In May 2014, the Court of Justice of the European Union (CJEU) upheld the so-called “right to be forgotten” in a privacy test case brought forward by a Spanish lawyer against Google. In its ruling, the court granted EU citizens the right to ask search engines, such as Google, Yahoo, and Microsoft Bing, to remove links to “old, inadequate or no longer relevant, or excessive” information about them that appear under search queries for their names. This ruling affirms article 17 of the European Union’s General Data Protection Regulation (GDPR), which gives individuals the right to have their personal data erased under specified circumstances.
In today’s digital age, the “right to be forgotten” – essentially, the right to withdraw consent over the processing of one’s personal information – is being hotly debated around the world, and it is now gaining momentum in Canada.
The Spanish case
The test case for this ground-breaking ruling originated in Spanish jurisdiction after the Spanish lawyer in question failed in his attempts to get Google to remove links to two old local newspaper publications related to his prior bankruptcy. Published at the order of the Spanish Ministry of Labour and Social Affairs, the webpages in question referenced two notices announcing that a real estate property he owned was to be put up for sale at auction so that he could pay off his outstanding social security debts. Given that he had since paid off these debts, the Spanish lawyer wanted that information altered or cast into oblivion.
To accomplish his goal, he filed a complaint with the Spanish Data Protection Agency (AEPD) against the newspaper (namely, its website), Google Spain, and Google Inc. arguing that the information of the legal proceedings contained in the newspaper’s publications was no longer relevant. He contended that those items concerned matters that had already been fully resolved and that their ongoing online presence was infringing his right to privacy and harming his reputation. As it turned out, the AEPD dismissed his claim against the newspaper publication, reasoning that the original information therein had been lawfully published, but it granted the action against Google. Unhappy with the AEPD’s decision, Google Inc. and its subsidiary, Google Spain, filed two separate appeals before the National High Court in Spain to have it annulled.
The Spanish court, in turn, referred a specific set of applicability questions concerning this matter to the CJEU. And, as we now know, the top European court ultimately ruled in favor of the Spanish lawyer. Accordingly, the Luxembourg-based CJEU held that, under existing European data protection laws, Google had to remove links to webpages referring to his outdated and no longer relevant bankruptcy record. The newspaper, however, could leave information about the auction on its website (under European data protection law, news websites, considered as part of the media, enjoy various protections and exemptions). The court’s ruling also made it clear that Internet search engines such as Google function as “data controllers,” and, as such, they must take responsibility for the links they make accessible online.
In brief, the CJEU concluded that, as a rule, an EU citizen’s right to privacy outweighs Google’s economic interest as well as the “interest of internet users” to access old and irrelevant information.
Parallel movement
In ironic parallel to the right to be forgotten movement, thousands of people, also in Spanish jurisdiction, are fighting to “remember” the truths of their country’s uncomfortable past. They are seeking to overturn an amnesty law that pardons crimes – including mass killings, disappearances, torture, and arbitrary detentions – committed during the 36-year dictatorship of General Francisco Franco. Stories about some of the victims of those crimes are featured in the award-winning documentary “The Silence of Others,” which was screened at the 2018 Hot Docs International Documentary Film Festival. To read more about the documentary and an interview with the film’s directors, click here.
To offer some historical context: in 1977, Spain passed the controversial amnesty law, which formalized an unwritten “pacto del olvido” (“pact of forgetting”). This was reached by the nation’s left and right parties following Franco’s death, to ease transition into democracy. In line with that pact, Spain’s political leaders effectively agreed to leave memories of those crimes in the distant past.
It is not known whether Google has received takedown requests from anyone accused of having committed crimes in Spain during the Franco era. Google did not respond to several queries about this matter.
Traditionally in Europe, the protection of privacy has been emphasized over that of freedom of speech. In the United States, by contrast, regulators have strongly favored the protection of freedom of speech.
As for implications, the right-to-be-forgotten ruling has implications beyond Spain. Indeed, it has global reach.
Now in Canada
In Canada, the right to be forgotten has attracted similar attention and controversy. Unlike the US originalist constitutional framework, Section 1 of the Canadian Charter of Rights and Freedoms already anticipates that in certain circumstances it will be reasonably necessary to limit the rights and freedoms guaranteed by the Charter. Thus, the recognition of a new right, like the right to be forgotten, which may abridge the constitutionally guaranteed right to free expression, is not very far-fetched in Canada.
Indeed, in January 2018, the Office of the Privacy Commissioner of Canada (OPC) released its draft position paper on online reputation, suggesting that current federal privacy legislation already provides an avenue for the adoption of a similar law in Canada. The Personal Information Protection and Electronic Documents Act (PIPEDA), according to the OPC’s position paper, provides a right to de-index search results and a similar right to source takedown.
Privacy Commissioner Daniel Therrien voiced his support for his office’s position at a recent symposium on the right to be forgotten called, “Striking the Balance: Privacy and Freedom of Expression in a Digital Age” in Toronto. The event was sponsored by Google and organized by the Canadian Journalism Foundation (CJF) and the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC). An audio recording of the symposium can be accessed here and here.
(Photo of Daniel Therrien © Canadian Journalism Foundation)
Therrien’s basis for this position is a belief that the Internet has fundamentally changed the ways in which we interact with and process information. In particular, information about others is easier to find, easily taken out of context and easily reproduced. At the same time, serious consequences emerge from privacy violations that pose a threat to a person’s reputation. Indeed, Therrien expressed concerns for the potentially detrimental consequences that reputational damage can have in terms of employment and housing, as well as personal and professional relationships.
Enter the elephant in the room
Peter Fleischer, Google’s global privacy lawyer, also speaking at the Toronto symposium, introduced the elephant in the room. Fleischer did not hide his disdain with the right to be forgotten decision.
Fleischer argued that the right to be forgotten is not only incompatible with the right to freedom of expression but is a total breach to this right. Freedom of expression is considered one of the cornerstone features of any modern democratic society. Indeed, freedom of expression is widely held as a means of furthering three core values: (1) acquiring the truth; (2) fostering individual autonomy and self-determination; and (3) strengthening democratic self-governance. It is on these fundamentals that Peter Fleischer rests his case against the recognition of the right to be forgotten.
Constitutional arguments aside, one of the most interesting pieces of information that came out of this symposium was finally getting a window into how the right to be forgotten is implemented, something the general public had limited information on up until this point. As the European mandate currently stands, it is search engine operators themselves who are tasked with creating a governance framework for the right to be forgotten. So, while many may have expected, or at least hoped, that it would be the courts or some other privacy-related administrative body that would be tasked with making decisions regarding what content would be de-indexed at the request of an individual, this is not the case.
Indeed, Fleischer explains the responsibility for overseeing the administration of the right falls exclusively on the shoulders of the search engines.
An individual seeking to exercise their right to be forgotten must complete an online web form, after which the form will go to a team at Google specifically established to deal with this matter. The team of legal professionals at Google are essentially tasked with weighing the competing interests implicated in each case. Fleischer explains this is no easy task as the nature of the balancing exercise makes automation highly unlikely. While some cases can be assigned an easy “yes” or “no”, others fall into a grey zone where the answer is not immediately apparent. For such ambiguous cases, Google has an internal process that allows for escalation to more senior professionals who will make the final decision.
(Photo of Olivia Mackenzie and Peter Fleischer © Canadian Journalism Foundation)
Food for thought
Over the next coming months, it is expected that, with the support of Daniel Therrien, we will see considerable movement towards a Canadian version of the right to be forgotten. At the same time, we should ask ourselves whether the search engines themselves are in the best position to oversee implementation. Besides the obvious self-interest concern, this task is also very resource intensive. According to Fleischer, there have been 650, 000 requests pertaining to 2.5 million URLs across the EU to date. So, by outsourcing oversight, do we risk putting smaller search engines with fewer resources out of business? This is one of many questions to consider during this time in limbo.
Roxana Olivera is a Journalist in Residence at Osgoode Hall Law School. Olivia Mackenzie is a JD Candidate at Osgoode Hall Law School. The authors would like to thank Osgoode students Natasha Jerome, Ankita Nayar and Carolyn Young for their assistance.