The ruling of the European Court of Justice (ECJ) on 13 May 2014 regarding the "right to be forgotten" 1 is no doubt one of the hottest, if not the hottest, topic in the global privacy arena in the past weeks. Naturally it was one of the agenda items of the Asia Pacific Privacy Authorities ("APPA") Forum2 that I attended last week.
In brief, the ECJ case was concerned with the continued public availability through Google search of a newspaper announcement in 1998 about a Spanish national's real-estate auction in connection with proceedings for the recovery of his social security debts. The announcement was accurate at the time and had been legitimately published. However, as the debt had been resolved, the information became irrelevant and misleading. The ECJ thus ruled in favour of the complainant and required Google to remove or conceal the information so that it no longer appeared in search results based on his name.
To put things in context, we should note that the right to be forgotten is a component of the European Commission's data protection reform proposals formulated to ensure more effective control of people over their personal data, and make it easier for businesses to operate and innovate in the EU's Single Market. The proposals were endorsed by the European Parliament on 12 March 2014. They have yet to be adopted by the Council of Ministers.
The ECJ ruling is therefore to some degree an affirmation of the right to be forgotten before it is transposed into national laws. The rationale behind this right is that citizens should be empowered to control their own identity online. If an individual no longer wants his or her personal data to be processed or stored by a data controller (the EU equivalent of "data user" in Hong Kong's Personal Data (Privacy) Ordinance (the "Ordinance")), and if there is no legitimate reason for keeping it, the data should be removed from their system.
I should emphasize that the right to be forgotten, as conceived by the European Commission, is not an absolute right. There could be legitimate reasons to keep data in a data base, for example, the archives of a newspaper. The right is really about empowering individuals, not about erasing past events or rewriting history. Neither is it meant to take precedence over freedom of expression or freedom of the media, albeit the continued existence and dissemination of the information concerned is prejudicial to the data subject.
The ECJ ruling is an exemplification of striking a balance between the sensitivity of the personal data for the data subject's private life and the interest of the public in having the data, an interest which may vary according to the role played by the data subject in public life. In this case, the publication of the information in 1998 was justified legally as it took place upon government order and was intended to give maximum publicity to the auction in order to secure as many bidders as possible. With the lapse of 16 years, however, the information is "no longer relevant" and the complainant could therefore exercise the right to delink his name from the information searchable through internet.
The ruling should be interpreted based on its facts. As the judgment pointed out, a different conclusion could be reached " … if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having … access to the information in question".
The ECJ ruling applies to the activities of an internet search engine. It has no effect on the original publication of the information in question by the newspaper concerned (which, as indicated above, was lawful) and its retention of the information on its website.
Taking into account the analysis above, it should be clear that the so called "right to be forgotten" is not an unqualified right to be forgotten, as some commentators seemed to portray. It is really a limited right to be de-indexed from internet searches made on the basis of the individual's name for certain information relating to him and in circumstances where his privacy right overrides not only the economic interest of the search engine but also the interest of the general public in finding that information. The test adopted by the ECJ to invoke this right is whether the personal data is "inadequate, irrelevant or no longer relevant, or excessive" in relation the original purpose for which the data was collected or processed, and in the light of the time that has elapsed.
In response to the ECJ ruling, Google has commenced to entertain requests from individuals to exercise this right. It must have by now received tens of thousands of such requests. Other search engines are relatively quiet and seem to prefer wait and see.
It is not entirely clear how Google will handle these requests. Based on its announcement and the information it provides in connection with submission of requests, the following salient features of the scheme are apparent:
The ECJ ruling, of course, does not bind Hong Kong courts. Prima facie, the approach it has taken is not applicable under the Ordinance. In the landmark case of Eastweek3, the judgment of the Court of Appeal pointed out that "It is … of the essence of the required act of personal data collection that the data user must thereby be compiling information about an identified person or about a person whom the data user intends or seeks to identify." As such, Google is not a data user as it does not collect personal data in this manner. Rather, it acts as an intermediary that only provides a facility for web users to gather information dispersed in various websites.
Whether the ECJ ruling will be repeated in countries outside EU has yet to be seen. I learnt from my APPA colleagues that similar cases will soon be heard in Canada as well as in Japan. As the convenor of the Technology Working Group of APPA, I am tasked to explore the implications of the ECJ ruling, including the possibility of APPA members engaging with Google and other search engine operators to discuss the rights of users in the Asia-Pacific region.
While conceivably Google's search removal service is primarily targeted at EU citizens, we should not rule out the possibility that the service could be extended to countries outside EU. First, future court rulings outside EU may oblige Google to provide the service as a matter of legal compliance. Secondly, we now live in a global village. There should be a lot of EU nationals residing outside EU. In particular, for historical reasons, there must be a significant number of UK passport-holders among the Hong Kong population. Could they not invoke the EU legislation and exercise their right to be de-indexed? Finally, I venture to suggest (as I did at the APPA Forum) that as a leading search engine operator, it makes good customer service and business competitiveness sense for Google to demonstrate its privacy friendliness by pioneering a borderless service, regardless of the applicant's nationality and place of residence. This is a mammoth, complicated but worthwhile project as users will benefit from a non-discriminatory and consistent approach in balancing their rights to control their personal data with public's right to know and distribute information. I hope Google will do a good job as it is ably supported by an advisory group which comprises the former Director of Spanish data protection authority and at least two advocates of freedom of information, among other distinguished professionals4.
1 Google Spain SL, Google Inc v Agencia Espanola de Proteccion de Datos, Maria Costeja Gonzalez (Court of Justice of the European Union, Case C-131/12, decision 13 May 2014. English text at http://tinyurl.com/qggvndl (you can change the language of the decision from that link).
3 Eastweek Publisher Limited & Another v Privacy Commissioner for Personal Data [2000] 2 HKLRD 83
4 Google has named the following as confirmed members of its expert advisory committee so far: