Aiming to save privacy, jeopardizing freedom of speech: The "Right to be forgotten"

Google strives to make every kind of information searchable. A fascinating, and to some somewhat sinister goal. Now, the European Court of Justice has decided that every citizen of the EU has a “Right to be forgotten” that is enforceable against Google (press release, .pdf – En, Ger). Surely, that is for the better, no?

No, it is not. Not at all. Except for one detail: The ECJ ruled that European Privacy laws are applicable to Google’s services offered in the EU, even though it’s incorporated in California. That makes sense. Ok.
Let’s take a closer look at the ECJ’s decision.

No balance

If an individual wishes for links to be removed from the results for a search for their name, Google has to do so. While there are exceptions for public figures, the rule is that privacy trumps freedom of speech and freedom of information. That’s it. There’s no balancing by the ECJ, as there ought to be whenever fundamental values like these collide. That is the most fundamental problem.

Invisible information

A very, very disturbing consequence of that lack of balance is that the ECJ separates information itself from its discoverability. I’ll give an example: An individual requests the removal of a newspaper article about themself. Google complies with the request. The article, on the newspaper’s website, stays online. Technically, the article is still “out there”. The point is that nowadays, what Google doesn’t find also doesn’t exist, as far as the general public is concerned. And the ECJ explicitly knows that.
Just a reminder: We’re talking about perfectly correct and lawful content here. Mr. Masing, judge with the German Constitutional Court, hits the nail on the head: He points out (Ger) (I’m paraphrasing) that in a free society, it would suggest itself that a statement covered by freedom of speech can also be distributed freely.
The ECJ seems to disagree on that very point, arguing with the “effective and complete protection of data subjects”.

One caveat: As soon as your search query doesn’t contain that person’s name, the newspaper article will show up in the results. How do you find information about a person without using their name, though? Managing that will become some sort of “skill” or something along those lines.

Trusting the cat to keep the cream

That’s not the end of it. Google itself is obliged to make the decision about which request to grant. There’s all kinds of problems with this. As just described, the ECJ’s decision bases on the very premise that people won’t find what Google doesn’t list. Hereby, it acknowledges Google’s gatekeeper position to the Internet. Instead of carefully working with this though, the ECJ goes on and hands Google the holy grail: The decision over what information is to be “forgotten” and what information is to be preserved.
You don’t like Google’s power that lies in managing all the information in the world? Better make sure to let them decide which website to remove from search results!

Google’s impossible task

I was part of a small group of law students that visited Google’s in-house counsel here in Germany, shortly after the ruling. He told us that Google definitely doesn’t want the burden of having to make these decisions. Not only because it costs them a ton of money, but also because Google aims to make information available instead of doing the opposite, so the very idea to selectively de-list websites repulses them. But of course they would comply with the law. It was also said that Google, in case of doubt, would risk litigation in the name of freedom of speech.
Whether or not you believe all parts of that statement: They don’t want the burden of the process, that’s for sure. They are puzzled, and rightfully so, since the ECJ didn’t give too much guidance on how to make these decisions. Google simply isn’t capable (and really nobody would be) of making tough decisions like these with a lack of information about the specific case – on a massive scale, let’s not forget that.

So, to somehow deal with this appropriately, Google seems to want to assemble some form of “council” to come up with some rules for the decision process. Now, it is understandable that Google wants to show that they’re on top of this.
The problem is that any body of people picked by Google will always lack democratic legitimization. If this is to be “proper” co-regulation, there have to be requirements for the regulation process. Coming up with those would be the European legislator’s task, not that of a group of people assembled by Google, however qualified they might be. The ECJ also misses the opportunity to lay these requirements out.
Getting privacy advocates into the process also wouldn’t work. There is a danger of them becoming “Communication regulation Agencies”, as Masing puts it (Ger).

In case you’re in doubt that the current model can’t work: We’ve already seen how it works out. Google de-lists specific search results, in compliance with the judgment. Then the Guardian complains about Google not making the right call, playing the censorship card, and legitimately so. Google reverses its decision, also justifiably.
Nobody could blame Google for defaulting to make the decisions so that there’s the least complaints, meaning granting all requests except the ones demanding de-listing of a Wikipedia page or a newspaper article. There’s some hope that there will be litigation at some point, resulting from Google not complying with a removal request (or defending a specific de-listing, but I honestly think the other way around is much more likely). That means trusting Google with going to court in the name of the freedom of speech. I’m not entirely convinced that’s what the ECJ intended.

Privacy who?

A side note: This is supposed to be about privacy. Well, I have to be honest: I’m a law student, and not since yesterday. But “privacy” for me was more the kind of thing that allowed you to go to Deutsche Telekom and request all of the information they have about you, like Malte Spitz did. Search results are nothing more than links to publicly available websites. “Privacy” wouldn’t have come to my mind in a thousand years. And, at least before the ECJ’s decision, many others wouldn’t have thought of it either. Now, of course, nobody can afford to even express this thought.
The decision’s severe consequences come from the inapt application of “full effect” privacy principles to an information and communication context.

Inconsistencies and backfiring

On top of that, there are several weirdnesses and inconsistencies.
Normally, you’re redirected to a Google page with a TLD according to the country you’re located in, for example google.de in Germany. On Google’s main page though, you can switch to google.com (link in the bottom right corner) and hereby get to unaltered search results. Yes, it is that easy.
On one hand that is good, because that means all of the stuff I described above is easy to circumvent. On the other hand: The fact that wrong regulation is easy to circumvent doesn’t make it right or even less dangerous. Even more dangerous actually, because it makes the slippery slope that this is seem more harmless.

Alluding to Google’s position as a gatekeeper: Any search engine operator with meaningful market share will be obliged to do the same. Remember, due to the massive scale, this requires significant infrastructure and therefore raises the bar of entry into this market even further. Maybe Microsoft will get annoyed with all of the EU’s regulation and just leave the search engine business altogether. Who knows? Anyway, this is another way the ECJ further reinforces Google’s position.

Another point, seemingly small but even more weird, is that publisher-run and for-pay databases will keep all the links (Ger) that are de-listed from Google search results. This, accidentally, makes freedom of information some kind of a media privilege.

Jeopardizing freedom of speech

There’s no other way to put this: This is really, really concerning. Freedom of information and freedom of speech are fundamental values, especially in the information society we live in today. All of this for prohibiting you from finding anything not entirely positive about your new neighbor online?
We simply can’t afford undifferentiated, trigger-happy and blanket-style approaches that endanger these values, be it in the fight against child pornography, copyright infringement or for the protection of minors (meaning porn filters).

All of this is not to say that I don’t see the problem with information living online, possibly forever. But I honestly think that’s a societal, not a technical one. Managing an online persona will only become an ever more important skill, and we have to acknowledge that. Making people compete for being the best private “censor” can’t be the way. I, for one, don’t want to live in that kind of society.

Mr. Masing, the judge of the German Constitutional Court heavily criticizes the judgment in an essay (Ger), letting me look forward to a decision of the German Constitutional Court concerned with any of the relevant aspects. The majority of law-savvy bloggers (Ger) also have many complaints.
The Electronic Frontier Foundation’s take is also quite interesting.

I’m anxious to see how this will play out.