[okfn-discuss] Right to be forgotten ruling

Mon May 19 16:53:12 UTC 2014

There was an interesting piece in the Guardian yesterday by Mark Stephens entitled “only the powerful will benefit from the ‘right to be forgotten’” http://www.theguardian.com/commentisfree/2014/may/18/powerful-benefit-right-to-be-forgotten

I was particularly struck by: “Google's content removal transparency report records how government officials around the world already seek to remove search results and other online content that threatens their position”.

Duncan

From: okfn-discuss [mailto:okfn-discuss-bounces at lists.okfn.org] On Behalf Of Rufus Pollock
Sent: 19 May 2014 17:21
To: Open Knowledge Foundation discussion list
Subject: Re: [okfn-discuss] Right to be forgotten ruling

Really glad you raised this as I'd been planning to email the list about this. This is potentially a very big issue for open data and open knowledge.

I think we should be putting up a post about this and i'm interested in what folks here think.

For those who haven't seen there's the official press release [1] plus lots of news articles. Key section is below and below that I have some comments.

[1]: http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-05/cp140070en.pdf and there's

<quote>
In 2010 Mario Costeja González, a Spanish national, lodged with the Agencia Española de
Protección de Datos (Spanish Data Protection Agency, the AEPD) a complaint against La
Vanguardia Ediciones SL (the publisher of a daily newspaper with a large circulation in Spain, in
particular in Catalonia) and against Google Spain and Google Inc. Mr Costeja González contended
that, when an internet user entered his name in the search engine of the Google group (‘Google
Search’), the list of results would display links to two pages of La Vanguardia’s newspaper, of
January and March 1998. Those pages in particular contained an announcement for a real-estate
auction organised following attachment proceedings for the recovery of social security debts owed
by Mr Costeja González.

With that complaint, Mr Costeja González requested, first, that La Vanguardia be required either to
remove or alter the pages in question (so that the personal data relating to him no longer
appeared) or to use certain tools made available by search engines in order to protect the data.
Second, he requested that Google Spain or Google Inc. be required to remove or conceal the
personal data relating to him so that the data no longer appeared in the search results and in the
links to La Vanguardia. In this context, Mr Costeja González stated that the attachment
proceedings concerning him had been fully resolved for a number of years and that reference to
them was now entirely irrelevant.

The AEPD rejected the complaint against La Vanguardia, taking the view that the information in
question had been lawfully published by it. On the other hand, the complaint was upheld as
regards Google Spain and Google Inc. The AEPD requested those two companies to take the
necessary measures to withdraw the data from their index and to render access to the data
impossible in the future. Google Spain and Google Inc. brought two actions before the Audiencia
Nacional (National High Court, Spain), claiming that the AEPD’s decision should be annulled. It is
in this context that the Spanish court referred a series of questions to the Court of Justice.

[The ECJ then summarizes its interpretation. Basically Google can be treated as a data controller and ...]

...  the
Court holds that the operator is, in certain circumstances, obliged to remove links to web pages
that are published by third parties and contain information relating to a person from the list of
results displayed following a search made on the basis of that person’s name. The Court makes it
clear that such an obligation may also exist in a case where that name or information is not erased
beforehand or simultaneously from those web pages, and even, as the case may be, when its
publication in itself on those pages is lawful.

Finally, in response to the question whether the directive enables the data subject to request that
links to web pages be removed from such a list of results on the grounds that he wishes the
information appearing on those pages relating to him personally to be ‘forgotten’ after a certain
time, the Court holds that, if it is found, following a request by the data subject, that the inclusion of
those links in the list is, at this point in time, incompatible with the directive, the links and
information in the list of results must be erased.
</quote>

This is really quite a big deal as:

a) it imposes potentially very substantial obligations on those who collect and curate "public" (open) data
b) it could entitle people to have "public-interest" info taken down (e.g. what about info that you were a director of a fraudulent company)

This issue also raises intriguing privacy vs transparency issues. After all, the basis of the case was data protection (cf also the debate re the recent directive update on the "right to be forgotten" point). In general, one is instinctively supportive of the view that someone's personal picture on facebook should not come back to haunt them 20y later.

However, here we are talking about "public-interest" info. Traditionally, society has accepted that we transparency concerns trump privacy in a variety of public interest areas: for example, one should be able to find who are the directors of limited liability companies, or know the name of one's elected representatives, or know who it is who was convicted of a given crime (in most cases).

This ruling has the potential to seriously undermine this either in theory or in fact.

In particular, whilst a company like Google may dislike this ruling they have the resources ultimately to comply (in fact it may be good for them as it will increase the barriers to entry!). But for open data projects this creates substantial issues - for example, under this ruling it seems possible that projects like Wikipedia, Poderopedia, OpenCorporares or even OpenSpending will now have to deal with requests to remove information on the basis of infringing on personal data protection even though the information collected only derives from material published elsewhere and has a clear public interest component.

Rufus

On 18 May 2014 23:15, martin biehl <odmartin at gmx.de<mailto:odmartin at gmx.de>> wrote:
Hi,

does anybody have a link to a good article on the supposed consequences of the recent EU "right to be forgotten" ruling? What is the open knowledge take on it?

Cheers!

Martin

_______________________________________________
okfn-discuss mailing list
okfn-discuss at lists.okfn.org<mailto:okfn-discuss at lists.okfn.org>
https://lists.okfn.org/mailman/listinfo/okfn-discuss
Unsubscribe: https://lists.okfn.org/mailman/options/okfn-discuss
This message is for the addressee only and may contain privileged or confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any views or opinions expressed are solely those of the author and do not necessarily represent those of IDS. Institute of Development Studies at the University of Sussex, Brighton BN1 9RE Tel: +44 (0)1273 606261; Fax: +44 (0)1273 621202 IDS, a charitable company limited by guarantee: Registered Charity No. 306371; Registered in England 877338; VAT No. GB 350 899914
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/okfn-discuss/attachments/20140519/d0c49481/attachment-0002.html>