Tag Archives: Data Protection

Data Belongs To The Individual

The Vice President of the European Commission, Viviane Reding, believes this mantra and it is irrevocably enshrined in European law. Following the ruling by the European Court of Justice yesterday (13MAY2014), it is a concept which has gone mainstream.  The ECJ have decided that “[a]n internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties”.

Unsurprisingly, that has prompted intense, and sometimes quite passionate, debate on the subject. This essay is, just for the sake of it, my two penn’arth on the subject.

Mario Costeja González

The case had been referred to Europe’s highest legal authority following an appeal by Google against a decision made by the Spanish Data Protection Agency (an organisation known as the AEPD). A Spaniard by the name of Mario Costeja González had found that when he Googled his name the results included links to an advertisement in a local newspaper. This advertisement showed that his house had been put up for sale to recover debts he owed to the social security agency. Given that was six years ago and his debts had long been settled, he wanted this information deleted under Europe’s Right to be Forgotten law. This EC Directive No.46 of 1995, is a part of the panoply of European Data Protection measures and requires “irrelevant or outdated” information to be deleted on request. 

Screen Shot 2014 05 14 at 15 42 17

The newspaper refused to delete the page and Google refused to remove the links. The AEPD decided that the newspaper had lawfully published the advertisement and so were justified in refusing to delete it. Google’s case was that by merely linking to it rather than hosting it, they had no control of, or responsibility for, the data. This didn’t wash with the Spanish authorities and they were ordered to “take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future”.

In considering Google’s appeal, the first question the ECJ had to consider was whether Google’s link to the newspaper constituted personal data and they clearly thought it did. They further decided that Google ‘collects’, ’retrieves’, ‘records’, ’organises’, ‘stores’ and ‘discloses’ the data it trawls from web sites. Throughout Europe, these actions are all regulated when the data concerned is Personally Identifiable Information. Anyone with any knowledge of the UK’s Data Protection Act will know that a Data Controller must ensure that the personal data they hold “shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed” and “…shall be accurate and, where necessary, kept up to date”.

That the information about Sr. González was old is beyond doubt, but was it irrelevant or  outdated? That he once owed money and his house was put up for sale is as true today as it was six years ago. That statement of fact was, it seems, something the newspaper could rely on as the “relevancy” criteria was evidently true when they “processed” the personal information of Sr. González. However, the ECJ seem to have taken the view that Google’s “processing” is an ongoing thing and therefore now fails the relevancy test.

Where EC/46/95 is enacted in domestic legislation, as it evidently is in Spain, this all means is that the Data Controller is obliged to delete the data when the Data Subject asks. Incidentally, the UK’s Department for Justice still refuses to sign-up to this Directive, suggesting it raises unrealistic demands on companies and unrealistic expectations in the minds of individuals.

The Big Picture

Clearly Mme Reding has strongly held beliefs and honourable intentions. Similarly, the judgement of the ECJ doubtless follows thoughtful consideration of the interests at stake. However, when the dust settles, will what we are left with be of benefit to society as a whole?

There is a much wider point to the ECJ judgement than just considering one result in isolation, and I suspect that is one more reason why they have ruled as they have.

The Court points out in this context that processing of personal data carried out by such an operator enables any internet user, when he makes a search on the basis of an individual’s name, to obtain, through the list of results, a structured overview of the information relating to that individual on the internet. The Court observes, furthermore, that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty. Internet users may thereby establish a more or less detailed profile of the person searched against.

In other words, one search result is bad enough, but taken as a whole, a collection of results could allow wholesale snooping into a person’s life.

The Backlash

An individual’s privacy can normally be safeguarded without cries of censorship. Yet here, Jimmy Wales, the founder of Wikipedia, is quoted by the BBC as describing it as “one of the most wide-sweeping internet censorship rulings that I’ve ever seen”. The ruling clearly put the concepts of privacy and censorship in direct conflict. 

The global fall-out of their ruling wouldn’t have been in the forefront of the judges’ minds, but given it is the internet we are talking about, global it most certainly is. Compare and contrast these two commentaries on the case, one from the BBC the other from the LA Times.

In the UK, the Rehabilitation of Offenders Act allows convictions to be “spent” after a certain period of time. For instance, for anyone sentenced to less than six months in prison, their conviction has become spent after seven years. Spent convictions typically do not need to be disclosed to employers, but it’s easy to see how a Google search result could void any possible benefit from the act.

http://www.bbc.co.uk/news/magazine-27396981

 

Though the idea of such a right has generally been well-received in Europe, many in the U.S. have criticized it as a disguised form of censorship that could, for example, allow convicts to delete references to past crimes or politicians to airbrush their records.

http://www.latimes.com/business/la-fi-google-eu-20140513-story.html?track=rss

To be fair, the BBC correspondent tempers their stance by suggesting that “It’ll be harder, for example, to have a story from the 1990s about an arrest for assault removed if you’re a politician than if you’re a plumber”. Indeed, even Mme. Redding asserts that “It is clear that the right to be forgotten cannot amount to a right of the total erasure of history”.

Therein lies the problem with the “Right to be Forgotten”.

The Data Protection Act is a tried-and-tested concept and most businesses are now adept in dealing with its principles. However, when it comes to the Right to be Forgotten, there are very obviously shades of grey and, as the politician-and-plumber comparison hints at, the graduations are near-infinite. Instead of simply considering what is factually accurate against what is demonstrably incorrect (admittedly itself an area with potential for murkiness), the Data Protection Principles have far vaguer concepts like Relevancy. Muddying the water still further, the Right to be Forgotten principle is that deletion at the request of an individual should occur “unless there is a good reason to retain data”.

The question has to be who decides what is a “good reason” as it is surely a concept which cannot be tied-down in words, even less so than “relevant”. The individual concerned can’t be an objective voice and nor can the host site. Presumably, if they were, they’d have already edited or removed the offending page. The ECJ’s ruling is that the role of adjudicator falls to each and every search engine linking to the page in question (almost by definition, any given page will be linked-to not just by Google, but all search engines). Whilst Google et al’s objectivity toward the complainant and the linked site is unlikely to be questioned (unless the site is an advertiser?), there would seem to be little incentive fully consider each side of the argument. In many cases it will inevitably be left to the Data Protection Registrar – or the courts – to decide. All of which is great news for lawyers.

There are other issues I don’t have time or inclination to get into here, such as the market in ‘dark net’ search engines which are bound to spring up – if, indeed, they don’t already exist.

Is This Really a Problem?

Back to the BBC…

Victims of domestic abuse often face a situation where a violent ex-partner is trying to track them down. The victims are often named in media reports about their partners’ crimes. Details about unhappy relationships and harrowing tales of violence can be permanently associated with their names, even as they want to move on to a new life of independence and freedom.

http://www.bbc.co.uk/news/magazine-27396981

This seems to miss the point that the exact same information would be very helpful for the perpetrator’s new partner. Or are we saying that in order to keep the perpetrator’s name visible, only the victim’s name should be excised from the search engine database? Except that the full link will regenerate when the search engine “web crawlers” find the page again – unless some sort of cross-checking takes place against a vast database of complainants. Fair enough, but how does that work with a celebrity or someone whose name is regularly in the news… 

My point is that this whole ruling seems to spectacularly under-estimate the scale of what it implies. To simply shrug ones shoulders and say that it is Google’s problem is, well, fairly typical arrogance on the part of the European Commission.

In many of the commentaries I have read on this subject, the example of “the drunken photograph posted to social media ruining a teenager’s future career” gets trotted out. This is surely a completely different issue. More often than not, the poster will retain direct control of such postings.  I recognise that — because of search engines or possibly a mean spirited ex-partner — images may propagate around the web making it virtually impossible to track down all copies. Surely in such circumstances, however, the search engines are a useful tool in finding and approaching sites hosting copies with a ‘take down’ request?

If the original page is altered or deleted, then search results will reflect this. Sure, there are caches kept and the WayBack Machine will likely as not have a record of the offending page, but the reality is such search techniques are not in the toolbox of everyday web users.

Targeting the search engines in pursuit of this Right to be Forgotten is rather like taking down road signs as an attempt to reduce urban congestion. Those who already know the way won’t notice and those who want to get there will find the place anyway – and if they don’t, their friends and colleagues will send them directions.

And Finally…

As a final thought, going back to the intricacies of Mario Costeja González’s tangled web. He complained that the local newspaper still made his shameful past available for all to see and that Google facilitated that. Because it is Google, I suggest that the most common reaction (mine included) has been something like, “well, that’s what they do, where’s the problem?”. 

However, imagine if the company that was collecting, storing and – on request to anyone who asked – distributing, a comprehensive and indexed dossier of your personal history which would otherwise be almost undetectable, wasn’t Google. Imagine it was a credit reference agency, or a debt collecting company, or a private detective… Would that be alright?

What the ECJ have said is that there is no difference.

Advertisements
Tagged , ,
Advertisements