The right to removal in the time of post-google Spain: myth or reality under general data protection regulation?

ABSTRACT

After the Google Spain judgment, removal of personal data has become a more significant and controversial topic in this era of digitalisation. Then, Article 17 of General Data Protection Regulation introduced ‘the right to erasure (“right to be forgotten”)’ for the first time including the grounds for its exercise, obligation of the controller for taking reasonable steps to inform other controllers and derogations from its application. Hence, this article aims to examine the right to removal, as a recommended concept rather than the right to erasure or the right to be forgotten, based on its territorial and material context besides striking a fair balance related to its derogations under GDPR in a period of post-Google Spain.

KEYWORDS:

• Right to erasure
• general data protection regulation
• google Spain

Disclosure statement

No potential conflict of interest was reported by the author.

Notes

1. Case 131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, ECLI:EU:C:2014:317.

2. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31. Pursuant to Article 12(b) entitled Rights of Access; ‘Member States shall guarantee every data subject the right to obtain from the controller, (…) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data’ whereas Article 14(1)(a) entitled The Data Subject’s Right to Object provides that ‘Member States shall grant the data subject the right, at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data’. For a significant brief background information on the adoption of the Directive and afterwards, see Stute (2015).

3. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1.

4. As Stute (2015) points out, a new GDPR with an explicit right to erasure had been discussed extensively since 2012 but was not scheduled to be adopted before 2016 due to the ‘extensive lobbying of EU institutions by U.S. technology firms -including Google, Facebook, and the U.S. Chamber of Commerce- aiming to water down’ the requirements of GDPR according to EU politicians and regulators.

5. For instance, see Explanatory Memorandum of EU Proposal for GDPR (Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation)’ COM(2012) 11 final) and Factsheet on the ‘Right to be Forgotten’ Ruling (Commission, Factsheet on the “Right to be Forgotten” Ruling (C-131/12) 2018).

6. As one of the most crucial reasons, Streisand effect cannot be denied and controlled due to the nature of internet which is defined as the ‘phenomenon that occurs when an attempt to hide or delete a piece of information instead results in wider circulation of the information’ (Stute 2015, 673) titled after a failed attempt by Barbra Streisand in 2003. Google Spain is one of the most ironical examples of Streisand effect on its own. For detailed information see Parkinson (2014); Parloff (2014); Bougiakiotis (2016).

7. Google Spain para 15.

8. In this respect, ‘remove’ and ‘delist’ are used as almost synonyms for defining data subjects’ requests and related transactions after Google Spain under the Transparency Report of Google without containing any concept such as ‘deleting’ or ‘forgetting’ (See Google Transparency Report 2018).

9. Whereas the title of former provides one right combining ‘forgotten’ and ‘erasure’, the latter covers two separately written rights.

10. Preamble, GDPR, Recital 66.

11. ‘This phenomenon of great data concentration (…) regards not only social networks but also other kinds of companies in different sectors characterized by a high level of personal data flow’ ‘in an era in which not everyone has access to all sources of information and not everyone has the knowledge or the instruments to exploit them’ (Mantelero 2013, 234).

12. Google Spain para 54.

13. Ibid para 53.

14. Ibid para 55.

15. Nevertheless, since different business models exist, each case must be assessed on its own merits taking into account its specific facts. Thus, the CJEU judgment should be evaluated neither too broadly as concluding that any establishment with the slightest link to the data processing activities will lead to the application of EU law, nor too restrictively as merely implementing it to a certain business model of search engine operators (Article 29 Data Protection Working Party, Update of Opinion 8/2010 on Applicable Law in light of the CJEU Judgment in Google Spain (176/16/EN, 2015) 5).

16. For detailed information see Bougiakiotis (2016).

17. The Advisory Council to Google on the Right to be Forgotten, Report of the Advisory Council to Google on the Right to be Forgotten (2015) 19.

18. Article 29 Data Protection Working Party, Guidelines on the Implementation of the CJEU Judgment on ‘Google Spain’ (14/EN, 2014) 3. Working Party was replaced by the European Data Protection Board which aims to ensure the consistency of the application of GDPR as an independent European body with the membership of all European data protection authorities.

19. In similar vein, see Kulk and Borgesius (2017).

20. In this regard, it is important to mention that CJEU is being waited to rule on a landmark case between Google Inc. and CNIL in order to determine whether the right to erasure ‘can and should stretch beyond EU borders’ (Hern 2017 and see Request for a preliminary ruling from the Conseil d’Etat (France) lodged on 21 August 2017 regarding Case 507/17 Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)).

21. Google Spain para 70.

22. Ibid para 88.

23. Since it is always possible for other websites or social networks to link it (Fomperosa Rivero 2017, 25) and new websites to be established which particularly list the removed webpages from search engines together with several other examples of Streisand effect (See Rawlinson 2014), the right to removal has definitely more potential for remembering and attention rather than forgetting and censorship. Conversely, Facebook can apply censorship as it did for the image of a Vietnamese girl attacked by napalm by deleting the photograph from profile pages without any warning (For a detailed evaluation see Solberg 2016).

24. According to Article 6(1)(a) of GDPR; ‘Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent to the processing of his or her personal data for one or more specific purposes’.

25. Under Article 9(2)(a); ‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall [not] be prohibited [if] the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition (…) may not be lifted by the data subject’.

26. See Preamble, GDPR, Recital 39. In this respect, controllers are obliged to implement adequate measures in order to minimise the risk of not knowing and not being able to contact all third parties and to allow the tracking of bounces (Bartolini and Siry 2016, 229–231). For a brief analysis on the technical solutions regarding internet bounces for safeguarding the enforcement of Article 17(2), see ibid 231.

27. See Information Commissioner’s Office (2018).

28. Google Spain para 81.

29. Charter of Fundamental Rights of the European Union [2012] OJ C326/391.

30. See the criticism about the CJEU’s use of terminology as the ‘interest’ for public’s right to access information whereas the ‘right’ for data subject’s right to have a private and family life in Frantziou (2014). Frantziou (2014) also regards CJEU’s approach for seeking a fair balance between rights and economic interests as problematic.

31. As a wider criterion than the ‘public figures’, it is not possible to designate a certain definition for the role in public life but ‘politicians, senior public officials, business-people and members of the (regulated) professions can usually be considered to fulfil’ it (Working Party 2014, 13).

32. According to Article 52(3) of CFREU; ‘In so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection’.

33. Consolidated Version of the Treaty on European Union [2012] OJ C326/13. Pursuant to Article 6(3) of TEU; ‘Fundamental rights, as guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms and as they result from the constitutional traditions common to the Member States, shall constitute general principles of the Union’s law’.

34. Explanations relating to the Charter of Fundamental Rights (2007/C 303/02, 2007).

35. Pursuant to Article 8 of ECHR titled Right to Respect for Private and Family Life;

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

36. For detailed information and balancing criteria of the ECtHR, see Wechsler (2015); Kulk and Borgesius (2017).

37. See Axel Springer AG v Germany [2012] ECHR 227, Von Hannover v Germany [2004] ECHR 294 and Węgrzynowski and Smolczewski v Poland [2013] ECHR 690.

38. Węgrzynowski and Smolczewski v Poland para 59.

39. Ibid para 65.

40. Ibid para 58.

41. Consolidated Version of the Treaty on the Functioning of the European Union [2012] OJ C326/47.

42. Despite generally being used as a mere rhetoric by EU politicians, this evolution requires the EU to abide international human rights law whilst constituting a legitimate justification to extend the territorial application of GDPR (Taylor 2015, 247–248).

43. For the contrary opinion supporting the supremacy of freedom of information see Fomperosa Rivero (2017).

44. According to Lynskey (2015), ‘at the heart of the matter is the divisive issue of default control over information’ ‘in an era of Big Data and ambient technologies’.

45. Facebook’s famous scandal in 2014 on providing misleading information about its technical capacities during its acquisition of WhatsApp constitutes one of the most dramatic examples for corruption. It resulted in a £94m fine from the European Commission and change in privacy policy of WhatsApp. Yet, Working Party sent a letter to WhatsApp on 24 October 2017 stating that ‘the company had still not resolved its concerns about getting user consent for the data sharing’ (See Gibbs 2017).

46. As Powles (2015) briefly explains, this ‘self-styled’ council constitutes ‘an alternative of its own choosing to the European regulatory body’, formerly known as Working Party. Thus, ‘Google attracted highly reputable and formidable experts’ who were actually excluded from any information on Google’s internal activities. ‘From September to November 2014, the advisory council completed a seven-stop European tour, notionally for the purpose of gathering “evidence” from public hearings of “experts” selected by Google’ (See Powles 2015, 594).

47. In this respect, Google earned plenty of advantages by keeping the information about majority of requests non-transparent and minimal such as, first and foremost, gaining bargaining power with regulators and policy-makers and ensuring constant support from the media under the rhetoric of ‘time pressure of compliance, the need to protect privacy, and litigation risk management’ (For a detailed evaluation see Powles (2015) besides for a significant analysis on the highly neglected role of media see ibid 606–610).

48. In this regard, it should be underlined that CJEU is awaited to rule another case against CNIL in order to determine; whether the prohibition imposed on other controllers regarding special categories of personal data under Directive 95/46/EC also applies to operator in question as the controller of processing by means of that search engine and the interpretation of the related provisions of Directive 95/46/EC considering whether or not publication of the personal data on the web page at the end of the link at issue is lawful (See Request for a preliminary ruling from the Conseil d’Etat (France) lodged on 15 March 2017 regarding Case 136/17 G.C., A.F., B.H., E.D. v Commission nationale de l’informatique et des libertés (CNIL)).

49. See Powles and Floridi (2014); Lynskey (2015).

50. For more information on the role of regulators see Powles (2015).

51. Case 398/15 Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v Salvatore Manni, ECLI:EU:C:2017:197.

52. Manni para 55.

53. First Council Directive 68/151/EEC of 9 March 1968 on coordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, with a view to making such safeguards equivalent throughout the Community [1968] OJ L65. Nevertheless at the time of the judgment, Directive 68/151/EEC was repealed by Directive 2009/101/EC of the European Parliament and of the Council of 16 September 2009 on coordination of safeguards which, for the protection of the interests of members and third parties, are required by Member States of companies within the meaning of the second paragraph of Article 48 of the Treaty, with a view to making such safeguards equivalent [2009] OJ L258. After the judgment, Directive 2009/101/EC was also repealed by Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law [2017] OJ L169 which is in force since 30 June 2017.

54. For a significant example, see the list of common criteria for delisting requests in Working Party (2014).

55. It would be easier to evaluate the importance of a fair balancing practice by the companies when it is considered that after Google Spain, 1.054.141 URLs were removed except pending requests as of 9 October 2018. (Google Transparency Report 2018).

56. For detailed information see Hoffman, Bruening, and Carter (2016).

57. See Powles (2015); Powles and Floridi (2014).

58. For a detailed table and information about the balancing criteria, see Hoffman, Bruening, and Carter (2016).