The European Court of Justice has been taking a stronger role this year in calculating how human rights apply to new technology, most recently with decisions repealing the EU's digital data retention directive. Now, in Google Spain v. Mario Costeja González, it has outlined how Europeans might have public information about them deleted from search engine listings — even if that data is available elsewhere, part of the legal record, and true.
The case concerns a Spanish citizen who sued Google to remove search links to a 1998 article in the newspaper La Vanguardia, which listed a real estate auction by the Spanish authorities, intended to recover his social security debts. EU data protection law has a "right of deletion" — a right generally assumed to grant the ability to remove information collected on individuals for business purposes. Until now, it's not been applied to public information indexed by search engines.
The ECJ declared that the search engine was covered by the EU's data protection laws because its spidering involved the processing of personal data, and as such, that Gonzalez had the right to demand that Google remove the story of his real estate sale from search listings, as the proceedings were resolved and the data was now "irrelevant." In the lower courts' decision, however, La Vanguardia itself was not required to remove its story from its site.
Effectively, the ECJ said that news stories such as González's forced real-estate sale might be part of the public record or worth publishing for journalistic purposes — but even if it was so, Gonzalez had the right to ensure that others online could not mention or link to the online web page.
The operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages ... even, as the case may be, when its publication in itself on those pages is lawful.
Worse, the argument as to why intermediaries should remove mentions of this content is because there may be other sites that are not subject to EU jurisdiction, who might be publishing and copying the content.
Given the ease with which information published on a website can be replicated on other sites and the fact that the persons responsible for its publication are not always subject to European Union legislation, effective and complete protection of data users could not be achieved if the latter had to obtain first or in parallel the erasure of the information relating to them from the publishers of websites.
In other words, the Internet's ability to route around censorship is a reason why the court doubled down on local censorship, rather than come to a decision that accommodates that fact.
The court is attempting to avoid enforcing the blanket purging of facts about ordinary individuals from the historical record while preventing the consequences of those facts becoming universally and permanently known. But publication and propagation are inseparable on a network which acts as both a decentralized historical record, and the means by which the public discovers and explores that record. When a newspaper publishes a news item, it appears online. The fact of that publication is one of the bits of information that Internet services collectively can, and do, disseminate and preserve. Attempting to limit the propagation of that information by applying scattergun censorship will simply temporarily distort one part of the collective record in favor of those who can take the time and money to selectively edit away their own online blemishes. Popular search engines will list the best of everyone, and be compelled to disappear other facts. Meanwhile, a new market is created for mining and organizing accurate public data out of the reach of the European authorities. The record of the major search engines will be distorted, just as it was by Scientology and the Chinese government. Outside of Europe's reach, rogue sites will collect the real information, and be more accurate than the compliant search services.
The court makes an exemption, as European law does, for public figures, whose privacy is more limited by the public interest. Their data will be harder to delete from your searches on privacy grounds. But history is not simply made of the stories of the famous. It is composed from the personal information of us all. All our data will continue to propagate and settle: the ECJ's decision has just made it marginally harder to find on a few platforms. Meanwhile, all intermediaries in Europe are suddenly responsible for policing the dissemination of content, even when original coverage was legitimate.
The decision leaves no hard and fast rules for intermediaries. It also leaves uncertain the status of the EU's new Data Protection Regulation, a reform of the older 1995 Data Protection Directive that the ECJ was interpreting in this case. During the new regulation's passage through the European Parliament, lobbyists for companies like Google and Facebook (whose business models means they would prefer on the whole, much laxer privacy laws) attempted to scaremonger opposition to the bill in Brussels and Washington. They did so by claiming it included a new "right to be forgotten" that would foster Internet censorship. The drafters of the bill said they were wrong, and included language to prevent its actual "right of erasure" provisions being used in that manner.
Now that the ECJ court has declared that a right to censor public information was buried in the original privacy law after all, those guarantees look to be undermined. Companies like Google and concerned citizens like Gonzalez may even have to re-litigate under the new law before we really know what's on the record, and what parts of history will end up hidden in plain sight.