There are many hypotheses trying to figure out the source of right to be forgotten.
Some scholars take the view that the right derives from the history of Europe where totalitarian regime took the lives of many people just because they had Jewish origins. The other scholars are of the opinion that the RTBF derives from the principle of rehabilitation in the context of criminal sentence that later advanced, in the context of insolvency proceedings.
The main motive of introducing such a right was the idea that there is some information that should not be subjected to the public debate. The 20th century was a time when “criminal RTBF” was being introduced into legal national orders. With the development of new technology and digitalization, RTBF has taken on a new meaning. Nowadays, it can be defined as the Internet user’s right to have their data deleted if they withdraw their consent and if there are no other legitimate grounds for retaining the data. At present, the RTBF is enshrined in article 17 of GDPR.
The introduction of this right into legal order is the aftermath of CJEU ruling in case Google Spain SL i Google Inc. v. Agencia Espanola de Protección de Datos (AEPD) i Mario Costeja González.
However, there are voices that RTBF has been already introduced in Data Protection Directive. Its Article 12 imposed an obligation on the MS to provide the data subject with the right to obtain from the controller: as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data“
According to the approach of former EU Commissioner for Justice V. Reding, expressed after Spain ruling “this right has been built on already existing rules” and is “not an ex novo right”, although the judgment was only handed down by the court recently, this decision has been taken in 1995, when the European law which protects individuals’ data was drafted. Her approach is confirmed by European Commission’s factsheet that states that DPD in article 12 allowed to an “adoption of historical protections in a modern context”.
One shall stress that introducing RTBF provoked a great deal of discussion. Scholars analyzed the nature of the right as well a philosophy that was behind it. The best-known theory is that elaborated by Koops. He argues that RTBF should be analyzed in three aspects. First of all, RTBF means that information concerning the data subject should be deleted upon its request. Secondly, RTBF means that person has a “clean slate” status, thirdly RTBF is a tool that unables individuals to be perceived only by current information as well as to shape own image by deciding which personal information can be accessible.
The importance of the historical and moral aspects of the RTBF should not be diminished, nevertheless, it would also be convenient to look at the exceptions that were introduced by EU legislator. One of them is the freedom of expression and information. The EU legislator is aware of the fact that the right to data protection may conflict with the freedom of expression and information. Bearing that in mind, he included in legal acts guidance how to reconcile them. Nonetheless, the process of right’s balancing generates a major controversy.
The main reason for this is the fact that the legal framework leaves finding a balance to data controllers who are deprived of legal background. This solution has far-reaching consequences. Many cases are brought before the courts and their decisions are sometimes considered as very controversial. I will discuss below one of such ruling.
Google Spain ruling
Google ruling is considered as a landmark case and a trigger in changing the approach toward personal data protection. The statement of facts and statement of law in the case present as follows: A Spanish citizen Mr Costeja Gonzales suffered financial difficulties. As a consequence of his debts, his real estate was auctioned off. Spanish law imposed an obligation to publish a notice before conducting the auction.
The notice was published in La Vanguardia Ediciones SL newspaper, which was also available in online version. As the result of this digital edition, even after 10 years, entering data of Mr Gonzales into browser resulted in showing by Google search notices about the public sale of real estate in order to recover social security debts. It shall be added that the auction was never held due to the fact that Mr Gonzales paid his debts. In the view of Mr Gonzales, such a situation was harmful for his reputation.
Thus, he decided to bring a claim before the AEPD, the Spanish privacy regulator. The request encompassed two claims, namely to remove pages concerning the information about his situation from the newspaper’s website, and to remove the publication from the Google groups search engine’s results.
The AEPD rejected his claim. The reasoning behind this decision was the fact that the publication in 1998 had legal basis (order of the Ministry of Labour and Social Affairs) and served as a way of gaining publicity and receiving as much bidders as possible. However, the AEPD stated also that Google as the operator engine is obliged to follow the data protection legislation. Thus, according to AEPDdoubts, decided to request the CJEU for a preliminary ruling.
The National Court raised questions concerning a territorial scope of the directive (whether the directive applies to Google Spain even if servers are located in the USA) Does Google fulfill requirements to be perceives as a “data controller” in the view of EU law and, last but not least, does the data subject have the right to remove his data from search engine results?
Firstly, the CJEU had to decide whether provisions of DPD would apply in the case at hand. Article 4(1) stated that:“The processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable.”
Google’s search engine was a part of Google Incorporated and that main establishment was located in the USA.
However, in order to encourage to buy its advertising space, Google had also an office in Spain, called Google Spain SL. The question was whether the processing of data took place within the territory of EU’s MS. The Court decided that activities of processing data were carried in Spain. The argumentation focused mainly on the economic aspect. The Court stated that selling advertising space in Spain generated great profit for the firm in the USA, thus, such an important economic role may constitute the liability of US company, even though physically data were processed outside the EU.
The echo of this ruling is reflected in GDPR that states that it applies to an organization that has a EU “establishment“, where personal information is processed “in the context of the activities.” The next question concerned interpretation of the Article 12 (the right to erasure) in the context of RTBF, namely, whether the Article 12 (b) and the right to object enshrined in the Article 14 of DPD enabled also an individual to ask search engines to render impossible indexing of the personal information published on the third party websites.
The CJEU decided that a search engine operator shall be obliged to remove the results that are displayed after entering the personal data of Mr Gonzales. The fact that the origin source was located the on third party’s website does not constitute an escape premise. What is more, the CJEU ruled that the violation of the right to data protection cannot be justified on an economic interest base.
Right to be forgotten and freedom of expression. A vivid discussion between scholars
The decision of CJEU raised much controversy and was the subject of a vivid discussion. Some scholars claimed that it represents a pro-data protection approach at freedom of expression’s expense. In their views“search engines facilitate the finding of data through the World Wide Web and in consequence, they enhance the ability of individuals to receive and impart information”.
The RTFB has been sharply criticized especially by US authors. They regarded RTBF as a potential threat to freedom of expression, because of its “chilling effect”. In their views, RTBF may result in the necessity of the content censorship of Internet intermediaries and, as the result, loosing their neutral status. Steven James paid attention to the possibility of a mechanic application of erasing data. According to him, a search engines operator, instead of carrying out a thorough analysis, would prefer to remove a controversial link. Acting in this way does not put them at risk of a potential violation of the right to data protection.
However, such behaviour is not the best model of respecting someone’s personal information, but only the easiest one. Lynskey accused the CJEU that it didn’t strike a right balance between these rights, which had been always noticeable in other CJEU’s rulings. She underlined the frequency of referring to the Article 7 and 8 of the EU Charter in the judgment without mentioning the Article 10 and 11 of the Charter. She took notice that CJEU carried a one-sided examination of the case, only from the data protection view. The CJEU did not make a reflection that the removal of data may be interpreted in the way the CJEU proposed it – as prevention of dissemination of data on wide scale, but forgot to notice that the interpretation can be also made from the freedom of expression approach, by preventing access for data by significant amount of individuals. The judgment was highly criticized by Eleni Frantziou.
She underlined that the CJEU barely touched the notion of personal data protection and the scope of protection it offers. As a result, the judgment does not define the reach of the right to be forgotten. Such position in the author’s opinion has far-reaching consequences regarding the protection of freedom of expression. In addition, Franziou emphasizes that CJEU overuses the wording “fair balance”. In her view, referring to this mechanism is not justified.
The reason for this is the fact that the CJEU in this dispute compares, one side, an abstract notion of personal data protection, on the other side, general policies or interests (under this term we can evoke many interests). According to her, such a comparison should have not taken place. It is impossible to balance values, rights without concretizing them.
The first step should be“ development and full exercise’ of the two valid rights. The analysis of ruling allows to conclude that the CJEU chose a more “economical” approach. Its activity was limited to examine whether there is a public interest that can limit a dissemination of personal information. However, it lost of sight the fact that the term public interest can be equivalent with the freedom of expression.
An adaptation of such interpretation could have changed the ruling. The reason for that is the fact that the freedom of expression as a fundamental right is enshrined in the Charter. Thus, it represents the same value as the protection of personal data. Considering this case also from the freedom of expression’s perspective would have allowed to perceive Google not only as a structured overview of the information regarding the data subject, but also as a source of knowledge, a tool for receiving information.
Rosen does not share the view that the CJEU ignored the freedom of expression. He underlined that, before the dispute, Google had been removing links with bank accounts information or if there was an infringement of copyrights reported. He claims that ruling complies with foe. As the argument in favor of this statement he stresses that the judgment only imposed an obligation of search results not delisting the material.
However, he spotlights another weighty issue – a limited application of RTBF. The reason for that was the fact that Google selectively removes links (limited to domain). Thus, the RTBF has only a local dimension. In his view, RTBF should have be applied globally. He also paid attention that according to the ruling, a substantial scope is limited to commercial operators, which profits from advertising. He said that these entities should be subjected to deontology rules.
The organization called the Article 19 was also very judgmental with regard to balancing the right to data protection and public interest. It emphasized that concept of public interest must be interpreted more broadly by including the notion of “important information of public concern. Thus, designatum of this notion cannot be reduced only to issues like politics, public health and safety, law enforcement and the administration of justice, consumer and social interests, the environment, economic issues, the exercises of power, and art and culture. Taking into consideration above mentioned view, the Article 19 specifies the scope of public interest. One may note, in order to do it, organization inspired itself of ECHR’s jurisprudence where is stated that :
“As matter of public interest cannot be regarded information that tended to titillate and entertain, which are aimed at satisfying the curiosity of a particular readership regarding aspects of a person’s strictly private life’, serving only to ‘entertain’ and not to ‘educate’. According to the Article 19 public interest “does not include purely private matters in which the interest of members of the public, if any, is merely salacious or sensational”
In their views, in Google v. Costeja ruling the CJEU claimed the domination of the rights to private life and protection of data over the right to freedom of expression, and too narrowly interpreted the notion of public interest. Daniel Solve also joined chorus of critics against the decision made by the CJEU, which he called the dramatic ruling. Questions raised by him concerned a problem of applying this ruling in practice. He emphasized that the CJEU presented only general principles that need to be followed in order to comply with EU legal order. He also noted, that in the view of the CJEU, search engines invade privacy and that activity cannot be justified by merely the economic interest which the operator of such an engine has in that processing.
However, as Solve so deftly points, the CJEU approach: When is the search engine’s purpose solely “economic interest”? Newspaper companies sell newspapers and access to their sites. They have ads on their sites. With many things, there are economic interests as well as other interests too. And is it practical? Can a right to be forgotten readily be done on a large scale?
According to Solve, the problem with the EU approach is the fact that it does not give directions how the realization of ruling should be executed. The CJEU only focuses on declaring rights not protecting them. F.Crehan shared the opinion that the case does not concern the freedom of expression issue. In order to support his view, he invoked argument that Google is not a content creator. Its role is to list the results of search.
Comparing RTBF to potential tool that serves the censorship is an exaggeration. He stressed that article was still available on newspaper’s website as well as presumably accessible in Catanal libraries. The right to freedom of information was this what should be crux of the dispute.
With these approaches in mind, I favour the critical approach toward ruling in the Case-131/12. The CJEU lost sight of the right to freedom of expression that encompasses also the freedom to receive information that may be exercised by using Google browser. In my opinion, the Court favors the right to data protection and gives the green light to censorship.