Steve Peers

The strong reaction to the ‘right to be forgotten’ in EU data protection law is focused on the Court of Justice of the European Union’s (CJEU) decision in the Google Spain case. This judgment indirectly established the right by interpreting the existing EU data protection directive. However, this ruling’s impact could be limited since the EU is in the process of replacing that directive.

The European Commission presented the first draft of the new General Data Protection Regulation in early 2012, and the European Parliament (EP) voted on it this past spring. However, the Council (made up of justice ministers from EU member states) is taking a slower approach. So far, they’ve only agreed on the proposal’s foreign relations components. After the Google Spain decision this spring, the Council shifted its attention to the right to be forgotten.

The Council had previously discussed this in 2012-13. They then waited for the Court’s judgment. Following the ruling, the Italian Council Presidency restarted discussions in July and recently submitted a revised version of its proposal. The Council hasn’t reached an agreement yet, and even once they adopt a position on the full proposal, they still need to negotiate with the EP.

Nevertheless, a consensus seems to be forming within the Council. Considering the significance of this issue, which has captured more public attention than any other EU legal matter in recent months, it’s worth examining the direction of these discussions.

Firstly, it’s important to remember that the Council already decided that search engines like Google, and potentially many other non-EU internet companies, will be subject to the new Regulation when it approved the external relations rules in the proposal.

The ‘right to be forgotten’ itself is addressed in Article 17 of the proposed Regulation. Initially, the Commission suggested that individuals could exercise this right (combined with the existing right to erasure) against the original data controller on four grounds: data no longer being necessary; the individual withdrawing consent or the storage period ending; the individual objecting to processing for specific reasons; or the processing no longer being valid for other reasons. The data controller then had to inform third parties of any requests to exercise that right.

In this initial proposal, exemptions to the right existed based on: freedom of expression; public health; historical, scientific, or statistical research; compliance with national or EU legal obligations; or situations where data access was merely restricted. The Commission would have the authority to adopt ‘delegated acts’ to further define the right.

The EP believed the right should also be directly enforceable against third parties, and there should be an option to exercise the right following an order from a court or regulatory body (potentially including a data protection authority).

The Council’s latest text retains these grounds for exercising the right, as amended by the EP. The requirement to inform third parties remains, but the Italian Presidency’s explanation of the proposal clarifies that this text acknowledges – rather than rejects – the CJEU’s ruling that Google itself is considered a ‘controller’ of personal data and therefore directly subject to data protection rules.

Regarding exceptions to the right, the ‘freedom of expression’ exception remains, elaborated with language from Article 10 of the European Convention on Human Rights (ECHR), taking ‘due account of the public interest…in relation to the personal quality of the data subject’. The Presidency’s explanations clarify that this phrasing aims to encompass the ‘public figure’ exception implied (but not detailed) in the Google Spain judgment. New exceptions would also apply to ‘archiving purposes in the public interest’, social protection, legal claims, public interest tasks, or exercising official authority. The Commission’s power to adopt delegated acts has been removed.

There’s no longer an exception (for the right to be forgotten) for the commercial interests of data controllers like Google. However, this doesn’t significantly alter the current situation since the CJEU easily concluded in Google Spain that the data subject’s right to privacy superseded Google’s economic interests.

The preamble includes new clauses reflecting the CJEU’s ruling on the ‘public figure’ exception, the possibility of lodging complaints with the controller, a data protection authority, or courts, and the controller’s role in applying the balancing test. The preamble also notes the need to balance the right to be forgotten against other rights; the language here comes from Article 52(1) of the Charter, which sets out a general rule on limitations of Charter rights.

What can we conclude from these proposals? Firstly, it’s evident that the core elements of the Google Spain judgment are more likely to be codified, not overturned, by the new law. This is assumed in the Presidency’s explanatory notes. The Google Spain judgment hinged on the Court’s reasoning that it was ‘no longer necessary’ to provide access to (accurate) data about the data subject’s past financial difficulties through Google. This very basis for exercising the right to be forgotten would be explicitly retained in the new legislation.

The judgment didn’t address the other grounds for exercising the right outlined in the proposal, though the Court likely would have upheld them if asked. It’s crucial to highlight the explicit right to withdraw consent for data processing. This would cover cases like ‘revenge porn’, where one party initially consented to images being posted online but later withdrew consent after a relationship ended. (In cases without initial consent for posting such images online, data protection law would have been violated from the outset).

Turning to the exceptions to the right, reconciling the right to be forgotten with freedom of expression is the most contentious aspect. As mentioned, the proposal codifies but doesn’t clarify the ‘public figure’ exception. There’s a cross-reference to Article 80 regarding freedom of expression. This article (in the Commission’s original proposal) mirrors the existing ‘journalist exception’ for ‘processing personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression’. While some member states argue this doesn’t apply to bloggers (see footnotes in the latest text), the CJEU interpreted this exception broadly in the Satamedia case, considering a company that sends text messages about tax information to be journalistic. On the other hand, the Court didn’t view Google itself as a journalist.

The more sound perspective is that bloggers and anyone expressing themselves on social media fall under the ‘freedom of expression’ exception, even if they aren’t professional journalists. Ultimately, these individuals are still exercising their freedom of expression, and it would be unfair, in today’s world, to protect that freedom for some but not others. Furthermore, such a distinction would clearly violate Article 10 of the ECHR, based on relevant case law from the European Court of Human Rights.

In Google Spain, the CJEU didn’t consider whether freedom of expression could be used to argue that journalists (and others) require unrestricted internet access for their work. This remains an open question a journalist could raise in a relevant case.

More importantly, the latest draft reinforces the CJEU’s stance that Google bears primary responsibility for handling privacy complaints without ensuring its accountability. In other legal areas, companies have reporting obligations to ensure they meet legal, social, and ethical responsibilities. Since Google will likely be the one balancing privacy and freedom of expression in practice, the new law should require them to report on how they’ve balanced these rights, allowing for public scrutiny of their actions.

Lastly, how might the new Regulation (as currently drafted) apply to Wikipedia and social networks? As discussed in a previous blog post, Wikipedia could certainly try to rely on the ‘public figure’ exception. It could also invoke the exceptions for archiving or historical interest, though that depends on the final language of other Regulation provisions.

Similarly, the precise application of the new rules to entities like Facebook depends on the final wording of the ‘household exception’ in the new legislation and the unresolved question of how (or if) the Google Spain judgment applies to user-generated content and user-controlled privacy settings.

The newest drafts of the new Regulation on the ‘right to be forgotten’ will likely disappoint both the most vocal critics of the Google Spain ruling, who see any limitation on search engine results based on privacy as unacceptable, and more moderate critics (including myself) who believe the ruling didn’t adequately balance the right to privacy and freedom of expression. There’s still time to urge the Council (and later, the Council and the EP) to address issues such as the unjustified special treatment of journalists, the accountability of search engines, and how these new rules apply to other types of internet use.

Barnard & Peers: chapter 9