‘The Right to be Forgotten’: The future EU legislation takes shape

Steve Peers

The furore over the ‘right to be forgotten’ in EU data protection law focusses, obviously enough, on the CJEU’s judgment in Google Spain, which obliquely referred to such a right, by means of interpreting the EU’s existing data protection Directive. But in principle the Court’s ruling might have limited impact, since the EU is embarked upon a lengthy process to replace that Directive.

The initial proposal for a new General Data Protection Regulation was tabled by the Commission at the start of 2012, and the European Parliament (EP) voted its opinion on the proposal this spring. For its part, the Council (Member States’ justice ministers) is moving more slowly. So far, it has only agreed its position on the external relations aspects of this proposal. But following the delivery of the Google Spain judgment this spring, it has turned its attention to the right to be forgotten.

The Council had initially discussed this issue in 2012-13 (see a record of those talks here). It then paused to wait for the Court’s judgment. Following that ruling, the incoming Italian Council Presidency then resumed discussions on the issue in July, and tabled a revised version of its proposal a couple of weeks ago. The Council has not yet agreed on this issue (see the Member States’ positions here), and in any event, once the Council has adopted its position on the entire proposal, it would still have to negotiate with the EP.

However, there seems to be an emerging consensus in the Council. Given the importance of the issue, which has attracted more public interest than any EU law issue in the last few months, it’s worth examining where the discussions are going.

First, of all, it should be recalled that the Council has already agreed that search engines like Google, and possibly many other Internet companies not based in the EU, will be subject to the new Regulation, when it agreed on the external relations rules in the proposal.

As for the ‘right to be forgotten’ itself, it’s in Article 17 of the proposed Regulation. The Commission initially proposed that the data subject could exercise the right (which is combined with the current right of erasure) against the original data controller, on one of four grounds: the data are no longer necessary; the data subject withdraws consent or when the storage period has expired; the data subject objects to the processing on specified grounds; or the processing is no longer valid on some other ground. The data controller had to inform third parties of any request to exercise that right.

In this initial proposal, there would be exemptions from the right on grounds of: freedom of expression; public health; historical, scientific or statistical research; compliance with a national or EU legal obligation; or cases where access to the data was merely restricted.  The Commission would have the power to adopt ‘delegated acts’ to spell out the right in more detail.

In the EP’s view, the right could also be exercised directly against third parties, and there would be a further possibility to exercise the right following an order by a court or regulatory authority (presumably including a data protection authority).

In the Council’s latest text, these grounds for exercising the right (as amended by the EP) are retained. The obligation to inform third parties is also retained, but the Italian Presidency’s explanation of its proposal makes clear that this text is taking on board – rather than rejecting – the Court of Justice’s ruling that Google must itself be considered a ‘controller’ of the personal data, and therefore directly subject to data protection rules.

As for the exceptions to the right, the ‘freedom of expression’ exception remains, fleshed out with the wording of Article 10 ECHR, taking ‘due account of the public interest…in relation to the personal quality of the data subject’. The Presidency’s explanations make clear that this awkward wording is meant to encompass the ‘public figure’ exception hinted at (but not elaborated upon) in the Google Spain judgment.  There would also be new exceptions, as regards ‘archiving purposes in the public interest’, social protection, making or defending legal claims, performing a public interest task or exercising official authority. The Commission power to adopt delegated acts has been dropped.

There’s no longer an exception (as regards the right to be forgotten) for the commercial interests of data controllers such as Google. But that won’t really change the status quo, since the CJEU easily found in Google Spain that Google’s economic interests were overruled by the data subject’s right to privacy.

New clauses in the preamble would reflect the CJEU’s ruling on the ‘public figure’ exception, the possibility of complaint either to the controller or to a data protection authority or the courts, and the role of the controller in applying the balancing test. The preamble would also note that the right to be forgotten has to be balanced against other rights; the wording here is taken from Article 52(1) of the Charter, which sets out a general rule on limitations of Charter rights.

What are we to make of these proposals? First of all, it’s clear that the essential features of the Google Spain judgment seem likely to be codified, not overturned, by the new law. This is assumed in the Presidency’s explanatory notes. Indeed, the Google Spain judgment turned on the Court’s reasoning that it was ‘no longer necessary’ to make available (accurate) data on the data subject’s previous financial troubles, via means of Google. And that very ground for exercising the right to be forgotten would be expressly retained in the new legislation.

The other grounds for exercising that right, as set out in the proposal, were not addressed in the judgment, although the Court would likely have ruled that they existed if it had been asked. Here, it’s important to point out the express power to withdraw consent for data processing. This would clearly cover cases of ‘revenge porn’,  where one sexual partner initially agreed to the images being posted on the Internet but withdrew his or her consent when the relationship broke down. (For cases where there was never any consent to posting such images on the Internet, data protection law would have been violated from the outset).

Moving on to the exceptions from the right, the most controversial aspect is the reconciliation of the right to be forgotten with the freedom of expression. As noted above, the proposal codifies but does not clarify the ‘public figure’ exception. There’s a cross-reference to Article 80 as regards the freedom of expression. This Article (in the Commission’s original proposal) reproduces the current ‘journalist exception’ for the ‘processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression’. While some Member States object that this exception does not apply to bloggers (see the footnotes to the latest text), the CJEU took a broad approach to this exception in the case of Satamedia, regarding a company which sends out text messages about people’s tax information as a journalist. On the other hand, the Court did not regard Google itself as a journalist.

The better view is surely that bloggers and anyone otherwise expressing themselves on social media fall within the scope of the ‘freedom of expression’ exception, even if they are not professional journalists. After all, such persons are still exercising their freedom of expression, and it would be deeply unprincipled, in the modern world, to protect that freedom for one group of people but not others. Moreover, such a distinction would clearly violate Article 10 ECHR, in light of the relevant case law of the European Court of Human Rights.

The CJEU did not consider in Google Spain whether freedom of expression could be relied upon to argue that journalists (and others) need unrestricted Internet access to do their jobs properly. So arguably this is still an open issue that could be raised by a journalist in an appropriate case.

More fundamentally, the latest draft entrenches the CJEU’s position that Google is mainly responsible for processing complaints about privacy, without ensuring that it is accountable. In other areas of law, there are reporting requirements imposed upon companies to ensure that they meet their legal, social and ethical obligations. Since Google will in practice usually be in charge of striking the balance between privacy and freedom of expression, the new legislation should require that it report on how it has balanced these rights, so that there can be a public discussion of the appropriateness of its actions.

Finally, how might the new Regulation (in the current draft) apply to Wikipedia and social networks? As discussed in a previous blog post, obviously Wikipedia could try to rely upon the ‘public figure’ exception. It could also try to rely upon the exceptions for archiving or historical interest, although that depends upon the final wording of other provisions of the Regulation.

Equally, the precise application of the new rules to entities like Facebook depends on the final wording of the ‘household exception’ in the new legislation, as well as the open question of how (if at all) the Google Spain judgment applies to user-generated content, as well as user-controlled privacy settings.

Overall, the latest drafts of the new Regulation on the ‘right to be forgotten’ will disappoint not only the fiercest critics of the Google Spain ruling, who regard any limitation of search engine results on privacy grounds as anathema, but also the more moderate critics (like myself) who believe that the ruling failed to strike clearly the right balance between the right to privacy and the right to freedom of expression. It’s not yet too late to urge the Council (and then, the Council and the EP) to address issues such as the unjustified special treatment of journalists, the accountability of search engines and the application of the new rules to other types of Internet use.

Barnard & Peers: chapter 9