Spanish Court Limits Scope Of EU's Right To Be Forgotten
from the more-clarity-needed dept
EU's 'right to be forgotten' is still relatively new -- the original ruling was made less than a year ago. Since then, the EU courts and companies have been trying to work out what it means in practice, which has led to some broadening of its reach. But an interesting court ruling in Spain seems to limit its scope. It concerns the following case, reported here by Stanford's Center for Internet and Society:
The claimant was a Spanish citizen who found that when typing his name on Google Search, the results included a link to a blog with information about a crime he had committed many years ago. While the official criminal records had already been cancelled, the information was thus still findable on the internet.
The Spanish Data Protection Authority (DPA) made two rulings. One was that Google should remove the information from its search engine, and the other was that Google should remove personally identifiable information from a blog hosted on its Blogger platform. When these decisions were reviewed by Spain's National High Court, it confirmed the first ruling, and clarified that Google needed to remove the link to the criminal records information from its search results. However, it did not confirm the second ruling:
The National High Court reversed that and held that the responsible for the processing is not Google but the blog owner. It further held that the DPA cannot order Google to remove the content within a procedure for the protection of the data subject's right to erasure and to object.
This is significant, because it says the "controller of the processing" -- a key concept in EU data protection law -- is the blog owner, not Google, and so the latter cannot be forced to take down a blog post. The Center for Internet and Society post notes:
Arguably, under the rationale that the platform is not the controller of the processing, other user generated content sites such as YouTube or social networking sites might also fall outside the scope of the right to be forgotten.
Well, not entirely outside the scope: presumably, search engines could still be required to remove links to user-generated content, but it would be the creator of that content that would be asked to remove it entirely, not the hosting company. Clearly, further cases will be needed to clarify how exactly this will work in Spain, and whether it applies anywhere else.
Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: blogs, eu, right to be forgotten, search engines, social media, spain
Companies: google
Reader Comments
Subscribe: RSS
View by: Time | Thread
Which is easier way to be forgotten?
or
B) Spend the rest of your life going after each and every current and future search engine
[ link to this | view in chronology ]
Re: Which is easier way to be forgotten?
[ link to this | view in chronology ]
Re: Re: Which is easier way to be forgotten?
[ link to this | view in chronology ]
Re: Which is easier way to be forgotten?
[ link to this | view in chronology ]
Re: Re: Which is easier way to be forgotten?
That said, it's worth contacting the blogger and asking politely that his name and identifying information be removed from the blog post. Most people are quite reasonable about these things. If the blogger says no, the smart thing to do is own up to the crime and create a Road To Damascus narrative on a blog post or social media status update to paint himself as a reformed character who Did That Thing Back Then But Is Very Sorry About It Now And Does Not Do Such Things These Days. That tends to go down well with the crowd. Nobody's perfect, after all.
[ link to this | view in chronology ]
Not that surprising
The blog owner has his rights to free speech.
The ruling basically says: "If you provide public access to a searchable database, which contains personal information, then you must ensure that the search result is held current and up to date. I.e. does not contain data which reasonably must be considered either: outdated, irrelevant or violating the privacy rights of a person"
The Data Protection Laws in the EU makes it clear that virtually any data which *by someone* can be traced back to a real physical person is considered sensitive and is safeguarded by the Data Protection Act."
Relevancy is a key topic in the Google ruling. For ordinary private citizens the definition on what is relevant is much stricter, than it is for public persons, e.g. politicians, artists, etc. who by virtue of their chosen profession has implicitly accepted a certain amount of publicity.
In short this ruling does nothing, ecept confirm what we already knew.
[ link to this | view in chronology ]
No google for the EU?
[ link to this | view in chronology ]
[ link to this | view in chronology ]