Google has kicked against it. Eric Schmidt was doing so in public only last month. But European regulators are now stipulating the so called ‘right to be forgotten‘ ruling should apply to search results displayed on Google.com, not just on European sub-domains such as Google.co.uk.
The reason the regulators want this expansion is to avoid an easy circumventing of the law, based on Google’s current implementation, which allows users to bypass the ruling by searching for private individuals’ names on Google.com. It’s then trivial to compare results on a sub-domain with results on Google.com for discrepancies.
The ‘right to be forgotten’ is actually a right for private individuals in Europe to request that inaccurate, outdated or irrelevant information be de-listed from any search engine’s results for a specific search for their name. It does not erase any source material from the Internet, as is often erroneously reported. And it does not only apply to Google, although Google has a hugely dominant share of the European search market (circa 90 per cent) — so in practice it hits Google hardest.
So far, in the roughly six months since the ruling, the search engine has received just under 175,000 search de-listing requests covering just over 600,000 URLs. It has agreed to less than half (41.5%) those requests, de-listing just over 208,500 URLs.
The search de-listing request right stems from a judgement by Europe’s top court this May which ruled that search engines are data controllers and therefore subject to existing European data protection legislation.
The ruling does not extend to public figures — so it requires search engines to weigh up any public interest component attached to a de-listing request. This can lead to complex judgements being made by search engines, albeit plenty of search de-listing requests do not require a degree in ethics to navigate — such as victims of abuse wishing their name to no longer be defined by news of their abuse. (For those interested, Google reveals some details about the requests it receives via its Transparency Report.)
Speaking in a public debate forum back in October, organized by Google to generate debate about the ruling, Schmidt argued that since the law focuses on European users Google is going to focus implementation on European sub-domains only.
“A very small percentage — less than 5 per cent — of European traffic goes to .com so 95 per cent or more are to these sites, I don’t know the exact number, and that’s where the action is,” he said.
During the debate Schmidt was also asked a question specifically about whether the public should move to searching Google.com rather than searching sub-domains such as Google.co.uk in order “to remove edited or removed information”, as the questioner put it.
“I am not recommending that, however we have reported that some people do it,” Schmidt answered.
Well, the window of opportunity for people to trivially circumvent European law by switching searches to Google.com looks to be closing.
The Article 29 Working Party, which is composed of representatives from the data protection regulators of individual European Union Member States, issued a press release today noting that the group has adopted guidelines on the implementation of the European Court of Justice ruling.
It has not yet published those guidelines — TechCrunch understands they are due later this week — but the release notes specifically that the law can’t be implemented effectively unless de-listing is also applied to .com domains, not just on EU domains (as Google has been doing).
The regulators write:
The WP29 considers that in order to give full effect to the data subject’s rights as
defined in the Court’s ruling, de-listing decisions must be implemented in such a way that
they guarantee the effective and complete protection of data subjects’ rights and
that EU law cannot be circumvented. In that sense, limiting de-listing to EU domains
on the grounds that users tend to access search engines via their national domains
cannot be considered a sufficient means to satisfactorily guarantee the rights of data
subjects according to the ruling. In practice, this means that in any case de-listing should
also be effective on all relevant .com domains.
A Google spokesperson contacted by TechCrunch declined to comment in detail. “We haven’t yet seen the Article 29 Working Party’s guidelines, but we will study them carefully when they’re published,” the spokesperson said in an emailed statement.
The WP29 press release also notes that EU law affords “everyone a right to data protection” — which sounds like a shot across Google’s bows, since it could mean a non-European resident could technically apply for personal data to be de-listed by a search engine.
However the WP29 adds that national data protection authorities will be focusing their energy where they see “a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident of an EU Member State”.
The forthcoming WP29 guidelines on implementing the search de-listing ruling will include a list of 13 main “common criteria” which data protection authorities can use to handle appeals where a search de-listing request has been refused. It emerged that the regulators were working on appeals criteria back in September.
Despite this list incoming to help steer national DP regulators, the WP29 noted that the stress remains on dealing with appeals on a case-by-case basis.
“No single criterion is, in itself, determinative. Each of them has to be read in the light of the principles established by the Court and in particular in the light of the ‘the interest of the general public in having access to [the] information’,” it adds.