Introduction

The idea of having one’s information being private is on a steady decline as we develop and adopt new technologies in our daily lives. The lives we lead now on Facebook, Twitter and Instagram, for most in the past generation was unimaginable 30 years ago. The control over these rights has led to the development of the doctrine of the right of erasure or the right to be forgotten. The right to be forgotten is a right which stipulates that personal data were obtained or available shall be erased when such data is inadequate, irrelevant and excessive in relation to the purposes for which it was collected[1]. A typical example is when a search engine operator would be obliged to delete the links to related pages. The right to be forgotten allows citizens of Europe to ask search engines to remove links to “inadequate, irrelevant or … excessive” content[2]. Since its inception, about 3 million people in Europe have utilised[3] this initiative.[4] This essay would attempt to critically examine the extent to which universal de-listing decisions and the deployment of geo-blocking technology strike a fair balance between all the interests and fundamental rights.

Credit: Zac Johnson

Right To Be Forgotten

The right to forgotten[5] was made prominent in the case of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González[6]. In that case, the Court of Justice of the European Union (CJEU) held that an individual could apply to an internet intermediary or online content service sharing provider to prevent information about the individual from coming up in searches or on the internet intermediary’s platform. The CJEU further noted that the applicability of the doctrine has a broad territorial scope, and should the need arise results gotten be delisted on a search engine’s platform. The Court further found that the fundamental right to privacy is greater than the economic interest of a commercial firm and, in some circumstances, the public interest in access to Information.

The right to be forgotten was codified in Article 17 of the GDPR and exceptions to the protection of this right were also stipulated[7]. This exception further delineates the right of erasure and set safeguards through which the right can be exercised. Rights are absolute until they are applied to jeopardise the freedom of others. The right to be forgotten therefore is not absolute as a total application of the right would lead to a clash of other fundamental rights guaranteed to other persons.

The right to be forgotten is a right to protect private dignity by making the erasure of data easier, while this right may well make a fundamental conflict with the right free speech and access to information. Then what is the proper balance between clashing values of privacy and free speech, or the right to be forgotten versus the right to remember?[8] How would the value of the right to be forgotten relative to the right to remember influence individuals’ behaviour and search engines’ response? Contrary to existing procedures such as “notice-and-takedown,” the decision by the CJEU on the “right to be forgotten” grants search engines to exercise discretionary power in the interpretation of the law as long as data subjects meet certain requirements.[9] The search engines now have private regulatory/enforcement powers or succinctly put they can be termed gate-keepers. The new role acquired by Google as a case-by-case decision maker for delisting requests turns the company into a quasi-legal organ [10] which means private actors implement a public initiative backed by EU law.[11]

Remedies

The notable remedy available to the Information society services in establishing the right to be forgotten belonging to data subjects is de-listing of websites and links.[12] In implementing this remedy, information society services providers such as Google have had clashes with country regulators such as CNIL and both parties are presently at the CJEU on the universal application of delisting.[13] Delisting of websites or links is the removal of sites or links from information society services or links. The offending pages or posts are not deleted[14], but rather links on Information society services or search engine operators are removed when specific keywords related to a data subject are typed into a search engine. In establishing a framework for universal delisting, the Article 29 Working Party[15] guidelines stipulated in Part 1 Provision 20(5) that

Although concrete solutions may vary depending on the internal organization and structure of search engines, de-listing decisions must be implemented in a way that guarantees the effective and complete protection of these rights and that EU law cannot be easily circumvented. In that sense, limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the judgment. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com.” [16]

This means that in applying the principle of the right to be forgotten’ the de-listing of a link must be effective, universal, complete, de-listing limited to EU domains ‘no sufficient’ and De-listing must apply to ‘all’ domains including domains in other countries.

The application of universal delisting for a data subject may lead to the breach of certain fundamental rights to other personalities such as other citizens, ISPs and the news media. The rights that would be affected include the freedom of expression and the freedom to conduct business. This fundamental right would clash with the right to privacy, right to protection of data and the right to a fair hearing.

 

Credit: Jodie Ginsberg

Conflicting Interests

At the heart of the debate for allowing universal delisting lies several conflicting interests. The individuals seeking to avoid harm from defamatory content have a right to ensure the de-listing of the negative information on a search engine. Such right is therefore premised on their privacy rights. Despite the compelling argument for this, what about other users seeking information or of the search engines providing information? Based on this, other users are deprived of the links that help them easily find contents, and search engines may experience loss or reliability. In essence, the erasure of links under the guise of protecting privacy rights can infringe fundamental rights, such as the freedom to do business, freedom of speech, expression, and access to information, and may generate various layers of social costs.

As a general rule and by virtue of the Spain Vs Google case a data subject’s right to privacy and data protection would prevail over the economic right of search engines and user’s right to access information via search engine granted under Article 11 of the EU charter. In considering the fundamental rights the grant of a universal delisting procedure is granted, issues such as the nature and sensitivity of process data and public interest in accessing personal data via a search engine.  If the data subject is an essential figure in the eye of the public, the right of the data subject would have to be balanced with the interest of the public to know. A good example is the case of Prince Albert of Monaco’s secret love child[17] where the prince had a son, and a media organisation reported it, the ECtHR held that the public had a right to be informed as the data subject was a public figure and the information concerned succession plans of the monarchy.

Google has argued that delisting if universally applicable would affect the fundamental rights of several persons and interests across the Globe.[18] The CNIL responded that only delisting on all of the search engine’s extensions, regardless of the extension used or the geographic origin of the person performing the search, can effectively uphold” the right to privacy. The CNIL, therefore, fined Google of 100,000 Dollars.[19] The Information society service provider further explained that to limit the scope of universal delisting, geo-blocking options would be suitable for defining the universal application of delisting websites and links. In determining the grant or legitimacy of a right to be forgotten request, there are several interests and fundamental rights that clash. This interests and rights determine if an application for a right to be deleted would be granted. The AG in his opinion in ABC Vs Google advocated that it would be appropriate to carry out an examination on a case-by-case basis, in which the operator of a search engine would be required to weigh up, on the one hand, the right to respect for privacy and the right to protection of data under Articles 7 and 8 of the Charter and, on the other, the right of the public to have access to the information in question.

On the other hand Article 29 WP established that to give full effect to the data subject’s rights as defined in the ruling[20], delisting decisions shall be enforced in a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. The guidelines further state that limiting de-listing to EU domains because users tend to access search engines via their national domains cannot be considered a sufficient mode of protecting the rights of data subjects according to the ruling of the CJEU.

The option of geo-blocking has been fronted as a proportionate way of narrowing the scope of universal delisting. Geo-blocking has also been applauded by several rights group[21] and Google’s council on the right to be forgotten.[22] Geo-blocking means restricting user access to specific content based on location. In considering the balance between the interest and fundamental rights at stake the Advocate general was of the opinion that a search engine operator is not required, when agreeing to delist a link to carry out such delisting on all the domain names of its search engine irrespective of the location from which the search on the basis of the requesting party’s name is performed.[23]

While the point raised by the Advocate general reduces the impact of a successful de-listing request, it is however noted that the provisions of the GDPR are applicable worldwide and an attempt to stifle the full power of delisting links would amount to cherrypicking of applicable rules in the GDPR and may defeat the purpose of delisting. In fulfilling the position of the Advocate General, a search engine would have to employ geo-blocking as a way of reducing the effects universal de-listing would have on a global scale. Users within the EU zone may utilize Virtual Private Network (VPNs) or proxy networks for browsing activities as it unlocks restrictions placed on browsing activities.

The Fundamental interests at stake in using geo-blocking to address de-listing are the Respect for private and family life, right to be forgotten, Freedom of expression and information, freedom to do business and right to access information. Balancing individual rights and liberties, the general interest of the public, and a search engine’s economic interest and credibility is a daunting task that requires a minimum set of guarantees, such as impartiality/neutrality, audi alteram partem (hearing both sides), and judicial review.[24] In reviewing the guidelines for the applicability of geo-blocking the case of UPC V Telekabel[25] is key in determining if geo-blocking is appropriate in a situation.

“None the less, the measures which are taken by the addressee of an injunction, such as that at issue in the main proceedings, when implementing that   injunction must be sufficiently effective to ensure genuine protection of the fundamental right at issue, that is to say that they must have the effect of preventing unauthorised access to the protected subject-matter or, at least, of making it difficult to achieve and of seriously discouraging internet users who are using the services of the addressee of that injunction from accessing the subject-matter made available to them in breach of that fundamental right”.[26]

This case stipulates that when an order for blocking of access to a particular service is made the order should be obeyed to the fullest and in such a way that the right to private family and data protection would not be infringed. The issues arising from the clash of fundamental rights would not be necessary if only Article 17 of the GDPR stipulated proper guidelines on what action should be carried out when a right of erasure request is made to an ISP.

This move by users to utilise VPNs may be further heightened by the recent release by the Department for Digital, Culture, Media and Sport (DCMS)[27] to stop the spread of online harm. Users not wanting to be censored by the DCMS would invest in VPNs and are more likely to search the web using VPNs for which geo-blocking is not adequate. The point does not help this fact that 17% of Europe’s online users currently use VPNs and that number increases as awareness rises. However, the Advocate General underlines that

“once a right to de-referencing within the EU has been established, the search engine operator must take every measure available to it to ensure full and effective de-referencing within the EU, including by use of the ‘geo-blocking’ technique, in respect of an IP address deemed to be located in one of the Member States, irrespective of the domain name used by the internet user who performs the search.”[28]

Another fundamental issue arising from universal delisting is the territorial applicability of the Right to be forgotten. How do national courts deal with this problem? Is localised geoblocking enough to enforce a right to be forgotten? And how does one continue to enforce it? Could we simply end up in a game whack-a-Mole game if media outlets get wind of such delisting and republish delisted content?  The CNIL in its position opined that both EU competition law and EU trademark law could have a territorial effect outside of EU Member States so delisting of links should also be applicable globally. Despite the position of the CNIL, Author >>> disagrees and says that universal delisting may lead to jurisdictional overreach on the part of the EU authorities. The Advocate General, on the other hand, stated that the enforcement of areas such as trademark and competition law constitutes an example of an exceptional nature.

Notwithstanding the position of the AG, the GDPR, in this case, is applicable worldwide as long as EU citizens are involved or would be involved in a particular transaction such as using a search engine. The unrestricted allowance of a European citizen’s private data to persons outside the EU zone could be self-defeating as EU citizens on whom the GDPR is applicable to would view the private information of a data subject outside the EU. In a line similar to Google’s approach Author, Svantesson advocates that the use of universal delisting could inevitably lead to the destruction of a shared resource — the Internet as we know it as oppressive regimes may seek global removal of content offensive to their laws.[29]

In dealing with the specific case, Advocate General Szpunar had the opportunity to point out that the fundamental right to be forgotten must be balanced against other fundamental rights. [30]The rights had to be balanced against rights such as the right to data protection and the right to privacy, as well as the legitimate public interest in accessing the information sought. The AG also stated that, if worldwide delisting were permitted, the EU authorities would not be able to define and determine a right to receive information, let alone balance it against the other fundamental rights to data protection and privacy. Peter expressed reservations on the geoblocking arguments being put forward by Google and stated that persons who use US proxy to bypass restrictions would Search engines block such proxies as well?[31].Under the EU Charter, the target audience is not global is European. However, the rights of European particularly their data would be exposed to Europeans outside the EU zone as the non-application of universal delisting would not affect them. Global de-listing would make a very detrimental impact on the right to freedom of expression ie Article 11 EU Charter.

The AG believes that Global de-listing may lead to censorship and an authoritarian data protection framework through which people from repressively ruled countries could utilize the European data protection framework to stifle free speech. The Advisory council to Google also shared this view.[32] While the fears of the Attorney general are rightfully founded, it is trite that persons outside the EU cannot take advantage of the EU’s data protection laws. Non-EU citizens/residents cannot, therefore, use such laws for censorship purposes as the Spanish Audiencia Nacional held in the case of a Paraguayan national who sought to invoke the provisions of the GDPR on a right of erasure recently.[33] The AG may not be correct on repressive regimes using the right of erasure like regimes for selfish purposes. The reason is that these countries can implement a regime of universal delisting based on the right to be forgotten even if the EU does not subscribe to it.

The AG’s opinion further stipulates that de-listing of links should be on a case by case basis as universal delisting may still be applicable. Just because private information is available on the Internet does not mean it should be made widely available. Search engines may not address the privacy problem in other regions outside the EU as a data subject’s private information within the EU would not be private outside the EU. This position, therefore, defeats the true meaning of privacy and the balance favours the right to freedom of expression and speech of persons outside the EU (inclusive of EU nationals) in relation to EU national data subject information.[34]

Right to be forgotten Credit: Burnetts Solicitors

Conclusion

The right to be forgotten is a problematic doctrine, both from a legal and ethical perspective and would remain so. In finding a balance between the fundamental rights involved in the use of universal delisting and geo-blocking. It is my opinion that matters relating to the right to be forgotten to be treated on a case by case basis. It would be good if regulatory bodies can set up a guideline for the proper implementation of the consequential order allowed under Article 17 of the GDPR.

This guideline would provide for the appropriate mode of delisting links to be used in specific situations. An excellent example of a unique situation that would require geo-blocking is when the personal data of a child is made available online or when a person whose conviction has been quashed makes a request. The appropriate solution in the hypothesis above would be for a universal delisting approach to be made. Determining the proportionality of a delisting would be easier with the setting of laid down rules by the EDPB.[35]

Also, we may make use of technology to allow people to make more informed decisions and judgments about what they find online; for example, search algorithms can help to rank information based on quality, content type, and age. While the arguments of Google and its supporters may be valid it is important to note that societal attitudes change, companies begin to adjust their practices, and entire infrastructures emerge to support the proper enforcement of the law.[36]

[1]Cristina Pauner and Jorge Viguri, ‘The Adaptation Of The GDPR In Spain: The New Data Protection Act (Lopd)’.

[2] Article 17(1) GDPR

[3] Michee Smith, ‘Updating Our “Right To Be Forgotten” Transparency Report’ (Google, 2018) <https://blog.google/around-the-globe/google-europe/updating-our-right-be-forgotten-transparency-report/> accessed 8 April 2019.

[4] Daniel Boffey, ‘Dutch Surgeon Wins Landmark ‘Right To Be Forgotten’ Case’ (the Guardian, 2014) <https://www.theguardian.com/technology/2019/jan/21/dutch-surgeon-wins-landmark-right-to-be-forgotten-case-google> accessed 8 April 2019.

[5] Article 17 GDPR

[6] C-131/12

[7] Article 17(2) GDPR

[8] Byung-Cheol Kim and Jin Yeub Kim, ‘The Economics Of The Right To Be Forgotten’ [2015] SSRN Electronic Journal.

[9] Supra

[10] Jean-Marie Chenou and Roxana Radu, ‘The “Right To Be Forgotten”: Negotiating Public And Private Ordering In The European Union’ (2017) 58 Business & Society.

[11] Jean-Marie Chenou and Roxana Radu, ‘The “Right To Be Forgotten”: Negotiating Public And Private Ordering In The European Union’ (2017) 58 Business & Society.

[12] European Commission, Factsheet On The “Right To Be Forgotten” RULING (C-131/12) (2014), http://ec.europa.eu/justice/dataprotection/files/factsheets/factsheet_data_protection_en.pdf

[13] Google LLC, succeeding Google Inc. Vs Commission nationale de l’informatique et des libertés (CNIL) Case C – 507/17

[14] CJEU Google vs Spain

[15] The agency is now known as European Data Protection Supervisor

[16] Guidelines On The Implementation Of The Court Of Justice Of The European Union Judgment On “Google Spain And Inc V. Agencia Española De Protección De Datos (Aepd) And Mario Costeja González” C-131/12 2014.

[17] Couderc v France (40454/07) [2016] E.M.L.R. 19; [2015] 11 WLUK 215 (ECHR (Grand Chamber)

[18] Advisory Council to Google, ‘The Advisory Council To Google On The Right To Be Forgotten’ (2015) <https://static.googleusercontent.com/media/archive.google.com/en//advisorycouncil/advisement/advisory-report.pdf> accessed 17 April 2019 and CNIL…

[19] ‘Google Street View : CNIL Pronounces A Fine Of 100,000 Euros – CNIL – Commission Nationale De L’informatique Et Des Libertés’ (Web.archive.org, 2014) <http://web.archive.org/web/20111009051607/http:/www.cnil.fr/english/news-and-events/news/article/google-street-view-cnil-pronounces-a-fine-of-100000-euros/> accessed 17 April 2019.

[20] Google Vs Spain

[21] Wikimedia Foundation Inc., Foundation for Freedom of the Press, Microsoft Corp., Reporters Committee for Freight of the Press and Others

[22] Advisory Council to Google, ‘The Advisory Council To Google On The Right To Be Forgotten’ (2015) <https://static.googleusercontent.com/media/archive.google.com/en//advisorycouncil/advisement/advisory-report.pdf> accessed

[23] Case C-136/17

[24]Jean-Marie Chenou and Roxana Radu, ‘The “Right To Be Forgotten”: Negotiating Public And Private Ordering In The European Union’ (2017) 58 Business & Society.

[25] Supra

[26]  UPC VS Telekabel CJEU 27-3-2014, C-314/12

[27] ‘Online Harms White Paper’ (GOV.UK, 2019) <https://www.gov.uk/government/consultations/online-harms-white-paper> accessed 17 April 2019.

[28] Advocate general opinion Case C-507/17 Google v CNIL

[29] Dan Svantesson, ‘Limitless Borderless Forgetfulness? Limiting The Geographical Reach Of The ‘Right To Be Forgotten’ [2015] SSRN Electronic Journal.

[30] Advocate general’s opinion Case C-507/17 Google v CNIL

[31] Tomm Webb, ‘ECJ Urged To Limit Right To Be Forgotten To The EU’ (globaldatareview.com, 2019) <https://globaldatareview.com/article/1178992/ecj-urged-to-limit-right-to-be-forgotten-to-the-eu> accessed 17 April 2019.

[32] Advisory Council to Google, ‘The Advisory Council To Google On The Right To Be Forgotten’ (2015) <https://static.googleusercontent.com/media/archive.google.com/en//advisorycouncil/advisement/advisory-report.pdf> accessed 17 April 2019.

[33] Miquel Peguera, ‘Right To Be Forgotten And Global Delisting: Some News From Spain’ (Cyberlaw.stanford.edu, 2017) <http://cyberlaw.stanford.edu/blog/2017/12/right-be-forgotten-and-global-delisting-some-news-spain> accessed 17 April 2019.

[34] Marc Rotenberg, ‘The Right To Privacy Is Global’ (Usnews, 2014) <https://www.usnews.com/debate-club/should-there-be-a-right-to-be-forgotten-on-the-internet/the-right-to-privacy-is-global> accessed 10 April 2019.

[35] EDPB Work Program 2019/2020 (EDPB 2019) <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb-2019-02-12plen 2.1edpb_work_program_en.pdf> accessed 17 April 2019.

[36] Martha Garcia-Murillo and Ian MacInnes, ‘Così Fan Tutte : A Better Approach Than The Right To Be Forgotten’ (2018) 42 Telecommunications Policy.