What Europe's new 'right to be forgotten' online means

Would something like this ever happen in the U.S.? Wikipedia founder Jimmy Wales doesn't think so.

Can you really be forgotten on the Internet? The European Union (EU) believes so, and recently ordered Google, Bing, and Yahoo to make it happen. The court's decision could fundamentally remake search engines, impact journalism and lead to all manner of thorny issues related to censorship, privacy, and the public's right to know.

The controversial ruling is still new, so the search engines are still figuring out their next steps; Google is already accepting right-to-be-forgotten requests while putting together an advisory committee that includes Wikipedia founder Jimmy Wales (who argues that the ruling is "censorship plain and simple," first on Twitter and also in an email interview.)

To make sense of the right-to-be-forgotten issue--including how it potentially impacts Web users--here's a look at some questions you may have about the European court's decision.

What does "the right to be forgotten" mean?

Just for the sake of example, let's say you're a cheating politician or a victim of online bullying or simply a regular person who types his name into Google and doesn't like what he sees. You want Google to remove links to any webpages about you that are wrong, harmful, outdated--or that simply do not reflect who you are. This is now legally possible, at least for those in the EU.

Why is this happening now?

Because of a recent ruling by the Court of Justice of the European Union. The exact case is Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González--here's a pdf. The court ruled that people can ask search engine operators--that'd be Google--to remove certain results about them.

What kind of results?

In the court's words, that means links to webpages that are deemed "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed." So even if the information is true, you can still keep it from showing up in search results.

So now pedophiles and corrupt politicians can have negative information about them removed?

They can try, and many already have. But they will likely fail. The Court was reasonably clear that information in the "public interest" need not be erased from Google's servers and that a "fair balance" between individual privacy and the public interest be maintained.

That said, it's open to debate whether a link to a 20-year-old arrest record, for example, should be forgotten or is (still) in the public interest. If Google rejects a removal request, the person could take the company to court.

Who is impacted by this court ruling?

Europe, basically--the ruling applies to the 28 European Union countries plus the four European Economic Area nations. That's more than 500 million people.

How can I be forgotten?

If you happen to reside in one of the 32 European nations, then fill out this online form Google created. You'll need three things: a "legible copy of a document that verifies your identity" (though not necessarily a photo ID), a list of all the URL links you want removed from Google's results, and an explanation of why each one is "irrelevant, outdated, or otherwise inappropriate."

Can I make a request on behalf of someone? My parents, for example?

Yes. This requires you provide a copy of that person's identity, as noted above, plus proof that you are authorized to make the request on their behalf.

How long does it take to be forgotten?

No one knows yet. Google says it is building a "system for removing links" in accordance with the EU ruling; until then, "your message is in our queue."

Is the data about me actually erased?

No. The court clearly understood that just because Google no longer links to a webpage, that page and the information in question does not suddenly vanish. However, as so much information is discovered via search engines, and since search engines enable anyone to compile a rapid dossier on a person, the Court felt that removal of search engine results was both adequate and feasible.

But I am removed from Google's results, right?

Not as much as you might hope. There are two issues: First, Google links will only be removed from EU country domains, such as Google.de or Google.fr, but not from Google.com. A person using Google.com will see the links, just as before.

Second, Google also intends to note on the bottom of its search results page when a particular link(s) has been removed. If you search a person's name at Google.de, for example, and see a notice at the bottom of the results page that a link has been removed, you might wonder if it was something just outdated, or especially heinous.

Will Google fight this ruling?

It may not, at least not vigorously or overtly. Individual privacy rights are valued differently in Europe than in the US. Plus, Google is facing several more potentially costly fights in Europe. These range from antitrust probes for both search and its Android operating system, to the company's possible association with NSA spying activities. Google is also fighting European authorities over tax revenues. This may be a case where the company decides to pick its battles.

Won't Google be overwhelmed by requests?

It just might be. On the very first day Google posted the online form, the company received 12,000 requests.

Does the EU ruling only affect Google?

No. Google is the dominant search engine in the EU, so obviously it's impacted a great deal. However, Yahoo and Bing must also comply as they have a presence in Europe, though neither has yet established a system to accept requests. It is still unknown how this may ultimately apply to related services such as Twitter or Facebook, both of which have search functions.

Could the U.S. follow suit with a right-to-be-forgotten ruling?

That's hard to say. Privacy rights and First Amendment-related issues are judged differently here. That said, there is precedent.California has a law that allows minors to have information on them removed from search engines. There are no doubt many people that would happily welcome the "right to be forgotten."

Tags GoogleWeb & socialeuropean unionsecuritylegal issuesinternet

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Sophos Mobile Control

Data protection, policy compliance and device control for mobile devices

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.