In 2010, Mario Costeja González, a Spanish citizen, filed a complaint with the Spanish Data Protection Authority against Google and La Vanguardia Ediciones, a Spanish newspaper. González said that a Google search for his name returned classified ads showing that his house was being auctioned off in order to repay his family’s debts. González said that these ads were more than a decade out of date and argued that their appearance in a Google search violated his right to privacy. A lower court ruled in his favor; the matter was then referred to the European Union’s Court of Justice, or ECJ, which, in 2014, also sided with González. The ECJ decided that a right to be forgotten—also known as the “right of erasure”—was implied by the Data Protection Directive, a 1995 EU rule, and that this gave EU citizens a right to the rectification, erasure, or blocking of their personal data, as well as a right to object to the processing of their personal data by corporations for a number of reasons.
In 2018, the EU’s General Data Protection Regulation took effect, superseding the Data Protection Directive. Article 17 of the GDPR outlines how and when the right to be forgotten should be applied, stating that people may request the removal of their personal information when the information is no longer relevant to the purpose for which it was collected, when the individual withdraws their consent to the information’s publication, and when there is no overriding legitimate interest to process the information, among other circumstances. The EU has stated that the GDPR’s right to be forgotten is “not an absolute right,” and is “much more complicated than an individual simply requesting that an organization erase their personal data”; the right might not apply, for example, in cases involving the right to freedom of expression, compliance with a legal ruling, or the public interest. But critics have argued that this kind of complexity is too great for search-engine companies to be expected—or allowed—to navigate on their own. And they have often argued that the right to be forgotten ultimately amounts to censorship.
The EU’s rules only endow citizens of EU member states with the right to be forgotten, but the duty to remove content if an EU citizen makes such a requests applies to global search engines and services, even if the data is kept on servers that are located elsewhere. Within days of the ECJ ruling, Google and Microsoft began fielding thousands of requests from users who wanted to have their personal information removed from those search engines; in March of this year, Forbes reported that Google and Bing, a search engine owned by Microsoft, received more than a million such requests between 2015 and 2021, with cases rising dramatically during the pandemic. Surfshark, a data-tracking service, told Forbes that half of these requests came from users in western Europe; France accounted for nearly a quarter of the total, while Estonia had the most per capita. German users submitted requests equivalent to 17 percent of the total, while requests from the UK made up 12 percent.
Note: This was originally published as the daily newsletter for the Columbia Journalism Review, where I am the chief digital writer
Since the ECJ’s ruling in 2014, meanwhile, a number of governments outside the bloc have considered creating their own right to be forgotten, often driven by what they see as a similar interest in protecting the privacy and personal information of their citizens. Recently, Canada has taken preliminary steps in this direction. In 2017, a man (whose personal details have not been released) complained to the federal Privacy Commissioner about outdated and inaccurate information that he said appeared in newspaper articles found in a Google search for his name. The man said that this information had led to employment discrimination, social stigma, and a fear of being physically attacked. The Privacy Commissioner asked the Federal Court of Appeal to rule on whether Google is subject to the Personal Information Protection and Electronic Documents Act, Canada’s privacy law.
Last week, the court found that Google is covered by this law, and rejected the company’s defense that it should be exempt because its services are journalistic in nature. Google argued that it acted as an intermediary between publishers and their audiences, in much the same way that libraries or newsstands do, and that restricting its ability to perform this function would render the privacy legislation’s exemption for journalism ineffective. News organizations such as the Globe and Mail, the Toronto Star, Postmedia, and the Canadian Broadcasting Corporation filed statements arguing that Google plays an important role in distributing news, but the court ruled that these were not relevant to the case. Justice John Laskin, writing for the majority, ruled that Google’s search engine doesn’t “collect, use, or disclose personal information for a journalistic purpose and, even if it does, it does not do so solely for that purpose.”
The decision did not exactly create a right to be forgotten in Canada. The country’s privacy law does not offer a clear-cut right to have content removed, but individuals can appeal to the principles of accuracy and appropriateness, which are protected by the law. As Aird Berlis, a Canadian law firm, explains, the accuracy principle requires personal information to be accurate, complete, and as up-to-date as possible. This is “a contextual determination that accounts for the interests of the individual, who has the right to challenge the accuracy and completeness of their information,” the firm writes, adding that “old and outdated information that is no longer true or reflective of a person’s current situation can hardly be claimed to be accurate, complete, and up-to-date.” As for appropriateness, Aird Berlis notes that any information that causes significant harm to the individual “may fail this principle.”
Again, one criticism of the GDPR in general, and the right to be forgotten in particular, has been that removing content from the web conflicts with freedom of speech. This argument has particular resonance not only in the US, with its First Amendment, but also in Canada, where the federal Charter of Rights and Freedoms protects the right to freedom of speech. In his ruling, Justice Larkin pointed out that the court’s analysis was specifically focused on whether privacy laws applied to Google, and did not address the question of free speech. Michael Fenrick, co-counsel for the unnamed complainant, told the Globe and Mail that his client was not arguing that people should have “an automatic right” to have their information removed, and that it has to be a “case-by-case balancing between the public’s right to know and privacy.”
While it may not have single-handedly created a right to be forgotten, however, the court’s decision appears to have increased the likelihood that Canada will decide to officially create such a right. In 2018, the Privacy Commissioner published a draft position suggesting that existing privacy law may allow Canadians to require search-engine operators and other commercial organizations to de-index results associated with their names in certain cases, and a new draft report, published after the recent court ruling, doubled down on this idea. And, if the federal government does decide to protect the right to be forgotten with a specific law, the Charter of Rights and Freedoms wouldn’t necessarily prove a roadblock, since the document’s “notwithstanding clause” allows Canada’s Parliament to pass laws even if they conflict with a section of the Charter. The province of Quebec already has a law that offers a right to be forgotten; it went into effect last month.
And Canada isn’t the only non-European country that is looking at either implementing or enforcing a right to be forgotten. Australia is also said to be working on privacy legislation that could include a similar right; in January, The Guardian reported that Mark Dreyfus, the attorney-general, indicated that the right to be forgotten “will be considered for the next tranche of Australian legislation.” (After reviewing the existing Privacy Act, Dreyfus concluded that it was “out of date and not fit-for-purpose in our digital age,” he said.) Argentina and India also have versions of the right to be forgotten, and France has had its own droit à l’oubli since a law to that effect was enacted in 2010.
The GDPR, of course, doesn’t apply to the US, and the First Amendment would seem to be a significant hurdle to introducing a legal right to be forgotten. But some US news organizations have started offering a version of this right of their own accord, particularly in the realm of criminal justice. This year, the Chicago Sun-Times introduced a right to be forgotten policy, saying that it isn’t fair “for stories about arrests to follow people around forever if they were never convicted—or if charges were dropped, dismissed, reversed or expunged”; leaving such stories online, the paper said, could lead to lasting negative impacts for their subjects, such as “unsteady employment, a lack of housing access or other issues.” In 2021, the Boston Globe announced what it called the Fresh Start Initiative, which it said would allow subjects of news stories to appeal to have the stories removed from Google searches or anonymized. “We are not in the business of rewriting the past, but we don’t want to stand in the way of a regular person’s ability to craft their future,” the paper said.
These kinds of policies, while increasingly prevalent, are not the norm, however. In 2021, Linda Kinstler wrote for CJR about the murky practice of removing names and even entire articles from newspaper databases—in some cases because of court rulings, but also for other reasons, and often without notice. Deborah Dwyer, a journalism researcher cited by Kinstler, found that “every news outlet in America seemed to have its own bespoke, often improvised way of handling take-down requests; some quietly deleted names or even entire articles from their websites, going much further than even their European peers; others refused to consider requests at all.” Critics may argue that the EU law oversteps the mark and is too vaguely worded. But having an actual law with specific requirements and a clear process may be preferable to the patchwork of practices that result when news organizations are left to their own devices.
Likes