home

Media Law Resource Center

Serving the Media Law Community Since 1980

Home

The Right to Be Forgotten

pdf Download Publication

By Kevin L. Vick*

I. INTRODUCTION AND SUMMARY

In 2014, the "right to be forgotten" leapt from the world of law school journals to the frontpages of newspapers and websites on the heels of the Court of Justice of the European Union's (CJEU) Google Spain decision. The CJEU ruled that individuals could force search engines to remove links to articles about them (a process known as "de-listing") that are "inaccurate" or, even if true, are "inadequate, irrelevant or no longer relevant, or excessive," unless there is an overriding public interest in the search results remaining public.[1] The "right to be forgotten," while a catchy phrase, is a bit of misnomer. The CJEU did not (at least not yet) order the deletion of the underlying articles and webpages; the mandated de-listing only applies to search engine results for an individual's name. However, considering how people rely on search engines to conduct online research, such targeted removal of search results can have the practical effect of ensuring that certain information will escape public view. In 2018, the EU's General Data Protection Regulation ("GDPR") will go into effect and essentially codify – and expand upon – the right to be forgotten recognized in Google Spain.

By contrast, there is no right to be forgotten in the United States. The First Amendment, Section 230 of the Communications Decency Act, 47 U.S.C. § 230(c), and well-established jurisprudence foreclose such a result. U.S. law recognizes the paramount importance of publishers' speech rights and the public's right to access information. Outside of the EU and the U.S., a number of countries have recognized a right to be forgotten analogous to that created by Google Spain.

II. THE RIGHT TO BE FORGOTTEN IN THE EU

A. The Google Spain Decision

In 1998, the Barcelona-based newspaper La Vanguardia published two announcements regarding the forced sale of properties arising from unpaid social security debts. One of those properties belonged to Mario Costeja González, who was named in the announcement. The Spanish Ministry of Labour and Social Affairs had ordered publication of the announcements to attract bidders on the foreclosed properties. In 2009, Costeja requested that La Vanguardia remove the announcement from its online archives. He complained that when people entered his name into internet search engines, the announcement in La Vanguardia was one of the top results. La Vanguardia refused to take down the announcements, citing the fact that the publication had been ordered by the Spanish Ministry of Labour and Social Affairs. Costeja then took his complaint to Google Spain, which declined to remove the links to the La Vanguardia announcement. Costeja responded by filing complaints against La Vanguardia and Google with the Spanish Agency of Data Protection. The agency rejected his complaint against La Vanguardia, but upheld his complaint against Google and ordered Google to remove the links to the announcements.[2]

A variety of legal proceedings ensued, culminating in the CJEU's decision in 2014. The CJEU held that individuals have a right to force internet search engines to remove links regarding their personal information that is "inaccurate," "inadequate, irrelevant or excessive in relation to the purposes of the processing" the data, unless there is an overriding public interest in the search results remaining publicly available.[3] The ruling was based on Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, which protect personal privacy and the protection of personal data. The CJEU held that individuals' rights to privacy and protection of personal data outweighed search engines' "economic rights," without addressing whether the search engines' had any speech-related rights in their results as U.S. courts have held.[4] Nor did the CJEU address the interests of the underlying publishers and websites whose links are threatened with removal (i.e., La Vanguardia, in the case of Costeja).

The CJEU set forth an amorphous and troubling standard for weighing individuals' privacy and data security rights against the public's rights to know and to meaningfully access information. That standard creates a presumption in favor of de-listing: "it is true that the [individuals'] rights ... also override, as a general rule, that interest of internet users" who might search for information online.[5] While that presumption may be rebutted, the CJEU provided only the most generalized guidance regarding the weighing of competing interests: "that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject's private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life."[6]

Importantly, the CJEU placed the initial responsibility to weigh individuals' privacy and data security interests against the public's rights to know and to access information on the search engine operators– not the judiciary.[7] This result has been criticized as an abdication of judicial responsibility to private enterprise, as well as unfair to internet search engine operators, particularly in light of the amorphous and vague legal standards set forth in the Google Spain decision.

Search engine operators provide online forms that individuals can fill out to request de-listing of specific links.[8] If a search engine operator declines an individual's de-listing request, that individual may appeal to his or her national or local data protection agency, which can affirm or reverse the search engines' initial determinations.[9] The process may then move to the national courts if the search engine or the individual objects to the agency's determination. On the flip side, while search engines generally notify websites if their links are removed from search results at the request of an individual,[10] there is not an equivalent legal process by which publishes and websites can challenge decisions to de-link their material.

Some feared that the CJEU's decision in Google Spain would lead to improper attempts by individuals (particularly politicians and powerful businesspeople) to censor search engine results to the detriment of the public discourse and the historical record. Jimmy Wales, co-founder of Wikipedia, characterized the CJEU's decision as "deeply immoral" because it threatened to create an internet "riddled with memory holes."[11] Search engines operators' experiences with right-to-be-forgotten removal requests suggest that concerns about illegitimate removal requests were valid. Microsoft has reported that 63% of the de-listing requests it has received were rejected as legally insufficient under the Google Spain guidelines, and Google similarly reported that 57% of the requests it received were rejected.[12] News reports have often focused on improper requests made by politicians, criminals, and celebrities, while others have raised concerns that the public may be deceived by, for example, doctors who seek removal of links concerning alleged medical malpractice. Some scholars have emphasized the danger of "collateral censorship," whereby governmental threats to punish online service providers can lead them to censor even speech that should be fully protected.[13]

One key issue that has emerged is where de-listing must occur on the internet. For example, if a French citizen requests that Google France remove certain links to articles on the website for Le Monde, what should be the geographical scope of de-listing? Search engines have sought to limit de-listing to the jurisdiction in which the individual resides or to only EU jurisdictions (by limiting removal of links on google.fr, google.de, etc., for example). However, the French data protection agency has sought to compel search engines to remove the links globally across all domains – including domains primarily used in jurisdictions in which there is no right to be forgotten and in which search results are, in fact, constitutionally protected (e.g., google.com). Google has resisted such efforts at unilateral internationalization of the EU's right to be forgotten, and the issue is currently pending before the CJEU for a preliminary ruling.[14]

B. The EU's General Data Protection Regulation: The Impending Codification And Expansion of The EU's Right To Be Forgotten.

The GDPR, scheduled to go into effect across the EU in May 2018, will provide the next chapter in the EU's right to be forgotten.[15] It largely codifies the Google Spain decision, but with some noteworthy additions:

  • Potential for massive fines. The GDPR provides for huge fines against companies – as high as $20 million or 4% of a company's annual global turnover –that violate its regulations, including those concerning the right to be forgotten.[16]
  • Establishment of European Data Protection Board, but individual EU nations continue to hold significant power to set rules. This new board will be responsible for best practices guidelines related to the right to be forgotten.[17] However, EU national legislatures also retain significant powers to set policy and modify relevant regulations, including to "reconcile the right to the protection of personal data pursuant to [the GDPR] with the right to freedom of expression and information."[18] This could result in a significant lack of uniformity among different EU countries.
  • A detailed notice-and-takedown procedure.[19]
  • Provisions for extraterritorial application of the GDPR's right-to-be-forgotten laws.[20] Under some circumstances, EU regulations can apply to entities outside the EU if they process EU users' personal data as part of monitoring those users' online behavior.[21] As previously mentioned above, the CJEU is currently considered whether online service providers who do business in the EU must de-list links globally, or only for services targeted to Europe specifically.[22]
  • Lack of clarity for online service providers regarding applicable rules and procedures. Commentators have opined that the GDPR has done little to clarify ambiguities regarding how online service providers should handle right-to-be-forgotten requests, and that such lack of clarity – coupled with other statutory incentives favoring removal – could lead to the over-removal of links.[23]
  • Lack of clarity regarding whether social media is covered. Commentators have also focused on the lack of certainty whether the right-to-be-forgotten procedures in the GDPR apply to social media sites such as Facebook.[24]

III. No Right To Be Forgotten In the United States Of America

In the United States, there is no right to be forgotten analogous to that of the EU. There are a handful of statutes and judicial decisions that some might characterize as baby steps towards a very limited right to be forgotten. For example, California has an "online eraser" law, which allows minors (and only minors) to force certain websites and apps to remove content previously posted by the minors themselves.[25] Occasionally a rogue trial court may grant an injunction that provides targeted right-to-be-forgotten-like relief.[26] Some scholars have seen potential conceptual support for a right to be forgotten in generally older privacy decisions where courts held that individuals' decades-old convictions and bankruptcies were no longer newsworthy and thus new publications concerning them could give rise to liability.[27] And two New York state legislators recently offered a bill to create a state right to be forgotten similar in scope to the right created by the CJEU in Google Spain.[28]

However, there are a number of constitutional and statutory barriers against a right to be forgotten in the United States. First, there is the First Amendment and Supreme Court cases interpreting it, such as Cox Broadcasting v. Cohn, 420 U.S. 469 (1975), Smith v. Daily Mail, 443 U.S. 97 (1979), Florida Star v. BJF, 491 U.S. 524 (1989), and Bartnicki v. Vopper 532 U.S. 514 (2001). Those cases, along with caselaw circumscribing the tort of public disclosure of private facts, support the principle that the publication of truthful information can only rarely be punished criminally or civilly. Under New York Times v. Sullivan and its progeny, even the publication of false information is only sanctionable under limited circumstances. And even as to speech that has been adjudicated and found to be defamatory, there is a split in authority regarding the permissibility of a permanent injunction against such speech going forward.[29]

Second, even setting aside the First Amendment protections for online speech, Section 230(c)(1) of the Communications Decency Act, 47 U.S.C. § 230(c), provides an additional layer of immunity to intermediaries who publish speech created and developed by others. Courts have consistently held that Section 230 bars claims against search engines based on their linking to allegedly tortious material.[30] Section 230 immunity includes immunity not just from liability for other parties' speech, but also from requests for injunctive relief seeking the removal of such speech.[31] Online service providers may sometimes voluntarily remove links to content if presented with a court order adjudicating the speech tortious, but U.S. courts generally have resisted efforts to compel them to do so.

IV. Other Countries

Courts in other countries have recognized rights to be forgotten somewhat analogous to that recognized by the EU in Google Spain, including:

  • Canada[32];
  • India[33];
  • Argentina[34]; and
  • South Korea[35].

On the other hand, a court in China recently rejected a right to be forgotten.[36]


Notes

* Kevin L. Vick is a partner in the Los Angeles office of Jassy Vick Carolan LLP

[1] Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, Case C-131/12 (2014), at ¶¶ 91-94, available at http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=14612.

[2] See generally id.

[3] Id. at ¶¶ 91-94.

[4] Id. at ¶¶ 81, 82, 97; compare Jian Zhang v. Baidu.com Inc., 10 F. Supp. 3d 433, 435 (S.D.N.Y. 2014) (holding that "the First Amendment protects as speech the results produced by an Internet search engine").

[5] Id. at ¶ 81.

[6] Id. The Google Spain decision ran contrary to some previous rulings interpreting the EU eCommerce Directive. See Royo v. Google (Feb. 13, 2013) (Spanish appellate court ruling that OSPs should not remove user content without a court order unless validity of removal clam is manifest, and warning OSPs against "set[ting] themselves up as judges of such content, since the aim is precisely to enhance freedom of expression online").

[7] Operators provide online forms that individuals can fill out to request de-listing of specific links. See, e.g., https://www.google.com/webmasters/tools/legal-removal-request?complaint_type=rtbf&visit_id=0-636331543110687615-947191996&rd=1&pli=1.

[8] Id.

[9] See Miquel Peguera, "No More Right-To-Be-Forgotten For Mr. Costeja, Says Spanish Data Protection Authority" (Oct. 3, 2015) ("The man who won the right-to-be-forgotten case in the Court of Justice of the European Union (CJEU) has now been denied the right to suppress links to comments about that case by the Spanish Data Protection Authority (DPA)"), available at http://cyberlaw.stanford.edu/blog/2015/10/no-more-right-be-forgotten-mr-costeja-says-spanish-data-protection-authority.

[10] However, some data protection agencies have punished search engines for such notifications. See Bruno Toledano, "La Agencia Española de Protección de Datos impone a Google una multa de 150.000 euros," El Mundo (Sept. 20, 2016), available at http://www.elmundo.es/tecnologia/2016/09/20/57e1019b268e3ead5d8b459d.html.

[11] Sophie Curtis and Alice Philipson, "Wikipedia founder: EU's Right to be Forgotten is 'deeply immoral,'" The Telegraph (Aug. 6 2014), available at http://www.telegraph.co.uk/technology/wikipedia/11015901/EU-ruling-on-link-removal-deeply-immoral-says-Wikipedia-founder.html.

[12] https://www.microsoft.com/en-us/about/corporate-responsibility/crrr; https://transparencyreport.google.com/eu-privacy/overview.

[13] Jack Balin, Old School/New School Speech Regulation, 127 HARV. L. REV. 2296, 2309 (2014).

[14] Natasha Lomas, "Google's right to be forgotten appeal heading to Europe's top court," TechCrunch (July 19, 2017), available at https://techcrunch.com/2017/07/19/googles-right-to-be-forgotten-appeal-heading-to-europes-top-court/.

[15] http://ec.europa.eu/justice/data-protection/index_en.htm; see also Daphne Keller, The Right Tools: Europe's Intermediary Liability Laws and the 2016 General Data Protection Regulation, forthcoming in BERKLEY TECH. L. J., draft available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2914684. While this chapter focuses only on the right to be forgotten, the GDPR applies to a wide array of other issues too.

[16] GDPR Art. 83.5(b).

[17] GDPR Art. 70.1(d).

[18] GDPR Art. 85; see also supra note 15, Keller, at 28, 51.

[19] Id. at 37-50; see also id. at 53-57 (discussing judicial enforcement processes for challenges to online service providers' decisions regarding removal requests).

[20] Id. at 57-60.

[21] GDPR Art. 3.2.

[22] See supra, note 14.

[23] See supra note 15, Keller, at 30-32, 51-53.

[24] Id. at 32-35.

[25] Cal. Bus. & Prof. Code § 22581. See also Eric Goldman, "California's New 'Online Eraser' Law Should Be Erased," Forbes (Sept. 24, 2013), available at https://www.forbes.com/sites/ericgoldman/2013/09/24/californias-new-online-eraser-law-should-be-erased/#2007a2e77a33 (suggesting California eraser law may be invalid).

[26] See, e.g., Gorman v. Steinborn, Case No. 2:14-cv-00890-NS (E.D. Penn. May 20, 2015) (entering permanent injunction allowing the plaintiff to submit court's order to Internet search engines to have links to certain defamatory statements removed.)

[27] Patrick O'Callaghan, "The Chance 'to Melt into the Shadows of Obscurity': Developing a Right to Be Forgotten in the United States" at Section 2.1; see also Briscoe v. Reader's Digest Association, 4 Cal. 3d 529 (1971), overruled by Gates v. Discovery Communications, Inc., 34 Cal. 4th 679 (2004).

[28] New York Assembly Bill 5323, Senate Bill 4561; see http://nyassembly.gov/leg/?default_fld=&leg_video=&bn=A05323&term=&Summary=Y&Text=Y

[29] Compare, e.g., Hill v. Petrotech Res. Corp., 325 S.W.3d 302, 309 (Ky. 2010) ("defamatory speech may be enjoined only after the trial court's final determination by a preponderance of the evidence that the speech at issue is, in fact, false, and only then upon the condition that the injunction be narrowly tailored to limit the prohibited speech to that which has been judicially determined to be false") with Kramer v. Thompson, 947 F.2d 666, 677 (3d Cir. 1991) (concluding that an injunction prohibiting a party from repeating statements deemed at trial to be libelous was not permissible because of the Pennsylvania rule that equity will not enjoin a libel).

[30] See, e.g., O'Kroley v. Fastcase, Inc., 831 F.3d 352, 355 (6th Cir. 2016) (so holding); Parker v. Google, Inc., 422 F. Supp. 2d 492, 501 (E.D. Pa. 2006) (same).

[31] See, e.g., Kathleen R. v. City of Livermore, 87 Cal. App. 4th 684, 698 (2001) ("claims for declaratory and injunctive relief are no less causes of action than tort claims for damages, and thus fall squarely within" Section 230); Medytox Sols., Inc. v. Investorshub.com, Inc., 152 So. 3d 727, 731 (Fla. Dist. Ct. App. 2014) ("An action to force a website to remove content on the sole basis that the content is defamatory is necessarily treating the website as a publisher, and is therefore inconsistent with Section 230"); but see Hassell v. Bird, 247 Cal. App. 4th 1336, 1364 (2016) (rejecting argument that Section 230 bars injunction reaching non-party in connection with speech that court had found to be defamatory in default proceeding), review granted by California Supreme Court on September 21, 2016, and pending as of time of this article.

[32] See Daphne Keller, "Ominous: Canadian Court Orders Google To Remove Search Results Globally" (June 28, 2017), available at http://cyberlaw.stanford.edu/blog/2017/06/ominous-canadian-court-orders-google-remove-search-results-globally; Daphne Keller, "Google's Us Challenge To The Canadian Global Delisting Order," available at http://cyberlaw.stanford.edu/blog/2017/07/googles-us-challenge-canadian-global-delisting-order.

[33] See Runima Bhattacharya, "In A First An Indian Court Upholds The 'Right To Be Forgotten,'", LiveLaw (February 3, 2017), available at http://www.livelaw.in/first-indian-court-upholds-right-forgotten-read-order/; Deya Bhattacharya, "Right to be forgotten: How a prudent Karnataka HC judgment could pave the way for privacy laws in India," FirstPost (Feb. 7, 2017), available at http://www.firstpost.com/india/right-to-be-forgotten-how-a-prudent-karnataka-hc-judgment-could-pave-the-way-for-privacy-laws-in-india-3270938.html.

[34] Edward L. Carter, "Argentina's Right to Be Forgotten", 27 EMORY INT'L L. REV. 23 (2013).

[35] James Lim, "South Korea Releases Right to Be Forgotten Guidance," Bloomberg BNA (May 9, 2016), available at https://www.bna.com/south-korea-releases-n57982070847/.

[36] Nathan Jubb, "Chinese Have No Right to Be Forgotten, Court Rules," Sixth Tone (May 5, 2016), available at http://www.sixthtone.com/news/814/chinese-have-no-right-be-forgotten-court-rules.

 
Joomla Template Tutorial: by JoomlaShack