In a landmark ruling from the European Court of Justice in Google v Commission nationale de l’informatique et des libertes (CNIL) (C-507/17) the court has ruled that the web giant Google – and thereby other search engines – must de-index offending content on all European versions of its search engines, although not beyond.
The majority of press coverage thus far has focused on the positives for free speech – unsurprisingly so – but have largely failed to highlight the positive impact that this will have on those rightfully seeking de-indexing across Europe of unlawfully published data.
Back to basics
The origins of the Right To Be Forgotten are a case which became known as Google Spain (Google Spain SL & Anor v Agencia Española de Protección de Datos & Anor [2014] QB 1022. On 13 May 2014, the European Court of Justice (ECJ) issued a ruling confirming an individual's right to request the removal of sensitive information from internet search results, being processed in breach of their data protection rights – notably where the personal data is excessive, irrelevant or out of date. The complainant, Mario Costeja González, had argued that the fact of an earlier bankruptcy – which had long-since been discharged – remained forever linked to his name on any internet search. The judgment in his favour, allowing for the information to be de-indexed, paved the way for the delinking of information in breach of a subject's data protection became known as the Right To Be Forgotten (RTBF).
We had written an article for Spear’s at the time of the judgment, and noted that it became all too easy to be breathily scandalised at the decision and its arguably chilling effects on free speech. But the other side of the story – unsurprisingly failing to find extensive column inches in the mainstream media – was the intended balance sought to be achieved by the court between privacy and free speech. By sensibly and proportionately applying the principles of the RTBF we successfully protected the rights of many clients.
The background to the recent ECJ ruling was a ruling in 2016 by France’s privacy watchdog CNIL which fined Google 100,000 euros for refusing to de-list sensitive information from search results globally upon request. Google's objection resulted in the action ultimately being heard in the ECJ and the current finding that while the whole of Europe is fair game for de-indexing, the whole of the world is not.
Back to the ECJ judgment…
Despite the loud applause for the judgment from free-speech proponents – and those with commercial interests in objecting to de-linking – two important aspects to the requirements which have not been widely reported – again perhaps unsurprisingly so given that they favour privacy protection – are reinforced in the judgment.
First, search engine operators ("SEOs") are required to carry out de-indexing on the versions corresponding to all Member States; and second, SEOs must put in place measures which 'discourage' internet users from gaining access (from one Member State) to the links in question which appear on versions of that search engine outside the European Union.
'…EU law requires a search engine operator to carry out such a de-referencing on the versions of its search engine corresponding to all the Member States and to take sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights' the judgment provided. It went on 'Thus, such a de-referencing must, if necessary, be accompanied by measures which effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, through a version of that search engine outside the EU, to the links which are the subject of the request for de-referencing. It will be for the national court to ascertain whether the measures put in place by Google Inc. meet those requirements.'
Of course, what that actually looks like, remains to be seen. The employment of burly bouncers to loom menacingly over the shoulder of an Internet user, and employing strong-arm tactics to 'discourage' said user from virtually slipping over a jurisdictional boundary, are fanciful. Geolocation signals – restricting access to a URL from the country of the person requesting the removal – are not, and indeed, is Google's current policy. Whether that will suffice for compliance with the ECJ's 'discouragement' requirement, remains to be seen.
Also missing largely from the reporting of the judgment is that the CJEU expressly observed that whilst EU law does not currently require de-indexing to be carried out on all territorial versions of a search engine, it does not prohibit it. It is possible therefore, that this notable positive stance by the CJEU on EU regulating with extraterritorial effects, may impact the manner in which Google and other search engines, and European domestic courts, interpret the judgement as the ensuing case law unfolds.
A fairer playing field
It's important not to forget the roots of these developments in Google Spain back in 2014, setting the whole Right To Be Forgotten ball rolling in the first place, which sought to achieve equity between the various players wishing to protect their competing rights: the right of publishers to publish public interest information; the right of search engines to make available that information to the pubic; the right of the public to access public interest information; but also importantly the right of the individual to respect for their privacy when it comes to outdated, inadequate or irrelevant information.
And there's the rub. Because as the ECJ noted, 'The balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world'.
Many commentators applauding the ECJ's ruling have argued that no country should be able to impose rules on citizens of another. Others however, have been disappointed in the decision, which naturally limits the rights of individuals properly and lawfully seeking to prevent the easy dissemination of material on which the spotlight of the internet should not be shown, but who cannot gain full protection because while the data cannot come in through the front door of the European based search engines it comes streaming through the windows of those in America, Africa or Asia.
Encouraging discouragement
This decision will throw up challenges for Google and other SEOs as to what the effective measures will be, to result in the requisite discouragement. Domestic European courts will have their say as decisions lay the parameters – indeed, they can always find that whatever Google does may not be good enough, resulting in litigation to hammer out the details.
We at Withers have long argued (to Google) that its existing policy is insufficient. And accordingly, while the mainstream media has heralded the decision as a success for SEOs, we will embrace the opportunities it heralds for our clients, properly and responsibly requiring Google and SEOs to comply with the law. While previously, had Google agreed to delist a URL as a result of a request from someone in the United Kingdom, users outside of the United Kingdom could continue to see the URL in search results when in searching for him/her on any non-European Google search domain. So a journalist in France could use Google.com to find the URL. The ECJ decision suggests Google must delist on all European domains and use 'measures which effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, through a version of that search engine ‘outside the EU, to the links which are the subject of the request for de-referencing'. Arguably, and on the right facts, a case could be made to the national data protection authority that the only way to do this is through geolocation signals throughout the EU meaning that Google's current policy is unfit for purpose.
RTBF - helpful tool, not holy grail
In providing holistic advice to our clients, the Withers Media & Reputation team does not lose sight of the fact that a RTBF complaint is not a holy grail. The offending material, once delisted, cannot be found on a search of the individual’s name, but it is still accessible on the site of the original publisher. Or to use a bookshop analogy, it only removes the offending material from the bookshop window – the book is still available on the shelves inside the shop, should anyone choose to go in and look for it. Accordingly, complainants with real grievances should always consider if it is better to challenge the primary publisher over the unlawful content, which if successful provides a complete remedy.
The ECJ judgment serves as an important recognition that Member States have different ways of balancing various rights that the court in the original Google Spain case sought fairly to deal with. The right to be forgotten was never a whitewasher’s charter – although it may have suited its detractors to mislead the public that it was - but rather a legal tool to assist those whose private information was unfairly and disproportionately being highlighted under the spotlight of an SEO search when there was no public interest justification for doing so.
