In a landmark decision last month, Europe’s highest court dealt a blow to U.S. technology companies and free speech advocates when it acknowledged and affirmed an individual’s “right to be forgotten” online.
On May 14, 2014, the Court of Justice of the European Union (the “ECJ”) ruled that Google, upon request from a user, is obliged to erase from its search results “links to web pages, published by third parties and containing information related to that person,” even when the information is truthful and its publication lawful. The ECJ based its holding on the distinctly European principle that individual online privacy rights “override, as a rule,” both Google’s economic interest and the public’s interest in the free flow of information.
In the U.S., reaction to the decision has been decidedly negative. Commentators have argued that the ECJ’s ruling, which would allow individuals to remove even non-sensitive information from search results, like their birthdates and the names of their employers, flies squarely in the face of the First Amendment. Several trade groups representing information technology companies have condemned the ruling as “large- scale private censorship in Europe,” which could allow individuals— particularly those in powerful positions—to erase certain past events from history. This ruling could reverse the Internet’s success in democratizing knowledge and advancing unrestricted access to information around the world.
Alternatively, across the Atlantic, European commentators have praised the ECJ’s decision as “a victory over the omnipotence of American Internet companies,” while criticizing the U.S. reaction as “hysterical.” The ruling is viewed as a long-overdue validation of the individual right to privacy online. Additionally, some consider the decision to be a balanced, nuanced response to a complex issue. They point to the ECJ’s statement that Google can ignore such takedown requests if there are “particular reasons” to do so, such as the important “role played by the data subject in public life.” Thus, the right to freedom of expression and the public interest can, in theory, outweigh an individual’s right to privacy. But at this point, the circumstances in which this can occur are far from clear.
For U.S. technology and data mining companies that conduct business in Europe, this ruling has already proven unwieldy, expensive, and bureaucratic. So far, Google’s response resembles the notice and takedown procedures that it (along with companies like Facebook and YouTube) currently uses to address copyright infringement claims in the United States under the Digital Millennium Copyright Act (“DMCA”). For instance, Google has since launched a website through which EU citizens can request the removal of information from the company’s search results. If Google deems a takedown request to be valid and removes the related material, it is reportedly planning to flag searches in which that material would otherwise appear such that users will know when relevant websites have been “forgotten.”
In the four days after Google’s request site went live, the company received 41,000 individual takedown requests. This deluge of requests has, predictably, encompassed a much broader scope of issues than the typical DMCA claim; according to Google CEO Larry Page, these requests frequently concern past criminal convictions. As a result of the magnitude of requests and the complexity of determining when the right to be forgotten applies, Google is considering hiring additional staffers to evaluate submissions and has established an advisory committee on the right to privacy. Still, it is far from certain whether Google’s DMCA-like approach will be acceptable to European regulators, as the ECJ offered little guidance regarding the scope of its ruling or the mechanism by which it should be implemented.
For U.S. intellectual property owners and content providers, however, the ramifications of this decision are harder to predict. Ironically, there is a chance that the same DMCA systems that intellectual property owners have used for years to prevent piracy and infringement of their material might be turned against them at the request of one offended individual to remove their content from Internet searches. For example, if a DMCA-like notice and takedown regime is implemented, this could potentially lead to the censoring of parody and criticism websites which, although otherwise legal, incorporate or refer to arguably private personal information.
Undoubtedly, the boundaries of “the right to be forgotten” will evolve over time as the EU’s twenty- eight Member States implement regulations based on their respective interpretations of this ruling. This portends a protracted and costly trial-and-error period for both U.S. companies and EU regulators. As a result, it is vital for technology companies and intellectual property owners alike to monitor closely the impact of this decision as it is interpreted and enforced across Europe.
The case is Case C-131/12, Google Spain SL v. Agencia Española de Protección de Datos (May 13, 2014).