Email
Google is currently conducting a grand tour of Europe, with the ten members of its Advisory Council touring seven cities to gather evidence on the developments in the so-called “right to be forgotten” ruling.
The aim, the company says, is to gather examples of best-practice principles and processes for Google’s application of the landmark European court ruling in May, which confirmed that decades-old European data protection rights extend to information indexed by search engines - including, most controversially, lawfully-published public domain information.
The one thing that everyone agrees about this case is that the label it has been given - the “right to be forgotten” - is a very poor descriptor. More accurately, it is about the right to obscure or suppress personal information that is inaccurate, irrelevant, or out-of-date, and which holds no public interest.
At the behest of Google, the Council of eight independent experts and two Google execs is traversing the patchwork European data protection realm, from yesterday in Madrid to November in Brussels - the places that started this mess and, Google might hope, have the power to fix it.
Hunting for appropriate solutions
The council - which today continues its tour in Rome, and is livestreamed from 1pm GMT - balances a distinguished array of academics (Peggy Valcke, Luciano Floridi, Lidia Kolucka-Zuk), former national and international public servants (José-Luis Piñar, Frank La Rue, Sabine Leutheusser-Schnarrenberger), entrepreneur Jimmy Wales, and journalist-editor Sylvie Kaufmann. They are joined by Google executive chairman Eric Schmidt, and senior vice president and chief legal counsel, David Drummond.
The council will be conducting public hearings of vetted experts selected from submissions made in response to a web call during an 11-day window at the beginning of August. At the end of the year, they will provide a report.
Paul Theroux famously referred to a Grand Tour as an inspired way of heading home - which, in this case, would involve shoring up Google’s opposition to the ruling.
The declared independence of the majority of the Council’s membership suggests it will be rather more interesting than that, as does Google’s acknowledgement that the Council’s remit is to “contribute to the evolving debate about the appropriate solutions for addressing knowing and forgetting in the Information Age.”
Nevertheless, and despite this promise, yesterday’s early indications suggest that the Council and testimony are on the whole sympathetic to Google’s position.
Contested concepts and terrain
One of the primary matters that the Council will be investigating is the delineation of “public interest” and “public figure”, the scope of which is absolutely key to the European court ruling. Though well-developed in media, privacy, and defamation law, public interest considerations are under-developed in data protection, being a regime constructed for a pre-internet era and concerned with regulating government and industrial data hoards; the daily incidental trade in personal information that now characterises our digital lives is a new thing entirely.
The Council will also touch on controversial jurisdictional issues and, in particular, whether it is sufficient for Google to respond to requests to obscure personal information exclusively by delinking results on European mirrors of its global site. Google claims that 95% of European users use local domains, rather than referring to google.com; though it is plausible that this may change for the specific purpose of name searches.
This is a topic that is currently exercising European regulators and will be included in guidance issued by their organising body, the Article 29 Working Party, at the end of this month.
Both the Council and the Working Party will also address whether it is appropriate for Google to notify webmasters of data protection requests. Though an important accountability mechanism, notifications are problematic if they do not also caution about avoiding republication where to do so would cause additional damage or distress.
Off-the-table questions?
There are two additional areas where, ideally, the Council could play a critical civic role.
The first is to expose Google’s current processes for dealing with requests.
The second is to openly discuss the fundamental conflict between European data protection law and conventional internet use. Focusing solely on Google and delinked news articles is like throwing ice cubes at a volcano. It rather misses the point - and it won’t do anything to save the rest of us.
Exposing Google’s current processes
Ideally, Google should be transparent with the Council and broader public about the obscurity requests it has dealt with already in the last three months - their nature, issues, and lessons.
This is not to expose Google to critique or penalty, but to learn from its experimentation with implementing the ruling via a largely unstructured web form. That put a particular spin on the ECJ ruling and likely attracted many speculative, boundary-testing claims along with legitimate ones, as well as creating a very uncharacteristically labour-intensive manual process.
We know that Google has responded to data obscurity requests by removing links in 53% of an unknown proportion of the 91,000 requests that were made between 30 May and 18 July. It rejected 32% of cases, and it asked for more information in a further 15%.
What we don’t know is the total number of cases dealt with so far, or even the order of magnitude. Clearly, the implications will vary dramatically, depending on whether Google has dealt with 1,000 requests, 10,000, or the most recent figure of 120,000. Until we have fine-grained statistics and a sufficient range of deidentified cases to review, the expert hearings are largely conducted in a vacuum.
More significantly, without examples, the hearings are being conducted in an abstract way, leaving the debate to inapt analogies, rather than tales of real, human concern that inspire proactive responses.
The absence of any legal obligation on Google to reveal its processes - or on authorities to intervene - is one of the chief criticisms of the ruling and the legal framework from which it derives. In short, it renders Google judge, jury, and executioner.
Hitchhikers on the edge of the data protection galaxy
To date, the debate following the May court ruling has been conducted on a rather limited terrain, concerning itself with the borderline and rather pedestrian facts of the case, which concerned obscuring two 16-year-old notices about home foreclosure published in a Spanish newspaper.
While this has brought more hitchhikers than ever before to the edge of the data protection galaxy, most haven’t yet appreciated the scale of what they’re facing.
The reality is that the broader edifice of data protection presents very troubling tensions when individual data protection rights confront other fundamental rights, such as freedom of expression and rights to information.
At the root of this is the fact that data protection’s core concern is with information about individuals - not necessarily harmful, nor prejudicial information - just information about you and me. So in scope, it covers matters that may warrant protection (substantive as well as procedural), but it also overreaches dramatically. Its sheer breadth creates enforcement problems, meaning that the regime is only patchily enforced and respected.
It is important to acknowledge this openly, because while the process of entrenching a slightly-updated data protection law continues inexorably at the European Commission, the replacement regulation maintains the same core structure. It is a structure that claims to extend to almost everything we do online.
If we look at the data protection galaxy beyond the limited compass of the May ruling, there are some formidable black holes looming. These are above and beyond anything discussed so far in the debate.
Black holes, from bloggers to sensitive data
Google has pointed to a couple of the black holes of data protection. The restrictive scope of what constitutes “journalism” is one; while concerns about research, court rulings, and the historical record, are another.
One particularly glaring black hole is the prohibition on processing “sensitive data” - defined as “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life”, as well as “offences, criminal convictions or security measures”.
The staggering scope of this prohibition - which, read literally, effectively entirely bans Google’s processing of such information without waiver - is unconstrained by the public interest. If we are making an exception - which indeed we are, if we agree that Rolf Harris shouldn’t be permitted to ask Google to delete articles concerning him and the recent sex abuse convictions, for example - then that exception needs to be made explicit. At the moment, this is a huge lacuna in the European ruling.
The challenges of data protection in the modern era are extensive. The issues that will be raised in the several hours of publicity around Google’s Grand Tour will scrape the surface. But as we move to entrenching the governing regime for another 20 years, it is high time to open up the dusty directive and the replacement regulation, and to confront their true import.
• Right to be Forgotten is a false right, Spanish editor tells Google panel
;