Right to be forgotten: a Transatlantic Dialogue

Jane Lambert

On 12 June 2014 La Commission Nationale de l'Informatique et des Libertés (CNIL). the French data protection authority, issued a notice requiring Google to apply de-listing from all platforms of its search engine such as Google Sierra Leone and Google Mongolia and not just those like Google UK, Google France and Google Deutschland that are marketed to residents of EU member states. In his post Implementing a European, not global, right to be forgotten 30 July 2915 Google's privacy counsel Peter Flecischer stated that Google had refused to implement that notice and had asked the CNIL to withdraw it.

It is possible that the CNIL will change its mind and do so but it is more likely that it won't.  In that case the President of the Commission could nominate a Rapporteur and ask him or her to draft a report recommending sanctions to be imposed on Google for such non-compliance. Google could of course challenge the CNIL's decision in the Conseil d'État. As the obligation that the CNIL purports to enforce arises under EU law  the Conseil d'État will be urged to seek a preliminary ruling under art 267 of the Treaty on the Functioning of the European Union ("TFEU") from the Court of Justice of the European Union ("CJEU") on the nature and extent of the so-called right to be forgotten.

I say "so-called" because you will struggle if you look for the right to be forgotten in the Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data OJ L 281 , 23/11/1995 pages 31 - 50) or member states' implementing legislation. The phrase "right to be forgotten" may not have been coined by the CJEU in C‑131/12 Google Spain SL and Another v Agencia Española de Protección de Datos (AEPD) ex parte Costeja 36 BHRC 589, [2014] 3 CMLR 50, [2014] EMLR 27, EU:C:2014:317, ECLI:EU:C:2014:317, [2014] All ER (EC) 717, [2014] 3 WLR 659, [2014] ECDR 16, [2014] 2 All ER (Comm) 301, [2014] EUECJ C-131/12, [2014] 1 QB 1022, [2014] QB 1022 bur it entered everyday speech after that judgment.

The Costeja case was a reference for a preliminary ruling under art 267 TFEU from the Audiencia Nacional in Spain. It was made in an application by Google Spain and its US parent company to quash an order of the AEPD, the Spanish data protection authority. The AEPD required Google to withhold from its search results URLs to advertisements that had appeared in a Spanish newspaper many years ago of an auction of Mr Costeja's property that had been seized and sold to pay his social security arrears. Mr Costeja had complained to the AEPD that the advertisements came up on every search of his name. He had rebuilt his life since then and those advertisements were a constant embarrassment.  He asked the AEPD to order the newspaper to remove the advertisements and Google to stop including them in its search results.  The AEPD rejected his request in respect of the newspaper since the advertisements had been ordered by the Spanish Ministry of Labour but upheld it against Google.

In the Audencia Nacional the Google companies had argued that Spanish data protection law did not apply to search engines. They argued that search engines were not "data controllers", that they did not process personal data and that in any case they were not within the Spanish courts' jurisdiction. As the Spanish legislation purported to implement the Data Protection Directive the Audencia Nacional referred those questions to the CJEU. The actual questions and reply are lengthy but paragraph [1] of the CJEU's judgment summarizes them conveniently:

"This request for a preliminary ruling concerns the interpretation of Article 2(b) and (d), Article 4(1)(a) and (c), Article 12(b) and sub-paragraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) and of Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’)."

The CJEU recognized at paragraph [19] that it had to apply a 1995 directive to technologies that had emerged after the adoption of that legislation.

Essentially, the CJEU held that Google (and no doubt all other search engines including Yahoo and Bing) were data controllers and that they processed personal data. It followed that Spanish data protection law applied to their activities and that they had to comply with its data quality and subject access provisions just like everybody else. One consequence of the CJEU's decision was that Google and other search engine operators were subject to enforcement notices from national data protection authorities. Also, they could be sued by data subjects in national courts for any loss or damage that might arise from breaches of their obligations under those laws.

Google responded to that judgment by establishing procedures for handling requests for search result removals. It prepared a simple form and FAQ for such requests. As of 31 July 2015 Google had received 291,243 removal requests and considered nearly 1,6 million URLs since Costeja. It had removed 41.3% of those URLs and had rejected removal requests in respect of 58.7%. Its Transparency Report gives examples of requests that it has accepted and others that have been rejected. Those whose requests are rejected are, of course, free to complain to their national data protection authority or bring proceedings in their national courts. It is not known how many have done so. Bing and Yahoo have established similar procedures. Bing's request form is here and Yahoo's is here.

Although Mr Fleischer characterized the right to be forgotten as a European right and not a global one, similar rights seem to exist elsewhere. In Melvin v Reid and Others 112 Cal.App. 285 (Cal. Ct. App. 1931), for example, the California Court of Appeal allowed a claim against a film maker who had exposed the claimant's early life as a prostitute on the ground that the film had invaded her privacy. It seems to me that the issues in that case as well as the outcome were very similar to those in Costeja.

Should anyone wish to discuss this article with me, the right to be forgotten or data protection generally, he or she should call me on 020 7404 5252 during office hours and send a message through my contact form.

Post Script

As I wrote this post at the suggestion of Cathy Gellis who practises IP and internet law in California I drew it to her attention by twitter to which she kindly replied:

"@nipclaw thanks! But I wouldn't put much stock in Melvin v Reid. It's old case that has likely been mooted by later US Supreme Ct precedent.
— Cathy Gellis (@CathyGellis) August 1, 2015"

Helpfully, she also made the following observations:

"@nipclaw or let me rephrase: the right to privacy may remain, but not such that deletion would be a recognized remedy."

Adding in her next tweet

"@nipclaw especially not by a party not connected to the act that invaded the privacy. Section 230 would also preclude."

I am sure Cathy is right but nobody even in Europe argues that excluding URLs from a search report is the only or even in many cases the appropriate remedy.

I replied:

"@CathyGellis I think Melvin was an action for damages rather than an injunction. The point is that the cause of action appears to subsist."

I added:

"@CathyGellis The cause of action in Melvin seems to be invasion of privacy which is essentially what data protection is all about."

And concluded

"@CathyGellis my point is that the right to be forgotten (subject access and data quality) exists well beyond the shores of the EU states."

We shall have to see how this area of the law develops on both sides of the Atlantic but one thing of which I am very sure is that Americans don't take injustice and invasion of privacy lying down. Had Mr Costeja lived in San Francisco rather than Spain I suspect he would have consulted Cathy or some other US lawyer and asked whether there was anything to be done about the embarrassing search records. Knowing Cathy as I do, it is more than likely that she would have found a way to help him.

Further Reading

Farhad Manjoo  ‘Right to Be Forgotten’ Online Could Spread 5 Aug 2015 NYT