Right to Be Forgotten Likely To Affect U.S. Internet Users, Companies

Technology exists to automatically filter content by jurisdiction, meaning Google and other search engines can tailor their services to places with RTBF rules, said Brett Wilson (U.K.) attorney Iain Wilson, who handles online privacy, libel and harassment cases. The U.S. likely will resist EU pressure to change, but the RTBF could still alter how search engines operate, affecting U.S. user experience, said Steve Kuncewicz, a Bermans (U.K.) IP lawyer. The RTBF will pose a risk to U.S. companies, said Dentons (London) data protection attorney Nick Graham. Google didn't comment.

Two major RTBF-related regulatory actions have been taken in Europe in the past few months. French data protection agency CNIL (Commission Nationale de l'Informatique et des Libertés) on June 12 asked Google to honor delisting requests across all domains. The regulator gave Google 15 days to respond. In a July 30 posting on the company's blog, Global Privacy Counsel Peter Fleischer said the search engine disagreed with "the CNIL's assertion of global authority on this issue and we have asked the CNIL to withdraw its Formal Notice." He called the regulator's action "a troubling development that risks serious chilling effects on the web." The CNIL has until the end of September to reply to Google's request, a spokeswoman said. It could either decide to go ahead with some form of sanction or let the company off the hook, she said. The CNIL imposed sanctions against Google in 2014 for its privacy policy, she noted. Organizations have seldom refused a CNIL order, she said.

The U.K. Information Commissioner's Office on Aug. 18 ordered Google to remove nine search results that linked to no-longer-relevant information about a person. The links are part of the results displayed when a search was made on the person's name, and they lead to Web pages that include details of a minor criminal offense the individual committed almost 10 years ago, the ICO said in a statement. Google previously had granted the individual's request to delist the links relating to the crime, but the removal of the links then became a news story. Links to the news articles, which repeated details of the criminal offense, were then displayed in searches for the complainant's name, it said. Google correctly accepted that search results relating to the convictions were no longer relevant and affected the person's privacy, said Deputy Information Commissioner David Smith. The company is wrong now to refuse to remove the newer links that reveal the same details, he said. The ICO ordered Google to delist the links within 35 days.

Since the European Court of Justice ruling establishing the RTBF (see 1405140036), "there has been a huge number of requests made of Google to remove" links that could be prejudicial to individuals, Kuncewicz said. Stakeholders have "done their best to try and narrow the extent of the landmark judgment and put it into context," he said. "We've only just begun to see the effect" of the decision, because it was based on the original EU data protection directive from 1995, said Kuncewicz. The current reform of EU privacy law has the RTBF "at the heart of its attempt to better regulate the use of personal data in the internet age," he emailed. The ICO and CNIL actions are two instances that show that individual freedom and legislative oversight "are starting to catch up to the past of technology," he said.

Kuncewicz predicted more guidance will emerge, as well as a better sense of what information is truly in the public interest (and need not be delisted). Although Google is pushing back against regulators and applicants to be "forgotten," it's going to have lots of fights and any attempt to apply the EU approach internationally will be difficult, he said. "Europe will lead the way." The U.S. will likely resist European pressure, but the RTBF could still change how U.S. search engines operate and, hence, American's user experience, he said. "We may see them give users the opportunity to have more individual control over how they appear in search results, for example."

There's a conflict of laws between the EU and U.S., said Graham. If search engines have to remove information from .com links, this could be seen as an attempt by the EU to claim supremacy over U.S. law, he said. For American organizations, the RTBF is an "ongoing and persistent risk," Graham said. The biggest risk is whether companies are subject to EU law and, after the Google case, it will be harder to manage that risk, he said. Businesses that hold data about people in the form of public directories or news risk being served with delisting requests that could affect the value of the data as a commodity, he said.

There's nothing objectionable about making Google and other U.S. companies that want to operate in Europe comply with EU law, Wilson said. That shouldn't affect how they operate in the U.S., "and they wouldn't be here [Europe] if there wasn't money to be made," he said. The situation doesn't have to be messy, said Wilson. The technology to automatically filter content by jurisdiction exists and is already used by online intermediaries and websites to targeted results and advertising, he said.

Russia also enacted an RTBF law, Hogan Lovells (Moscow) attorneys Natalia Gulyaeva and Maria Sedykh wrote Aug. 21 on the firm's blog. Major Russian search engines have slammed the measure, saying it doesn't give them long enough to consider individuals' requests, they said. But the key concern is the lack of any clear criteria for determining the accuracy, relevance and lawfulness of the dissemination of the information in question, so search engines will struggle to assess whether a request is well-founded, they said. A separate bill introducing liability for noncompliance is under consideration in the Russian legislature, they wrote.