EU ruling on Google data risks ‘opening the floodgates’
An individual’s “right to be forgotten” is backed by the EU high court, which rules that Google must remove data from its search listings if asked, leaving lawyers, tech firms and Google reeling.
Google and other search engines can be made to remove “inadequate” or “irrelevant” data about individuals from their search engine results if requested, said Europe’s top court in a landmark ruling on Tuesday.
The EU’s court of justice (ECJ) upheld the complaint of a Spanish man who objected to the fact that Google searches of his name threw up links to a 1998 newspaper article about the repossession of his home. Mario Costeja González said the matter had been resolved – that he had auctioned his home to pay his debts – and that a search of his name should no longer recover this information.
We now need to take time to analyse the implications. Google
The case has put the spotlight on the tension between free speech and online privacy. But the court ruled that under existing EU data protection laws, Google should be forced to remove data which compromises an individual’s “right to be forgotten”.
Judges at the Luxembourg-based court said Google can be required to remove data that are “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.” The ECJ said the rights of people whose privacy has been infringed outweigh the general public interest.
The ruling has huge implications, and creates both technical challenges and potential extra costs for companies like Google, the world’s leading search engine, Facebook, Twitter and the many other sites which hold users’ data.
Google said it was disappointed with the ruling, and pointed out that it contradicted comments from the ECJ’s court adviser last year that deleting sensitive information from search results would interfere with freedom of expression.
“We are very surprised that it differs so dramatically from the advocate general’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications,” said Google spokesman Al Verney.
‘The right to be forgotten will affect the technology industry more than any other‘
“From a data protection point of view this ruling might give more control over web content to the wider public. However it remains to be seen if the UK will indeed opt out of this new law, as the Ministry of Justice has suggested it may,” says Tim Summers of Temple Bright law firm.
“This is because the right to be forgotten, if implemented in the UK, will affect the technology industry more than any other. Data and tech firms are the ones who would have to pay for this new law. The UK is seeking to build its stature as a global hub for tech innovation, and onerous legislation on tech firms is unlikely to help the cause.
“Dealing with requests to delete historic data is likely to be incredibly expensive, and it may set unrealistic expectations on companies like Facebook and Twitter – which have huge databases that would need to be monitored in minute detail.
“In practice, the way in which data is handled might not change – but the existence of such a law would risk opening the floodgates with tech companies being legally challenged for the removal of all types of content. The concept of ‘inadequate or irrelevant’ content, to which the right to be forgotten applies, seems very broad.
“So while such a law may have some immediate appeal from a privacy point of view, there are some serious potential consequences and these must be considered carefully.”
‘Companies can no longer hide behind their servers’
A Yahoo spokesperson said: “Since our founding almost 20 years ago, we’ve supported an open and free internet; not one shaded by censorship. We’re now carefully reviewing the European court of justice’s decision to assess the impact for our business and for our users.”
But the European Justice Commissioner Viviane Reding welcomed the ruling, and said it vindicated EU efforts to toughen up privacy rules. “Companies can no longer hide behind their servers being based in California or anywhere else in the world,” she said on Facebook, adding: “The ruling confirms the need to bring today’s data protection rules from the “digital stone age” into today’s modern computing world where data is no longer stored on “a server”, or once launched online disappears in cyber-space.”
The European Commission proposed in 2012 that people should have the “right to be forgotten” on the internet. This was subsequently watered down to a “right to erasure” of specific information by the European parliament last year. But today’s ruling was made under
The proposal needs the blessing of the 28 EU governments before it can become law. Google, Facebook and other internet companies have lobbied against such plans, worried about the extra costs.
