The highest court in the European Union ruled Tuesday that search engines such as Google have a responsibility to allow individuals the right to scrub their online histories.
The decision, handed down by the Court of Justice of the European Union, puts the onus on search engine operators to field and evaluate appeals from individuals who want to have links to harmful or unflattering content removed from their services, even if the material was published legally or as part of media coverage or government postings. Along with its effect on Google, the decision has the potential to affect the operations of all search engines in Europe, including Yahoo and Microsoft's Bing.
The case in question dealt with the complaint of Mario Costeja, a Spanish citizen who found that a link to a newspaper notice detailing a 15-year-old debt -- one that had been repaid -- was showing up prominently in Google searches for his name. He appealed to Google's office in Spain to have the link removed, saying that information was both no longer true and damaging to his reputation. Google refused, noting that the information had been published legally and that Google had no hand in creating the content and was therefore a neutral party. But the court found that search engines do have obligations under data protection laws -- in Google's case, because its advertising sales office processes search result data.
The ruling cannot be appealed and will apply in all of the European Union's 28 member states.
In a statement, Google said that it is disappointed in the ruling and is evaluating how it affects its larger business.
In a similar statement, Yahoo indicated that it believes the ruling crosses a line into censorship. "Since our founding almost twenty years ago, we’ve supported an open and free internet; not one shaded by censorship," the company said in a statement. "We’re now carefully reviewing the European Court of Justice’s decision to assess the impact for our business and for our users.”
Microsoft did not immediately respond to a request for comment.
Privacy has been a hot-button topic in the United States and the European Union for years. But it has come to a head in light of the information leaked by former National Security Agency contractor Edward Snowden, which revealed just how much access the U.S. government has to information collected in the private sector. Those revelations sparked a stronger push for data protection in the EU, and this ruling follows hard on the heels of another pro-privacy ruling on data retention last month.
Fordham Law professor Joel Reidenberg, an expert on information law and privacy, said that the ruling could affect how these companies structure their worldwide operations. For one, it shows that setting up an office in a country such as Ireland, which -- on balance -- has a less protective data privacy law than others in the European Union, is no longer an effective way to avoid stricter laws in other EU countries. Gone, too, is the argument that search engines should have a very small role policing the content that their queries surface online, Reidenberg said.
"The decision is telling Google that an algorithm doesn't shield you from a privacy claim," he said. "That's a position that many in the big data world and in the U.S. have been advocating."
This complicates the role that Google and these other firms play as arbiters of online privacy and open information. While the court ruled Google must evaluate users' claims, it also said that it can reject the requests if there's a "preponderance" of evidence that keeping the information online is in the public interest. The court, however, does not provide any guidance on how companies should evaluate that situation.
The court does, however, say that individuals can appeal company decisions to national data protection agencies -- a provision that opens companies up to potential fines by those agencies in cases of disagreement. Critics have warned that companies could opt to deal with the issue by removing all information identified in the complaints, opening up the system to abuse by those who wish to hide negative information from the public.
In fact, Reidenberg said, search engines may be able to apply systems similar to the ones they employ to block material that copyright or other rights holders say infringe on their property rights.
"Certainly, we see that in the context of intellectual property, that there's no trouble" in taking down information, Reidenberg said. The ruling, he said, indicates that -- for Europeans -- the court is saying that individual privacy rights are at least as important as those economic rights.
The situation in the United States is very different. There has been little concrete movement from the U.S. government on the issue of online privacy, and the government has generally opted to let the industry regulate itself on privacy matters. Even in a recent White House report that acknowledged that data collection efforts can lead to discriminatory practices, the government has stopped short of calling for even a broad-based privacy protection law.
Measures like the one recommended by the European court, some say, do not strike the right balance between free expression and privacy.
"This result is incompatible with the right to free expression, and wouldn't be possible on American soil because of the First Amendment's protections," said Lee Rowland, staff attorney for the American Civil Liberties Union’s speech, privacy and technology project. "Requiring Web sites to eliminate or hide access to already public information is a troubling precedent that harms the freedom of expression without producing meaningful gains for the right to privacy."
Still, the "right to be forgotten" -- to have your own say over what kind of information can or should be linked to your name online -- has long been championed in the United States by privacy advocates, who say that consumers should have a say in what should be included in their online profile of publicly available information. Federal Trade Commissioner Julie Brill has been particularly vocal on the issue, aiming to introduce a similar movement in the United States through an initiative she calls "Reclaim Your Name." The principles of privacy, she notes, do not have to raise concerns about the right to free expression.
"There is no reason that big data cannot coexist with an effective Do Not Track mechanism and with a system that empowers consumers to make real choices about how their private information will be used," Brill said in a speech last summer. "The ability to claim your name – or in the case of big data, Reclaim Your Name – is as American as Mom and apple pie."
The European court's ruling is unlikely to spark any fast movement among U.S. lawmakers, who have long dragged their feet in producing privacy legislation, Reidenberg said. But it does add ammunition to those fighting for similar provisions in America, he said, by providing "a degree of international legal support."