—particularly when the information is “inadequate, irrelevant or excessive in relation to the purposes of the processing”—search engines should remove links from their search index following appropriate requests for removal. The CJEU decided that fundamental privacy rights overrode the economic interests of the search engines and the interests of the public to access information. In essence, the CJEU granted Europeans the ability to ask search engines to erase certain search results after a user searches his/her name on the search engine. The Court also mandated that search engines comply with the requests if they contain inadequate or irrelevant material. Thus, the “right to be forgotten” was born.
The Google Spain decision explains why search results on Google in the EU yield statements such as, “Some results may have been removed under data protection law in Europe,” and why this disclaimer is not present on Google searches in the United States. The CJEU’s decision only affects Internet search engines in the EU, but the decision is not limited to Google. Bing also processes right to be forgotten requests.
The Google Spain case left Google and other search engines on their own to establish criteria that comply with the CJEU’s decision to process removal requests. For now it seems as if Google is following the limited guidance from the CJEU. Its website says Google is looking for “inadequate, irrelevant or excessive” results, and assessing the requests on a case-by-case basis. The search engines have developed their own patchwork of criteria to determine whether to remove a link from a search engine result, resulting in a “very vague and subjective” process. Google established an Advisory Council that is currently touring Europe soliciting input on how right to be forgotten requests should be processed.
The procedure for submitting a right to be forgotten request is fairly straightforward. Google and other third party websites, such as forget.me, allow users to file right to be forgotten requests by completing an online form. Google’s form asks users to select one of the EU countries, submit personal information (name used in search, email address, etc.), and then provide the URLs for the results you want removed. Next, the user must explain “why the inclusion of that result in search results is irrelevant, outdated, or otherwise objectionable.” Finally, users must submit a document verifying their identity, such as a passport or government-issued ID.
If a right to be forgotten request is granted, the underlying content will not be removed. The link will only be removed from the search engine index; the URL that is being linked to from the search engine will remain online. For example, pretend I am a French citizen, and I search “Michael Lambert” on “Google.fr.” A Wikipedia article appears in the search results that I claim contains irrelevant or inadequate information. I could then file a right to be forgotten request. If the request is granted, the link to the Michael Lambert Wikipedia article would be removed from the Google search entry in the EU. But this does not affect the underlying Wikipedia article. The article itself is not removed from the Internet. If you type in the exact URL of the Michael Lambert Wikipedia article in your browser, you could still find the article regardless of whether you are in the United States or Europe. Additionally, if you search Michael Lambert on Google.com, the Wikipedia article would still be found in the search results.
As of July 2014, Google received more than 91,000 right to be forgotten requests, approving more than 50 percent of them. Early in the process Google reported that requests concerned issues such as “serious criminal records, embarrassing photos, instances of online bullying and name-calling, decades-old allegations, negative press stories, and more.” When a link is removed from a search, the underlying publisher is notified by the search engine that the search engine has removed one of its links from search results. But the search engine does not tell the publisher the identity of the requester or the reasons for the request. Some of the publishers notified have decided to tell the public that some of its content has been removed from search engines. For example, Wikipedia announces all the Wikipedia links removed from searches pursuant to right to be forgotten requests. The website “Hidden from Google” posts links that are being censored by search engines.
Recently, The New York Times announced that Google removed links to five Times articles because of right to be forgotten requests. Google did not tell The New York Times who submitted the request but only that they have had removed them from EU search results. To give you an idea of what type of content people are attempting to censor, the five articles removed contained information about two wedding announcements, a death notice, a report about a website being shut down after allegedly selling $1 million of useless web addresses, and a feature story regarding a theater production “Villa Villa.
For years courts across the world have struggled to balance privacy and free expression. In recent years this debate has moved to a new forum: the less-structured realm of the Internet. The Google Spain case gave the CJEU one of the first opportunities for a high court to set the precedent for the privacy-speech tug-of-war online. The CJEU chose privacy at the peril of free and robust free expression. But the debate is far from over in Europe or the United States. More privacy and speech questions will be posed as the Internet advances. And many will remember that much of the debate was sparked by the Google Spain case—a case that is unlikely to be forgotten.
Author’s note: This post is the first in a series of posts addressing the Google Spain case and the right to be forgotten.
I recommend two papers from European writers that discuss the Google Spain case in greater detail:
- Ioannis Iglezakis, The Right to Be Forgotten in the Google Spain Case (Case C-131/12): A Clear Victory for Data Protection or an Obstacle for the Internet?, available at http://ssrn.com/abstract=2472323.
- Stefan Kulk & Frederik Zuiderveen Borgesius, Google Spain v. González: Did the Court Forget about Freedom of Expression?, available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2491486.