Introduction
The European Union Court of Justice ruling of 13 May 2014 on a case brought by Google Spain highlighted the problems for the protection of freedom of expression and the right to information posed by the right to de-indexation from search engine results and, more broadly, the right to be forgotten. Privacy and freedom of expression are fundamental rights of equal value (articles 8 and 10 of the European Convention on Human Rights and articles 8 and 11 of the Charter of Fundamental Rights of the European Union). Whenever one conflicts with the other, a balance must be reached under a judge’s authority because, as a matter of principle, one cannot be given more importance than the other.
The EUCJ ruling requires search engine operators such as Google to deal with requests made by members of the public for the removal of search engine results attached to their names. Responsibility for a decision involving individual freedoms that should be handled by a court is thereby delegated in practice to a private sector company. This delegation of responsibility is all the more dangerous because the ruling is based on vague and general principles that provide no guarantee for freedom of expression.
In response to the EUCJ ruling, Google established an advisory committee that is currently working on the formulation of more precise rules for search engine operators on how to respond to requests to be removed from results. The questions that Google is asking on how to strike a fair balance between the right to de-indexation from results and the public’s freedom of expression and information are perfectly legitimate, but the fact that a private sector company is posing these questions accentuates the growing trend to privatize the implementation of Internet regulation, and is therefore unacceptable.
National data protection bodies such as the the CNIL – the French data protection authority –,are meanwhile also working on the formulation of precise rules in response to the EUCJ’s ruling. But, in so doing, they too are exceeding their powers. In the absence of sufficiently clear legislation, such government agencies have neither legitimacy nor competence for the formulation and application of rules designed to ensure a balance between the protection of privacy and freedom of expression.
The response must therefore come from national and European legislators. It is their duty to establish a clear legal framework that takes full account of freedom of expression and is implemented by the courts.
With this in mind, Reporters Without Borders and La Quadrature du Net jointly drafted this paper, which identifies points of concerns and makes recommendations designed to reconcile the right to privacy with freedom of expression in a reasonable manner under the aegis of the courts and not the private sector or government agencies. We now present them as a contribution to the ongoing debate on the right to be forgotten.
1. Misapplying The Right To Privacy To Editorial Content
In France
The provisions on the protection of persondal data from the directive of 24 October 1995 have been applied to editorial content and other informations of public interest, based on the fact that they broadly define “data of a personal nature” as “any information concerning an identified or identifiable physical person,” . This is so even though both article 9 of this directive and article 67 of the France’s Law on Information Technology and Freedoms provide an exception for journalistic purposes.
As a result, under the CNIL’s supervision, data protection laws are already widely used to curtail freedom of expression before the EUCJ ruling on the right to be removed from search engine results. This was made clear in a recent statement by CNIL president Isabelle Falque-Pierrotin: “Complaints involving the right to be forgotten are almost all honoured and the content is withdrawn. They concern comments in blogs, an unwanted photo or a court decision that someone wants suppressed.”1Le Monde, 19 May 2014
Using data protection laws to obtain the removal of published content and restrict freedom of expression (through the right to opposition and rectification) under the ruling of administrative authority, constitutes an extremely dangerous circumvention of the traditional principle of the judicial protection of freedom of speech (established, in France, with the Law of 29 July 1881 on press freedom).
This is why the vice-president of a Paris high court said in a ruling on 12 October 2009: “The constitutionally and conventionally guaranteed principle of freedom of expression forbids (…) any violation of the rules established by the Law of 6 January 1978, which is not one of the laws that was specially created to restrict this freedom in according with the second section of article 10 of the European Convention [on Human Rights].”
Similarly, a Paris appeal court ruling of 26 February 2014 said that suppressing online links to an article may violate media freedom: “The court is of the view that forcing a media outlet to modify its online archive of articles (…) either by suppressing information itself, withdrawing surnames and first names of persons concerned by judicial decisions, thereby depriving the article of any interest, or by restricting access by modifying the usual online links, exceeds the restrictions that may be placed on media freedom.”
In Europe
At the European level, a ruling by the European Court of Human Rights on 16 June 2013 rejected a request by two Polish lawyers for the suppression of a newspaper article that had been deemed libellous by a Polish court but continued to be accessible on the newspaper’s website. Seeking a balance between the right to defend one’s reputation and the right to information, the European Court ruled that withdrawal of the article “would amount to censorship and to rewriting history.”
These decisions shed light on the appropriate scope that should be given to the exception for journalism. Provisions on the protection of personal data should not affect freedom of expression. They should remain inapplicable to all editorial content and all information of public interest.
Given a certain desire on the part of European Union member states to follow up on the EUCJ ruling by considerably reinforcing the right to be forgotten and the right to deletion, it is important to restrict these rights in order to protect freedom of expression. The rules must be amended to reinforce the exception for journalism by extending it to all editorial content and other information of public interest.
After this legislative clarification has been enacted, the right to privacy and the freedom of expression can be properly balanced under national and international law and the relevant jurisprudence (for example, in France, article 9 of the civil code or articles 226-1 and 226-2 of the penal code), while respecting the existing guarantees of freedom of expression (such as those in the 1881 media law).
Recommendations
- Base arbitration between the right to privacy and freedom of expression on common law provisions or, when appropriate, on respect for the guarantees applicable to media rights, and not on special data protection laws.
- As part of the negotiations under way on European regulation on personal data, extend the exception for journalism to all editorial content and information of public interest and restrict application of the right to be forgotten under article 17 to data put online by the data subject himself.
- Pending the adoption of the European regulation, establish a moratorium on measures based on this special right that restrict freedom of expression and the right to information. Or otherwise adopt interim measures that fully respect freedom of expression.
- At the European level, consider complementing the rules on protection of privacy with legislation that protects freedom of expression, above all in order to reconcile these two fundamental rights.
2. The Role Of Search Engines In Access To Information
By interpreting the concept of “controller of the personal data” broadly, the EUCJ has extended it to search engine operators and has put private sector companies in charge of handling requests for the deletion of links in search engine results.
The EUCJ’s decision seems to stem from a conservative and erroneous vision of the Internet and what search engines do. At no point did the court mention the role of search engines in gathering information and their contribution to freedom of expression. Instead it limited itself to stressing the dangers resulting from the “important role played by the Internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.”
While the Internet and search engines may indeed make it harder to protect privacy, they also play a very positive role from the viewpoint of freedom of expression. A recommendation on the protection of human rights in connection with search engines, adopted by the Committee of Ministers of the Council of Europe on 4 April 20122Committee of Ministers, 4 April 2012, recommendation on protecting human rights in connection with search engines said: “search engines enable a worldwide public to seek, receive and impart information and ideas and other content in particular to acquire knowledge, engage in debate and participate in democratic processes.”
France’s Council of State pointed out in a recent report that “removing links from search results affects the freedom of information of the website’s publisher by making the published information less accessible and thereby returning it to the pre-Internet situation.”3French Council of State, 2014 Annual Report. Digital technology and fundamental rights, p. 188. Because of the role of search engines in facilitating access to editorial content and information of public interest, there are significant dangers involved in treating search engine operators as personal data “controllers.” It removes measures directly affecting online freedom of expression and information from the judicial domain and prevents sufficient account being taken of the different interests and rights at play.
Moreover, as EUCJ advocate-general Niilo Jääskinen said in a preliminary report on the Google Spain case, it would be “absurd” to hold search engines responsible for the personal data on the web pages to which their search results refer. He said: “If Internet search engine service providers were considered as controllers of the personal data on third-party source web pages and if on any of these pages there would be ‘special categories of data’ referred to in Article 8 of the Directive (e.g. personal data revealing political opinions or religious beliefs or data concerning the health or sex life of individuals), the activity of the Internet search engine service provider would automatically become illegal, when the stringent conditions laid down in that article for the processing of such data were not met.”
For this reason, among others, search engine operators should not be regarded as the personal data “controllers.” The plaintiff must go to the source, asking the personal data “controller” to withdraw or correct the information that was posted online and was then indexed by the search engine. This also applies to links to content that is neither editorial in nature nor of public interest.
Data protection authorities should nonetheless be empowered to order search engine operators to update their results. After getting a personal data “controller” to remove or correct content, individuals should be able to ask their national agency to order search engine operators to correct or suppress the relevant information in their web page excerpts or in their caches (in the same manner as courts have ordered search engines to remove links to illegal
Recommendations
- Amend European personal data regulations to reflect the fact that search engines and other Internet “facilitators of access to information” are essential for exercising the right to information and provide links to editorial content and information of public interest and should therefore be covered by a broad interpretation of the exception for journalism and should not be regarded as personal data “controllers.”
- In the case of links to personal data with no editorial content and no information of public interest, give data protection agencies the power to order search engine operators to update the information displayed in their results, while not treating them as personal data “controllers.”
3. Defence Rights And Appropriate Procedures
In a democracy, it is not the role of private sector companies or even France’s CNIL (or its equivalent in other European countries) to determine the right balance between the protection of privacy and freedom of expression.
In its decision on the Law on the Confidence in the Digital Economy in 2004, France’s Constitutional Council said with reference to the withdrawal of online content by private sector companies: “determining whether a message is illegal can be delicate, even for a lawyer.” This would also apply to search engine operators trying to determine whether search engine result deletions would restrict freedom of expression and the right to information. The publishers of online content have the right to a fair hearing if requests are made for the removal of links to their content, and this right cannot be respected if a private sector company is taking the decisions.
Similarly, the authorities in charge of protecting privacy do not have the required competence or legitimacy for examining such requests and determining the limits that should be set on freedom of expression. As France’s Constitutional Council said in its ruling of 10 June 2009 on the HADOPI law, legislators cannot give an administrative agency, even an independent one, the power to restrict the right to express oneself freely.
As this is about balancing fundamental rights, it can only be a judge, the guarantor of individual freedoms, who can perform the task of reaching a decision in a dispute, thereby also fully guaranteeing the right to a fair hearing.
If some cases, the judge’s intervention could follow mediation process aimed a reaching an out-of-court settlement of a dispute involving the right to be forgotten. In such mediation, both parties (the plaintiff who claims that his or her privacy has been violated and the publisher of the disputed content) should be able to defend their viewpoint and obtain legal advice.
Finally, in the event that it is determined that freedom of expression was indeed abused in order to violate privacy, various types of measure should be envisaged. The EUCJ ruling focuses on deleting links from search engine results, but updating the disputed content, deleting only some of the information it contains, anonymization or use of pseudonyms may be more appropriate and proportionate, according to each case.
Recommandations
- In accordance with the principle of judicial protection for freedom of expression, ensure that only a judge has the power to reconcile freedom of expression and respect for privacy.
- Consider creating a multistakeholder mediation body that allows the parties to the dispute to reach an out-of-court settlement (with recourse to a judge clearly still being possible in the event of failure to reach an agreement).
- Bear in mind that deleting links from search engine results is just one of several possible measures for reconciling freedom of expression with the right to privacy, and that updating the disputed content, deleting some of its information, anonymization or use of pseudonyms may prove more appropriate.