Google Wins Key “Right to be Forgotten” Ruling
- Paul Thurrott
- Sep 24, 2019
-
37
The European Court of Justice ruled that the EU’s “right to be forgotten” rule cannot be enforced outside of Europe, a key victory for Google.
“There is no obligation under EU law, for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine,” the ruling notes. “EU law … also does not prohibit such a practice.”
Windows Intelligence In Your Inbox
Sign up for our new free newsletter to get three time-saving tips each Friday — and get free copies of Paul Thurrott's Windows 11 and Windows 10 Field Guides (normally $9.99) as a special welcome gift!
"*" indicates required fields
As you may recall, the “right to be forgotten” drama dates back to 2010, when a Spanish citizen complained that the publication of details of his home prepossession in Google search results violated his privacy rights. The Spanish courts eventually referred the case to the European Court of Justice, which ruled in May 2014 that the EU’s Data Protection Directive applied to this case and that Google and other search engine providers that operated in EU member states would need to remove privacy-invasive search results when requested.
Essentially, EU citizens have the right to be forgotten when the information published about them is inaccurate, inadequate, irrelevant or excessive. But the Court also ruled that right to be forgotten was not absolute, and that it needed to be balanced against other rights, including the freedoms of expression and the media.
Google has since removed many millions of URLs from search results based on privacy requests. But left unanswered was whether this right extended beyond the boundaries of the EU. Google and many outside the EU argued it did not; many privacy advocates argued that they did and should. (My position is that this rule is fundamental to privacy and should be applied worldwide, not that it matters.)
But now we have a ruling: The EU “right to be forgotten” does not apply outside the EU.
“Since 2014, we’ve worked hard to implement the right to be forgotten in Europe, and to strike a sensible balance between people’s rights of access to information and privacy,” a Google statement reads. “It’s good to see that the Court agreed with our arguments.”
Tagged with
Conversation 37 comments
-
Stooks
Log in to Reply<p>Google is loved more and more each day!</p>
-
ajgisler
Log in to Reply<p>Good. The law is dumb and violates peoples right to freedom of speech and freedom of the press. </p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470185">In reply to ajgisler:</a></em></blockquote><p>No it doesn't.</p><p>It does not violate the right to free speech (in fact, there is no right to free speech in law in most countries) and it is exactly because the freedom of the press cannot be violated that the law exists.</p><p>The paper that published the original article is public record and the article cannot be removed.</p><p>But it is illegal for a credit institute, for example, to look at the article and reject a loan based on it, because his insolvency expired nearly 20 years ago. Therefore doing a search on a search machine should not return the article, when searching for the person by name or name + "repossession", for example. Searching for the newspaper, searching for repossessions at that time etc. <em>without</em> the person's name in the search would return the original article, as would going directly to the paper's site and digging through their archive.</p><p>This is supposed to be the internet equivalent of the traditional model of newspapers, while the information is valid (i.e. the time it is printed), it is quick to find (buy a paper on the news stand). 10 years later, when it is no longer relevant (or it would be illegal to use the information against someone), it would be difficult to find the article, you would need to go to the local library and dig through their archives (on microfiche or microfilm, if you are lucky) or you go direct to the newspaper and search their archives.</p><p>The problem is, search engines don't work on whether the information has legally "expired", the information is in the index, so it is returned, unless someone tells the search engine that that piece of information, in combination with a person's name should not be returned.</p><p>Take a more serious and hypothetical example, you are accused of murder and arrested. Front page news in all the papers. A week later, you are acquitted and it is somewhere in the middle of the paper, no front page news. Not good, but normal… Now fast forward 10 years and you try and get a new job, the employer does a search and the first thing that is returned on your name is that you were arrested for murder. The acquittal appears on the 10th search page. You are refused the job, because you are a "murderer".</p><p>If you can tell Google to not return the links to the murder charge, because they are now irrelevant – you were released without charge – when someone enters ajgisler or ajgisler + murder, you have a better chance of getting that job.</p><p><em>However</em> if someone searches for the victim's name, they will still see the headline where you are arrested. So a researcher looking into the murder will find the information, someone doing a quick profile search on ajgisler won't get the irrelevant information back.</p><p>That is very different from violating freedom of speech or freedom of the press.</p>
-
ajgisler
Log in to Reply<blockquote><em><a href="#470200">In reply to wright_is:</a></em></blockquote><p>This is where we will really disagree. I think it should be legal for a credit institute to deny you a loan for any reason they chose. An employer to not give you a job for any reason they believe. You have no right to a loan, or a job. Its not your money or your job. </p><p><br></p><p>Don't forget freedom of speech is not just about the right to speak but also the right to listen or in this case read. More importantly websites and search providers has the right to run their business however they want. </p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470245">In reply to ajgisler:</a></em></blockquote><p>But in Europe the law says that if you have claimed insolvency, for example, after a specific period of time a credit institute cannot legally take that into account, once a set period of time has elapsed. They can refuse the loan for other reasons, but not for information that was "illegally" gathered.</p><p>Likewise, not getting a job because of a newspaper misreporting your guilt or innocence is a gross miscarriage of justice. You are not guilty of anything, were never guilty of anything, the prospective employer made his decision based on invalid information. If he went to the courts and looked through public records and found you were found guilty, fine. Googling an inaccurate report, no!</p><p>I agree, you have no right to a job, but you shouldn't be refused a job because of a crime you didn't commit.</p><p>And, again, freedom of speech is not affected here. If you really want to go and read that information, you can. It is still there if you go to the source website and it is still searchable, using alternate keywords.</p>
-
geschinger
Premium MemberLog in to Reply<blockquote><em><a href="#470246">In reply to wright_is:</a></em></blockquote><p><br></p><p>Look at a similar example from the alternative context. If I'm a writer and wrote a fantastic article about the case and how this hypothetical person was wrongly accused why should anyone have the right to disappear my article from the Google index if everything in my article was/is accurate? </p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470425">In reply to geschinger:</a></em></blockquote><p>Your article isn't affected, directly. Unless it is defamatory and the target can get it taken down by a court for those reasons, nobody can stop you publishing it (there are things like anti-hate speech rules that could affect it, but they are outside the scope of this discussion).</p><p>The limit is that, because the article is now so old that it is no longer <em>legally</em> relevant, it should not be indexed on a search machine using the name of the person or persons named in the article.</p><p>You can still navigate to the article, you can still search for the article using other keywords, just not the names of the people for whom it is no longer legally relevant.</p>
-
ajgisler
Log in to Reply<blockquote><em><a href="#470246">In reply to wright_is:</a></em></blockquote><p><br></p><p>"But in Europe the law says that if you have claimed insolvency, for example, after a specific period of time a credit institute cannot legally take that into account, once a set period of time has elapsed. They can refuse the loan for other reasons, but not for information that was "illegally" gathered." </p><p><br></p><p>I agree this is probably the law. My point was that I believe credit institutions should be able to take into account whatever they want. Even false information. </p><p><br></p><p>"Likewise, not getting a job because of a newspaper misreporting your guilt or innocence is a gross miscarriage of justice." </p><p><br></p><p>Its not a miscarriage of justice, since it had nothing to do with the courts. </p><p><br></p><p>I agree its all unfair to the individual who may be in the situation but I think Google, businesses and financial institutions have a right to not be told what content is searchable, and their hiring practices etc. </p><p><br></p><p>"It is still there if you go to the source website and it is still searchable, using alternate keywords. "</p><p><br></p><p>Sounds like a chilling of speech to me. So does Charles Manson, Ted Bundy and Bernie Maidoff have a right to be forgotten? </p>
-
sandy
Log in to Reply<blockquote><em><a href="#470483">In reply to ajgisler:</a></em></blockquote><p><br></p><p><em>… I think Google, businesses and financial institutions have a right to not be told what content is searchable, and their hiring practices etc.</em></p><p><br></p><p>It sounds like you're saying it's fine for employers to discriminate on the basis of race, sexual preference, etc?</p><p><br></p><p><span style="background-color: rgb(255, 255, 255);">Law is imperfect, but this one is well meaning.</span></p><p>Either courts order removal of the original article (such as a false report on a news site), but that isn't always possible as the original (wrong) information is not within the court's jurisdiction, or as in this case removal would violate another law, so another remedy had to be found, and so while this compromise isn't perfect, it appears to be, on-balance, good.</p><p><br></p><p>Now if only other countries (outside the EU) would match these human rights laws.</p>
-
wright_is
Premium MemberLog in to Reply<blockquote><a href="#470483"><em>In reply to ajgisler:</em></a></blockquote><blockquote>Sounds like a chilling of speech to me. So does Charles Manson, Ted Bundy and Bernie Maidoff have a right to be forgotten?</blockquote><p>No, they aren't EU citizens and their crimes weren't carried out in the EU, US laws apply.</p>
-
hrlngrv
Premium MemberLog in to Reply<p><a href="https://www.thurrott.com/google/217221/google-wins-key-right-to-be-forgotten-ruling#470246" target="_blank"><em>In reply to wright_is:</em></a></p><blockquote>But in Europe the law says that if you have claimed insolvency, for example, after a specific period of time a credit institute cannot legally take that into account, once a set period of time has elapsed.</blockquote><p>Insolvency in Europe would seem to mean bankruptcy in the US.</p><p>If a law stated that anyone's financial condition from N years ago couldn't be used in current credit ratings, that should be sufficient without prohibiting web search results from displaying search results mentioning financial problems older than N years.</p><p>As for newspapers incorrectly reporting someone as guilty when they were in fact acquitted of charges would be libel if those newspapers were unwilling to publish retractions and corrections. Falsely reporting someone acquitted when they were actually guilty wouldn't seem to be harmful to that individual unless they wanted a job in organized crime.</p><p>In short, the US and EU have very different notions about free speech vs privacy. For the US, it's not much of an overstatement to describe the status quo as <em>privacy? what's that?</em></p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470560">In reply to hrlngrv:</a></em></blockquote><blockquote>As for newspapers incorrectly reporting someone as guilty when they were in fact acquitted of charges would be libel if those newspapers were unwilling to publish retractions and corrections.</blockquote><p>Sorry, poorly worded on my part. Go back to my expample, what I actually meant is you were arrested (reported) and released without charge (not newsworthy), so if someone searches for your name, they get that you were arrested, but the information that you were released without charge either doesn't appear or is relegated to page 10, because it isn't "interesting".</p><p>The laws is Europe do state that credit institutes shouldn't use this information, landlords and employers etc. as well, but if it is the first thing that crops up when you search for the person's name (and that was the case in this instance, Google put a 20 year old bankruptcy as more relevant than anything positive the guy had done in the last 10 years, after rebuilding his life), can you un-see it?</p><p>Also, a lot of web sites don't display the date that the report was published, so it is difficult to tell if the report has legally expired or not, without digging deeper. If it is the first result on Google and it doesn't have a publish date, I'd assume it is the most current information.</p>
-
stvbnsn
Premium MemberLog in to Reply<blockquote><em><a href="#470581">In reply to wright_is:</a></em></blockquote><p>NY Times did a story just days ago about how that’s not true. <span style="background-color: rgb(255, 255, 255); color: rgb(51, 51, 51);">Vittorio Pecoraro got a news website shut down because he just wanted the story about his brother stabbing him in an argument erased from the universe. Now I think a person known to stab people in the heat of arguments is pretty newsworthy, the Italian court fined the news sites for non-compliance and the ECHR refuses to hear the appeal. Now the site has folded, you may believe that this “right” is principled and high-minded, in action it’s just a way to vanish things you want to hide and deceive people about. </span></p>
-
mikes_infl
Log in to Reply<blockquote><em><a href="#470200">In reply to wright_is:</a></em></blockquote><p>Thanks for your reply. I was trying to find out why information about a "preposession" was illegal in Spain. You saved me the trouble of trying to figure out how to google that one.</p>
-
wright_is
Premium MemberLog in to Reply<p>This was pretty obvious. It is a shame it had to go to court. But at least the question is now answered.</p><p>To be clear the "irrelevant" part is the part in question for the Spanish case. Under Spanish law, the judgement for repossession had expired and it would be unlawful for it to be used when judging creditworthiness.</p><p>The original newspaper story cannot be removed as it is public record, but references to it from search engines, for example, can be removed for specific keywords (such as the person's name or their name in connection with a repossession), but it would still be available for other criteria (such as repossession in general, or repossession in combination with the town name).</p><p>When the ruling was first made, Google was very obtuse about it, having a special page listing all of the removed entries (illegal under the ruling) and removing all references to the destination, regardless of the search criteria (overreaction).</p><p>Hopefully they have calmed down and are doing things properly now.</p>
-
txag
Log in to Reply<blockquote><em><a href="#470191">In reply to wright_is:</a></em></blockquote><p>Google, doing things properly? You are an optimist.</p>
-
MikeGalos
Log in to Reply<p>Which was a given seeing that it was just a question of jurisdiction. </p><p>In other "key decisions", Seattle city ordinances don't apply in Nepal.</p><p><br></p>
-
Daekar
Log in to Reply<p>This is a victory for common sense, the EU ruled rightly. If other sovereign entities want that kind of protection, they need to pass their own legislation.</p>
-
Stooks
Log in to Reply<blockquote><em><a href="#470262">In reply to Daekar:</a></em></blockquote><p>Agreed. Now the US needs to pass the same law and have it apply to Google and all social media platforms.</p>
-
hrlngrv
Premium MemberLog in to Reply<p><a href="https://www.thurrott.com/google/217221/google-wins-key-right-to-be-forgotten-ruling#470320" target="_blank"><em>In reply to Stooks:</em></a></p><p>I'm not a lawyer, but I figure the US Constitution's 1st Amendment precludes ANY RESTRICTIONS on 'speech' which isn't slanderous or libelous. That is, ANYTHING which were true or for which a reasonable person would consider true can be spoken or published. IOW, I figure the <em>right to be forgotten</em> is unconstitutional in the US.</p>
-
minke
Log in to Reply<p>The big picture is that laws created in and for the EU should not apply to the entire world.</p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470380">In reply to Minke:</a></em></blockquote><p>Try telling America that, they constantly try to imply that their laws take priority over the rest of the world. </p>
-
hrlngrv
Premium MemberLog in to Reply<p><a href="https://www.thurrott.com/google/217221/google-wins-key-right-to-be-forgotten-ruling#470407" target="_blank"><em>In reply to wright_is:</em></a></p><p>It's a <strong><em>BAD</em></strong> when the US does it. Not an excuse for the EU.</p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470553">In reply to hrlngrv:</a></em></blockquote><p>Exactly. And this is exactly what the EU decision says.</p>
-
waethorn
Log in to Reply<p>If this is so, why is GDPR enforced so vehemently outside of the EU?</p>
-
MikeGalos
Log in to Reply<blockquote><em><a href="#470453">In reply to Waethorn:</a></em></blockquote><p>Laziness and profits. It's easier and cheaper to have one code base to write and maintain. The ONLY time you won't see things "enforced" globally is where there's a cost to the ruling that the company cares enough about to write and maintain a second version. </p><p>Google makes enough off this issue to make it worth having a second code base. Having a notice that you use cookies and storing the user saying "OK" in a cookie isn't worth a second code base.</p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470520">In reply to MikeGalos:</a></em></blockquote><p>You also forgot, as long as the fines remain below the cost of actually writing that second code base, they will throw lawyers at the problem, until that costs more than actually doing what they are supposed to do. ;-)</p>
-
sandy
Log in to Reply<blockquote><em><a href="#470453">In reply to Waethorn:</a></em></blockquote><p>I believe GDPR is written so it applies to all EU citizens regardless of where physically the citizen is (companies/organisations which operate in the EU and/or provide services to EU citizens still have to comply with the GDPR), so for example just because a Frenchman is visiting Australia doesn't mean Google, Facebook, Amazon, etc. can violate that person's rights while they happen to be outside the EU.</p><p><br></p><p>Oh and of course it's easier to program in a single (most restrictive) set of rules/behaviours globally to avoid accidentally breaching GDPR (or other similar rules).</p>
-
MikeGalos
Log in to Reply<blockquote><em><a href="#470537">In reply to Sandy:</a></em></blockquote><p>Laws follow the jurisdiction. That's why there's a need for diplomatic immunity and extradition. You can write a law pretending it applies outside your jurisdiction all you like. It doesn't.</p><p><br></p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470537">In reply to Sandy:</a></em></blockquote><p>Partly. If the EU citizen is abroad, then the local laws also apply. </p><p>What is more important is that anybody storing or processing information related to an EU citizen is automatically affected by GDPR. It is their data that is the important factor.</p><p>If they are anonymously surfing in a Café in Australia, nobody knows that they are an EU citizen, so GDPR can't be enforced.</p><p>If they are surfing from within the EU, or they provide information that defines them as being an EU citizen, then the GDPR applies to the data collected, processed and held after that point.</p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470453">In reply to Waethorn:</a></em></blockquote><p>GDPR only affects and protects EU citizens. But it protects them from data processors, even if those data processors are located extra-territorially. It was specifically designed to get around the usual evasion of saying ah, but our data is not stored in the EU.</p><p>No, the data isn't stored in the EU, but it is information about an EU citizen and they are the ones protected by GDPR, so any company doing business or providing services to EU citizens has to comply. It is the same as if I do business in the USA, I have to abide by US laws for all business carried out in the USA or with US citizens or businesses.</p><p>It is a part of the whole Globalization thing. You want to act globally, that means you have to take responsibility globally.</p><p>The biggest problem, in the tech industry, is that many US, especially West Coast and even more specifically Silicon Valley based companies seem to think that US laws are beneath them, let alone international laws for where they carry out their business.</p><p>The US Government also seems to be going down the route of our laws trump local laws where our companies do business (CLOUD Act, Patriot Act etc.). "You have data on EU citizens stored in Ireland, beholden to Irish and EU data protection law? Yeah, about that, we don't care, you go break those laws and give us the data or you go to prison!"</p><p>US companies now face fines or prison if they move the data outside of Europe and they face fines or prison if they don't move it outside of Europe and hand it over to US authorities… It just doesn't make sense, at the moment, to use any services that have any ties to the USA, especially as an EU business, having your data on a US owned cloud means you no longer have control over your data and the cloud provider can be forced to hand it over to the US authorities and you, as the EU business will face huge fines and possible prison time for their actions.</p><p>For individuals, it is often more of a convinience factor. I subscribe to Thurrott, because I find it useful, but I am theoretically putting myself at risk of having my rights violated by the US Government.</p>
-
Ekim
Premium MemberLog in to Reply<p>Whatever happened to "do no evil"? </p>
-
stvbnsn
Premium MemberLog in to Reply<blockquote><em><a href="#470477">In reply to Ekim:</a></em></blockquote><p>You mean like repressing Google's freedom of expression to index and share all of the world's information? We value freedom of expression in the United States, and this right to be forgotten severely undermines that fundamental cornerstone of our society. </p>
-
Vladimir Carli
Premium MemberLog in to Reply<blockquote><em><a href="#470478">In reply to stvbnsn:</a></em></blockquote><p><br></p><p>interesting… a right that is a cornerstone of a society and at the same time violates basic human rights</p>
-
stvbnsn
Premium MemberLog in to Reply<blockquote><em><a href="#470532">In reply to Vladimir:</a></em></blockquote><p>Human rights? Or I guess to just delete things you think are inconvenient. I just finished reading a story from The NY Times about an Italian news site that had to shut down because a man, was stabbed by his brother in an argument, wanted the news story deleted and the Italian court agreed with him, and fined the news site. Right to be forgotten is just a nice name for a memory hole, it’s literally not a human right to force people to not remember or know about your past mistakes. </p>
-
smartin
Premium MemberLog in to Reply<p>I'm glad the EU has recognized this. However, I still side with Google and the First Amendment. If you have had bad press in the past, it isn't up to Google to hide your indiscretions, or crimes. Sweeping your shite under the rug doesn't make the world a better place, and the entire EU stance on this is Orwellian.</p>
-
wright_is
Premium MemberLog in to Reply<blockquote><em><a href="#470513">In reply to smartin:</a></em></blockquote><p>There is no First Amendment outside of the USA… ;-)</p><p>This is also not necessarily about sweeping past indiscretions under the rug – in fact most such cases usually get thrown out of EU courts – it is about when the law decides that your previous actions are no longer legally relevant and <em>must not be used in making future decions</em>.</p><p>There are also exceptions for politicians, celebrities etc. who are of "public interest".</p>