Schneier sees data security laws as solution to privacy problems

Security expert Bruce Schneier’s recent article for Forbes, “Everyone Wants You To Have Security, But Not From Them,” provides insight into a number of privacy topics. Schneier described how private tech companies like Google, Apple, and Facebook and government entities want your data to be secure – but only from their competitors. Schneier said private companies use your data for proprietary gain, and the government uses your data for “security purposes.”

The most interesting part of Schneier’s piece was his final paragraph. Here, he explained how he would solve the privacy problem:

… any long-term security solution will not only be technological, but political as well. We need laws that will protect our privacy from those who obey the laws, and to punish those who break the laws. We need laws that require those entrusted with our data to protect our data. Yes, we need better security technologies, but we also need laws mandating the use of those technologies.

For more from Bruce Schneier, you can read his blog “Schneier on Security” or new book, “Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World.




Ninth Circuit to hear Garcia v. Google, Inc. en banc; Will reconsider Garcia’s copyright interest in “Innocence of Muslims” film

The copyright community has been anticipating what was made official today—the Ninth Circuit will review en banc its July decision in Garcia v. Google, Inc.  Chief Judge Kozinski and 10 other Ninth Circuit judges randomly chosen will reconsider its decision granting a preliminary injunction against Google.


An anti-Islamic film “Innocence of Muslims” appeared on YouTube featuring a five-second clip of Cindy Garcia. Garcia’s performance was used in “Innocence of Muslims” even though she only consented to be in an Arabian adventure film “Desert Warrior.” “Innocence of Muslims” garnered vast negative attention and ultimately resulted in threats to Garcia. Garcia then asked Google to take down the film on YouTube under the Digital Millennium Copyright Act (DMCA). When Google did not remove “Innocence of Muslims” from YouTube, Garcia sued Google for copyright infringement.


The district court denied her motion for preliminary injunction against Google because the court found she lacked a copyright interest in the film. Garcia appealed the case, and the Ninth Circuit Court of Appeals granted a preliminary injunction against Google. The Ninth Circuit held that Garcia’s performance contained the minimal creativity to be copyrightable, suggesting she had a “performance copyright.” Judge Kozinksi wrote:

“[J]ust because Garcia isn’t a joint author of ‘Innocence of Muslims’ doesn’t mean she doesn’t have a copyright interest in her own performance within the film.”

Five months later, the Ninth Circuit amended its Garcia opinion. The Ninth Circuit’s revised opinion said that the district court could find that Garcia is not entitled to copyright in her performance because the U.S. Copyright Office rejected Garcia’s attempt to register a copyright interest in her “Innocence of Muslims” appearance. At the same time, the revised opinion did not alter the court’s discussion of Garcia’s “performance copyright,” and the injunction on the film remained.

Today’s news of an en banc review shows that the Garcia saga is far from over. Now, the Ninth Circuit is set to discuss Garcia’s copyright interest in the film and determine if the injunction against YouTube/Google should remain.

Free Speech in the Internet Age: True threats, the right to be forgotten, and net neutrality

Today I had the privilege of organizing an event for the Sports, Entertainment, and Media Law Society at the LSU Paul M. Hebert Law Center titled, “Free Speech in the Internet Age: True threats, the right to be forgotten, and net neutrality.” We were honored to have three experts speak on these three important free speech topics that continue to evolve as the Internet progresses.

LSU law professor Michael Coenen spoke about the true threat doctrine, focusing on the upcoming case before the United States Supreme Court of Elonis v. United StatesOral arguments are set for Dec. 1. Then, Eric Robinson, the co-director of press law and democracy project at the LSU Manship School of Mass Communication, explained the right to be forgotten in the EU. He published his Powerpoint presentation from today’s event on his blog. Finally, ACLU representative Stephen Dixon discussed net neutrality and how it has recently become a partisan issue.

unnamedThese three topics—true threats online, the right to be forgotten, and net neutrality—will be crucial in shaping how speech freedoms persevere in the Internet Age.

Tracking fame through the lens of a search engine

In my latest post for the Interdisciplinary Internet Institute, I delve into one aspect of how Google has implemented the Court of Justice of the European Union’s ruling in the Google Spain case. The way Google’s algorithm adds or does not add a disclaimer to certain search results gives you a glimpse into if Google thinks you are “famous.” As my post suggests, if you Google your name on a Google website in the EU (, for example), whether a disclaimer appears at the bottom of the results will tell if you the search giant believes you are public figure. Disclaimer = not famous. No disclaimer = famous.


All search results are not created equal: The right to be forgotten in the European Union

“Some results may have been removed under data protection law in Europe.”

This sentence is new to the eyes of the average American, but Europeans who use Google have become accustomed to seeing these 12 words or a similar set of words at the bottom of online searches. This difference stems from a case brought before the Court of Justice of the European Union (CJEU) last spring that fundamentally changed online search engines in Europe—Google, Inc. v. AEPD and Mario Costeja González—known by most as the Google Spain case.


The case began when Mario Costeja González searched his name on Spain’s version of Google,, and found two articles from the Spanish newspaper La Vanguardia that discussed his financial troubles. The articles concerned the announcement of a real estate auction that was held 16 years ago to recover social security debts owed by González . After seeing the articles, González made a request to the Spanish Data Protection Agency asking that La Vanguardia and Google Spain remove the articles, claiming that the proceedings were resolved years ago and were irrelevant. The Spanish Data Protection Agency rejected his claim in regards to La Vanguardia but asked Google to remove the links from its search index in Spain. Google appealed this request and sought review from the CJEU, the highest court in Europe.

Court’s Opinion

Summing up the CJEU’s opinion, the Court interpreted Directive 95/46/EC, which is a legal act in the EU governing the processing of personal data, to mean that in certain situations—particularly when the information is “inadequate, irrelevant or excessive in relation to the purposes of the processing”—search engines should remove links from their search index following appropriate requests for removal. The CJEU decided that fundamental privacy rights overrode the economic interests of the search engines and the interests of the public to access information. In essence, the CJEU granted Europeans the ability to ask search engines to erase certain search results after a user searches his/her name on the search engine. The Court also mandated that search engines comply with the requests if they contain inadequate or irrelevant material. Thus, the “right to be forgotten” was born.


The Google Spain decision explains why search results on Google in the EU yield statements such as, “Some results may have been removed under data protection law in Europe,” and why this disclaimer is not present on Google searches in the United States. The CJEU’s decision only affects Internet search engines in the EU, but the decision is not limited to Google. Bing also processes right to be forgotten requests.

The Google Spain case left Google and other search engines on their own to establish criteria that comply with the CJEU’s decision to process removal requests. For now it seems as if Google is following the limited guidance from the CJEU. Its website says Google is looking for “inadequate, irrelevant or excessive” results, and assessing the requests on a case-by-case basis. The search engines have developed their own patchwork of criteria to determine whether to remove a link from a search engine result, resulting in a “very vague and subjective” process. Google established an Advisory Council that is currently touring Europe soliciting input on how right to be forgotten requests should be processed.

Request Procedure

The procedure for submitting a right to be forgotten request is fairly straightforward. Google and other third party websites, such as, allow users to file right to be forgotten requests by completing an online form. Google’s form asks users to select one of the EU countries, submit personal information (name used in search, email address, etc.), and then provide the URLs for the results you want removed. Next, the user must explain “why the inclusion of that result in search results is irrelevant, outdated, or otherwise objectionable.” Finally, users must submit a document verifying their identity, such as a passport or government-issued ID.

If a right to be forgotten request is granted, the underlying content will not be removed. The link will only be removed from the search engine index; the URL that is being linked to from the search engine will remain online. For example, pretend I am a French citizen, and I search “Michael Lambert” on “” A Wikipedia article appears in the search results that I claim contains irrelevant or inadequate information. I could then file a right to be forgotten request. If the request is granted, the link to the Michael Lambert Wikipedia article would be removed from the Google search entry in the EU. But this does not affect the underlying Wikipedia article. The article itself is not removed from the Internet. If you type in the exact URL of the Michael Lambert Wikipedia article in your browser, you could still find the article regardless of whether you are in the United States or Europe. Additionally, if you search Michael Lambert on, the Wikipedia article would still be found in the search results.


As of July 2014, Google received more than 91,000 right to be forgotten requests, approving more than 50 percent of them. Early in the process Google reported that requests concerned issues such as “serious criminal records, embarrassing photos, instances of online bullying and name-calling, decades-old allegations, negative press stories, and more.” When a link is removed from a search, the underlying publisher is notified by the search engine that the search engine has removed one of its links from search results. But the search engine does not tell the publisher the identity of the requester or the reasons for the request.  Some of the publishers notified have decided to tell the public that some of its content has been removed from search engines. For example, Wikipedia announces all the Wikipedia links removed from searches pursuant to right to be forgotten requests. The website “Hidden from Google” posts links that are being censored by search engines.

Recently, The New York Times announced that Google removed links to five Times articles because of right to be forgotten requests. Google did not tell The New York Times who submitted the request but only that they have had removed them from EU search results. To give you an idea of what type of content people are attempting to censor, the five articles removed contained information about two wedding announcements, a death notice, a report about a website being shut down after allegedly selling $1 million of useless web addresses, and a feature story regarding a theater production “Villa Villa.

Closing Thoughts

For years courts across the world have struggled to balance privacy and free expression. In recent years this debate has moved to a new forum: the less-structured realm of the Internet. The Google Spain case gave the CJEU one of the first opportunities for a high court to set the precedent for the privacy-speech tug-of-war online. The CJEU chose privacy at the peril of free and robust free expression. But the debate is far from over in Europe or the United States. More privacy and speech questions will be posed as the Internet advances. And many will remember that much of the debate was sparked by the Google Spain case—a case that is unlikely to be forgotten.




Author’s note
: This post is the first in a series of posts addressing the Google Spain case and the right to be forgotten.

I recommend two papers from European writers that discuss the Google Spain case in greater detail: