ISPAI View on CJEU Ruling on the “right to be forgotten”

June 19, 2014

CJEU ruling on Spanish Google “right to be forgotten” in relation to search engines has very worrying implications for the ISP industry and for society as a whole.

The Court of Justice of the European Union (CJEU) has ruled that an individual may request an Internet Search Provider to remove their personal information from search results when that information is outdated or irrelevant. What is particularly curious is this same principle does not appear to apply to the original publisher.

There’s already much commentary on this ruling which was referred to the CJEU from a case taken by an individual against the original publisher and Google in Spain. Some examples from online law publications:

The National Law Review:

The Index on Censorship

The New Law Journal

and many more articles may be found in the news media. Hence, we are not going to describe the background or analyse the actual ruling here. ISPAI is far more concerned about the serious implications for Internet Providers and the wider public interest in the precedent set by this ruling.

Essentially the Court has found in examining relevant EU legislation that the complex interrelationship between data protection, fundamental rights of privacy, public right to information, freedom of expression and the freedom to conduct Internet business services, intersect in such a way that (for the immediate purposes of this Spanish case) Google and other search engine providers are responsible for allowing or not allowing “easy” access to legally published data that may be deemed to be personal information that has become outdated or irrelevant. However, we believe this interpretation of legislation has far greater reach and in future could equally be applied to social media, information aggregation, discussion forums, etc., and could stifle development of future Internet services.

It must be emphasised, that the ruling has nothing to do with information posted on the Internet that is manifestly illegal (under criminal law) or breaks the terms of service of the provider. ISPs and ESPs already have processes aimed at the original publisher to deal with this, often as required by law. What is so worrying is this ruling is about factual information pertaining to a person that has been legally published (i.e. was not private information improperly obtained) and appeared at some time in the past on a website. That legitimate information remains publicly accessible on that website, for anyone to access and read, as long as the owners of that website have not deleted or changed it. Similarly automated crawlers from search and directory services can also reach that public information and will build it into their index. The search engine process is one of the cornerstones that makes the web the superbly useable information facility that it is today.

Many might immediately think this is a great victory for the ordinary citizen to assert their rights against big business but in fact it is the very opposite. The insidious side effect of this ruling is that ISPs are expected to act on other peoples’ data with no form of judicial oversight. Individuals simply make the request to the ISP.

ISPAI members do not want to prevent citizens from making legitimate requests to have information pertaining to them deleted from the websites where it is published. However, it is wholly inappropriate that such requests should be adjudicated by ISP/ESP who merely provide access to that data by way of running a search engine or other service which is unconnected with, and not responsible for, the published information.

That is why ISPAI say this is a dilemma for ISPs and bad for EU society – because yet again EU legislation has created a situation where ISPs are being put in the position of judge, jury and executioner. This is a position in to which no commercial business should be placed and it is certainly a role which we as ISP/ESPs do not want. Such decisions rightly must only be made by a court of law or state body established to adjudicate on whether the legal information should be censored by virtue of time or relevance.

In addition, even if such cases were judged by a national court or state authority, with international agreement for mutual recognition of decisions, we believe the “removal order” should apply to the original publishers of the information, or those who have directly copied and republished it, and not to third party service providers. Any “private adjudication” is anti-democratic and amounts to private unaccountable censorship by proxy.

ISPAI do not lay blame at the door of the CJEU for this situation. They made a difficult decision “achieving the best balance possible in the eyes of the judges” based on the EU legislation that exists today.

This situation results from the complex interplay of laws and regulations drafted and enacted at different times but which have had consequences that nobody could reasonably have foreseen at the time. However, that is an explanation, not an excuse for inaction by legislators. The situation has been clearly defined by the CJEU. It is now up to the EU legislative institutions (Commission, Parliament and Council) who have created this situation to fix it for the good of the Internet and society as a whole.