Startling, unexpected and potentially revolutionary; that is the initial response from lawyers to a landmark Google court defeat that sets a new standard in data privacy in Europe.
What Europe’s highest court in effect concludes is that there is a “right to be forgotten” already in EU law that Google is obliged to enforce. When asked, the technology company must purge its servers of harmful or unwanted personal content, even if it is legally published elsewhere.
The implications go well beyond the threat to Google’s search business from the requests it may prompt from individuals seeking to remove links to nasty comments about them, unfavourable court orders or embarrassing pictures.
The precedent laid down – which applies across the EU – will now force Google and other online publishers to rethink completely how they handle links to content on the web. “This ruling opens the door to large scale private censorship in Europe,” warned James Waterworth of the CCIA, a tech company lobby group in Brussels.
The ruling reinterprets a 1995 data protection directive – passed in the year Google’s founders first met at university – and applies it to the internet age. It establishes that Google, and any website indexing links, is in effect responsible for content even if it was simply processing it on its servers and presenting results.
The ruling potentially goes beyond Google and would apply to searches on social media such as Twitter or Facebook. The deletion requests could be links to pictures of teenage indiscretions, insulting comments on a social media website, bad reviews, malicious allegations, notifications of court orders or company filings.
The first question is practical. Can this be achieved? Will it create an unmanageable flow of demands for deletions? What happens if a video is copied and published elsewhere? To what lengths must Google go to remove related material?
The second is ethical. Google – and other search engines such as Yahoo or Microsoft’s Bing – will be put in a role of deciding what is in the public’s interest. The court states that in cases involving “public” figures, Google can challenge the deletion request and refer the case to a court or data protection authority.
Defenders of freedom of speech will question whether we should trust Google to refer the right cases. Take the case of a budding politician with a criminal conviction or unsavory public comments that are mentioned in an online post. Is it right for content censorship to clear the path to them becoming a public figure?
There are moral dilemmas, too, over requests from people out of the public eye. Should a fiancée of a convicted fraudster be deprived of the right to see information relating to their past because he asked for it to be removed from Google searches?
Google said it was “a disappointing ruling”. Given it has no opportunity to appeal and is fighting data protection challenges on multiple fronts in Europe, that is something of an understatement.
And beyond this administrative nightmare for the tech world, there are bigger political and ethical questions raised regarding freedom of speech in Europe.
After all, EU member states and lawmakers thought they were mid-debate about this controversial “right to be forgotten” – the limits, the practical burden and the potential curbs on debate in the public interest.
If this remarkable data protection right already exists – as the ECJ judges ruling seems to indicate – what was the point of the European Commission proposing that it explicitly be introduced into law? And what should we make of the fundamental objections raised by the UK and others?
The stakes were bluntly outlined in advice to the court from its own advocate general Niilo Jääskinen, who argued enshrining a “right to be forgotten” would “entail sacrificing pivotal rights such as freedom of expression and information”. Saddling search engines with such obligations would encroach on the rights of publishers and “amount to the censuring of his published content by a private party”, he added.
Advocates of tighter data protection laws naturally welcomed the ruling. Jean-Claude Juncker, the centre-right candidate to be European Commission president, told the Financial Times it was “good to see that our citizens’ right to data protection is being well protected by European judges in Luxembourg.”
Tech companies once fearful of the Brussels proposals to revise data protection laws may now see them as a path to salvation. A fierce lobbying effort will begin. But there will inevitably be a long period of uncertainty: given the European elections and a change of guard at the commission, solid legislative work may not restart until next year.
Looking back, the Google lawyers may be ruing putting up a fight against Mario Costeja González, a Spaniard who wanted them to remove links to a court-mandated announcement that his house was to be auctioned because of missing tax payments. Mr Costeja González, the original complainant, told the FT he remained “a fan of Google”.
Additional reporting in Tobias Buck