Author Archives: Peter Fleischer

Three years of striking the right (to be forgotten) balance

It is now three years since Europe’s highest court decided that EU citizens should have a ‘right to be forgotten’. Implementing that right has neither been simple nor without controversy, but in that time we have evaluated 720,000 delisting requests, ultimately removing around 43% of the more than 2 million links submitted to us.  

Over the three years, the way search engines delist, and national law, has continued to develop. Now, two fundamental issues are being considered by two of Europe’s highest courts.

Sensitive personal data and the public interest

Put simply, the first issue—due to be heard by the Court of Justice of the European Union (CJEU) in the coming months—is whether people have an absolute right to request removal of lawfully published, but sensitive, personal data from search results.  Or whether, as is the case now, search engines should continue to balance the public interest in access to information with the individual’s right to privacy.   

The background to this CJEU case is that in 2016, four individuals were unhappy with our decision not to remove certain links to webpages about them. They appealed to the French data protection regulator, the CNIL, asking them to review our decisions, challenging the underlying principle that a public interest test should apply.

In its review, the CNIL agreed with our decisions. The individuals subsequently took their case to the French Supreme Administrative Court (the Conseil d’Etat). This court heard their arguments in February of this year, and referred the case to the European Court of Justice of the European Union (case number C-136/17).

The CJEU now has to decide whether ‘sensitive personal data’—such as the political allegiance of an individual, or a past criminal conviction reported in the press—should always outweigh the public interest.

The tricky thing with this kind of information is that it is often important for people to know and it is frequently reported in newspapers and elsewhere. Requiring automatic delisting from search engines, without any public interest balancing test, risks creating a dangerous loophole. Such a loophole would enable anyone to demand removal of links that should remain up in the public interest, simply by claiming they contain some element of sensitive personal data.

So when the CJEU confirms a date to hear this case, we will be advocating strongly for the public interest balancing test to apply to all types of delisting requests—including those containing sensitive personal data.

Where does the right to be forgotten apply?

There is another fundamental legal question due to be heard in coming months at the French Conseil d’Etat. At stake: whether Europe’s right to be forgotten should reach beyond the borders of Europe, whether delisting of links should also happen in other countries which have different ways of balancing privacy and access to information.

Enforcing the right to be forgotten beyond Europe would set a grave precedent. There would quickly be a race to the bottom as other countries, perhaps less open and democratic than France, ordered Google to remove search links for every citizen in every other country of the world.

We’ve written extensively on this topic in the past, as have a wide range of human rights and media organisations, and others. It’s possible that the Conseil d’Etat may also refer this geographical scope question to the CJEU.  But wherever this case is heard, our key assertion remains the same: no one country should be able to impose its rules on the citizens of other another country, especially when it comes to lawful content.

Fundamental questions

Google did not welcome the right to be forgotten, but we have worked hard to implement it in Europe over the last three years. Access to information in the public interest, and the right of of all countries to define the balance between privacy and free expression within their own borders, are important, fundamental issues. We look forward to presenting our arguments at both the CJEU and the Conseil d’Etat.


Three years of striking the right (to be forgotten) balance

It is now three years since Europe’s highest court decided that EU citizens should have a "right to be forgotten." Implementing that right has neither been simple nor without controversy, but in that time we've evaluated 720,000 delisting requests, ultimately removing around 43 percent of the more than 2 million links submitted to us.  

Over the three years, the way search engines delist, and national law, has continued to develop. Now, two fundamental issues are being considered by two of Europe’s highest courts.

Sensitive personal data and the public interest

Put simply, the first issue—due to be heard by the Court of Justice of the European Union (CJEU) in the coming months—is whether people have an absolute right to request removal of lawfully published, but sensitive, personal data from search results. Or whether, as is the case now, search engines should continue to balance the public interest in access to information with the individual’s right to privacy.   

The background to this CJEU case is that in 2016, four individuals were unhappy with our decision not to remove certain links to webpages about them. They appealed to the French data protection regulator, the CNIL, asking them to review our decisions, challenging the underlying principle that a public interest test should apply.

In its review, the CNIL agreed with our decisions. The individuals subsequently took their case to the French Supreme Administrative Court (the Conseil d’Etat). This court heard their arguments in February of this year, and referred the case to the European Court of Justice of the European Union (case number C-136/17).

The CJEU now has to decide whether "sensitive personal data"—such as the political allegiance of an individual, or a past criminal conviction reported in the press—should always outweigh the public interest.

The tricky thing with this kind of information is that it is often important for people to know and it is frequently reported in newspapers and elsewhere. Requiring automatic delisting from search engines, without any public interest balancing test, risks creating a dangerous loophole. Such a loophole would enable anyone to demand removal of links that should remain up in the public interest, simply by claiming they contain some element of sensitive personal data.

So when the CJEU confirms a date to hear this case, we will be advocating strongly for the public interest balancing test to apply to all types of delisting requests—including those containing sensitive personal data.

Where does the right to be forgotten apply?

There is another fundamental legal question due to be heard in coming months at the French Conseil d’Etat. At stake: whether Europe’s right to be forgotten should reach beyond the borders of Europe, whether delisting of links should also happen in other countries which have different ways of balancing privacy and access to information.

Enforcing the right to be forgotten beyond Europe would set a grave precedent. There would quickly be a race to the bottom as other countries, perhaps less open and democratic than France, ordered Google to remove search links for every citizen in every other country of the world.

We’ve written extensively on this topic in the past, as have a wide range of human rights and media organizations, and others. It’s possible that the Conseil d’Etat may also refer this geographical scope question to the CJEU.  But wherever this case is heard, our key assertion remains the same: No one country should be able to impose its rules on the citizens of other another country, especially when it comes to lawful content.

Fundamental questions

Google did not welcome the right to be forgotten, but we have worked hard to implement it in Europe over the last three years. Access to information in the public interest, and the right of of all countries to define the balance between privacy and free expression within their own borders, are important, fundamental issues. We look forward to presenting our arguments at both the CJEU and the Conseil d’Etat.

Three years of striking the right (to be forgotten) balance

It is now three years since Europe’s highest court decided that EU citizens should have a "right to be forgotten." Implementing that right has neither been simple nor without controversy, but in that time we've evaluated 720,000 delisting requests, ultimately removing around 43 percent of the more than 2 million links submitted to us.  

Over the three years, the way search engines delist, and national law, has continued to develop. Now, two fundamental issues are being considered by two of Europe’s highest courts.

Sensitive personal data and the public interest

Put simply, the first issue—due to be heard by the Court of Justice of the European Union (CJEU) in the coming months—is whether people have an absolute right to request removal of lawfully published, but sensitive, personal data from search results. Or whether, as is the case now, search engines should continue to balance the public interest in access to information with the individual’s right to privacy.   

The background to this CJEU case is that in 2016, four individuals were unhappy with our decision not to remove certain links to webpages about them. They appealed to the French data protection regulator, the CNIL, asking them to review our decisions, challenging the underlying principle that a public interest test should apply.

In its review, the CNIL agreed with our decisions. The individuals subsequently took their case to the French Supreme Administrative Court (the Conseil d’Etat). This court heard their arguments in February of this year, and referred the case to the European Court of Justice of the European Union (case number C-136/17).

The CJEU now has to decide whether "sensitive personal data"—such as the political allegiance of an individual, or a past criminal conviction reported in the press—should always outweigh the public interest.

The tricky thing with this kind of information is that it is often important for people to know and it is frequently reported in newspapers and elsewhere. Requiring automatic delisting from search engines, without any public interest balancing test, risks creating a dangerous loophole. Such a loophole would enable anyone to demand removal of links that should remain up in the public interest, simply by claiming they contain some element of sensitive personal data.

So when the CJEU confirms a date to hear this case, we will be advocating strongly for the public interest balancing test to apply to all types of delisting requests—including those containing sensitive personal data.

Where does the right to be forgotten apply?

There is another fundamental legal question due to be heard in coming months at the French Conseil d’Etat. At stake: whether Europe’s right to be forgotten should reach beyond the borders of Europe, whether delisting of links should also happen in other countries which have different ways of balancing privacy and access to information.

Enforcing the right to be forgotten beyond Europe would set a grave precedent. There would quickly be a race to the bottom as other countries, perhaps less open and democratic than France, ordered Google to remove search links for every citizen in every other country of the world.

We’ve written extensively on this topic in the past, as have a wide range of human rights and media organizations, and others. It’s possible that the Conseil d’Etat may also refer this geographical scope question to the CJEU.  But wherever this case is heard, our key assertion remains the same: No one country should be able to impose its rules on the citizens of other another country, especially when it comes to lawful content.

Fundamental questions

Google did not welcome the right to be forgotten, but we have worked hard to implement it in Europe over the last three years. Access to information in the public interest, and the right of of all countries to define the balance between privacy and free expression within their own borders, are important, fundamental issues. We look forward to presenting our arguments at both the CJEU and the Conseil d’Etat.

Reflecting on the Right to be Forgotten

What if links to stories about someone’s past—stories about defrauding an international business or about medical tourism malpractice—were removed from Google search in your country, not because of your local laws but because someone was able to use the laws of another country. How would you feel about that?

That question may seem simplistic.  But it goes to the heart of a very important debate that is taking place now in Europe, initially between some Data Protection Authorities and, next year, in court. At stake: whether Europe’s right to be forgotten—which allows people in EU countries to request removal of certain links from name search results—should reach beyond the borders of Europe and into countries which have different laws.

Google believes it should not. That’s why, for much of the last year, we’ve been  defending the idea that each country should be able to balance freedom of expression and privacy in the way that it chooses, not in the way that another country chooses.

To be clear: we are not disputing that Google should comply with the right to be forgotten in Europe. We have worked diligently to give effect to the rights confirmed by the European Court of Justice. We have delisted approximately 780,000 URLs to date and have granted fast and effective responses to individuals who assert their rights.  

We have also worked efficiently with Data Protection Authorities when they are asked to review (the small number of) cases that are appealed to them.  Our approach to delisting takes into account the criteria set out by the European Court, as well as guidance from each country’s regulators and courts.  And from the outset, we have delisted links on all European versions of Google Search simultaneously. So links would no longer appear on Google.de, Google.fr and Google.be, and so on.

But some Data Protection Authorities argued that people could still find delisted links by searching on a non-European version of Google such as Google.com.  So in March 2016, in response to the concerns of a number of Data Protection Authorities, we made some changes.  As a result, people using Google from the same country as the person who requested the removal can no longer find the delisted link, even on Google.com, Google.co.kr, or Google.com.mx.

But one Data Protection Authority, the French Commission Nationale de l'Informatique et des Libertés (the CNIL), has ordered Google to go much further, effectively instructing us to apply the French balance between privacy and free expression in every country by delisting French right to be forgotten removals for users everywhere.  Ultimately, we might have to implement French standards on Google search sites from Australia (google.com.au) to Zambia (google.co.zm) and everywhere in between. And any such precedent would open the door to countries around the world, including non-democratic countries, to demand the same global power.

We agree with the CNIL that privacy is a fundamental right—but so too is the right to free expression. Any balance that is struck between those two rights must be accompanied by territorial limits, consistent with the basic principles of international law. Aside from anything else, it’s plain common sense that one country should not have the right to impose its rules on the citizens of another, especially not when it comes to lawful content.

We are not alone in this view.   A wide range of organisations from all over the world have also expressed fears about the CNIL's decision and its impact on freedom of speech, press freedom and the right to access information on the Internet, including The Wikimedia Foundation, The Reporters Committee for Freedom of the Press, The International Federation of Library Associations, and The Article 19 Coalition of Human Rights organizations.

The right to be forgotten can sometimes seem complex, and discussions about jurisdiction online certainly are complicated. But this issue is simple: should the balance between the right to free expression and the right to privacy be struck by each country—based on its culture, its traditions, its courts—or should one view apply for all?

Reflecting on the Right to be Forgotten

What if links to stories about someone’s past—stories about defrauding an international business or about medical tourism malpractice—were removed from Google search in your country, not because of your local laws but because someone was able to use the laws of another country. How would you feel about that?

That question may seem simplistic.  But it goes to the heart of a very important debate that is taking place now in Europe, initially between some Data Protection Authorities and, next year, in court. At stake: whether Europe’s right to be forgotten—which allows people in EU countries to request removal of certain links from name search results—should reach beyond the borders of Europe and into countries which have different laws.

Google believes it should not. That’s why, for much of the last year, we’ve been  defending the idea that each country should be able to balance freedom of expression and privacy in the way that it chooses, not in the way that another country chooses.

To be clear: we are not disputing that Google should comply with the right to be forgotten in Europe. We have worked diligently to give effect to the rights confirmed by the European Court of Justice. We have delisted approximately 780,000 URLs to date and have granted fast and effective responses to individuals who assert their rights.  

We have also worked efficiently with Data Protection Authorities when they are asked to review (the small number of) cases that are appealed to them.  Our approach to delisting takes into account the criteria set out by the European Court, as well as guidance from each country’s regulators and courts.  And from the outset, we have delisted links on all European versions of Google Search simultaneously. So links would no longer appear on Google.de, Google.fr and Google.be, and so on.

But some Data Protection Authorities argued that people could still find delisted links by searching on a non-European version of Google such as Google.com.  So in March 2016, in response to the concerns of a number of Data Protection Authorities, we made some changes.  As a result, people using Google from the same country as the person who requested the removal can no longer find the delisted link, even on Google.com, Google.co.kr, or Google.com.mx.

But one Data Protection Authority, the French Commission Nationale de l'Informatique et des Libertés (the CNIL), has ordered Google to go much further, effectively instructing us to apply the French balance between privacy and free expression in every country by delisting French right to be forgotten removals for users everywhere.  Ultimately, we might have to implement French standards on Google search sites from Australia (google.com.au) to Zambia (google.co.zm) and everywhere in between. And any such precedent would open the door to countries around the world, including non-democratic countries, to demand the same global power.

We agree with the CNIL that privacy is a fundamental right—but so too is the right to free expression. Any balance that is struck between those two rights must be accompanied by territorial limits, consistent with the basic principles of international law. Aside from anything else, it’s plain common sense that one country should not have the right to impose its rules on the citizens of another, especially not when it comes to lawful content.

We are not alone in this view.   A wide range of organisations from all over the world have also expressed fears about the CNIL's decision and its impact on freedom of speech, press freedom and the right to access information on the Internet, including The Wikimedia Foundation, The Reporters Committee for Freedom of the Press, The International Federation of Library Associations, and The Article 19 Coalition of Human Rights organisations.

The right to be forgotten can sometimes seem complex, and discussions about jurisdiction online certainly are complicated. But this issue is simple: should the balance between the right to free expression and the right to privacy be struck by each country—based on its culture, its traditions, its courts—or should one view apply for all?

Reflecting on the Right to be Forgotten

What if links to stories about someone’s past—stories about defrauding an international business or about medical tourism malpractice—were removed from Google search in your country, not because of your local laws but because someone was able to use the laws of another country. How would you feel about that?

That question may seem simplistic.  But it goes to the heart of a very important debate that is taking place now in Europe, initially between some Data Protection Authorities and, next year, in court. At stake: whether Europe’s right to be forgotten—which allows people in EU countries to request removal of certain links from name search results—should reach beyond the borders of Europe and into countries which have different laws.

Google believes it should not. That’s why, for much of the last year, we’ve been  defending the idea that each country should be able to balance freedom of expression and privacy in the way that it chooses, not in the way that another country chooses.

To be clear: we are not disputing that Google should comply with the right to be forgotten in Europe. We have worked diligently to give effect to the rights confirmed by the European Court of Justice. We have delisted approximately 780,000 URLs to date and have granted fast and effective responses to individuals who assert their rights.  

We have also worked efficiently with Data Protection Authorities when they are asked to review (the small number of) cases that are appealed to them.  Our approach to delisting takes into account the criteria set out by the European Court, as well as guidance from each country’s regulators and courts.  And from the outset, we have delisted links on all European versions of Google Search simultaneously. So links would no longer appear on Google.de, Google.fr and Google.be, and so on.

But some Data Protection Authorities argued that people could still find delisted links by searching on a non-European version of Google such as Google.com.  So in March 2016, in response to the concerns of a number of Data Protection Authorities, we made some changes.  As a result, people using Google from the same country as the person who requested the removal can no longer find the delisted link, even on Google.com, Google.co.kr, or Google.com.mx.

But one Data Protection Authority, the French Commission Nationale de l'Informatique et des Libertés (the CNIL), has ordered Google to go much further, effectively instructing us to apply the French balance between privacy and free expression in every country by delisting French right to be forgotten removals for users everywhere.  Ultimately, we might have to implement French standards on Google search sites from Australia (google.com.au) to Zambia (google.co.zm) and everywhere in between. And any such precedent would open the door to countries around the world, including non-democratic countries, to demand the same global power.

We agree with the CNIL that privacy is a fundamental right—but so too is the right to free expression. Any balance that is struck between those two rights must be accompanied by territorial limits, consistent with the basic principles of international law. Aside from anything else, it’s plain common sense that one country should not have the right to impose its rules on the citizens of another, especially not when it comes to lawful content.

We are not alone in this view.   A wide range of organisations from all over the world have also expressed fears about the CNIL's decision and its impact on freedom of speech, press freedom and the right to access information on the Internet, including The Wikimedia Foundation, The Reporters Committee for Freedom of the Press, The International Federation of Library Associations, and The Article 19 Coalition of Human Rights organisations.

The right to be forgotten can sometimes seem complex, and discussions about jurisdiction online certainly are complicated. But this issue is simple: should the balance between the right to free expression and the right to privacy be struck by each country—based on its culture, its traditions, its courts—or should one view apply for all?