Google and the right to be forgotten: Should delisting be global or local?

The Contested Map of the “Right to Be Forgotten”

The Contested Map of the “Right to Be Forgotten”

The citizen’s guide to the future.
Feb. 25 2015 10:38 AM
FROM SLATE, NEW AMERICA, AND ASU

Results May Vary

Border disputes on the frontlines of the “right to be forgotten.”

google search and forget.
Any browser, anywhere, can access any of Google’s national extensions.

Photo illustration by Slate. Photo by Francois Lenoir/Reuters

In 2025, when continuous monitoring, tracking, and nudging are the norm and there is no such thing as a stranger, America may look back at its condemnation of Europe’s data protection rights as one of the moments when we lost our way. Upon reflection, the misnamed “right to be forgotten” might be seen not as stealth censorship or a torero’s flag to storming autocrats, but as a positive development. It might be recognized for what it is: a critical test of our commitment to giving individuals some small degree of control over personal data.

Ever since Europe’s highest court found that citizens have a “right to delist” private, out-of-date, inaccurate, or irrelevant data from search results on their name, an incendiary debate has engulfed and overshadowed the facts. The debate has fallen easily into overdrawn grand narratives: between “disruptive, innovative” tech companies and “protectionist” regulators; between the informational interests of the global public and easily trivialized private individuals; between U.S. openness and European restraint.

The new frontline of this debate has been dubbed “extraterritoriality.” It derives from the standoff between European data regulators (who represent the European Commission and each state in the 28-member EU bloc) and Google, the highest-profile company involved. The regulators have called for content against European laws to be delisted across search engines’ worldwide indices. Google has resisted, implementing delisting requests only on European country code extensions: google.fr, google.de, google.co.uk, and so on. A new report by a Google-appointed advisory panel has, by majority (with an important dissent from long-time German justice minister Sabine Leutheusser-Schnarrenberger), backed Google’s approach.

Advertisement

But Google and its allies are wrong to characterize the conflict between global and domain-based delisting as a purely “territorial” enforcement question. Any browser, anywhere, can access any of Google’s national extensions, as well as google.com. So the tension is really between enforcement that is effective, global, and potentially overreaching, and enforcement that is geographically localized through the power of default, but simple to circumvent by switching to google.com or any non-European domain.

Part of the reason the regulators and Google are split is because they are seeking a general solution. This may be both undesirable and unnecessary, given the grab bag of interests that motivate delisting and the balances involved. The vast bulk of successful delisting requests are straightforward and concern primarily one individual—improperly uploaded contact details, medical information, or intimate photos; incidental mentions on old, high-ranking news items that have acquired timeless significance; private conversations that ended up online. At the other end of the spectrum, there are a small number of instances that involve multiple parties and real potential conflicts between privacy, speech, and access to information. If delisting is determined on a case-by-case basis, surely the remedy can be too.

One approach to deciding whether to delist globally or locally is detailed in a new paper by Belgian-based researchers Brendan Van Alsenoy and Marieke Koekkoek. They emphasize that delisting is already contingent on personal data not being in the public interest. If other states’ potential interest in the requestor is low, and the publisher, host, subject, author, or audience of content are strongly connected to Europe, then global delisting might be appropriate. The Spanish victor of the European court ruling, whose data concerned a Spanish auction, published in a Spanish newspaper, is a good example. By contrast, information that has international reach and potential interest, or which strongly engages another country’s free speech protections, such as a Canadian-authored article, involving a European citizen, published in a U.S. news outlet, may be better dealt with by only delisting results on that citizen’s name in Europe.

A victim of physical assault asked for results describing the assault to be removed for queries against her name.1 Request by a pedophile who wanted links to articles about his conviction removed.1,3
A request to remove results detailing a patient's medical history.1 Elected politician requesting removal of links to news articles about a political scandal he was associated with.1
A request by someone incidentally mentioned in a story, a news report, but not the actual subject of the reporting.1 Multiple requests from a single individual who asked to remove 20 links to recent articles about his arrest for financial crimes committed in a professional capacity.4
A woman requested removal of a decades-old article about her husband’s murder, which included her name.4 A media professional requested removal of four links to articles reporting on embarrassing content he posted to the Internet.4
A victim of rape asked to remove a link to a newspaper article about the crime.4 An individual asked to remove links to articles on the internet that reference his dismissal for sexual crimes committed on the job.4
A request from a crime victim to remove 3 links that discuss the crime, which occurred decades ago.4 A doctor requested removal of more than 50 links to newspaper articles about a botched procedure. Three pages that contained personal information about the doctor but did not mention the procedure have been removed from search results for his name. The rest of the links to reports on the incident remain in search results.4
An individual asked to remove a link to a page that had taken a self-published image and reposted it.4 A request from an individual to remove more than 50 links to articles and blog posts reporting on public outcry over accusations that he was abusing welfare services.4
A man asked to remove a link to a news summary of a local magistrate’s decisions that included the man’s guilty verdict. Under the U.K. Rehabilitation of Offenders Act, this conviction has been spent.4 An individual asked to remove a link to a copy of an official state document published by a state authority reporting on the acts of fraud committed by the individual.4
An individual asked to remove a link to an article covering a contest in which he participated as a minor.4 A public official asked to remove a link to a student organization’s petition demanding his removal.4
Request to remove an old document posted in an online group conversation that the requestor started.2 Request from a former clergyman to remove two links to articles covering an investigation of sexual abuse accusations while in his professional capacity.4
Request to remove five-year-old stories about exoneration in a child pornography case.2 Request from a news outlet to remove content about it from another news outlet.2
Links to "revenge porn"—nude pictures put online by an ex-boyfriend.3 Request for removal of a news article about a child abuse scandal, which resulted in a conviction.2
Links to the fact that someone was infected with HIV a decade ago.3 Request to remove a 2013 link to a report of an acquittal in a criminal case, on the ground that it was very recent.2
An article in a local paper about a teenager who years ago injured a passenger while driving drunk.3 Request by a writer to remove links to his own work, on the ground that the articles were recent and deliberately made public by the author.2
The name on the membership list of a far-right party of someone who no longer holds such views.3 Request by a doctor objecting to patient reviews.3
Reports of a violent crime committed by someone later acquitted because of mental disability.3

The subtleties of Van Alsenoy and Koekkoek’s reasoning point to a major inadequacy in the current delisting debate—it is being fought in an entirely elliptical, abstract, dehumanized way. More than 222,000 citizens based in Europe have made delisting requests, and yet the debate focuses on a handful of cases in the press. Angst over the extraterritorial question is a symptom of incomplete knowledge. It precludes engagement, the discovery of common ground, and the evolution of predictable and consistent approaches to different categories of cases and conflicts.

Advertisement

In cases where different legal regimes may reasonably differ on the balance of interests for and against delisting, an intermediate alternative not yet seriously considered by the opposed parties is location-based, rather than domain-based, delisting. This is a stronger form of geo-filtering, and is better targeted and harder (though not impossible) to circumvent. It has found particular favor with French courts seeking to effectively remedy defamation, blasphemy, and privacy cases; while domain-based delisting is more favored in European antitrust proceedings, where reduction of market dominance is the primary objective. For as long as physical location, rather than virtual domain, is the basis for tailoring results and advertisements, location-based delisting seems to be a more credible basis for search engines to give “full effect to European law, within the framework of their responsibilities, powers and capabilities,” while also avoiding some of the perceived challenges of global delisting.

Of course, proxies, virtual private networks, and pseudonymity tools can all evade location-based delisting, but this is more complex than a one-click switch to an alternative domain and alternative content. It furthers the objective of the right to delist, which is to practically obscure and prevent further proliferation of the offending material, rather than to remove it at source. Perhaps it is a good direction, in any event, because the more that citizens experiment with variegated tools, the more complex and costly it becomes to collect and mine data at scale, and government and corporate surveillance will return to its proper homeland: intelligence. On the other hand, location-based delisting is still a less than ideal solution in all cases, since it is patchy and vulnerable—and the evasion tools favor the well-informed or wealthy.

Google’s current domain-based approach is inadequate for the same reason as its practice of post-hoc notification to publishers (signaling that delisting has occurred, but without specifying details, and therefore encouraging speculation and collateral damage). These measures can serve a public interest, but without careful safeguards on mitigating republishing, they risk undermining the private rights of individuals too. No matter how damaging and harmful a piece of content is, there is always one piece of information more sensitive—and that is the fact that removal is desired. This is pure flame to ignite the “Streisand Effect,” in which attempts to obscure information only risk notoriety. Removal must be treated with appropriate sensitivity, or it undermines the entire enterprise.

Clearly, if national or regional laws are enforced worldwide, then Web users will have access to less digital content, in mathematical terms. Still, to those railing against Europe’s murmurs in this direction, or raising fears about illiberal regimes seizing on the EU’s precedent, it must be said: Pandora’s box is open, but it wasn’t the European Court of Justice that opened it. From 62 requests in 2008 to 345 million in 2014, Google has devised a very substantial apparatus for dealing with copyright takedown requests. And for this, it applies U.S. law on a worldwide basis, at a 97 percent acceptance rate. 

Why has Google conceded to implementing copyright requests at a level exceeding privacy requests by three orders of magnitude? The deeper truth is that copyright enforcement doesn’t threaten the geoeconomic, geopolitical order in the same way that giving users control over personal data does—empowering citizens, in other words—and that is something that deserves much deeper reflection and civic and political engagement than we’ve seen to date. 

This article is part of Future Tense, a collaboration among Arizona State University, New America, and Slate. Future Tense explores the ways emerging technologies affect society, policy, and culture. To read more, visit the Future Tense blog and the Future Tense home page. You can also follow us on Twitter.

Julia Powles is a lawyer and research fellow at Cornell Tech and New York University.