In 2010, Mario Costeja González, a Spanish citizen, filed a complaint with the Spanish Data Protection Authority against Google and La Vanguardia Ediciones, a Spanish newspaper. González said that a Google search for his name returned classified ads showing that his house was being auctioned off in order to repay his family’s debts. González said that these ads were more than a decade out of date and argued that their appearance in a Google search violated his right to privacy. A lower court ruled in his favor; the matter was then referred to the European Union’s Court of Justice, or ECJ, which, in 2014, also sided with González. The ECJ decided that a right to be forgotten—also known as the “right of erasure”—was implied by the Data Protection Directive, a 1995 EU rule, and that this gave EU citizens a right to the rectification, erasure, or blocking of their personal data, as well as a right to object to the processing of their personal data by corporations for a number of reasons.
In 2018, the EU’s General Data Protection Regulation took effect, superseding the Data Protection Directive. Article 17 of the GDPR outlines how and when the right to be forgotten should be applied, stating that people may request the removal of their personal information when the information is no longer relevant to the purpose for which it was collected, when the individual withdraws their consent to the information’s publication, and when there is no overriding legitimate interest to process the information, among other circumstances. The EU has stated that the GDPR’s right to be forgotten is “not an absolute right,” and is “much more complicated than an individual simply requesting that an organization erase their personal data”; the right might not apply, for example, in cases involving the right to freedom of expression, compliance with a legal ruling, or the public interest. But critics have argued that this kind of complexity is too great for search-engine companies to be expected—or allowed—to navigate on their own. And they have often argued that the right to be forgotten ultimately amounts to censorship.
The EU’s rules only endow citizens of EU member states with the right to be forgotten, but the duty to remove content if an EU citizen makes such a requests applies to global search engines and services, even if the data is kept on servers that are located elsewhere. Within days of the ECJ ruling, Google and Microsoft began fielding thousands of requests from users who wanted to have their personal information removed from those search engines; in March of this year, Forbes reported that Google and Bing, a search engine owned by Microsoft, received more than a million such requests between 2015 and 2021, with cases rising dramatically during the pandemic. Surfshark, a data-tracking service, told Forbes that half of these requests came from users in western Europe; France accounted for nearly a quarter of the total, while Estonia had the most per capita. German users submitted requests equivalent to 17 percent of the total, while requests from the UK made up 12 percent.
Continue reading “The EU’s right to be forgotten is migrating to other countries”