Is there a "Right To Be Forgotten"? I don't know

A number of people have asked me what the recent European Court judgment in the Google “right to be forgotten” case means; here’s why I have been answering that I don’t know!

The case concerned a fifteen-year old article in a Spanish newspaper about a named individual who had got into financial difficulties. The individual, whose circumstances are now apparently different, asked the Spanish courts to order under Data Protection law that the article be removed from the newspaper’s on-line archive and that Google must stop linking to it. The national court concluded that the newspaper was not required to remove the article, but asked the European Court’s view on whether Google might be. That court has now made its ruling, which almost all commentators seem to regard as a simple "yes", and that the court has therefore found that a "right to be forgotten" already exists under European law.

My problem is that the Court’s judgment doesn’t seem to make clear where in law that right is to be found. They refer to three requirements of data protection law:

• personal data must be accurate;
• personal data must not be kept longer, or in greater quantity, than is required for the purpose of processing;
• the legitimate interest of an organisation in processing personal data may, on occasion, be overridden by the interests of the individual whose data are processed.

The first two of those ought to be simple questions of fact, applying equally no matter who the person is. If information is wrong, or you no longer need to keep it, you must correct or delete it. However the Court’s discussion says that the right to delete isn’t equal – it "may vary, in particular, according to the role played by the data subject in public life" [para 81]. That doesn’t seem to match either the "inaccurate" or "unnecessary" reasons for deletion.

The Court’s own press release talks mostly about a balancing test between the rights of the individual and those of the search engine and the readers of the article. That sounds more like the third, legitimate interests, argument. However the court also says that the right to deletion does not require "that the inclusion of the information in question in the list of results causes prejudice to the data subject" [para 96]. If the individual is not going to suffer any harm, then how can they "win" a test of balancing interests? Chris Pounder is the only commentator I’ve found who looks at this angle and his argument seems sound to me. It’s just that everyone else seems to be reading the case the other way!

I just hope that when the case returns to Spain, the court there makes a better job of explaining its reasoning, so I can work out how it might apply to different circumstances.

[UPDATE] The UK Information Commissioner says "there is no absolute right to have links removed", and that Data Protection Authorities will be working together to produce guidance "to ensure search providers take the right approach". That's good news, but the guidance needs to be clear and simple for search engines to follow, otherwise there is a risk that they will simply delete any link that is the subject of a complaint. That 'allege and takedown' response was sufficient of a problem under defamation law that a new Act had to be passed last year to restore the balance of incentives for hosting providers. It would be a waste if this judgment now recreated the old, unbalanced, legal position for a diffferent group Internet intermediaries and for those who want to make, and find, critical statements online.