Monday, September 5, 2011

"The Right to be Forgotten", seen from Spain

I'd like to share some personal musings about an interesting series of court cases pending in Spain, pitting the "right to be forgotten" against the right to freedom of expression. The New York Times reported on this debate recently. In a nutshell, the cases ask the question whether people can demand that search engines delete content from their indexes, even if the content is true and the third-party site that published it clearly has the right to publish it (e.g., newspapers).

Virtually everyone uses search engines to find information on the web. There are way over a trillion pages on the web today. To help people find what they're looking for in the vastness of the web, search engines create giant indexes of the web. Search engines are intermediaries, since they don't create, select or edit the content on the web sites they index. Search engines try to match a user's search query with the search results most likely to be relevant, using complex algorithms to rank the likely relevance of a particular webpage. The vast majority of websites want to appear in search engine indexes, but if they don't want to be included in the index, they can use a simple tool, called robots.txt, to opt-out of being indexed by all leading searching engines.

Many websites publish information about people, and sometimes this information can be hurtful to a person's sense of privacy or reputation. For example, government websites or newspapers may publish information about criminal convictions or accusations of medical malpractice. People who feel that information about them was wrongly published by these web sites can always ask them to correct or delete it. But newspapers and government websites usually have published this information legally, or indeed may even be legally obligated to publish it, or may be exercizing their rights of freedom of expression. As search engine intermediaries, Google and other search engines play no role in what these web sites publish, or in deciding whether they should revise or remove content based on someone's privacy claim against them.

That's why I think it's wrong that the Spanish Data Protection Authority has launched over a hundred different privacy suits against Google, demanding that Google delete web sites from its index, even though the original websites that published the information (including Spanish newspapers and Spanish official government journals) published that information legally and continue to offer it. The legal question is important: should search engines like Google be responsible for the content of the web sites that they index? Should Google be forced to remove links from its search index, in the name of privacy, even if the websites that published it want to be included in its search index and the content is legal? Should search engines be used to make information harder to find, even if the information is legally published?

I have great sympathy with people who feel their privacy has been invaded by a web site that publishes information about them. But search engines shouldn't be asked to delete links to legal content that is published by a third-party website. These cases have sometimes been referred to as about the "right to be forgotten". In fact, these cases are not about deleting or "forgetting" content, but just about making it harder to find content. These cases would make it impossible for users to use search engines to find content that otherwise continues to exist on the web.

It's not hard to imagine the negative consequences for freedom of expression, if search engines could be ordered to delete links to any website that publishes content about a person that is deemed to have invaded someone's privacy. The debate about privacy v freedom of expression is an important and timeless debate, which is becoming more urgent in the age of the Internet. But it's wrong to try to use search engines to try to make legal information harder to find. It's wrong to use search engines as a indirect tool of censorship, since European law rightly holds the publisher of material is responsible for its content. Requiring intermediaries like search engines to censor material published by others would have a profound chilling effect on freedom of expression.

There are better ways to protect privacy online, by remembering that it should be the publisher of content who is responsible for it. Interestingly, the Spanish Data Protection Authority seems to be coming around to this conclusion itself. It recently issued a resolution ordering a website to use the robots.txt protocol to exclude some of its pages from search engine indexes. That's exactly the right approach. Now, the debate will turn to the websites that receive such orders: should they exclude some of their pages from search engine indexes, in the name of privacy, or should they refuse, in the name of freedom of expression? Newspapers worldwide, and in particular their online archives, will soon be in the middle of this debate. I believe that Spanish papers, like El Pais, are now respecting such orders. I would wager that The New York Times wouldn't, based on their reporting on Two German Killers demanding Anonymity Sue Wikipedia's Parent.

This is a difficult debate, and I'm sure that different publishers will come to different conclusions about it. That's how it should be.


Anonymous said...

What about the arguments in Mayer-Schonberger's book "Delete"?

Jules Polonetsky said...

Well argued. Sharing this on Google+ (dont see you there)

Darkmane said...

So I understand that the privacy regulations are poorly written and attacking the wrong end of the problem, but I don't think that they are completely wrong.

The Google Cache is a wonderful tool in many ways, but in the event that a newspaper took down a page and issued a correction on a different page. It would be possible that the original page would retain a higher ranking and false information could be disseminated as true.

I don't think it should be unreasonable for a government to establish a maximum data retention time. It would be wrong to have the Google index not reflect the state of web, but there are other Google products that it might make sense to create a data retention policy

Anonymous said...

Peter Fleischer debe desconocer profundamente que, en España, las dos únicas personas que han solicitado la retirada de datos de Google Maps no recibieron atención de Google, y tuvieron que dirigirse a la AEPD para que se pronunciase (positivamente). La Resolución 1257/2010 de la AEPD, de un procedimiento de Google Maps EXPLICA QUE Google ni siquiera recogió la comunicación del afectado “No se hizo cargo” y posteriormente Google le negó el derecho.

Casi un centenar de sentencias (resoluciones) de la Agencia Española de Protección de Datos) han pedido a Google retirar datos y Google las está recurriendo, generalmente, ante la Audiencia Nacional, sin eliminar los datos. ¿Qué significa entonces QUE google intenta cumplir con las Agencias Europeas?

La persona que está incluida en un BOE, o en un Boletín Autonómico, en muchas ocasiones debe verse resignada a que sus datos se publiquen oficialmente puesto que obedece a una publicación amparada en la Ley.

¿Tiene el mismo derecho Google que el BOE a publicar los datos? No. Y con más importancia ¿debe el ciudadano resignarse ante Google sabiendo que el BOE difícilmente lo eliminará? No.

La declaración de Peter Feisher choca frontalmente con el derecho de oposición establecido en la LOPD (art.6.4) que obliga a retirar contenidos sin necesidad de acudir al origen.

En Francia Google fue condenada por mostrar, en las sugerencias de búsqueda (es decir, antes que en los resultados), el nombre de un particular asociado a conductas delictivas de su pasado. En España, la AEPD lo ha declarado en multitud de ocasiones.

Peter Feisher defiende la postura de Google como si el buscador fuese un medio de comunicación con las garantías de información establecidas en el artículo 20 de la Constitución Española, obviando que su difusión es desproporcionada. Hoy por hoy, con las sentencias en la mano, Google no es un medio de comunicación con las garantías del artículo 20 CE. Pero si quisiera serlo, tiene un buen trabajo por delante para cumplir las obligaciones, incluso formales, de privacidad.