Hold on to our personal data forever? Europe tells Google to 'fuggeda-bout-it!'
Gwenael Piaser (c) [CC BY-NC-SA 2.0]
In a test case that has profound implications for the future of Internet search engine companies and social media sites, the European Court of Justice (ECJ), the highest court in all of Euroland, has ruled that under the data protection laws extant in the European Union, Google must delete 'irrelevant' personal data when individuals demand it.
Dubbed "The Right to be Forgotten" the ruling will compel the likes of Google and Facebook to remove an individual's personal data from search results on request. The collection, storage, archiving and manipulation of personal data is, of course, Google's lifeblood and its sole raison d'etre.
The ECJ ruling follows a case brought by Spaniard Mario Costeja Gonzalez who complained to the court that Google had refused to delete a notice, dating from 1998 and first printed in La Vanguardia, a Catalonian newspaper, about the auction of his repossessed home.
Mr. Gonzalez claimed that notice was very old and pertained to the forced sale of his house, some 16 years ago, to secure the repayments incurred in over-claiming of social security; an incident that is long over and done with. He contended that despite the matter being the equivalent of a 'spent' conviction, and despite him asking Google to delete the link, it was retained and thus it has since adversely affected his credit rating, his financial and social standing, his livelihood and his privacy.
The Court's decision means that Google and its ilk must henceforth remove search results pertaining to personal data when requested, "unless there are public interest reasons not to do so." In a statement commenting on the ruling, Google wrote, "This is a disappointing ruling for search engines and online publishers in general".
At present, the terms of Article 17 of the European Data Protection Regulation, enshrine the "right to be forgotten and to erasure". It is a broad right and definition and, in confirming and re-emphasising that it long has been, and still remains, in force, the ECJ seems to be pre-empting the possibility of protracted and expensive cases being brought by individual member states of the European Union demanding negotiations about a new and updated data protection directive that might eventually result in a watered-down and partial "right to be forgotten".
The ECJ ruling also establishes that search engine companies are to be regarded as "data controllers" and defines them as "persons or bodies that collect and/or manage personal data." Under Article 17, people who are mentioned in the data have the right to "obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data." Meanwhile, the EU General Data Protection Regulation requires any data controller who has been asked to remove data to "take all reasonable steps, including technical measures" to remove it. If they do not do so they can face massive fines.
In other words, Google (and others) are legally responsible for the content to which their search engines link and individuals can demand that contested search results be deleted, even if the material involved has already been published, perfectly legally, at another time. Thus Google has effectively lost its status as a "neutral intermediary."
Commenting on Facebook, (and how ironic is that?) Viviane Reding, the EU Justice Commissioner, observed, "This is a victory for the protection of personal data. The ruling confirms the need to bring today's data protection rules from the 'digital stone age' into the modern world.
Threat to free speech?
In reaction, some privacy and freedom of expression lobbyists opined that the ruling is a threat to free speech and will allow crooks, chancers and opportunists to "whitewash their personal histories". Others, however, point out that the court has specifically exempted news media of every kind from complying with deletion requests while individuals cannot just simply contact the likes of Google and demand a link be taken down without "good reason that may be arbitrated and ruled on by an Information Commissioner."
The root of the trouble is that the Internet and social media are still in their early infancies, and, seduced by the thrill and novelty of it all, individuals have been perfectly happy to hand out huge amounts of their personal data in return for various free services.
Big data, meanwhile, is a neonate and who knows what kind of a monster (or saint) it may turn into over the next 20 years or so? Giving up personal information now, that can and will be kept forever, is dangerous and stupid, but we all do it to a greater or lesser extent.
Google, Facebook and the rest of them are building up patchwork profiles of just about everyone on the planet. These profiles are incomplete and exist in a limbo where time doesn't exist - a place where the peccadillo's of yesteryear co-exist simultaneously with irreproachable actions of today (and vice versa) and can be used for who-knows-what purposes as the whole melange is conflated into whatever shape search engines or social network sites might mash them into.
Here in the UK, ten years ago, there were mass protests against the government's proposal to introduce compulsory biometric identity cards for all Brits that would have included a chip carrying reams and reams of personal data. There was outrage and government backed down. Since then though we have been happy voluntarily to feed Google etc. with a steady drip of intimate information some of which some of us wouldn't reveal to our nearest and dearest, let alone an 'official'.
The amount of data freely given has risen exponentially and it's already out there. Private companies use our data to make money and we now know that government agencies in the US, the UK and elsewhere routinely tap into and suck up all the information we so gladly supply in exchange for a bit of server space to store photographs, favourite recipes or whatever it may be.
The fact of the matter is that it's too late. We have uncorked the bottle, the genie is out and a ruling by the European Court of Justice certainly won't be enough put it back. In the none-too-distant future the ECJ's actions will be seen to be little more than a prime example of the futility of pissing into the wind.
On a jollier note about the right to be forgotten I commend to you the following from Mr. Laurel and Mr. Hardy. They are legionnaires under siege in Fort Arid waiting for the final attack of the dreaded Riff-Raffs. Oliver Hardy takes out a photo of his long-lost girlfriend, sighs heavily and looking limpidly into the camera says, "I joined the legion to forget." Stan Laurel asks, "Forget what, Ollie?" Mr. Hardy replies, "I don't know. I can't remember." The worry and yet the delight is that Google can.