Document Actions

No section

On the Search for an Adequate Scope of the Right to Be Forgotten

  1. Prof. Dr. Rolf H. Weber

Abstract

During the last decades, the virtual world increasingly gained importance and in this context the enforcement of privacy rights became more and more difficult. An important emanation of this trend is the right to be forgotten enshrining the protection of the data subject’s rights over his/her “own” data. Even though the right to be forgotten has been made part of the proposal for a completely revised Data Protection Regulation and has recently been acknowledged by the Court of Justice of the European Union (“Google/Spain” decision), to date, the discussions about the right and especially its implementation with regard to the fundamental right to freedom of expression have remained rather vague and need to be examined in more depth.

Keywords

1. History and Contents of the Right to Be Forgotten

The “right to be forgotten” reflects the claim of an individual to have certain data deleted from the Internet so that third persons can no longer trace them. In contrast, the “right to forget” refers to the already intensively reflected situation that a historical event should no longer be revitalized due to the length of time elapsed since its occurrence.  [1] From a substantive perspective, the right to be forgotten is based on the autonomy of an individual becoming a right holder with respect to personal information on a given time scale; the longer the origin of the information goes back, the more likely personal interests prevail over public interests.  [2]

The right to be forgotten can play a role in different situations depending on the circumstances and the time aspects:  [3]

  • The purpose of the undertaken data processing has been achieved and the respective data are not to be stored or made available any longer. In this situation, two generally accepted data protection principles, namely the proportionality principle and the purpose limitation principle in case of data processing, justify the deletion of the data.

  • The processed data are on a decreasing importance slope and their impacts are “overruled” by persisting priorities of the individual, i.e. private interests exceed public interests.

  • The importance of the processed data and their respective impacts on the society are decreasing due to changing priorities, i.e. the environment influences the (diminishing) justification of the data storage.

The right to be forgotten can also be differentiated according to possible compliance situations with the legal framework:  [4]

  • In case of an initial unlawfulness that has inhered in the processing from its very beginning, the storage of data will never be able to be justified.

  • A non-initial unlawfulness can be pre-existing in a way that this situation has started at a point in time after the beginning of the data processing but before the potential exercise of the right to be forgotten.

  • The unlawfulness can occur subsequently, namely at the moment of the very exercise of the right to be forgotten.

So far, the recent discussions about the right to be forgotten have remained rather vague and abstract. This contribution pleads for the development of an approach that is based on the relevant factual situations and related compliance aspects instead of general perceptions. Such an approach appears to be particularly appropriate in the case of a “conflict” between two fundamental rights (privacy and freedom of expression).

2. Data Protection Regulation

In January 2012, the European Commission submitted the proposal for a completely revised Data Protection Regulation (DPR) which is supposed to replace the Data Protection Directive 1995.  [5]

2.1.  Rationale of the New Approach

When presenting the new Data Protection Regulation, Commissioner Viviane Reding emphasized that “if an individual no longer wants his personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system”.  [6] The right to be forgotten should enable the data owners to be in control of their own identity online. This rationale is reaffirmed in the Recital 53 of the proposed DPR that, after affirming the right to be forgotten of the data subject, observes the particular relevance of this right “when the data subject has given their consent as a child, when not being fully aware of the risks involved by the processing, and later wants to remove such personal data especially on the Internet”. Nevertheless, it has always been assessed that the right to be forgotten is not absolute and that it must not take precedence over freedom of expression or freedom of the media (Recital 53).

The pre-existing “right to erasure” subject to the Data Protection Directive 1995 has been enlarged to a “right to be forgotten and to erasure” in the draft submitted by the European Commission,  [7] however, the parliamentary discussions  [8] led to the conclusion that it would be more appropriate to “delete” the right to be forgotten again and to concentrate on the right to erasure.  [9] In contrast, the Council of the European Union’s position of December 2014 names Article 17 DPR still “Right to be forgotten and to erasure”.  [10]

2.2.  Scope and Content of the Right to be Forgotten

Article 17 (1) DPR specifies the scope of the right to be forgotten (i.e. the right to erasure). This right can be invoked against the data processor if (i) the processing concerns data that are no longer necessary “for the purpose for which they were collected or processed”, (ii) consent has been withdrawn or the storage period consented to has expired, such consent providing the only legal basis for the processing, (iii) the data subject validly objects to the processing, or (iv) the processing violates the legal instrument on any other ground.

As mentioned,  [11] the situation of the lack of further necessity to keep the data can be assessed under the perspective of the fundamental principle of purpose limitation having been in place for quite some time. The withdrawal of the consent also constitutes a well-known concept; if the justification reason for the data processing has elapsed, the storage of data cannot continue any longer. The most difficult situation must be seen in the valid objection by the data subject. The last condition has a residual function, covering processes that are unlawful for any other grounds.

The main entitlement in the right to be forgotten is the normative power to inhibit the continuation of the processing or storage of data. From a procedural perspective, the data subject has a right to an injunction to this effect. Furthermore, the data subject is entitled to enforce the termination of the illegal processing; this right is inalienable, similarly to a property right, and cannot be renounced.

A certain limitation of scope and content of the right to be forgotten consists in the description of the addressee being obliged to comply with an erasure complaint: According to Article 4 (5) and (6) DPR in conjunction with Article 17 DPR only the controller of data is subject to the obligation to delete certain data upon request. Consequently, only if Internet intermediaries can be qualified as data controllers in regard to content originated from third parties, they will be subject to these obligations.  [12]

2.3.  Exceptions of the Right to be Forgotten

The right to be forgotten is not an absolute right. Some apparent exceptions are set out in Article 17 (3) DPR: For example, the controller of data is exempted from the obligation to erase the data to the extent that (i) the processing is necessary for the sake of certain other rights and interests, namely the exercise of the freedom of expression in line with Article 80 DPR, (ii) that public health considerations prevail (Article 81 DPR), (iii) that requirements of historical, statistical and scientific research need to be met (Article 83 DPR) and (iv) that compliance with other legal obligations is compulsory.

As far as the freedom of expression is concerned, legal problems cannot be overlooked: Article 80 DPR “only” contains an authorization/obligation for Member States to limit data protection in order to enable the processing of data carried out for the purpose of journalism and authentic and literary expression. However, the scope of this provision is unclear: Should the rule be understood in the way that processing of personal data for the purposes of journalism and authentic and literary expression are forbidden according to EU law? Should an authorization to processing personal data for such purposes “only” exempt the processing from the right to be forgotten while maintaining its unlawfulness? Both questions are likely to be negatively answered.  [13] Nevertheless, the fundamental right of freedom of expression does not seem to be covered by the exception rule, i.e. the scope of the right to be forgotten as stated in Article 17 DPR cannot be limited by reference to this fundamental right. This lack of clear rules giving guidance for the reconciliation of two fundamental rights  [14] constitutes a major weakness of the proposed exceptions’ regime.

2.4.  Lack of Clear Rules on Conflicts between Fundamental Rights

Without any doubt, the intention of giving the data subject the right to have certain data deleted over time must be supported. However, Article 17 DPR fails to address important problems that have justified its proposal. In particular, the new legal instrument does not contain provisions as (i) to the extent up to which a publication or its persistence through time is legitimate, even when it may go against the interest, or in any case the will, of the data subject and (ii) to the extent up to which the intermediary, rather than the originator of the information, can be responsible for its publication or for failing to comply with removal requests.  [15]

The first issue pertains to the general problem of freedom of expression as confronted with the privacy rights of data subjects. These rights can hardly be “reconciled”, if reconciling means maximising the satisfaction of both; the occurring conflict can only be “settled” by applying a balance of interest test. Therefore, in order to find an appropriate trade-off, not only should the general rules be applied, but the path-dependency of the contextual factors must be taken into account.

With respect to the second issue regarding the liability of intermediaries, it appears to be doubtful whether data protection law alone can provide the best legal framework, even if complemented with fundamental rights. In other words, the specific provisions as contained in Articles 13-15 of the EU E Commerce Directive of 2000 merit better attention in the context of the right to be forgotten.

3. Jurisprudence of the Court of Justice of the European Union

In May 2014, the Court of Justice of the European Union (CJEU) acknowledged the right to be forgotten in the so-called “Google/Spain” case.  [16]

3.1.  Facts of the “Google/Spain” Case

A Spanish citizen having been requested to sell property by way of forced auction more than ten years ago filed a complaint with the national Data Protection Agency against a Spanish newspaper and against Google Spain and Google Inc. in the year 2010. The individual was of the opinion that an auction notice of his repossessed home on Google’s search results infringed on his privacy rights because the proceedings had been fully resolved for a number of years and hence the reference to these proceedings was entirely irrelevant. As far as Google Spain and Google Inc. were concerned, the individual requested that the link to the respective information on the website of the Spanish newspaper would have to be deleted so that it no longer appeared in the search results.

The Spanish court referred the case to the Court of Justice of the European Union submitting three questions, namely (i) whether the Data Protection Directive 1995 of the EU applied to search engines such as Google, (ii) whether EU law applied to Google Spain, given that the company’s data processing server was in the United States, and (iii) whether an individual has the right to request that his or her personal data be removed from accessibility via a search engine (the ‘right to be forgotten’).

3.2. Decision in the “Google/Spain” case

In particular, the Court of Justice was of the opinion that the right to be forgotten would apply if the information is inaccurate, inadequate, irrelevant or excessive for the purposes of the data processing.  [17] The Court of Justice also expressed the opinion that in this particular case the interference with a person’s right to data protection could not be justified merely by the economic interest of the search engine.  [18] However, the Court of Justice clearly found that the right to be forgotten would not be absolute but would always need to be balanced against other fundamental rights without discussing a balance of interest test between privacy and the freedom of expression in detail.  [19] Therefore, the Court of Justice clarified that a case-by-case assessment is needed considering the type of information in question, its sensitivity for the individual’s private life and the interest of the public in having access to the relevant information.  [20]

The decision of the Court of Justice does not concern the “deletion of information”, but “only” the “deletion of a link”. In other words, the critical information can still be found by way of searching through google.com or another search engine.

3.3 Google’s Reaction

Google has criticized the decision of the Court of Justice but reacted quickly by uploading to the website a form which allows individuals to file a request for removal of personal data.  [21] On the one hand, the form is relatively simple and can be filled out quickly; apart from a detailed paragraph outlining the reasoning for the request, no specific details are to be disclosed; nevertheless, a clear identification of the intervening individual must be submitted. Google also announced that it would closely cooperate with the European data protection authorities and appointed an independent council designing the general principles to be applied in individual cases.

In the meantime, already more than 200,000 erasure requests have been filed with Google, of which about 40% were approved.  [22] Transparency with respect to the detailed reasoning of the requests is not given (Google’s Transparency Reports only disclose figures and general information, not detailed arguments), i.e. Google’s decision-making power when assessing the complaints is very broad.

3.4. Follow-up Court Practice

Following the “Google/Spain” decision of the CJEU national courts have applied and interpreted the acknowledged right to be forgotten in different ways:

  • The competent court in Barcelona awarded damages to an individual similarly concerned as the Spanish citizen in the “Google/Spain” decision; however, the amount was much lower than claimed by the individual.  [23]

  • An Amsterdam court rejected a complaint to have certain information deleted based on the argument that the referenced information would not be inaccurate or inadequate in the sense of the “Google/Spain” decision.  [24]

  • A Japanese court decided along the lines of the CJEU reasoning in a judgment rendered in October 2014.  [25]

  • A Spanish court ruled in early 2015 that Google must remove links from a search on a man’s name; from a reference in the decision the conclusion can be drawn that the judgement concerned the individual of the “Google/Spain” case.  [26]

Consequently, the already available court practice since the “Google/Spain” decision shows that a clear delineation of the right to be forgotten has not (yet) been developed. This fact jeopardizes the legal certainty and increases the discretion of the concerned search engine enterprises; from a legal perspective, this result is undesirable.

4. Possible Contours of a Right to be Forgotten

Without any doubt the interest of an individual that certain information having become irrelevant is not any longer accessible merits to be protected in certain circumstances. This assessment was already applied prior to the time of the virtual world; for example, if the criminal conviction of a person long ago should not be disclosed anymore.  [27] The new possibilities to store and spread information, however, require a closer look at the contours of a justifiable right to be forgotten. The respective analysis can be done from a constitutional law perspective or from a regulatory angle.

4.1. Tensions between Privacy and Freedom of Expression

Tensions between privacy in the specific form of the right to be forgotten and freedom of expression/information mirror the balancing test between different interests, often but not always between private interests and public interests. In the Internet age, the most probable/typical situation consists in the following scenario: A certain piece of information is very relevant to the public for a short time after its disclosure (for example, information about a crime). Afterwards, however, this information progressively loses the general interest; nevertheless, it might continue to have a significant impact on the situation of the person concerned (for example, the convicted person after having been released from prison). Consequently, while the benefit to society might outweigh the loss of the individual at the beginning, at a certain point in time, a change occurs insofar as the loss in privacy could outweigh the benefits derived from the freedom of expression. Arguably, at this point, the concerned individual must be entitled to exercise the right to be forgotten.  [28]

4.1.1. Lack of Coherent Constitutional Perceptions

Without a doubt, the Internet is a global medium, and information uploaded onto the Internet is accessible around the globe. Together, these facts create a problem: that a global search engine is confronted with different legal (constitutional) regimes. As the “Google/Spain” case has shown, the Spanish citizen complaining about the existence of a link could force Google to delete this link, but the information is still available and can be retrieved either through google.com or any other search engine. Google also clearly indicated that only the links from European websites are deleted (making people eventually even curious by adding the remark that the search could be limited due to European regulations).

In other countries, the balancing test between two fundamental rights (such as the privacy right and the freedom of expression) could lead to another result. Typically, this statement can be exemplified by way of a comparison between European and American law: In Continental Europe the ideas of autonomy, self-determination and the right to be secure in one’s own reputation from intrusion by others play a key constitutional role; in contrast, American law (mainly the First Amendment to the US Constitution) reflects the traditional distrust of centralized power, i.e. the “freedom of speech is recognized over privacy as a fundamental value, paramount to a functional democracy and an educated society”.  [29] As a consequence, scholars argue that the United States would never implement a right to be forgotten.  [30] In view of this disparity, it can hardly be seen how a reconciliation of the two fundamental rights is achievable on a global level.

The problem of this tension has also been addressed by the Advocate General, Niilo Jääskinen, in his submission of June 25, 2013, to the CJEU, discussing the conflict between two fundamental rights that cannot easily be overcome.  [31] The Advocate General pointed to the fact that search engines would play an important role to the benefit of individuals who are interested in finding certain information and that the search processes would constitute an important concretization of the freedom of expression in the information society.  [32] Based on that, the Advocate General pleaded for the execution of an appropriate balancing test between the different fundamental rights protecting different freedoms; as a result of such a balancing test, the communications freedoms are considered the prevailing human rights.  [33]

An additional constitutional problem which has hardly been addressed so far concerns the question of whether or not, or at least to what extent, the freedom of speech guarantees an easy and speedy access to information at all. Are Internet users entitled to completeness concerning search engine providers’ result lists? And, if so, of what relevance is it that Google did not disclose its search algorithm so far? Thus, it is still incomprehensible according to what criteria the search engine provider represents its results (or even excludes some results).

Therefore, Google has been rigorously criticized for years for rigging the results for their own benefit and to preferentially display their own services; as a result, an investigation before the EU competition commission has been pending since 2010.  [34] Given the increasing importance of search engines in the Internet users’ daily life and, in particular, Google’s market share which amounts to more than 90 percent in Europe, it is necessary to ensure that Google is not misusing its market power.  [35] Feeling unjustly criticized, Google rejected all accusations.  [36] Addressing this issue, the German Federal Minister of Justice, Heiko Maas, (like others) repeatedly invited Google in September 2014 to enhance transparency. The outcome of the different antitrust proceedings involving Google will probably last for quite some time.  [37]

Apart from the theoretical problem of reconciling two fundamental rights, it corresponds to the understanding of a State based on legal principles (“Rechtsstaat”) that such tensions are to be assessed and decided upon by a court (a legal body). Following the “Google/Spain” case, this decision-making power is transferred to a private body, namely the search engine, at least as a first step. Only this private decision can be challenged in court if the concerned person becomes aware of the deletion of a link. It appears to be at least questionable whether or not search engines are qualified to reasonably judge the conflicting interests between an individual (protection of privacy) and an Internet intermediary (safeguarding the openness of communication channels). In a public statement (so-called position paper), a judge of the German Constitutional Court expressed the fear that Google would become a “private arbitral tribunal” with far-reaching discretionary decision power about the communications flow in the Internet.  [38]

4.1.2. Models for Concretizing the Time Factors

The maximisation of the overall outcome in an information society is obtained if a switch from making available all information to erasing certain data is done at the time when the loss in privacy outweighs the benefits derived from the freedom of expression. In other words, the right to be forgotten plays a role in a situation in which certain information relevant for public security loses most of its significance (for example, when the effects of crimes can be immediately detected) while continuing to have a negative impact on the privacy of the person whose data is stored.  [39]

The possibility of tracing the conflict between privacy and transparency through partial concealment or integration (rather than deletion) assumes that the differential benefit provided by the new form of processing is positive after the switch time has been reached. For a concretization of this approach the traditional economic analysis models can be used: with a curve showing the slope for the elapse of time and a curve showing the slope for the importance of society’s knowledge of a specific fact, it is possible to identify at which point (namely where the two slopes cross) the solution should be localized.  [40]

Obviously, probability considerations have to be taken into account in order to assess the flow of time. In order to properly identify the pointing time from which the data controller will no longer be motivated to continue distributing the information, three aspects play a role:  [41]

  • The loss that the party would suffer in case the data were considered to be illegal (publicity interests being outweighed by private interests);

  • The probability that the party assigns to the data being considered illegal;

  • The motivation that the party has for leaving the material online.

In a nutshell, this assessment of potential time expiration models leads to the conclusion that certain relevant factors can be defined, which allow for the execution of a balancing test between two fundamental rights. But, in any case, the factual environment and the historical experience continue to play an important role in the decision-making process.

4.2. Regulatory Delineation of the Scope for a Right to be Forgotten

4.2.1. Art. 17 DPR

An alternative to the often vague and uncertain interest balancing test in the constitutional context would consist of a detailed regulatory delineation of the scope of a right to be forgotten. This attempt has been undertaken by the European Commission with Article 17 of the proposed Data Protection Regulation. However, apart from the fact that the EU Parliament has deleted the reference to the “right to be forgotten”  [42] by shortening the heading of Article 17 to a “right of erasure,” the submitted wording is not convincing.

Some problems, particularly related to the exceptions of the right to be forgotten, have already been analysed.  [43] In addition, the wording appears to be, by far, too complex since the application of some provisions in Article 17 DPR may give rise to uncertainties that could have been prevented by a more thoughtful formulation of the provisions on the “right to erasure” and the “right to be forgotten”. By way of example, the proposed Article 17 para 2 DPR obliges controllers making personal data public to accordingly inform third parties which are processing the data; this provision’s content is unclear and the addressee is vague. The EU Parliament’s alteration of this Article-- to the effect that the controller, who has made the information public without a justification, has to take all reasonable steps to have the data erased-- cannot be seen as a remedy and rather increases the provision’s indeterminacy.  [44] Additionally, redundancies and inconsistencies with the language used in other parts of the newly proposed Regulation do exist.  [45]

 

 

4.2.2. Article 29-Working Group

Another approach has been chosen by the EU's Article 29-Working Group which has issued guidelines on the implementation of the Court of Justice’s Google Spain judgement on 26 November 2014.  [46] These guidelines concretize the right to be forgotten by offering a list of 13 criteria for European data protection authorities (DPA) to take into consideration when handling complaints (on a case-by-case basis). First of all, the DPA has to ensure that the research results relate to a natural person and come up against a search on the data subject’s name (No. 1); provided the data subject plays a role in public life, there is usually an interest of the public in having access to the information about them (No. 2). The data subject’s age can be seen as another important factor; in the event that the data subject is a minor, the DPA is more likely to require de-listing of the relevant results (No. 3). Concerning the published data, the data protection authorities need to assess whether the data are accurate, relevant and not excessive (Nos. 4 and 5) and, if so, whether or not the data is up-to-date or being made available for longer than is necessary for the purpose of the processing (Nos. 7 and 8).

In the instance that the relevant information is classified as being sensitive within the meaning of Art. 8 of the Directive 95/46/EC or if the search results link to information putting the data subject at risk, the DPAs are more likely to intervene when a de-listing request is refused (Nos. 6, 9). The result of the assessment should be the same in cases where the content was voluntarily made public by the data subject that revoked its once given consent later (No. 10). As far as the published data relate to a criminal offence, the interest of the general public to have access to the information might be increased (No. 13). Besides that, it may also be relevant to consider whether the information has been published for a journalistic purpose (No. 11) and whether the publisher of the data had a legal power or obligation to make the personal data publicly available (No. 12).

These criteria should be seen as a flexible working tool, and all de-listing requests should be assessed on a case-by-case basis in consideration of the factual environment. In summation, it can be said that a regulatory framework delineating the scope of the right to be forgotten must consist of a cluster of protection measures  [47] which adequately assess the different interests involved.

4.2.3. Liability of Internet intermediaries

Apart from the above discussed need to define precise regulatory criteria, a further important aspect has not been discussed in-depth so far: As mentioned, as a consequence of the “Google/Spain” decision, the search engines do have wide discretion in the decision-making about submitted requests to have certain links deleted, thereby executing the function of a judge;  [48] however, the risk of liability occurs. In order to motivate search engines to thoroughly assess the legal situation in the case of an erasure request, the risk for becoming liable due to a “wrong” decision should be particularly reflected in the regulatory regime.

As a consequence, it would be worthwhile to consider to what extent the specific liability provisions contained in Articles 13-15 of the Directive on Electronic Commerce (E-Commerce Directive)  [49] should also be applicable in the context of the right to be forgotten. Is it justifiable to grant a privilege to a search engine provider along the lines of the E-Commerce Directive’s immunities for avoiding sanctions when failing to comply with an erasure request?  [50] The answer to this question depends on whether the provider, having been requested to remove data, can still be considered as not having knowledge of these data’s illegality. If this knowledge encompasses both the provider’s awareness that certain data are hosted in his platform and that the respective data are illegal, a provider having failed to comply with a justified removal request is subject to injunctions by the component authorities but may still be released from liabilities for processing the data as long as an uncertainty existed on whether such processing violated data protection law.  [51]

 

5. Overall Assessment and Outlook

Privacy is an important value and a fundamental right that has been underestimated for many years. In addition, the enforcement of privacy rights is becoming more and more difficult in the virtual world. Therefore, particularly in Europe, privacy has been perceived as a fundamental right which merits higher attention.

An emanation of this trend is the newly propagated right to be forgotten which protects the control right of the data subject over his/her data. However, the legal implementation of such a right is more difficult than the moral appreciation. The deletion of information can have an impact on third persons and on the society as a whole.  [52]

This assessment can be easily made if an analysis of the proposed Article 17 DPR is done; the rationale of the proposed provision merits support, but the wording, as such, is not convincing and should be adapted and amended in order to become a guiding force in the field.  [53]

A similar evaluation can be done with respect to the “Google/Spain” decision of the EU-Court of Justice: The wish to have the Spanish citizen protected against disclosure of quite old information is understandable; however, the chosen approach does not solve many problems but rather causes additional problems. Furthermore, Google is not obliged to delete certain pieces of information but only to remove the link to this information, having the consequence that the information can still be found through other technical measures, such as the search engine of Google.com or the initiation of a search process with more variables.

In particular, neither the Data Protection Regulation nor the “Google/Spain” decision clearly address the tensions caused by the parallel application of the freedom of expression and the right to be forgotten.  [54] The tensions are occurring because two fundamental rights need to be balanced against each other in order to avoid contradictory results, notwithstanding the fact that a reconciliation between the two fundamental rights is quite difficult. Even the proposed DPR, that could have stated specific rules in relation to the applicability of privacy or freedom of expression, remains silent on this point.

The guidelines of the Article 29-Working Group on the implementation of the “Google/Spain” judgement offer a list of 13 criteria to handle complaints and therewith also concretize the right to be forgotten. But the Working Group’s guidelines address the right to freedom of expression only marginally and leave room for interpretation, too.

This situation leads to the fact that Internet intermediaries and search engines become responsible for monitoring the Internet traffic. This unfortunate situation cannot easily be remedied. Notwithstanding the fact that the “Google/Spain” decision only requests the search engine to remove the links to the contested information, not to delete the information, more attention should be paid to the possibilities of improving the difficult reconciliation between the two fundamental rights. In this context, the responsibility of search engines in their function as Internet intermediaries needs to be reconsidered and legally adapted to the requirements of the respected activity.

 

 



[1] See Rolf H. Weber, The Right to Be Forgotten. More Than a Pandora’s Box?, JIPITEC 2011, p. 120, n 3.

[2] Weber (supra note 1), p. 125, n 27-31.

[3] For more details see Giovanni Sartor, The right to be forgotten: Publicity, privacy and the passage of time, in: Schartum/Bygrave/Berge Bekken (eds.), Jon Bing – A Tribute, Oslo 2014, pp. 79, 81-93.

[4] Sartor (supra note  [3]), p. 99.

[5] See Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM (2012) 11 final, 25 January 2012, available at: http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf.

[6] Viviane Reding, The EU Data Protection Reform 2012: Making Europe the Standard Setter for Modern Data Protection Rules in the Digital Age, Speech at the Conference Digital, Life, Design Munich, 22 January 2012, available at: http://europa.eu/rapid/press-release_SPEECH-12-26_de.htm.

[7] See Proposal for a General Data Protection Regulation (supra note  [5]), Art. 17.

[8] See European Parliament legislative resolution of 12 March 2014 on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), 12 March 2014, available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P7-TA-2014-0212+0+DOC+XML+V0//EN.

[9] See also Giovanni Sartor, The right to be forgotten in the Draft Data Protection Regulation, International Data Privacy Law, 2015, Vol. 5(1), 64-72, p. 71.

[10] Council of the European Union, 15395/14, 19 December 2014, available at: http://amberhawk.typepad.com/files/dapix-text-eu-council-dp-reg-december-2014.pdf; see also Sartor (supra note  [9]), p. 71.

[11] See above margin number 2.

[12] Sartor (supra note  [9]), p. 65.

[13] Sartor (supra note  [9]), p. 67.

[14] For a more detailed discussion of this so far often neglected problem see margin numbers 14 and 28.

[15] Sartor (supra note  [9]), p. 70.

[16] CJEU, Decision of May 13, 2014, Rs C-131/12, Google Spain SL. Google Inc./Agencia Espanola de Protección de Datos, Mario Costeja González.

[17] CJEU (supra note  [16]), n 92-94.

[18] CJEU (supra note  [16]), n 81.

[19] CJEU (supra note  [16]), n 81.

[20] CJEU (supra note  [16]), n 94.

[21] See Google, Search removal requests under data protection law in Europe, available at: https://support.google.com/legal/contact/lr_eudpa?product=websearch&hl=en.

[22] See Google Transparency Report, European privacy requests for search removals, available at: http://www.google.com/transparencyreport/removals/europeprivacy/?hl=en.

[23] Barcelona Court of Appeals, 364/2014, 17 July 2014, online available at: http://www.poderjudicial.es/search/doAction?action=contentpdf&databasematch=AN&reference=7173091&links=08019370162014100388&optimize=20140929&publicinterface=true.

[24] District Court (Rechtbank) Amsterdam, C/13/569654 / KG ZA 14-960, 18 September 2014, available at: http://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2014:6118.

[25] Tokyo District Court, 9 October 2014, see http://www.wsj.com/articles/google-japan-case-raises-privacy-issues-1413981229.

[26] See http://www.bloomberg.com/news/articles/2015-01-23/google-gets-spanish-court-order-to-cut-search-links-on-privacy.

[27] See Weber (supra note 1), p. 121, n 7.

[28] Compare CJEU (supra note  [16]), n 89, 93 and 98.

[29] Peter Brown, The Right to be Forgotten: U.S. Rulings on Free Speech Won’t Let Google Forget, Cri 2014, pp. 161, 162.

[30] Brown (supra note  [29]), p. 164; see also ibid. to the US court practice related to free speech and search engines.

[31] CJEU, Opinion of Advocate General Jääskinen, 25 June 2013, n 2 and 103.

[32] CJEU, Opinion Jääskinen (supra note  [31]), n 121 and 131.

[33] CJEU, Opinion Jääskinen (supra note  [31]), n 127, 128 and 133.

[34] European Commission, Antitrust: Commission probes allegations of antitrust violations by Google, Press Release IP/10/1624, 30 November 2010, available at: http://europa.eu/rapid/press-release_IP-10-1624_en.htm.

[35] Federal Ministry of Justice and Consumer Protection, Interview Bild am Sonntag: Justizminister Heiko Maas nutzt Google beinahe täglich, 28 September 2014, available at: http://www.bmjv.de/SharedDocs/Interviews/DE/2014/Print/20140929_Maas_BAMS.htm.

[36] Google Germany, publicly delivered reply to Heiko Maas, Federal Minister of Justice, 28 September 2014, available at: https://plus.google.com/+GoogleDeutschland/posts/FgeXzAQPACR.

[37] See Rolf H. Weber/Stephanie Volz, Kartellrechtlicher Handlungsbedarf im Lichte potenzieller Meinungsmacht von Suchmaschinen, Wirtschaft und Wettbewerb 2015 (forthcoming, March 2015).

[38] Johannes Masing, RiBVerfG Masing: Vorläufige Einschätzung der “Google-Entscheidung” des EuGH, 14 August 2014, available at: http://irights.info/artikel/ribverfg-masing-vorlaeufige-einschaetzung-der-google-entscheidung-des-eugh/23838.

[39] To the civil law perception see Weber (supra note 1), pp. 121/22, n 5-9.

[40] This approach has been chosen by Sartor (supra note 3), p. 92.

[41] Sartor (supra note  [3]), p. 99.

[42] See European Parliament legislative resolution of 12 March 2014 (supra note  [8]).

[43] See above margin number 12.

[44] Sartor (supra note  [9]), p. 72; the author (p. 72) considers Article 17 para 3 DPR of being anyhow unnecessary since the exclusion of lawful processings from the scope of the right is obvious due to the fact that Article 17 para 1 DPR only covers unlawful processings.

[45] For further details see Sartor (supra note  [9]), pp. 65/66.

[46] Article 29 Data Protection Party, Guidelines on the Implementation of the Court of Justice of the European Union Judgement on “Google Spain and Inc. v. Agencia Española de Protection de Datos (AEPD) and Mario Costeja Gonzales” C-131/12, 14/EN WP 225, adopted on 26 November 2014, available at: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp225_en.pdf.

[47] See Rolf H. Weber, Der Ruf nach einem Recht auf Vergessen: Ein neues datenschutzbezogenes Verfassungsrecht im Spannungsfeld zwischen Privatheit und Transparenz?, digma 2011, p. 104.

[48] See above margin number 34.

[49] Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on Electronic Commerce).

[50] See Sartor (supra note  [9]), p. 70.

[51] See Sartor (supra note  [9]), p. 71.

[52] Right to information.

[53] See also Sartor (supra note  [9]), p. 72.

[54] Fore more details see Rolf H. Weber/Ulrike I. Heinrich, Verletzt das Recht auf Vergessen(werden) des EuGH die Meinungsäusserungsfreiheit?, in: IT-Jusletter Weblaw of December 11, 2014.

Fulltext

License

Any party may pass on this Work by electronic means and make it available for download under the terms and conditions of the Digital Peer Publishing License. The text of the license may be accessed and retrieved at http://www.dipp.nrw.de/lizenzen/dppl/dppl/DPPL_v2_en_06-2004.html.

JIPITEC – Journal of Intellectual Property, Information Technology and E-Commerce Law
Article search
Extended article search
Newsletter
Subscribe to our newsletter
Follow Us
twitter