The Right to Forget

Google has just won a judgment with important implications at the European Court of Justice (ECJ). The court ruled that the European Union’s (EU’s) Right to Forget regulation could only apply within the jurisdiction of the EU. Hence, Google and others can geo-selectively remove links to information within the ambit of that regulation. The Right to Forget, or Right to Erasure, lets individuals in the EU request that search engines remove links to some categories of embarrassing information, or personal data, on the Internet. The information may remain available, but it can no longer be found via a simple search. The law came into effect in 2014 after a Spanish citizen appealed to have links pertaining to an old bankruptcy to be erased. The provisions became more stringent after the General Data Protection Regulation (GDPR) came into force last year.

Affected citizens can make a request “verbally or in writing” to have links or personal data deleted. The recipient of the request (not necessarily a search engine) has one month to respond. The recipient must consider many things before it complies with the request or turns it down. For example, the data may be personal, or collected with consent, for a purpose that has been fulfilled. It may be obsolete or pertain to a minor. In such cases, the data itself may be erased. However, it could also be in the public interest, or it may be necessary to hold that data in the interests of freedom of expression. For example, criminal records of adults may not be erased. Nor can news about communicable diseases, etc. be wiped out. Ironically, the landmark case that sparked the regulation remains easily searchable precisely because it led to the regulation.

In practice, search engines delete links while the content itself may remain available. Google claims that it has complied with such requests roughly 45 per cent of the time — of the 845,000 requests that it has received asking for the removal of more than 3.3 million links. It does this by geo-blocking. The links are no longer visible if a search is made on global server Google.com from within the EU. All links are removed from European servers like Google.fr, Google.co.uk, and Google.de. But the links are visible from other regions and they are visible to a EU surfer who uses a VPN to circumvent geographic restriction. The search engine giant appealed an order by the French regulator, CNIL, which demanded that links be removed globally. CNIL also imposed a fine of Euro 100,000. The ECJ has ruled this as overreach saying: “There is no obligation under EU law for a search engine operator who grants a request for de-referencing made by a data subject ... to carry out such a de-referencing on all the versions of its search engine.”

The UK will become a grey zone if Brexit occurs if it doesn't legislate its own version of GDPR. Many other non-EU nations are legislating their versions of GDPR. Such legislation will be uneven since it is driven by regimes and constitutions, which vary in the priority allotted to privacy and free speech. Assuming this ECJ judgment is foundational, there may be a situation where geoblocks with regard to the right to forget are selectively applied in many regions. The embarrassing information will remain searchable from servers and IP addresses in other jurisdictions. This will lead to a delicate balance between privacy and free expression. India could be a global test case. It has a vast, growing population of Netizens. The Supreme Court affirmed privacy as a fundamental right but the government has not come up with specific privacy legislation in the two years since that judgment. The draft privacy legislation by the Srikrishna Committee doesn't include a Right to Forget. At the same time, vast numbers of sites are geoblocked in India, on the request of government agencies and under court orders granted to companies and individuals. How India chooses to prioritise privacy and free expression will affect the internet experience of hundreds of millions.