At the Asia Pacific Privacy Authorities (APPA) Forum1 that I attended earlier this month in Vancouver, Canada, the 'right to be forgotten' was again one of the major topics on the agenda. Senior representatives of search engine operators also attended that discussion session upon invitation and shared their views.
As I mentioned in a previous Blog2 on this subject, the 'right to be forgotten' is part of the data protection reform proposals now pending passage into law by the European Union (EU) legislature. The principle was invoked in the Google Spain decision3 of the European Court of Justice (ECJ) in May 2014. The court affirmed an individual's right to compel a search engine to de-list search results which link the person's name to certain online publications. The right could be exercised in circumstances where the information is inadequate, irrelevant or no longer relevant, or excessive in relation to the original purpose for which the data was collected or processed, and in the light of the time that has elapsed since the original publication. The court decision recognises that the universal diffusion and accessibility of such controverted information by search engines has a disproportionate impact on privacy. It has since generated much controversy.
Google, which has since the ECJ decision received more than 190,000 requests to remove links to personal information on its search engine, called the court decision "disappointing". Not surprisingly, many advocates for freedom of information have spoken against the verdict. Some of them expressed worries that the 'right to be forgotten' could spell the end to a 'free Internet'. There were also fears that the exercise of the right would hinder free speech, or inhibit the right to access information. In many ways, these reactions are overblown.
Not erasing history
First, the scope of the exercise of the 'right to be forgotten' is narrow. It involves the de-listing of search results for only searches performed on the basis of the person's name, e.g. "John Smith". If a search is performed based on other search terms (for example, "car accident in London" in which John Smith was involved), the information, inclusive of the person's name, will not be de-listed.
The "right to be forgotten", though a convenient label, is a misnomer as no published material is required to be deleted through exercise of the right. It empowers individuals to control the online dissemination of information about them and involves the de-listing of Internet search results only. The original information continues to exist at the source and can be accessed online directly or by search using other search terms. The public record of a newspaper perpetuates regardless of the removal of the link to it from a search website.
No absolute "right to be forgotten"
Secondly, the right is not meant to take precedence over freedom of expression or freedom of the media. There is no absolute right to have links removed. Each removal request has to be determined on its merits.
In late November, a working party comprising EU data protection authorities released a set of guidelines on how the 'right to be forgotten' is to be implemented in Europe. They recognised that a balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the personal data in question and on the interest of the public in having access to that particular information.
The EU Guidelines articulated 13 criteria4 which need to be considered when deciding whether a request to de-list information should be accepted. They include:
Based on these criteria, it should be obvious that contrary to the assertions of many critics, the 'right to be forgotten' will not allow public figures to "whitewash" their unflattering personal titbits. Nor will it allow professionals or public officials who owe a duty to the public to cover up their past misconduct.
Territorial effect of a de-listing decision
Hitherto, Google has responded to justifiable de-listing requests by removing search results from all its European websites but not its google.com site. Hence anyone using the google.com version of the search engine will be able to circumvent the ECJ ruling and see the complete search results.
To address this anomaly, the EU data protection authorities have stated in their Guidelines that de-listing decisions must be implemented by search engines in such a way that they guarantee the effective and complete protection of data subjects' rights. In practice, this means that de-listing should not be limited to EU domains; it should be applied to all relevant domains, including .com.
Revealing facts and figures
Certain pertinent statistics came to light at the APPA Forum concerning Google's implementation of the requests to de-link. 90% of the requests are pretty much a no-brainer in terms of the decision to accept or decline.
Only the remaining 10% of cases required some fine balancing between the right to privacy and the public's right to know. Of these minority cases, some appeals against Google's decisions were lodged with the respective EU data protection authorities but the number is small. For example, the Information Commissioner's Office of the United Kingdom has received some 130 such appeals. This is minuscule and falls far short of the Internet-apocalypse that doomsayers have been foreboding.
At one end of the spectrum are accepted cases where the prejudice against the requester is obvious and disproportionate, and privacy must prevail, for example,
The greatest number of removal requests was in respect of materials on social media platforms, such as Facebook, Profile Engine, Google Groups/+, Badoo and YouTube. Although they are not "newsworthy" publications and have no public interest value, they do affect ordinary people's private lives and the de-listing of the search results did lessen the prejudice against them.
At the other end of the spectrum are rejected cases where the public's right to know clearly overrides the individual's right to privacy, for example:-
The way forward
The "right to be forgotten" is still a very fluid concept and rapid developments are expected in the short and medium terms.
First, although the ECJ ruling does not bind courts outside EU, cases involving the exercise of similar rights have recently been heard in Japan and could well be heard in other jurisdictions.
Secondly, search engines other than Google have either commenced or will commence to handle the de-listing requests they have received and it would be interesting to watch how all the search engines respond to the Guidelines recently issued by the EU working party of data protection authorities.
Thirdly, the appeals against the search engines' decisions, once decided by the EU data protection authorities, will set important precedents.
Finally, Google has appointed a council (comprising privacy experts and advocates of freedom of information) to advise on how to implement the ECJ decision. They are going to release a review report soon.
Against this background, the APPA Forum has concluded that members would continue to closely examine the forthcoming developments. While no concrete action has been contemplated, the possibility of future collective action is not ruled out either.
As far as Hong Kong is concerned, I appeal to the opponents of the "right to be forgotten" to keep an open mind and re-consider the issues in their proper perspective. I believe it is of paramount importance to strike a balance between the right of individuals to privacy and other rights and interests.
2 http://www.www.pcpd.org.hk/english/about_pcpd/commissioners_message/
blog_26062014.html
3 Google Spain SL and Google Inc v AEPD and Mario Costeja González ECJ Case C-131/12
http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131
4 The 13 criteria are appended to the end of the Guidelines:
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp225_en.pdf