Search engines and data privacy: What’s happening with all those ‘right to be forgotten’ requests in Europe?

A recent EU ruling has given internet users the right to request the removal of personal listings on Google and other search engines.

Last week alone, Google received 41,000 takedown notice requests. Since the May 13 European Union (EU) ruling, it has received tens of thousands of requests from internet users requesting sensitive information about them to be removed.

Yahoo! has publicly stated that they are working on developing their own solution and have a team that is looking into how they can balance the EU decision with the important privacy interests and freedom of expression.

On the other hand, Bing does not appear to be taking any action at this point, saying that they are hoping the courts and data protection authorities will strike a balance between protecting privacy rights and freedom of speech.

Everyone was awaiting the 28 heads of the EU data protection authorities meeting last week in Brussels to agree an approach, but they have put off any decision until their next meeting in September. They are divided on whether people will bother to go to court for any non-action by search engine providers and whether there should be a public interest test applied.

Currently, the country leading the Google requests for takedown notices is Germany (40% but it is also the most populous EU country), followed by Spain, UK, Italy and France, in that order. Of the requests to have material removed, the leading reason at this point seems to be fraud or scams, with violent or serious crimes just behind this, followed by child pornography arrest removals.

How does it work?

Google has posted a form that individuals fill out to request a URL list of results they want removed from search results. The form only permits the submission of one name (rather than variations of the name) and requires photo ID to confirm the person submitting the request is actually the person authorised to do so. The form requests a ‘reasonable explanation’ of why the listing is ‘irrelevant, outdated or inappropriate’.

Apart from processing the form and according to the EU ruling, Google (and any other search engine) has to determine whether the data in question is “excessive in relation to purposes for which they were processed and in the light of the time that has elapsed”. This vague phrase in the EU ruling is open to interpretation.

Does this mean it will actually be removed?

Google has set up a ‘removal team’ but the timeframe for the actual removal process is not yet set. Individuals who submit a form receive an automated confirmation of receipt of their request but there is no time for removal indicated.

It’s understood that should the process for removal be implemented, Google is planning to flag any censored search results similar to the manner in which it does for such things as copyright infringement takedown requests.

This would mean that people would see a notification at the bottom of the page that links to a separate page where there is an archive of cease-and-desist notices. In other words, if someone asks for a URL to be removed from the listings for their name, and if it is approved, the URL will not be visible but anyone looking at the bottom of the page of results will be able to see that they must have requested something to be removed.

What are people saying?

Google believes that the forced expunging is equivalent to censorship.

The US is already jumping up and down and saying it clashes with their law on the ‘right to know’.

The Australian Law Reform Commission (ALRC) has recommended a new Australian Privacy Principle (APP) to be considered which would give individuals the right to request destruction of their personal information or de-identification.

The ALRC has also recommended a statutory cause of action for serious invasions of privacy but there still is no equivalent for the EU fundamental right to privacy or anything similar.

The ALRC’s final report goes to the Attorney-General this month so we will have to wait to see if the new proposed APP will be introduced.

What seems to be avoided in any discussion is not the actual physical removal or the mechanics of it, but rather the vague criteria and how it is to be assessed and processed to ensure consistent application. The biggest criticism from most countries is around the issue that a search engine must judge what is entitled to be deleted. It seems a big interpretive task for one company. But everyone seems to agree, at this point, it’s still a ‘wait and see’ game.