On May 13th 2014, the European Court of Justice introduced legal backing for the "right to be forgotten." There's been a great deal of talk about this, most of it inaccurate. This post will explain what this is all about and what it means.
What is the European Court of Justice?
Basically – it’s the European Union’s equivalent of the US Supreme Court. It’s the highest court in the EU, so there is no appeal of its rulings. The EU is halfway between the US federal system and a bunch of independent countries. Each country, just like each US state, can draft their own laws, but they have to comply with EU-wide “directives.” EU directives state whether there should be a law for a given situation and roughly what it should contain. It is up to each state to implement a directive as they see fit, and decide what sort of enforcement they want to put on it. There can be wide variations. For example, some herbal products, like Melatonin, are banned by EU directive. While they are illegal under every EU country’s laws, some countries, like the UK and Germany, enforce the ban strongly, while others, like Italy and Spain, don’t bother and you can buy Melatonin everywhere. Unlike the USA, the EU can’t make laws at the federal level. In the USA this would be like Congress being able to recommend what states do, but without any powers to make law itself.
The European Court of Justice has the power to interpret EU directives, check whether individual nations have proper legislation in place, and that they enforce the laws properly. This allows individuals to take countries to court when they don’t think their nation is acting properly, either through inadequate laws or lack of enforcement.
What was the problem?
It was a question of old, possibly misleading, news being displayed prominently by Google.
In 1998, Spanish citizen, Mario Gonzalez, was forced by the government to auction his house to pay social welfare debts. This involved placing a suitable advertisement in his local newspaper. Mr Gonzalez recovered from his financial issues and got on with repairing his life (successfully). Twelve year’s later the local newspaper digitised it’s archive and put it online. Suddenly Mr Gonzalez found that the 1998 advertisement for the forced auction was #2 in Google listings for his name. Since most employers now search Google for material on potential employees, Mr Gonzalez found it impossible to get a job. He contended the material was so old as to be out-of-date and the prominent listing gave a misleading impression of his current circumstances. He therefore asked Google to remove the link. Google refused. He took this to the Spanish Data Commissioner - and lost. He appealed this to the EU Court of Justice - and won. He also wanted the newspaper to remove the advertisements from their website but lost.
What was the Court’s decision?
The court reasoned that the information was out-of-date and created a misleading impression of Mr Gonzalez.
The newspaper does not have to remove the advertisements. They were legally published and can remain on the website.
Google does have to remove the links to these advertisement.
The Court reasoned that Google is a data processing organisation, and that it’s links are not empty pointers to data but are data themselves. The court also found that, even though Google Inc. is a US organisation, it is subject to Spanish laws.
Why is Google a data processing organisation?
The court decided Google was a data-processing organisation because it retrieves information, analyses it, stores it and displays it in new ways. The court said this constitutes processing. If you process data, you’re a data-processing organisation. That makes you subject to data protection and privacy laws. Google’s defence that the information has already been published elsewhere is irrelevant.
What is important is that the ruling states the list of items linked to in Google search results constitute a description of someone because the results page itself creates an impression of what someone is like.
Why is a US company subject to Spanish law?
Google argued that the data was processed by Google Inc. in the USA, and that Google Spain was just a sales subsidiary. The court said “so what?” The court’s ruling is that it doesn’t matter where the data is processed or what subsidiary does it. If you have a legal entity in a nation and do business there, you are bound by that country’s laws. The reasoning is that the data processing by Google Inc. supports the business activities of Google Spain, so it’s subject to the laws of Spain. It’s not about where you do the data processing, it’s about where you derive benefit from it. If the links had not been available in Spain, or if there was no Google Spain, things would have been different.
Is this censorship?
No. The rules are very specific.
This only applies to private individuals. Organisations can’t ask for links to be removed.
You cannot request the removal of content, only that search engines do not link to it.
The information has to be out-of-date.
The information has to create a misleading impression of you. So, for example, saying someone played football in college is out-of-date but doesn’t create a misleading impression. Making someone’s financial troubles from 15 years ago the #2 listing for their name does. I suspect that if that item had been listed at #200, it would have been OK.
The information cannot be of public interest. If Mr Gonzalez had been running for political office, he would have lost. This is not going to allow politicians or movie stars to remove information they don’t like.
So basically all this covers is information about a private citizen which is out-of-date, creates a misleading impression and is of no public interest.
Is this a massive burden?
Many commentators have expressed the view this creates a huge, possibly unsupportable, burden for search engines. I seriously doubt that.
Firstly, search engines get millions of remove-link requests each year over copyright breaches. The number of individuals making requests under this ruling is likely to be very small compared to that. [update: since this blog was published we've seen just what sort of burden this adds to Google. Google gets 12,000 requests per day for link removal under this ruling. It gets 275,000 request per day for link removal for breach of copyright. So this ruling has added only 4% to Google's link removal workload].
Secondly, Google make massive profits. They can handle any additional costs without it making much impact on those profits.
What does this mean for US companies?
You will never be asked to remove content. This applies to links in search engines only.
It does mean you are bound by the data regulations of any country in the EU where you have a company. You may have T&C’s stating someone is governed by the laws of California, but that won’t wash anymore. Neither will getting your data processed in another country or by another company. It’s not about where or who processes the data, it’s about who benefits from it. However, if you don’t have a company in that country, you don’t have to worry about that country’s data regulations.
Lessons for Google
Get better at your listings. Why would you list something from 16 years ago at #2 for someone? What is relevancy about if it ignores how old an item of information is?
The problem is that Google’s ranking system can be fairly stupid. It prioritises stuff like code and link structures over age. Old rubbish on a well-ranked site gets priority over new gold on a badly-ranked site. How much effort would it really take for Google to factor in the content’s age?
Google should stop pretending it's just some neutral link between us and other people's content. What's the value proposition of Google if it's not that it processes and generates data by which to tune ad delivery? Of course Google processes data - you can't decide what to list where unless you do that. We all know Google chooses the order in which items are listed. That represents the equivalent of editorial influence.
Lessons for the rest of us
I think this will start a trend. The current internet still has this old-world thinking that all data is valuable. Guess what? – some data goes out of date. That should have been obvious. Out-of-data information is not just worthless, it can be harmful. Some companies are like a bunch of obsessive hoarders, indexing everything, keeping everything, while the amount of data piles to the point it may bury us.
We don’t need to keep everything. Once data ceases to be relevant it should be downgraded. Notice the court did not force the newspaper to remove the content. If you want to go digging around local papers in the old-fashioned research style, you can still find it. We’re not forgetting anything, we’re simply tuning how we value old information. We need to learn new ways of handling the data we create. This is simply a small step on the way.