Whoops! I forgot to write a post about the right to be forgotten

Sometimes we forget things. Sometimes, we’d like to forget things. You know, like that time I you had a few too many and got naked on the bar and everyone had their iPhones pointed at me you and well, I’ve said too much already. I’d You’d like to forget that incident, but the internet never forgets. And Google never forgets. But thanks to a ruling from a couple of weeks ago that can only be described as “landmark” from the top court in the EU, the Court of Justice, Google kind of has to. Let’s dive in.

So the full name of the case is Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, but we’ll just call it Google v Gonzalez, because that’s what’s important here, and damned if I will be typing those accents this whole post. Lo siento, Mario. As usual, I have actually read the thing so you don’t have to. So what is the case about? To quote the Court:

This request for a preliminary ruling concerns the interpretation of Article 2(b) and (d), Article 4(1)(a) and (c), Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

Well that’s clear. Holy crap that’s a lot of numbers. Maybe they wrote this judgment in Spanish and it’s a bad translation? OK let’s start with what the hell Directive 95/46/EC is:

Directive 95/46 (…) has the object of protecting the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and of removing obstacles to the free flow of such data

OK now we’re getting somewhere. Right to privacy, data, yada yada. That’s good stuff. There is also a right to privacy and protection of personal data in the EU Convention on Human Rights. Keep that privacy bit in mind.

So what are the facts here? Well, in 1998, a Spanish newspaper called La Vanguardia published notices about Mario, that his “name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts.” Christ, that’s your problem buddy? Some debt? I had worse things published on the internet about me this morning. But I guess, to him, it could feel like the end of the world. Being in debt is hard enough to deal with as it is, but it probably makes it a lot harder when the whole world knows about it. Not only will you be thinking about how to pay it off, but they will be as well, so it may be better to figure it out sooner rather than later… in my opinion anyway. I’ve heard that many people decide to use a crowdfunding service like GoFundMe, (https://www.gofundme.com/c/blog/how-to-get-rid-of-debt) when they’re in this situation. From credit card debt to student loans and medical bills, apparently it can be used for anything and everything. And if it helps them to get out of debt, then Mario should try it himself. I think I’d give it a go. He can also check out blog articles such as https://www.sprawlway.org/want-to-clear-debt-quickly-here-are-three-things-you-must-understand/ to better prepare himself for getting out of debt. Anyway, two dinky little newspaper clippings from 1998 appear on the newspaper’s website, and you can find them through Google. You know, like every other piece of information on the internet. Mario asked Google Spain, via the Spanish data protection authorities (the AEPD), to remove links to the newspaper stories so that they wouldn’t appear in search results. Google said bite me. The whole thing ended up at the Court.

The first question to answer was whether Google is a “data processor” under the Directive, because then the data protection rules of the Directive would apply. It’s a technical point, but an important one. The Court concludes:

it must be found that, in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results. As those operations are referred to expressly and unconditionally in Article 2(b) of Directive 95/46, they must be classified as ‘processing’

Sure, whatever. Some giant servers are automatically scouring the internet and listing stuff found there, so that’s processing. The Court also then concludes Google is a “controller” under the Directive, and that discussion is such a load of crap I’m not even getting into it. There is then a whole bit about jurisdiction, whether Google and Google Spain are one and the same, but that’s pretty useless, Google is Google and the Directive applies.

So let’s get to the meat (perhaps some delicious Spanish Serrano ham?) of the issue. Does Google have to remove links to the newspaper stories? Google’s position is that:

any request seeking the removal of information must be addressed to the publisher of the website concerned because it is he who takes the responsibility for making the information public, who is in a position to appraise the lawfulness of that publication and who has available to him the most effective and least restrictive means of making the information inaccessible

Seems pretty logical to me! But then, I’m an internet law expert who understands how the internet works. Mario and some EU member states say that they should be allowed to ask Google to remove links without asking the publisher of the website. Because, uh, privacy or something. Remember that “processor” crap from earlier? The Court says:

processing of personal data, such as that at issue in the main proceedings, carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet

Well duh, that’s what a search engine is for! But as a processor and controller, Google controls the information and:

in order to comply with the rights (…) the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. (my emphasis, because Jesus Fucking Christ)

Are you kidding me? So even if publication of information is lawful, Google may still have to remove links to it? I’ll get back to this in the my fun-time analysis later. We’re going over the judgment here. So when should Google have to remove such links? Well, the Court is kind a vague on that. First they say when:

that information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant

Uh, right. Who is to decide what is “no longer relevant”? The links should also be removed when the data is:

excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine

Sure, that’s clear. The next (and final) one kills me:

(when the data) are not kept up to date, or that they are kept for longer than is necessary unless they are required to be kept for historical, statistical or scientific purposes

“Longer than necessary”??? In the facts of this case it was 16 years. But what if the information was about child molestation 25 years ago? Is that ok?

That pretty much ends the judgment. The Court orders Google to remove the links to the newspaper clippings, they summarize the stuff they just laid out in 100 paragraphs, and we’re done.

Super fun-time analysis happy hour

I am sure you can tell by my tone (well maybe not, my tone is always like that) I am not a fan of this decision. Now, don’t get me wrong, it may be useful to me in the future. I am inundated by requests from potential clients who want me to help them get embarrassing or other unpleasant stuff about them removed from the internet. This case, while European, may be a tool in my arsenal. And also don’t get me wrong that I like privacy, and support privacy rights. But the case is still a load of crap.

The case is ostensibly about the right to be forgotten. The Court asks if that right:

extend(s) to enabling the data subject to address himself to search engines in order to prevent indexing of the information relating to him personally, published on third parties’ web pages, invoking his wish that such information should not be known to internet users when he considers that it might be prejudicial to him or he wishes it to be consigned to oblivion, even though the information in question has been lawfully published by third parties?

So the Court answered yes. I don’t really have a problem with the right to be forgotten, but what about competing rights? What about the right of the Googler to know? What about the right of the publisher to publish, to freedom of expression? These competing rights are barely mentioned in the judgment. That’s crap. In Canada, the Supreme Court just declared a whole privacy law unconstitutional because it violated freedom of expression. Again, the Court says that the links can be removed even if the data was published legally. So the publisher legally exercised freedom of expression, and the info should still not be linked to? That’s fucked.

And “relevance”? How can anyone decide what is relevant to who. Maybe it is important to me to know Mr. Gonzalez had debts 16 years ago. Well, probably not, but maybe someone who has a financial interest with him might want to know that? And that’s just an example from this stupid case. It may be very relevant for someone to know that I you danced naked and drunk on a bar.

But the most important thing that drives me crazy about this, is that the actual information is not even being removed! It’s just links to it. If there really is a “right to be forgotten”, shouldn’t it be the actual info itself that is removed from the internet? The Court didn’t order the newspaper to remove the info. Google is just a bunch of computer robots that scour the web and make links. And now Google has to be the guardian of the internet? They have to decide what is no longer relevant or that well, 10 years is just too long ago? I am no fan of Google. But this is onerous for them beyond words, and completely misguided.

Lots of these criticisms have already been made by lawyers way smarter than me, though probably with less profanity. But I wanted to get my digs in too.