ISPs Facing High Hurdles with Right to Be Forgotten Ruling, Say Critics
The European Court of Justice (ECJ) ruling on the right to be forgotten could create enormous implementation and legal problems for ISPs, said critics of the decision at panel Monday hosted by Georgetown University’s Communication, Culture & Technology (CCT) department (http://bit.ly/1r9At2y). Proponents of the ruling said requests to remove personal data shouldn’t necessarily be weighed differently than requests to remove financial or sensitive information.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
The ECJ ruled in May that search engines are responsible under EU data protection law for their processing of personal data appearing on Web pages published by third parties (see 1405140036). Google has received nearly 145,000 requests for information removal since it started accepting requests May 29, said a transparency report published Oct. 10 (http://bit.ly/1snEpBQ) (see 1410140109). From those requests, Google has considered 497,695 URLs for removal, ultimately removing 41.8 percent of them. Facebook has had the most URLs, 3,332, removed from search results of any domain, followed by European social network Badoo, data crawler ProfileEngine.com and YouTube.
The values and principles of the ECJ opinion are “valid,” but the problem is implementation, said Gabe Rottman, a legislative counsel in the American Civil Liberties Union's Washington Legislative Office. “One of the underlying principles behind the First Amendment” is to “prevent unintended consequences,” he said. That Google has to go through right to be forgotten requests on a “case-by-case basis” creates a “very difficult line drawing exercise” and the “potential for unintended consequences,” said Rottman.
Google isn’t legally obliged to act on right to be forgotten requests, said Andrea Glorioso, European Commission official. The ECJ isn’t going to “suggest … that due process and the rule of law” should be “bypassed,” he said. The right to be forgotten is not yet law, Glorioso said, but the European Parliament expects the ruling to be become law in the first half of 2016.
Google must implement “28 right to be forgottens” within the EU’s 28 member states, said Meg Ambrose, Georgetown University CCT assistant professor. “Normally I don’t feel sorry for Google, but this is a massive compliance cost,” she said. “There could not possibly be a worse way to develop a right to be forgotten [regime] than to hand it to an American mega-corporation,” said Ambrose. The better route would be for each member state to determine its laws and then notify Google, she said.
The “implementation of a court’s order” on the right to be forgotten “threatens to retard innovation on the Internet broadly,” Rottman said. He said Google has the necessary infrastructure to deal with such requests due to its compliance with the Digital Millennium Copyright Act’s notice and takedown scheme. But smaller providers probably wouldn’t be able to handle such requests and would be less likely to enter the market, said Rottman.
“So what” if ISPs are flooded with takedown requests, said John Tran, Electronic Privacy Information Center open government fellow. “Why is that a concern?” he asked. It’s not a concern if the requested information to be removed is financial or personal information, he said. “That issue never gets raised.” But in the case of right to be forgotten, the potential harm isn’t “as well defined,” said Tran.
If the right to be forgotten ruling isn’t a “Whack-a-Mole” regime, it can’t apply only to certain country code top-level domains in Europe, said Rottman: “It has to apply to everything.” That’s not just a problem for the U.S., but a potential boon for autocratic regimes looking to stifle dissent online, Rottman said.