EU Demands Global 'Right to Be Forgotten'

Privacy Watchdogs Want Worldwide Erasure of Search Results
EU Demands Global 'Right to Be Forgotten'

European privacy watchdogs say Google and other search engines must remove links - in response to "right to be forgotten" requests - not just from their European sites, but across all of their sites. The announcement, which is one of several recently released new guidelines for search engines, has been stoking fears that EU officials want to censor search results in other countries.

See Also: A Look at Processing Principles Under the GDPR, CCPA, and the EU-US DPF

Representatives from Europe's data protection authorities, who together comprise the EU's Article 29 Data Protection Working Party, last week announced the new guidelines. They follow a ruling from the European Court of Justice in May that search engines must eliminate "inadequate, irrelevant or no longer relevant" search results in response to related requests from members of the public. Since then, EU countries' data protection commissioners have been working to translate that ruling, from Europe's highest court, into concrete guidelines and procedures.

After the court's ruling, Google began accepting right-to-be-forgotten requests and, upon approval, removing links from search results, then notifying media outlets or publishers of sites to which the links led. To date, Google has been removing links only from country-specific domains in Europe, such as the google.fr website in France. At the same time, Google also launched an EU privacy roadshow to discuss the ruling.

But EU privacy watchdogs have dismissed some aspects of Google's approach. Most notably, the new guidelines require that the "right to be forgotten" be implemented in a way that "cannot be circumvented" by Europeans. To date, any Google user in Europe, for example, could see removed links simply by not using a country-specific site, such as google.co.uk, and instead searching with google.com.

Now, however, the new guidelines say links must be excised from all of a search engine's sites, such as google.com, if they can be accessed from within Europe. "From the legal and technical analysis we are doing, they should include the '.com'," said Isabelle Falque-Pierrotin, who heads France's privacy watchdog and the Article 29 Working Party, The Telegraph reports.

But the working party did note that search engines do not need to remove the actual links from their databases, and emphasized that the link removal from search engine results was tied only to the person's name in the link-removal application. "The original information will still be accessible using other search terms, or by direct access to the source," the working party says. The new guidelines also state that search engines don't legally have to notify sites when they remove their links from results. "It may in some cases be necessary, but not as a routine and not as an obligation," Falque-Pierrotin says.

Google didn't immediately respond to a request for comment on the new guidelines.

Regulators React To Google's Approach

The release of the new guidelines wasn't unexpected. That's because EU privacy commissioners already met with Google in July to discuss a number of issues related to how Google was choosing to interpret the EU court's ruling, such as only applying link-removal requests to its European portals. "The problem is that Google has made its implementation of the ruling extremely easy to circumvent, and the WP29 is reacting against that," Julia Powles, a researcher in law and technology at the U.K.'s Cambridge University, tells Information Security Media Group.

Even so, Powles says it's "disappointing" that data commissioners have released their response to the high court's ruling, without detailing the social and ethical justifications for their new guidance. "The regulators seem to have done what most of those in the debate have done - i.e. abstract the whole situation from real, human cases - and this has predictably generated, in English-language coverage at least, an enormous amount of negative publicity," she says. That has largely centered on allegations that the EU ruling amounts to "European censorship" of Google, which "enrages the free-speech activists."

Still, Powles thinks the "censorship" claim is overblown. For starters, she notes that when Google deals with copyright-related takedown requests, "U.S. copyright law is applied to all Google domains, no matter where the alleged infringer resides and where the infringement occurs." In other words, the company removes links to content not just from google.com, but also from google.fr in France, and every other one of its portal sites, based on U.S. law.

Google's "right to be forgotten" removals also comprise a small fraction of copyright-related takedowns. The company, according to its Transparency Report, receives 1 million copyright-related requests per day, and in the past has said it complies with 97 percent of them. To date, however, the company has received a total of only about 175,000 right-to-be-forgotten takedown requests, referencing a total of 600,000 URLs, of which it has then removed 42 percent of requested links, tied to specific search results.

Microsoft, Yahoo Follow Suit

Microsoft Bing and Yahoo have likewise begun accepting and responding to "right to be forgotten" requests. In many European countries, Google commands more than 90 percent of the search engine market, typically followed by Bing and then Yahoo.

While Bing posted a link-removal request form in July, it only began excising some links in November, reports reputation management firm Reputation VIP's Forget.me site.

"We've begun processing requests as a result of the court's ruling and in accordance with the guidance from European data protection authorities," Microsoft says in a statement. "While we're still refining that process, our goal is to strike a satisfactory balance between individual privacy interests and the public's interest in free expression."

Yahoo has issued a similar statement, saying: "We will carefully evaluate each request with the goal of balancing the individual's right to privacy with considerations of the public's right to information."

EU Votes for Google Breakup

In another recent development, members of the European Parliament passed a resolution on Nov. 27 calling for Google to be split into multiple companies, citing concerns that the search giant is stifling competition. The resolution now moves to the European Commission, which could pass it into law. But many observers say the resolution is largely symbolic and relates to concerns not just over how Google weights search results in a non-neutral way, but also the relatively low amount of taxes that many U.S. technology giants pay in Europe.

The European Parliament's proposal, which comes four years into a related EU antitrust investigation, has been slammed by many U.S. lawmakers, including the leaders of the Senate Finance Committee and House Ways and Means Committee. "This and similar proposals build walls rather than bridges [and] do not appear to give full consideration to the negative effect such policies may have on the broader US-EU trade relationship," they wrote in a bipartisan letter to EU officials.


About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.eu, you agree to our use of cookies.