Why Google Spain worries me

Next month I'll be going to an academic conference on Google Spain and the "Right to be Forgotten" (actually, "right to be delinked") so I thought I'd better organise my thoughts on why, as a provider and user of communications and information services, the decision worries me. And I am much more worried by the decision itself and the train of proposed law it seems to have created than by how Google has responded. Their response may indeed have been driven by PR and commercial interests – it certainly doesn’t follow the legal incentive the ECJ created – but Google’s actions and the proposals of their Advisory Council are far less harmful to fundamental rights than I feared when I read the Court’s original decision. Nor are my concerns about where the balance between the rights to privacy and to receive information actually lie.

So why am I worried?

1. The Wrong People are Deciding. The "right to be delinked" is, essentially, a conflict between two fundamental rights – the right to privacy (Article 8 of the European Convention) and the right to communicate and receive information (Article 10). Both rights are qualified – the Convention recognises that there are occasions where one or other will take priority. And the Convention expects that the appropriate place for that balance to be decided is a court. However when the European Court of Justice (ECJ) had the chance to consider the balance in Google Spain it didn't actually make a decision. Instead it said that a search engine was covered by data protection law, and that in some circumstances the Article 8 right to privacy would override the Article 10 right to receive information. The issue of deciding which circumstances, in other words of setting the balance between two fundamental rights, was handed back to the search engine. And, as far as I can see, there's no way, at least in UK law, to ever get the decision-making back into the ECJ where it belongs. If I ask for a link to be removed from search results and the search engine doesn't (in other words it gives too much weight to Article 10) then I can appeal to the Information Commissioner and, eventually, it's possible for the dispute to end up back in the ECJ. But if the search engine removes a link that it shouldn't (for example if another Andrew Cormack asks for one of my search results to be removed and the search engine – giving undue weight to Article 8 – mistakenly does), then I can't see any way for me to bring my complaint to any court. I don't have a contract with the search engine that they will link to my articles (no adwords here!) and, as a private company, it doesn't seem possible to make a direct claim against them for breach of Article 10.
2. They're Encouraged to Decide One Way. Not only does that situation give me no way to defend my Article 10 right to be heard, it also gives the search engine a strong incentive to override that right in favour of any claim for privacy. Even if the ECJ hadn't made the (questionable, given previous cases) statement that "[privacy] rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name", if you are faced with a decision where one choice can land you with the costs of defending a court case and the other can't, which would you choose? This problem of one-sided incentives has been known for a long time. More than a decade ago Bits of Freedom's Multatuli project found that a false claim of copyright infringement (Multatuli placed the work in question in the public domain) was sufficient to have a document removed from the majority of web hosting sites. This shouldn't have been a surprise: if the host left the document and turned out to be wrong then they risked finding themselves in court, if they removed it then there was no legal risk thanks to clauses in their contracts with customers. One-sided incentives on Internet intermediaries are a well known problem. The European Commission have been investigating the incentives created by notice and takedown schemes for years; the Defamation Act 2013 finally provided an alternative course of action that protects UK hosting services from one-sided liability risk. But now the ECJ has created a new one, applying to no less than the "gatekeepers to the internet".
3. Proposed Solutions Make Other Problems Worse. Google seems, at least for now, to have resisted the temptation to follow that incentive and simply remove any search result that was the subject of a complaint. However the risk of a search engine adopting that approach does seem to have been noticed, to judge from a recently proposed amendment to the "Right to Be Forgotten" section of the draft General Data Protection Regulation, discovered by Statewatch. This would require all internet search engines to create independent dispute resolution bodies to ensure that fundamental rights were balanced. Quite apart from the effective side-lining of the public court system, that would impose a substantial cost burden on anyone running a search engine. For the existing dominant players that might create a dent in the bottom line, but for would-be entrants into the market it could well make their finances unviable. In 2000 the e-Commerce Directive considered it important that there be special immunities for internet intermediaries, in order to promote a competitive market in these vital services. Has the market now changed so much that we can, instead, consider placing special burdens on intermediaries and exclude new competitors?