The right to de-linking

Recommendations on the right to be de-referenced, called “the right to be forgotten” by the media, were worked out in summer 2014 jointly between La Quadrature du Net and Reporters Without Borders following on the 13 May 2014 decision of the EU Court of Justice against Google Spain.

Introduction

The Google Spain decision of the ECJ, handed down on 13 May 2014, brought to daylight how the right to be de-referenced, and more broadly the right to be forgotten, present problems for freedom of expression and the right to information. With its decision, the ECJ forces search engines like Google to respond to demands to be de-referenced, effectively delegating to a private entity a task normally belonging with a judicial authority, which alone is competent to guarantee individual liberties. This delegation is even more dangerous because the decision is based on vague general principles which carry no guaranty whatsoever for freedom of expression.

As a consequence of this decision, Google created a consultative committee which not seeks to determine more precise rules which search engines can use to respond to the demands for de-referencing addressed to them. But even if Google’s questions are perfectly legitimate over how to arrive at a fair equilibrium between a person’s right to be de-referenced and the public’s right to freedom of expression and of information, the very fact that a private enterprise must take it up accentuates the rampant privatisation of regulating the Internet. From this point of view it is unacceptable.

At the same time, the national authorities for data protection (such as the CNIL in France) are also obliged to come up with precise rules embodying the ECJ’s decision. But in doing so, the go beyond their prerogatives. Failing clear enough legislation on this matter, these administrative authorities are both illegitimate and incompetent to adopt and apply rules aimed at guaranteeing a balance between the protection of privacy and freedom of expression.

Privacy and freedom of expression are fundamental rights of equal value (cf. articles 8 and 10 of the European Convention on Human Rights, articles 8 and 11 of the the EU’s Fundamental Charter of Rights). When they conflict they must be balanced in each particular case under a judge’s authority, neither superseding the other in principle. The ECJ’s decision wounds this principle: not only does it overturn judicial authority, it considers the right to be de-referenced as practically automatic.

The response to this must therefore come from European and national legislators. They are the ones who bear the responsibility to put in place a clear judicial framework that takes freedom of expression fully into account, and whose implementation stems from judicial authority.

In this spirit, Reporters Without Borders and La Quadrature du Net have come together to work out a series of points for vigilance and recommendations intended to assure a reasonable harmony between the right to privacy and freedom of expression, under the aegis of judges in court, and not of private or administrative actors. Today we submit these reflections to discussion.

1. On the abusive application of the law on personal data to editorial content

In defining broadly “personal data” (“all information about an identified or identifiable natural person”) the rules for the protection of personal data included in the directive of 24 October 1995 can be applied to editorial content and other information of public interest, despite the journalistic exception expressed in article 9 of the same directive, which we find also in article 67 of the French law on Informatics and Liberties.

In fact besides the right to be de-referenced opened by the ECJ, the law on personal data is already being widely used to put up obstacles to freedom of expression, under the authority of the CNIL. As witness, the proposals of Mme Isabelle Falque-Pierrotin, President of the CNIL: “complaints concerning the right to be forgotten are almost all honoured, and the content is withdrawn. This concerns blog postings, offending images, a judicial decision that someone wants to suppress.” (Le Monde, 19 May 2014).

Using the law on personal data to force withdrawing a publication and limiting freedom of expression (by using the right to reply and correct), all under the aegis of an administrative authority, constitutes an extremely dangerous way of sidestepping the traditional guarantees of freedom of expression, and in particular the principle of judicial protection instituted in France by the law of 29 July 1991 on the freedom of the press.

And that is how, in a decision 12 October 2009, the Vice President of the Superior Court of Paris judged that “the constitutional and common-law guarantee of freedom of expression forbids affirming a particular attack which might violate the rules instituted by the law of 5 January 1978, which is not one of the norms especially created to limit this freedom considering the second clause of article 10 of the European Convention referred as above [the European Convention on protecting human rights and fundamental liberties].”

In the same sense, a decision of the Paris Court of Appeal of 26 February 2014 specifies that de-referencing an article on the grounds of the 1978 law damages freedom of the press. Thus it was judged “that to require an organ of the press to remove from its own Internet site dedicated to archiving its articles, which can be compared to a database of legal decisions, either the information itself, or the full names of the persons involved which alone make the article of interest, or of restricting access by changing the normal references, in the court’s opinion exceeds permissible restrictions on the freedom of the press.”

At the European level, in a decision of 16 June 2013 the European Court of Human Rights (ECHR) rejected a demand by two Polish lawyers to suppress an article already judged defamatory by a Polish court, but which remained accessible on the newspaper’s Internet site. Seeking a balance between the right to good repute and the right to information, the ECHR that withdrawing the content in question “would constitute censorship and amounts to rewriting history”.

These decisions bring a welcome specificity to the weight we should give to journalistic privilege. Indeed, the laws on protecting personal data should not limit freedom of expression. They should also remain inapplicable to all editorial content and all information of public interest.

In the face of the whims of member states of the EU in following up the ECJ’s decision to reinforce considerably the right to be forgotten and to erasure, it is important to limit these in order to protect freedom of expression. The law should be amended to reinforce journalistic privilege by extending it to all editorial content and other information of public interest.

Once this legislative clarification has been enacted, balancing the right to privacy and freedom of expression can be done in a balanced way under national and international law and associated jurisprudence (for example, in France, article 9 of the civil code or articles 226-1 and 226-2 of the penal code), while respecting the applicable existing guarantees of freedom of expression (notably those in the press law of 1881).

Recommendations

• Mediation between the right to privacy and freedom of expression should be based on common law and, failing that, respect for guarantees that apply to the right of the press, and not on special rights for personal data.
• In the framework of current negotiations on the European regulation of personal data, broaden the journalistic exception to the entirety of editorial content and information of public interest, and limit applying the application of the right to be forgotten foreseen in article 17 to personal data put on-line by the person him- or herself.
• Until a European law is adopted, implement a moratorium on the special law that limits freedom of expression and the right to information. At least adopt temporary measures that respect freedom of expression fully.
• At the EU level, consider the opportunity to flesh out the rules about protecting privacy and by adopting a protective framework for freedom of expression, in particular to harmonize these two fundamental rights.

2. On the role of search engines in access to information

In holding to a broad conception of the notion of “one responsible for the handling of personal data”, the ECJ handed over responsibility to a private enterprise to handle demands for de-referencing by subjecting search engine to requirements which make them responsible to handle personal data.

The ECJ’s reasoning seems to result in a conservative, false vision of the Internet and the role of search engines in communication. Indeed, the Court never specified the role of search engines in gathering information, and their contribution to exercising freedom of expression. The Court was content to emphasize the greatest risks that the Internet creates “by virtue of the important role that the Internet and search engines play in modern society, which give the information they present in their results a ubiquitous nature.”

And if the Internet and search engines may, in effect, increase the risks to protecting privacy, they play symmetrically a positive role from the viewpoint of freedom of expression. Thus on 4 April 2012, the Committee of Ministers of the European Council adopted a recommendation to protect human rights in the context of search engines (Council of Ministers, 4 April 2012, recommendation on the protection of human rights in the context of search engines”). There they emphasise that “search engines let the entire world’s public search, acquire, and communicate information, ideas, and other content, in particular to have access to knowledge, to take part in discussions and to participate in democratic processes.”

In a recent report, the Council of State judges again that “de-referencing affects the site editor’s freedom of expression by rendering published information less accessible and by returning it to pre-Internet conditions” (Council of State, Annual study 2014. The digital and fundamental rights, p 199) By virtue of their role as facilitators of access to editorial content and information of public interest in the public sphere, there is a significant risk of considering search engines to be responsible for handling personal data. Indeed this encourages alienating personal data from being handled by the judicial system, directly affecting freedom of expression and the right to information allowed by the Internet, and would prevent taking adequately into account the various interests and rights concerned.

Moreover, as General Advocate Jääskinen states in his conclusions in the Google Spain case, to regard the activity of search engines as if they were processing personal data would be utterly “absurd”. Indeed, according to him, “ if internet search engine service providers were considered as controllers of the personal data on third-party source web pages and if on any of these pages there would be ‘special categories of data’ referred to in Article 8 of the Directive {[(|fnote_stt|)]}Or article 9 of the General Data Protection Regulation, that will replace the 95 Directive in May 2018.{[(|fnote_end|)]} (e.g. personal data revealing political opinions or religious beliefs or data concerning the health or sex life of individuals), the activity of the internet search engine service provider would automatically become illegal, when the stringent conditions laid down in that article for the processing of such data were not met.”

For this reason in particular, search engines’ activity must not be assimilated to the status of personal data controllers, including when linking to non-editorial content or content that does not carry an interest for public interest. In such cases, the problem must be tackled from the root, by requesting the data controller to withdraw or correct the information published on the Internet, and that has consequently been linked to by a search engine.
Nonetheless, it would be wise to give DPAs the power to enjoin search engines to update their search results. That way, after having exercised their right to object or to obtain the correction of their personal data by controllers, users could lodge a complaint before their DPA so that it orders search engines to correct or to delete data found in excerpts of copies of web pages or in their cache (like court decisions ordering the delinking of hyperlinks pointing to illegal content).

Recommendations

• Amend the EU data protection regime to consider that, as they are crucial to the exercise of the right to information and if they provide links to editorial content and information of public interest, search engines and other intermediaries facilitating access to information, by providing links to such content, should be covered by the expanded journalistic exception. By the same token, they should not be qualified as personal data controllers.
• If search engines and intermediaries provide links to sites processing personal data, in case such sites are not related to editorial content or information of public interest, give Data Protection Authorities (DPAs) the power to order them to update the information in the search results, without considering them as personal data controllers.

3. On the rights of the defence and the adequate procedures

In application of the rule of law, it does neither up to private actors or nor DPAs to determine the balance between protection of privacy and freedom of expression.

Regarding the removal of content by private actors, the French Constitutional Council had noted, in the context of its 2004 decision on the Law on Confidence in the Digital Economy (LCEN) that “characterisation of an unlawful message can be troublesome, even for a lawyer“{[(|fnote_stt|)]}In Les Cahiers du Conseil constitutionnel, Comments related to decision N° 2004-496 DC of 10 June 2004, Cahiers du Conseil constitutionnel, N° 17, p. 4.. An observation which, by analogy, equally applies to the delinked done by search engines since they restrict freedom of expression and the right to information. The right to fair trial owed to authors and content publishers who have seen their content delinked cannot be upheld if notifications are dealt with by a private actor.

Similarly, DPAs have neither the competence nor the legitimacy to conduct the review of these notifications and to determine the limits of freedom of expression. As stated by the French Constitutional Council in its decision of 10 June 2009 on the French HADOPI, the legislator cannot entrust an administrative authority, even an independent one, the power to restrict the right to speak freely.

With regard to the balancing of fundamental rights, it is the judicial judge, guardian of individual liberties, that should be tasked with the settling of disputes. That way, the right to fair trial would be upheld.

If necessary, the intervention of the judicial judge could be before a mediation procedure for a settlement of disputes relating to the right to be forgotten among the different parties (that is to say, firstly, the plaintiff who alleges a violation of its privacy and secondly, the publisher of the contentious content). This should assure a minimum respect of the right to a fair hearing as well as the right to legal advice.

Finally, if should an abuse of freedom of expression violating privacy was to be recognized, several types of measures should be considered. Indeed, if the ECJ’s ruling is only about delinking, updating, deleting certain information, anonymising or pseudonymising contentious publications can be more relevant and proportionate, depending on the case at hand.

Recommendations

• In line with the principle of judicial protection of freedom of expression, guaranteeing the exclusive jurisdiction of the judicial judge in order to reconcile freedom of expression and respect for privacy.
• Consider the creation of an entity of multi party mediation so that parties to a dispute can to reach a settlement (recourse to the judicial judge will of course remain possible in case the parties did reach a settlement).
• Stress that delinking content in search engines is one of numerous measures available to reconcile freedom of expression and the right to privacy (depending on the case at hand, the update, withdrawal, anonymisation or pseudonymisation of the source of the litigious content may be more appropriate)