1. Introduction

The legal terminology “right to erasure (right to be forgotten)” originates from Directive 95/46/EC of the European Parliament and of the Council of 1995 and is currently mainly found in Article 17 of the GDPR. The “right to be forgotten” basically empowers the data subject, under certain circumstances, to obtain from the data controller the erasure of personal data that concerns him or her. As to the circumstances under which an individual has the right to have his or her personal data erased, jurisdictions’ standards vary for such applications. This article presents the first “right to be forgotten” case decided by the Taiwanese Supreme Court, in which Google was ordered to remove some personal data content retrieved from its search engine.  How the Court examines whether X has the right to dereference from the perspective of the Personal Data Protection Act is reviewed below (2020 No. 489 Civil Judgment).

2.  Professional Baseball Pitching Dispute

(1) Facts of the case

X sued Google Inc. in 2015, asking the latter to remove all links and webpage related to the contents of his name, as well as messages related to “X throwing games.”  X claimed that although he was indeed a manager of a Chinese professional baseball team in 2008 and was involved in the ball-fixing scandal that had received widespread media coverage, a final criminal judgment had already confirmed his innocence and X had since resigned as the team’s manager many years ago, so that it was unnecessary to collect or process the outdated information. In addition, some media outlets have been disclosing all of X’s occupations, relationships, family and other private information, which were also irrelevant to the public interests and infringed his rights of reputation, privacy and the right to be forgotten. Google argues that all information is automatically retrieved and indexed by a search engine program from public websites, and that Google is not involved in the “collection, processing or use” of X’s personal data.  Hereunder is a summary of the Court’s assessment of the key legal issues.  

(2) Is the operator of a search engine subject to Personal Data Protection Act?  And if so, how should it comply with the law?

 “Personal data,” as defined in Article 2 of the Personal Data Protection Act, refers to the name, educational background, occupation, social activities and other information that can directly or indirectly identify a natural person. Moreover, the term “collection” refers to the act of collecting personal data in any way; “processing” refers to the act of recording, inputting, storing, editing, correcting, duplicating, retrieving, deleting, outputting, connecting or internally transferring data for the purpose of establishing or using personal data files; and “use” refers to the use of any personal data for purposes other than processing, all of which are defined in the same Act. Here, the controversial search engine shows 85 web pages of tabulated results when one types “X’s name” into Google.  These results are collected by search engine operators through the automatic, continuous and systematic exploration of information on the Internet by means of crawlers, and the information is continuously recorded and edited by cataloguing programme, and then entered and stored on servers, in the form of a list of search results to be retrieved and linked to by users. Therefore, all the activities performed by the search engine are still the activity of “processing of personal data,” which is regulated by the Personal Data Protection Act.  This means that Google could only collect or process relative personal data in accordance with the provisions of the Act.

In addition, according to Articles 5, 8 and 9 of the Personal Data Act, the collection and processing of personal data should in principle respect the rights and interests of the data subject, be carried out in good faith and in an honest manner, shall not exceed the necessary scope of specific purposes, bear a legitimate and reasonable relationship to the purposes of collection, and be subjected to the obligation to inform the data subject in advance, unless the statutory exemption requirements set out in Article 9(2) are met.  In this case, the personal data collected and processed by Google were obtained from the sources of general public websites; and the collection and processing of personal data through the use of search engines is a form of speech that has the function of disseminating information via the Internet to ensure the public’s right to know, and thus promoting the progress and development of democracy accordingly, which is related to the public interest. Therefore, the Court held that the data “collected and processed” at issue was “the personal data disclosed to the public by the data subject or have been lawfully made public” or “necessary for the collection of statistics or for academic research in pursuit of the public interest,” as provided for in Article 9(2)(ii) or (iv) of the same Act, which exempts search engine operators from the obligation to inform the data subject before collecting and processing personal data, and is “lawful activity” as provided for in Article 19 of the same Act.

(3)  Measuring whether the “necessity” to collect personal data has changed over time - assessing the balance between the free flow of information, freedom of expression and the rights to personal data

The Court then goes on to elaborate that although Google’s collection and processing of X’s personal data in this case have been accorded with the statutory purposes from the outset, it should nevertheless ensure that it continues to comply with the provision of Article 5 of the Personal Data Protection Act, which is also reflected in Articles 11(3) and (4) of the Act, which states: “(W)hen the specific purpose of the data collection no longer exists, or upon the expiration of the relevant time period, the data controller shall, on its own initiative or upon the request of the data subject, erase or cease the processing or use of the personal data.”

Both the first and second instance courts dismissed X’s complaint on the grounds that the ”baseball pitching dispute” was a matter of public concern and that the public had the right to be properly informed, and that the collection of information in this case was a freedom of expression which is protected by the Constitutional Act. The Supreme Court stated that although the first and second instance judgments are not entirely unfounded, the protection of personal privacy and the autonomy of information should be taken into account at the same time.  The Supreme Court therefore vacated the the first and second instance Judgments, explaining that “The determination of the necessity of data collection and use is based on a balance of legal interests between the data subject's right to privacy of information and the public interest in the right to public knowledge… The data subject may still request the collector or processor of the data to delete the personal information, even if it has been lawfully disclosed, if the specific purpose for which it was collected, processed or used no longer exists or has exceeded the scope of necessity for that purpose… The court should also take into account the nature of search engine services, the impact of search results on Internet users’ access to information, the social conditions at the time when the information linked to the search results was made public and subsequent changes, and the specific public interests involved in the information. The need to record private facts, the extent to which public information intrudes on the privacy of the parties concerned, the role of the parties concerned in the public life of the data, and the relevance of the results of their actions shall be comprehensively weighed.”

The case was then remanded to the court of the second instance for retrial. In line with the the Supreme Court’s elaborations, the retrial court divided the disputed data into the following two types.

(i) Information to be deleted at X’s request

The content of message relating to negative comments with vulgar and bigoted language, such as “People like this should be put through their mouths and out of their asses with a bat,”… “This article is full of black and profanity, …If everything reported is true, then X is really rubbish shit, a fucking son of a bitch, a quick glance at the news last night thought it was just like the previous occasions when players were involved in gambling, but it turned out that the son of a bitch boss took the lead in exerting pressure.”

Points to measure the “necessity” of the cessation of the collection or processing of such information:

  • Most of the pages are self-expressed words without any factual knowledge.
  • Content that is completely out of the public domain.
  • The fact that X resigned from his position as team leader around 14 years ago, was acquitted of criminal charges, and had since changed his name, indicates his intention to reduce his public profile and the need to improve the protection of his privacy.  If the content of the aforementioned website continues to exist, it will obviously continue to infringe on X and is not in line with the purpose of Article 1 of the Personal Data Protection Act, which is to “promote the reasonable use of personal data.”
  • Google’s search engine is currently the most famous and influential search engine for web information, and its market share or the strength and influence of its search engine are incomparable to those of other search engine operators.  It therefore has a corresponding social responsibility to balance the free flow of information, freedom of expression and the right to personal data.

 (ii) Information to be retained

The content of the message includes news (along with descriptions of X’s age and educational background), an introduction to the history of the baseball pitching case, and a link to the relevant court’s relative judgments, etc., focusing on the development and impact of the professional baseball pitching case.

Points to measure the “necessity” of the continued collection or processing of such information:

  • Google only places these search results on its platform for public viewing and does not actively address these information.
  • The “Pitching Baseball Case” is relevant to public interests such as “facilitating the adequate flow of information” and “making information available to the public.” If only negative search results for X were removed, the search engine would not be able to reflect the continuing development of events, online information would not be complete and objective, and the right of online users to access information by online users would be impeded. In addition, the “Pitching Baseball Case” is also suitable for commercial purposes such as collection by search engine operators as a basis for evaluating relevant databases, related service updates and related advertising.
  • The record of X’s privacy is not a major part of the record, and that privacy has been rendered and displayed in another final judgment and is already a semi-public fact.

3.  Implementation of the “right to be forgotten” in Taiwan

How to balance between public interest (free flow of information, press freedom) and individual interest (private privacy) is always a gray area that remains to be measured on a case-by-case basis.  This case offers more guidance on the relative deference of personal data versus public website.  Moreover, the above Judgment shows that in Taiwan, the “right to be forgotten” is a reconciliation of the right to privacy, the protection of personal data and the right of public access to online information, yet Taiwanese laws do not directly use the legal terminology “right to be forgotten.”  As the retrial court in this case cited No. 585 and No. 603 Interpretations of the Constitutional Court stated, the so-called “right to be forgotten,” is essentially a protection of information privacy, which should be pursued by considering whether the Personal Data Protection Act or the tort regulated under the Civil Code could be applied on a case-by-case basis, and that “right to be forgotten” should not be a single and independent cause of action for suit in Taiwan.