EU Privacy Chiefs to Review ECJ Ruling Amid Concerns About How It Will Work
As EU data protection officials meet this week to analyze the online “right to be forgotten” granted by the European Court of Justice (ECJ) last month, there are concerns about the practicalities of the decision and whether it could lead to legal and financial uncertainties for companies, and free speech issues, said industry and public interest stakeholders in interviews. The U.K. Data Protection Act-mandated Information Commissioner’s Office (ICO), however, cautioned against overstating the ruling’s implications. The ECJ ruled that search engines are responsible for personal data published by third parties that show up in search results (WID May 14 p5). Google, the defendant, responded to the decision by offering a Web form for requests for removal of information (WID June 2 p11).
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
The Article 29 data protection working party, made up of national privacy officials, meets Tuesday and Wednesday to begin considering the “consequences of the ECJ’s ruling and to identify guidelines in order to build a common approach of EU data protection authorities on the implementation of the ruling,” it said in a May 23 news release (http://bit.ly/1iMQpl). The ICO addressed the ruling in a May 20 blog by Deputy Commissioner and Data Protection Director David Smith (http://bit.ly/1u90zpg). He welcomed the judgment because it sets a framework for holding data controllers operating search engines to account for the personal data they process, and backs the ICO view that search engines are subject to data protection law, a previously uncertain area.
Some seek to make more of the ruling’s implications for freedom of expression, but “it’s important to keep the implications in proportion and recognize that there is no absolute right to have links removed,” Smith said. Nevertheless, the ICO is concerned about how the right to be forgotten can be achieved in practice and how to set reasonable expectations for the public about how the right works, he said. It’s extremely difficult to completely remove all traces of personal information online, he said.
Although compliance with the judgment is mainly up to search engines, data protection regulators now must interpret and apply this judgment to concerns raised with them, said Smith. The judgment “provides space to strike a balance between the right to privacy and the public’s right to know,” he said. But companies will need guidance from privacy chiefs to ensure search providers take the right approach, he said. The ICO wouldn’t comment on Google’s mechanism for removing data, saying it might have more to say after this week’s working group discussion.
Hogan Lovells (Washington) lawyer Christopher Wolf said the judgment is “so opaque” that it could be extremely broad, making people justifiably concerned. The ECJ didn’t specify how to strike the balance between outdated information and the public’s right to know, which is “enormously subjective,” said Wolf, who leads the firm’s privacy and information management practice. The decision makes clear that original documents can’t be removed, but the Internet is based on hyperlinks, he said in an interview. It’s uncertain whether the judgment extends, for example, to links within blogs, Wolf said. Resolving the requests will “absolutely” be expensive for Internet companies in the U.S. and Europe, because it will involve human input, he said.
As to whether other search engines and Internet companies are likely to follow Google’s lead in setting up a mechanism for taking down personal information, Wolf said there has to be some process for receiving complaints and resolving disputes. Others may not copy Google’s model, but it’s pretty good, he said. Google’s response “is important for all stakeholders as it is likely to set the industry bar for responding to take down notices of this sort,” wrote Baker & McKenzie (London) attorneys Ben Allgrove and Ian Walden in a client alert. Several Web companies said they're studying the decision and had no comment. Google didn’t immediately comment.
The problem is that “whatever system search engines put into place is likely to be overbroad,” said Hogan Lovells (Paris) media, communications and data protection lawyer Winston Maxwell. Faced with a deletion request, Internet companies will probably err on the side of deletion to avoid potential liability, he said. “This will create significant chilling effects” intolerable under U.S. First Amendment principles, he said by email.
"We should be dealing with a very narrow class of complaints,” said (U.K.) Open Rights Group Executive Director Jim Killock. The worry is that “many more people will wish to complain than have a right for material to be removed,” he told us. The ruling shouldn’t cover data leaks or defamation, for instance, but personal data that’s irrelevant or misleading, he said. Publishers or courts, not search engines, should handle most complaints, he said.
"The real question is whether a company can create a process that is sufficiently robust, keeps a narrow focus, and doesn’t err on the side of caution,” Killock said. He said there’s an incentive for Google to avoid legal action rather than contest complaints.