Yet Another Google Case: The right to privacy versus the freedom of expression.

The Court of Justice of the European Union (CJEU) has backed the "right to be forgotten", telling Google to delete personal data from its search results when a member of the public requests it. This landmark ruling was heavily debated on the web: what are the effects on freedom of expression? Does it open the door to censorship?

The case concerns a Spanish citizen whose name appeared in announcements in a Catalonian newspaper for a real-estate auction for the recovery of his social security debts. When searching for him on the web years later, Google still returned links to those announcements. (If you Google for him now, you will only find pointers to sites discussing this case ;-). The man requested that Google remove these results when searching for him. The CJEU has ruled that Google should honour this request. (The man also requested the original newspaper publications to be deleted. This request was however already denied by the Spanish data protection authority, that originally received the request, because "publication by it of the information in question was legally justified as it took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction in order to secure as many bidders as possible.".)

The ruling is interesting for three reasons. First, the court establishes (again) that search engines are not neutral intermediaries, but should be considered data controllers in the context of the European data protection regime. This means they are only allowed to process personal data in accordance with these laws. Second, it ruled that Google is subject to European law in this case. Even though its headquarters are in the U.S., it has an official establishment in Spain. Third, and perhaps a bit surprisingly, the court rules that even in the current legal framework people have some right to be forgotten.

I will focus on the first point though, as it reignited the debate between the right to privacy versus the freedom of expression, and reraised concerns about facilitating censorship. The ruling of the Court of Justice of the European Union for example diametrically opposes a 1997 US Supreme Court saying that "[t]he interest in encouraging freedom of expression in a democratic society outweighs any theoretical but unproven benefit of censorship." The Supreme Court compared the Internet with a vast library. If the web is a library, and Google the index, is the CJEU crippling the web by putting restrictions on its index?

To be clear, the right to freedom of expression is not restricted to cover only the right to express oneself. It also includes a right to receive information, and impart information received by others. The freedom of expression therefore prevents the state to interfere with the media, and guarantees a free press. This is important because a right to 'send' information is useless if there is not a corresponding right to 'transport' and 'receive' that information. (See also this commentary.) However, the right to freedom of expression carries duties and responsibilities, including the requirement to respect the right of others. This is where the right to privacy interferes with the right to freedom of expression.

How does this all apply to a search engine? Let's look at this from a few different perspectives.

Let's look at the press first. Journalists provide us with a continuous stream of fresh news and dig up background information that would otherwise be hard to find. Freshness of the information makes it news, and worth our while. A newspaper planning to run the same story on its front page for (say) a year would probably be out of business before that year ends. But if it would manage to pull it off, and if that (true) story would happen to be aimed at a particular person, at some point the mission to inform the public starts to become a mission to hurt that particular person.

This is where a search engine differs from the press: it serves the same old information about you to me on its homepage, whenever I search for you. The search engine may provide me with more recent information first. Its algorithms may instead choose to always show that particular story about you as the first result. In that sense, to compare a search engine like Google with an index in a library is a bit misleading. A search engine is not neutral. It tunes the search results on what it believes is most appropriate for me. This not only depends on the keywords I choose to search for, but also my past search history, my preferences, and the search history of others, and in general page popularity (determined by page ranking and what have you).

Taking an entirely different perspective, I do not expect my freedom of expression to allow me to follow you all day with a banner carried by a drone, revealing your past (true) history to anybody meeting you in the street. Neither would I expect it to allow me to tweet that information every day to all your friends. (I know, these analogies are not perfect; what would become closest is a system that would allow me to stick a message to your forehead that you cannot remove.)

Does the ruling of the court lead to censorship? The right to freedom of expression is primarily aimed at shielding members in society (whether the are individuals, or organisations) from state interference. This is not what this ruling is about. This ruling aims to give individuals a means to control the flow of their personal information. Compared to censorship we are talking about totally different power dynamics here.

Yet another perspective is the conflict between the protection of copyright (instead of privacy) versus the freedom of expression. In the Netherlands we've had courts ruling that ISPs should block access to the Pirate Bay, which served as an index to (not even the actual provider of) illegally provided copyrighted material. This is an extreme measure, and one that didn't work at all because it turned out to be trivial to circumvent the block. And this points us to a crucial difference between protecting copyright and protecting privacy. To protect copyright one must ensure that a dedicated person looking for a particular piece of copyrighted material is prevented from obtaining it. Moreover, the original source is in itself illegal and can be targeted by separate legal action. To protect privacy on the other hand, the point is not to prevent a dedicated person from finding a particular piece of information in the public domain. The point is rather to prevent a third party (Google in this case) to decide that a particular piece of personal information will always be associated with you. Moreover, the original source itself is legal. Finally observe that in the case of copyright infringements typically (in the context of search engines at least) the infringement is done by an individual trying to find copyrighted material. In the case of privacy invasions, the infringement is done by the search engine. So the power balance is reversed.

Therefore something the ruling does not discuss, but which I think is highly relevant in this case, is the question what someone is searching for. If I am searching for arbitrary information about you (say I only enter your name), then if the search engine consistently returns the same old information as a first hit, I think you have the right to take issue with the results and question their relevance and appropriateness. Given the power and ubiquity of search engines, they have a very strong influence on how your identity is perceived by others. If, on the other hand, I am specifically searching for information about say your past business transactions, then you should not be able to stop the search engine from allowing me to find it.

Some argue that Google should not be made the arbiter for these decisions, i.e. deciding whether showing a certain search result is a privacy invasion or not. But I think this misses the point. Google choose to offer a service that processes personal data. Because of that, it needs to respect data protection law. Unfortunately laws, and especially data protection law, is susceptible to interpretation. (This is why law firms make a good living.) Offering a service that allows people to search personal data happens to touch a particularly fuzzy area of data protection law. Nevertheless, Google will have to think about how to respect the right to privacy when offering this service. Like any other company processing personal data. A good first step is to take complaints by individuals seriously. (It happily does so when it gets complaints about copyrights.) Second, Google needs to design its search algorithms in such a way that they protect privacy, ensuring it receives few complaints. Privacy is simply another parameter against which their algorithms need to be tuned. It would be even better if they could convince independent third parties their algorithms respect privacy. And in the end the judge is the arbiter deciding whether Google was right or wrong dealing with a particular case.