Recommendations on the right to be forgotten By La Quadrature du Net and Reporters Without Borders

The European Union Court of Justice ruling of 13 May 2014 on a case brought by Google Spain highlighted the problems for the protection of freedom of expression and the right to information posed by the right to be removed from search engine results and, more broadly, the right to be forgotten. Privacy and freedom of expression are fundamental rights of equal value (articles 8 and 10 of the European Convention on Human Rights and articles 8 and 11 of the Charter of Fundamental Rights of the European Union). Whenever one conflicts with the other, a balance must be reached under a judge’s authority because, as a matter of principle, one cannot be given more importance than the other. The EUCJ ruling requires search engine operators such as Google to deal with requests by members of the public for removal from search engine results. Responsibility for a decision involving individual freedoms that should be handled by a court is thereby delegated in practice to a private sector company. This delegation of responsibility is all the more dangerous because the ruling is based on vague and general principles that provide no guarantee for freedom of expression. In response to the EUCJ ruling, Google established an advisory committee that is currently working on the formulation of more precise rules for search engine operators on how to respond to requests to be removed from results. The questions that Google is asking on how to strike a fair balance between the right to be removed from results and the public’s freedom of expression and information are perfectly legitimate, but the fact that a private sector company is posing these questions accentuates the growing trend to privatize the implementation of Internet regulation, and is therefore unacceptable. National data protection bodies such as France’s National Commission for Information Technology and Freedoms (CNIL) are meanwhile also working on the formulation of precise rules in response to the EUCJ’s ruling. But, in so doing, they are exceeding their powers. In the absence of sufficiently clear legislation, such government agencies have neither legitimacy nor competence for the formulation and application of rules designed to ensure a balance between the protection of privacy and freedom of expression. The response must therefore come from national and European legislators. It is their duty to establish a clear legal framework that takes full account of freedom of expression and is implemented by the courts. With this in mind, Reporters Without Borders and La Quadrature du Net jointly drafted this paper, which identifies points of concerns and makes recommendations designed to reconcile the right to privacy with freedom of expression in a reasonable manner under the aegis of the courts and not the private sector or government agencies. We now present them for debate.

1. Misapplying the right to privacy to editorial content

In France

The regulations on the protection of privacy in a directive of 24 October 1995 have been applied to editorial content because they broadly define “data of a personal nature” as “any information concerning an identified or identifiable physical person,” although both article 9 of this directive and article 67 of the France’s Law on Information Technology and Freedoms say that an exception should be made for journalism. The right to privacy was already widely used under the CNIL’s supervision to curtail freedom of expression before the EUCJ ruling on the right to be removed from search engine results. This was made clear in a statement by CNIL president Isabelle Falque-Pierrotin: “Complaints involving the right to be forgotten are almost all honoured and the content is withdrawn. They concern comments in blogs, an unwanted photo or a court decision that someone wants suppressed.” ([Le Monde, 19 May 2014)] Use of the right to privacy to obtain the withdrawal of published content (through the right to objection and correction) constitutes an extremely dangerous circumvention of the Law of 29 July 1881 on media freedom (in particular, its procedural guarantees and its three-month time limit). The proposed privacy regulations currently under discussion in Brussels, which contain several provisions on the right to be forgotten, are liable to aggravate the problem. On the other hand, the vice-president of a Paris high court said in a ruling on 12 October 2009: “The constitutionally and conventionally guaranteed principle of freedom of expression forbids (...) any violation of the rules established by the Law of 6 January 1978, which is not one of the laws that was specially created to restrict this freedom in according with the second section of article 10 of the European Convention (on Human Rights).” Similarly, a Paris appeal court ruling of 26 February 2014 said that suppressing online links to an article may violate media freedom: “The court is of the view that forcing a media outlet to modify its online archive of articles (...) either by suppressing information itself, withdrawing surnames and first names of persons concerned by judicial decisions, thereby depriving the article of any interest, or by restricting access by modifying the usual online links, exceeds the restrictions that may be placed on media freedom.”

En Europe

At the European level, a ruling by the European Court of Human Rights on 16 July 2013 rejected a request by two Polish lawyers for the suppression of a newspaper article that had been deemed libellous by a Polish court but continued to be accessible on the newspaper’s website. Seeking a balance between the right to defend one’s reputation and the right to information, the European Court ruled that withdrawal of the article “would amount to censorship and to rewriting history.” These decisions bring welcome definition to the scope that should be given to the exception for journalism. Provisions on the protection of privacy should not affect freedom of expression. They should continue to be inapplicable to all editorial content and all information of public interest. Given a certain desire on the part of European Union member states to follow up on the EUCJ ruling by considerably reinforcing the right to be forgotten and the right to deletion, it is important to restrict these rights in order to protect freedom of expression. The rules must be amended to reinforce the exception for journalism by extending it to all editorial content and other information of public interest. After this legislative clarification has been enacted, reconciliation of the right to privacy and the freedom of expression can be done in a balanced manner under national and international law and the relevant jurisprudence (for example, in France, article 9 of the civil code or articles 226-1 and 226-2 of the penal code), while respecting the existing guarantees of freedom of expression (such as those in the 1881 media law).

Recommendations

- Base arbitration between the right to privacy and freedom of expression on common law provisions or, when appropriate, on respect for the guarantees applicable to media rights, and not on special privacy rights. - As part of the negotiations under way on European regulation of privacy, extend the exception for journalism to all editorial content and information of public interest and restrict application of the right to be forgotten under article 17 to personal data put online by the individual himself. - Pending the adoption of European regulations, establish a moratorium on measures based on this special right that restrict freedom of expression and the right to information. Or otherwise adopt interim measures that fully respect freedom of expression. - At the European level, consider complementing the rules on protection of privacy with legislation that protects freedom of expression, above all in order to reconcile these two fundamental rights.

2. The role of search engines in access to à information

By interpreting the concept of “controller of the personal data” broadly, the EUCJ has extended it to search engine operators and has put private sector companies in charge of handling requests for the deletion of links in search engine results. The EUCJ’s decision seems to stem from a conservative and erroneous vision of the Internet and what search engines do. At no point did the court mention the role of search engines in gathering information and their contribution to freedom of expression. Instead it limited itself to stressing the dangers resulting from the “important role played by the Internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.” While the Internet and search engines may indeed make it harder to protect privacy, they also play a very positive role from the viewpoint of freedom of expression. A recommendation on the protection of human rights in connection with search engines, adopted by the Committee of Ministers of the Council of Europe on 4 April 2012 ([Committee of Ministers, 4 April 2012, recommendation on protecting human rights in connection with search engines)], said: “search engines enable a worldwide public to seek, receive and impart information and ideas and other content in particular to acquire knowledge, engage in debate and participate in democratic processes.” France’s Council of State pointed out in a recent report that “removing links from search results affects the freedom of information of the website’s publisher by making the published information less accessible and thereby returning it to the pre-Internet situation.” ([Council of State, 2014 Annual Report. Digital technology and fundamental rights, p. 188)] Because of the role of search engines in facilitating access to editorial content and information of public interest, there are significant dangers involved in treating search engine operators as personal data “controllers.” It removes measures directly affecting online freedom of expression and information from the judicial domain and prevents sufficient account being taken of the different interests and rights in play. As EUCJ advocate-general Niilo Jääskinen said in a preliminary report on the Google Spain case, it would be absurd to hold search engines responsible for the personal data on the web pages to which their search results refer. He said: “If Internet search engine service providers were considered as controllers of the personal data on third-party source web pages and if on any of these pages there would be ‘special categories of data’ referred to in Article 8 of the Directive (e.g. personal data revealing political opinions or religious beliefs or data concerning the health or sex life of individuals), the activity of the Internet search engine service provider would automatically become illegal, when the stringent conditions laid down in that article for the processing of such data were not met.” For this reason, among others, search engine operators should not be regarded as the personal data “controllers.” The plaintiff must go to the source, asking the personal data “controller” to withdraw or correct the information that was posted online and was then indexed by the search engine. This also applies to links to content that is neither editorial in nature nor of public interest. Data protection agencies should nonetheless be empowered to order search engine operators to update their results. After getting a personal data “controller” to remove or correct content, individuals should be able to ask their national agency to order search engine operators to correct or suppress the relevant information in their web page excerpts or in their caches (in the same manner as courts have ordered search engines to remove links to illegal content).

Recommendations

- Amend European personal data regulations to reflect the fact that search engines and other Internet “facilitators of access to information” are essential for exercising the right to information and provide links to editorial content and information of public interest and should therefore be covered by a broad interpretation of the exception for journalism and should not be regarded as personal data “controllers.” - In the case of links to personal data with no editorial content and no information of public interest, give data protection agencies the power to order search engine operators to update the information displayed in their results, while not treating them as personal data “controllers.”

3. Defence rights and appropriate procedures

In a democracy, it is not the role of private sector companies or even France’s CNIL (or its equivalent in other European countries) to determine the right balance between the protection of privacy and freedom of expression. In its decision on the Law on Confidence in the Digital Economy in 2004, France’s Constitutional Council said with reference to the withdrawal of online content by private sector companies: “determining whether a message is illegal can be delicate, even for a lawyer.” (Papers of the Constitutional Council, Comment on Decision No. 2004-496 DC of 10 June 2004, Papers of the Constitutional Council, No. 17, p. 4) This would also apply to search engine operators trying to determine whether search engine result deletions would restrict freedom of expression and the right to information. The publishers of online content have the right to a fair hearing if requests are made for the removal of links to their content, and this right cannot be respected if a private sector company is taking the decisions. Similarly, the authorities in charge of protecting privacy do not have the required competence or legitimacy for examining such requests and determining the limits that should be set on freedom of expression. As France’s Constitutional Council said in its ruling of 10 June 2009 on the HADOPI law, legislators cannot give a state agency, even an independent one, the power to restrict the right to express oneself freely. As this is about balancing fundamental rights, it can only be a judge, the guarantor of individual freedoms, who can perform the task of reaching a decision in a dispute, thereby also fully guaranteeing the right to a fair hearing. If some cases, the judge’s intervention could follow mediation aimed a reaching an out-of-court settlement of a dispute involving the right to be forgotten. In such mediation, both parties (the plaintiff who claims that his or her privacy has been violated and the publisher of the disputed content) should be able to defend their viewpoint and should be able to have legal representation. Finally, in the event that it is determined that freedom of expression was indeed abused in order to violate privacy, various types of measure should be envisaged. The EUCJ ruling refers only to deleting links from search engine results, but updating the disputed content, deleting only some of the information it contains, anonymization or use of pseudonyms may be more appropriate and proportionate, according to each case.

Recommendations

- In accordance with the principle of judicial protection for freedom of expression, ensure that only a judge has the power to reconcile freedom of expression and respect for privacy. - Consider creating a multiparty mediation entity that allows the parties to the dispute to reach an out-of-court settlement (with recourse to a judge clearly still being possible in the event of failure to reach an agreement). - Bear in mind that deleting links from search engine results is just one of several possible measures for reconciling freedom of expression with the right to privacy, and that updating the disputed content, deleting some of its information, anonymization or use of pseudonyms may prove more appropriate.