The floodgates have opened. According to a Reuters story, following Tuesday’s European Court ruling establishing a Europe-wide “right to be forgotten” (RTF), Google is preparing for an anticipated “flood” of removal requests across the 28 country jurisdiction.
The ruling provided a right to individuals to request (and ultimately compel) removal of unflattering or undesired information about themselves from search results, even if the underlying content is legal and maintained online by a publisher. The European Court offered no tests or procedural guidance to determine what sorts of legal information would be considered “outdated” or “irrelevant.”
Right now, the RTF pertains to individuals. It’s not clear whether it will eventually extend to small businesses and even larger companies. But what’s the difference between a private individual requesting removal of a long-ago personal bankruptcy (the facts of the Spanish case behind the EU court ruling) and the following scenarios not that far removed from it:
In addition, what is a “search engine” under the decision? While search engines and specifically Google were singled out in the RTF ruling (vs. the newspaper site that originally published the information about the plaintiff), it may turn out that the designation “search engine” extends to vertical sites and smaller directories that potentially impact the reputations of individuals and businesses.
What about Twitter or Facebook? They have search capabilities and archive “old” information? There would seem to be no conceptual or legal reason to exclude them. You see the “slippery slope” as it’s often called in the law.
Indeed, the other side of this RTF issue is reputation management. I suspect that in Europe RTF will quickly become a component of “negative SEO.” Again, it’s not clear whether RTF will extend to individuals as business owners or acting in their professional capacities or beyond that to non-individual business entities more generally. But I suspect the issue will come up very quickly.
German privacy (data-protection) regulators have said that they will establish a procedure for removal requests within the next two weeks. Apparently in Germany, removal requests started almost immediately after the EU court’s ruling this week. The Wall Street Journal quotes German authorities who reported that in the city of Hamburg, “privacy regulators normally received about 100 requests to suppress search results every year — but received eight in just the day following the decision this Tuesday.”
As I wrote on Tuesday, I sympathize with the idea behind the decision: preventing old, harmful information from haunting people for the rest of their lives. And privacy rights should be given stronger protections in this era of “big data” and “surveillance.”
However, practical implementation of the ruling will be highly problematic and in some cases contrary to the public interest. In its zeal to protect individual privacy (and perhaps its antipathy toward Google) the EU court doesn’t appear to have clearly thought through all the issues.
Postscript: According to the BBC some of problem cases I anticipated are already starting to show up (people trying to cover their tracks):