Two much anticipated rulings have come from the Court of Justice of the European Union. Both are ‘preliminary rulings’, effectively requests to the Court to offer clarification on what EU law – in this case the ‘right to be forgotten’ doctrine created by the Court in 2014 and placed in legislation in the General Data Protection Regulation of 2016.
As a reminder, the right to be forgotten refers to the right of individuals to ask that particular stories not be included in search results for their name. The idea is to ensure that there is a way of avoiding that search engines automatically give prominence to information that is unduly invasive of privacy.
IFLA has released a statement on the subject, underlining that the right to remove search results risks undermining access to information for internet users. While the IFLA statement notes that in some situations, a right to be forgotten may make sense, it argues strongly that this should be the exception, not the norm, and stresses concern about the impacts of leaving this choice to private actors.
The two cases in question come from France, and its Conseil national de l’informatique et des libertés (CNIL) – the national digital data protection authority. In the first (C-507/17), the CNIL itself was in dispute with Google about whether, once there had been a decision to award the right to be forgotten, this should only be applied within Europe, or whether Google should be obliged to apply it on all versions of its search engine, around the world.
The second (C-136/17) asked whether the ban on ‘processing’ (doing things with) certain types of personal data, such as that about religious beliefs or politics, should also apply to search engines.
The Right to Information
In the first case, the Court decided that there was no obligation to remove relevant links from search engines around the world, rather than just in France or the EU (global delisting). This is an important decision, and one that IFLA itself supported, given our own statement on the subject.
Significantly, the Court explores the question of the costs of global delisting: ‘However, it states that numerous third States do not recognise the right to dereferencing or have a different approach to that right. The Court adds that the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addition, the balance between the right to privacy and the protection of personal data, on the one hand, and the freedom of information of internet users, on the other, is likely to vary significantly around the world.’
This definitely a welcome point for libraries, and one that underpins the final decision of the European Court, given its explicit recognition of a right to information of internet users around the world.
In the second case, the Court does note that the bar on processing highly personal information applies also to search engines to the extent that they process it.
However, it also argues that the exceptions to this bar do too – in a case where including a link in search results is essential if a balance is to be found between the rights of individuals and of information seekers, then this can be OK.
Therefore, in cases where the subject of the information has a prominent role in public life, it may well be acceptable to maintain search results, in order to ‘protect[…] the freedom of information of internet users potentially interested in accessing that web page by means of such a search.’
But No Resolution Yet
In both cases, the final decision rests with the French courts. The European Court has given guidance on how to take this, but leaves enough margin of appreciation the judges in Paris. As a result, in the case of global delisting, despite all of the arguments to suggest that this is a questionable move, the judgement still says that there’s nothing saying that this cannot still be requested.
Similarly, the judgement on highly personal data suggests that it is for the French judges to determine whether Google has taken sufficient care in working out whether it was necessary to include the relevant links in its search results. As a result, we will not know the final results for a while yet.
Clearly Google itself is a lightning rod. Its size and reputation make it a bogeyman for many. However, it is worth noting that the judgements apply not just to Google, but also to any other company or information service offering search functionality.
As seen in the Le Soir judgement in Belgium in 2016, the idea of the right to be forgotten can also be applied to a service offering search into digitised old newspapers.
Crucially, while Google may be in a position to apply the rules set out, it may be harder for others to do the same. For example, in the judgement on highly sensitive data, the Court argues that a search engine should be able to rearrange results about court judgements in order to ensure that the most recent information comes first.
If the rules around offering search services become more complicated, the risk is that it’s the smaller players who will fall foul of the rules, not Google, reducing the choice of information seeking tools available to users around the world.