The EU’s decision on Tuesday to back a “right to be forgotten” is the latest move by European authorities to bolster its citizens’ data protection rights in an era when personal data has become a valuable currency for big tech companies.
Over the past five years, Brussels has been trying to overhaul the EU’s 20-year-old data privacy rules. In 2012 the commission proposed a draft law, which large US groups and the White House have lobbied against, as they considered them too onerous on internet companies’ business model.
However, following the controversy caused by Edward Snowden, the US security contractor who exposed details of sprawling US surveillance and data collection activities, the issue of citizens privacy rights has landed back on the agenda for European policy makers and courts.
The Court of Justice of the EU recently scrapped a law that required mobile operators and internet service providers to retain data of citizens, as it argued that it went against the bloc’s fundamental rights.
The ruling on Tuesday effectively deems Google a “data controller”, and therefore subject to data protection rules. This means that the search engine is not being treated as a neutral intermediary.
The ruling, now set to be followed by courts and data protection authorities in member states across the EU, could also have big implications far beyond Google – making it easier for people to remove personal information held by newspaper publishers, catalogue systems and even public libraries.
Lawyers say the landmark ruling could impose a heavy burden on Google and leave the US company few realistic options to escape compliance. To comply with the judgment, the search engine will need to set up technical and administrative functions to deal with potentially millions of requests from individuals to remove links.
“If sufficient people complain to Google requiring it to stop linking to material relating to them, Google could soon cease to be a useful tool for collating biographical information,” said Dan Tench, a media partner at Olswang, the law firm.
Legal experts have yet to reach consensus about how a “right to be forgotten” will be implemented in practice. Much will depend on how Google designs a takedown system – and how national data protection authorities and courts interpret the law, including the exception that applies to journalism.
But everyone is in agreement that the European court’s latest judgment paves the way for a substantial increase in the number of attempts to remove information from the internet.
“Once there is a clear route to removing information [from Google and other search engines], it will attract legitimate and frivolous and vexatious requests,” said Sally Annereau, data protection analyst at Taylor Wessing, a law firm.
“There’s a risk that information in the public interest is taken down, if they develop a sledgehammer solution.”
Letters in response to this article:
Get alerts on Data protection when a new story is published