Thursday European data protection authorities met with executives from Google, Yahoo YHOO.O and Microsoft (Bing) to discuss the implementation of the landmark right to be forgotten ruling. Guidelines on how search engines must comply will be released early October. The participating companies were asked to answer several more questions about compliance with the ruling by the end of July.
In May the European Court of Justice made a ruling That affects how search engines operate in Europe. The “right to be forgotten” was argued by plaintiffs and gives people the right to request old, irrelevant or incorrect information be removed from search engines. The ruling only affects search results, the original link would not be removed or altered. Google already had to return some links to their former place after public outcry and talk of censorship.
The difficulty in interpreting a loosely stated standard and the perception that it would be censoring the internet is why Google continually fought against the case.
“…it did not want to be put in the position of internet censor extraordinaire. But that is exactly what has happened. And Google appears to be curiously allowing this to unfold. It has sent notices to the likes of the Guardian and the BBC, presumably for sake of transparency,” Wired UK reporter Liat Clark said. “However, it will have known that these journalistic institutions would leap on the facts and write about them. The stories are everywhere. We are all questioning the implementation of the right to be forgotten, the threat of censorship and, more troubling, the threat that public figures are already succeeding in using it to quash information they would rather we didn’t know. They have a new route open to achieve this, since the articles are factual and not libellous in any way.”
Privacy regulators can take Google to court if if they don’t comply with the new guidelines to requirements to be set by the organization by mid-September or early October. This happened in Spain which is the origin of the original “right to be forgotten” ruling began. According to Reuters, “Privacy experts say Google’s removal of results from only European domains effectively defeats the purpose of the ruling.”
“We didn’t tell the search engines to do anything. We were gathering information,” said Isabelle Falque-Pierrotin, head of France’s data-protection authority and chairman of the pan-European group of authorities in a WSJ interview. “The goal was to help inform our decision on the guidelines.”
Regulators focused on the question of how the providers have implemented the ruling thus far, which is worded such that the ambiguity leaves room for multiple interpretations. The decisions says there needs to be a balance between public interest and the impact that such information can have on people’s lives.This wording makes it difficult for companies trying to figure out whether and how they need to comply.
They also addressed the idea that Google only takes down results on its European sites. Regulators have complained that Google does not filter results on google.com which means anyone in Eruope can simply go google.com to see resuts.
“Privacy experts say Google’s removal of results from only European domains effectively defeats the purpose of the ruling.”, according to the Sydeny Morning Herald. “Google has claimed that the decision is restricted to localised versions of Google,” said Ashley Hurst, a partner at Olswang, a UK law firm. “There appears to be no basis for that claim at all.”
Since the ruling, both Google and Microsoft have launched online forms for citizens to submit a right to be forgotten request. According to Bloomburg, Google has removed about half of the 91,000 requests is received since the May decision. The requests involve 328, 000 web addresses. The highest number of requests are coming from France with 17500 and Germany with 16, 500.
Regulators are expecting more information from the service providers by the end of the month. Here are the list of questions the regulators addressed, as reported by the Wall Street Journal provided by France’s data-protection authority:
Questions asked during the meeting:
1. What information do you request from a data subject prior to considering a delisting request e.g. URLs, justification? Do you ask further motivation from the data subjects to substantiate their request?
2. Do you filter out some requests based on the location, nationality, or place of residence of the data subject? If so, what is the legal basis for excluding such requests?
3. Do you delist results displayed following a search:
a. Only on EU / EEA domains?
b. On all domains pages accessible from the EU / EEA or by EU/EEA residents?
c. On all domains on a global basis?
4. What criteria do you use to balance your economic interest and/or the interest of the general public in having access to that information versus the right of the data subject to have search results delisted?
5. What explanations / grounds do you provide to data subjects to justify a refusal to delist certain URLs?
6. Do you notify website publishers of delisting? In that case, which legal basis do you have to notify website publishers?
Additional questions to be answered in writing by July 31:
7. Do you provide proper information about the delisting process on an easily accessible webpage? Have you developed a help center explaining how to submit a delisting claim?
8. Can data subjects request delisting only using the electronic form that you provide, or can other means be used?
9. Can data subjects request delisting in their own language?
10. If you filter out some requests based on the location, nationality, or place of residence, what kind of information must be provided by the data subject in order to prove his nationality and / or place of residence?
11. Do you ask for a proof of identify or some other form of authentication and if yes, what kind? For what reason? What safeguards do you put in place to protect any personal data that you process for the purpose of processing delisting requests?
12. Do you accept general claims for delisting (e.g. delist all search results linking to a news report)?
13. When you decide to accept a delisting request, what information do you actually delist? Do you ever permanently delist hyperlinks in response to a removal request, as opposed to delisting?
14. Do you delist search results based only on the name of the data subject or also in combination of the name with another search term (i.e. Costeja and La Vanguardia)
15. How do you treat removal requests with regard to hyperlinks to pages that do not (no longer) contain the name of the data subject? [Examples: hyperlink to anonymised ruling, hyperlink to page where name of data subject was removed]. Do you immediately recrawl the sites after a removal request?
16. Does your company refuse requests when the data subject was the author of the information he/she posted himself/herself on the web? If so, what is the basis for refusing such requests?
17. Do you have any automated process defining if a request is accepted or refused?
18. What technical solution do you use to ensure that links to material to which a removal agreement applies are not shown in the search results?
19. Which of your services do you consider delisting requests to be relevant to?
20. Do you notify users through the search results’ page information that some results have been removed according to EU law? In that case, which is the legal basis for this? What is the exact policy? In particular, it appears that this notice is sometimes displayed even in the absence of removal requests by data subjects. Can you confirm or exclude that this is actually the case and, if so, could you elaborate on the applicable criteria?
21. Have you considered sharing delisted search results with other search engines providers?
22. What is the average time to process the requests?
23. What statistics can you share at this stage (percentage of requests accepted / partially accepted / refused)? How many have you answered in total? How many per day?
24. Will you create a database of all removal requests or removal agreements?
25. What particular problems have you faced when implementing the Court’s ruling? Are there particular categories of requests that pose specific problems?
26. Could you please provide us with contact details in case we need to exchange on a specific case?