A Presentation byBill Hannay

Charleston Conference 2014

The right to privacy has been a hot topic for several years, but in the past six months the hottest privacy topic in Europe – and to only a slightly lesser extent in the United States and elsewhere around the world – is the enforcement of a “right to be forgotten.”

It is also known as “the right to oblivion.”

On May 13, 2014, the European Court of Justice held that the operator of a search engine (Google) is obliged to remove from the list of results displayed – following a search made on the basis of a person’s name – links to web pages, published by third parties and containing information relating to that person, if such information is “inadequate, irrelevant or no longer relevant, or excessive” in relation to the purposes for which the data was collected or processed and in the light of the time that has elapsed (even if the information is true).

Google-iath

Mario

In Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, CJEU Case C-131/12 (13 May 2014), the European Court of Justice established a major legal precedent that a search engine company like Google is responsible for the data that it displays because it is a “processor” of that data, not just a passive conduit, and thus a “controller” of it.

The Court’s ruling came in response to a series of questions from a Spanish court.

In 2009, Mr. Costeja González discovered that a Google search of his name pulled up two newspaper articles from 1998, describing the forced sale of his home to pay overdue debts.

He asked the newspaper and Google to remove the articles on the ground of irrelevancy because the debts had long ago been resolved.

When they refused, he filed a complaint with Spain's data protection agency. It concluded that Google had violated EU privacy laws.

Google appealed to Spain’s high court, which referred several legal questions to the ECJ.

Technically, the case involved interpreting Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Quite a mouthful, no? So it’s referred to as the “EU Data Directive” The result in the case was foreordained by

the Directive’s provisions.

6(1). Member States shall provide that personal data must be: (c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed; [and] (d) accurate and, where necessary, kept up to date . . . .

12. Member States shall guarantee every data subject the right to obtain from the controller: . . . (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, , in particular because of the incomplete or inaccurate nature of the data . . . .

The ECJ held that “processing of personal data . . . carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data . . . since that processing enables any internet user to obtain . . . information which potentially concerns a vast number of aspects of [an individual’s] private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty . . . .”

The court emphasized that “the effect of the interference with those rights of the data subject is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous . . . .” BUT . . .

“A fair balance should be sought . . . between [the legitimate] interest [of internet users in having access to information] and the data subject’s fundamental rights.”

Balance “may . . . depend on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”

In the case of Mr. Costeja González, the balance tipped in his favor, overriding the economic interest of the search engine operator and the general public’s interest in the data about him.

On request of an individual to remove information about him/her, a data “Controller” must balance the individual’s privacy rights against the public’s interest in the information at issue and remove the data if the individual’s rights outweigh the public’s.

Google has now published an online form for EU citizens to request removal of data links.

On its first day of service, Google received 12,000 requests to remove links about them.

Google has mounted a publicity campaign, holding seminars in major cities in Europe.

Wikipedia co-founder Jimmy Wales is reported to have described the EU's Right to be Forgotten as “deeply immoral” and warned that the ruling will “result in an internet riddled with memory holes".

A legal commentator characterizes the judgment as “profoundly harmful to the operation of the internet and a betrayal of Europe's legacy in protecting freedom of expression.”

A Conservative MP in the UK said: “This ruling is a draconian attack on free speech and transparency. It highlights the increasingly authoritarian dimension to the EU.”

An anti-censorship spokesman called the ruling “retrograde” and said “This is akin to marching into a library and forcing it to pulp books.”

A leader in the UK Parliament praised the decision, saying “The presumption by internet companies . . . that they can use people’s personal information in any way they see fit is wrong, and can only happen because the legal framework in most states is still in the last century when it comes to property rights in personal information.”

A privacy advocate has argued that "Without the freedom to be private, we have precious little freedom at all.”

I think that it is a great decision … a careful and correct application of the EU Data Privacy law, recognizing the need for balancing all interests.

More than that, it is a vital first step in trying to bring the insanity of the Internet under control. It’s already destroyed legitimate newspapers and is now gutting libraries. It’s easier to find porn and libel than Shakespeare on the Internet.

It’s all well and good to worship “free expression” but you can’t yell fire in a crowded movie theater just ‘cuz you’re “expressing” yourself.

We need to take control of this Wild West now before it gets worse.

Europe, schmeurope … What about the U.S.? Could Google happen here? Maybe, maybe

not. We don’t have a broad-based law anything

like the Data Directive. Nothing in the Constitution says that a data controller has to remove or take down data that is irrelevant or inaccurate.

But we do regulate data use and content in one notable area: credit reporting. The Fair Credit Reporting Act imposes certain rules on accuracy, relevance, and obsoleteness.

We do recognize a hazy kind of “invasion of privacy,” but it’s very spotty.

Some state laws prohibit use of a name or likeness for advertising without consent.

Of course, there are defamation and slander laws, but they require intent and damages.

Intrusion upon seclusion? See Restatement 2d of Torts, § 652B. Kind of a trespass theory.

Best shot? Restatement 2d of Torts, § 652D – public disclosure of embarrassing private facts.

In June 2014, a judge in British Columbia ordered Google to block a group of websites from its worldwide search engine.

It is not a privacy case. It is a trade secret case, where the plaintiff sought an injunction to prevent the defendant from selling its services over the Internet. Court held it had the power.

Plaintiff persuaded the court that Google was (unwittingly) facilitating the violations by linking users to defendant’s website.

You are dedicated to preserving information. Printed information in books and periodicals

… information captured on CDs and DVDs … as well as e-books … and now every library is filled with computer terminals for patrons and scholars and students to access e-info online.

It tears your heart out to have to discard “old” books and magazines into the dumpster.

But what about “bad” or “private” info? What do you say when someone asks you to help them takedown false, old or embarrassing info?

Lethe (n.) a river in the Greek underworld that, when drunk from, made souls forget the sufferings of life; oblivion or something to make you enter oblivion and forget.

In the U.S., many online hosts offer procedures for requesting that they voluntarily remove (or take down) material from their websites.

They are basically used to respond to copyright infringement claims, and less often involve libel and other illegal content. See, e.g., www.youtube.com/t/community_guidelines.

Notice and takedown is mandated as part of the safe harbor provision for online hosts in the Digital Millennium Copyright Act 1998 .

Forget him ‘cuz he doesn't want fame.Forget him ‘cuz it isn’t fair.Don't let them search for his old data'Cause they can't find the dirt that isn't there.

Google guy, I am asking politely,Remove those links so they can’t see.Oh don’t you cry now, just be a good guy now;Forget him and guard his privacy.