After almost a month since the CJEU decision on Google and (allegedly) a “right to be forgotten” stirred up not only the international privacy community but also all of the digital world, managing to even occupy prominent general press space—among others, in The Economist, The New York Times and The Guardian, and while Google has already published a “search removal request” webpage that already attracted more than 40.000 applications within the first days it became operational, it is perhaps time to calmly assess what the CJEU decision really is and is not about.

What Google Does

With Google accounting for more than 90 percent of Internet searches in Europe, it shall be used from now on as showcase for any (successful) Internet search engine. Although it is obvious, we need to be reminded that Google links information – it does not create content. By scanning interminably, through automatic means, the web in order to create new connections and correlate more information leaves no record unsearched and no information unrelated to another. Given the exponential growth of digitized information and the lack of structure on the web, Google is the non-human, file-keeper of the past. Admittedly, it executes its task brilliantly: Through its successful search engine discovery of personal information on any individual that would otherwise take significant resources to carry out takes only moments and may be performed even by the most inexperienced user. This contribution is neither insubstantial nor without legal consequences. One should always keep in mind that, at least in the EU, data protection legislation emerged during the 1970s as a privacy spin-off only when the first computers entered public administrations in order to do exactly the same thing, for until that time, manual records were kept in cabinets and storage rooms. In other words, the efficiency of the personal data processing matters.

The EU Principle of Proportionality: Even Lawful Behavior May Be Found Infringing, Depending on the Actual Conditions

Such qualitative effect is court assessable. In EU law this is mostly performed by application of the principle of proportionality: All other factors found lawful, measures also need to be proportionate to their aims. This is an ever-present principle that at times had led to unexpected results, as was, for instance, the case in April when the same court annulled (retrospectively!) the EU law on the retention of telecoms and Internet data by their providers for law enforcement purposes. The same principle is embedded in EU data protection legislation as well. The processing needs to be proportionate to its purposes, meaning that if it is not, even if all other circumstances relating to it are lawful, it will be ultimately found unlawful. Perhaps this is the case in U.S. law as well. Although we would generally hesitate to approach U.S. Supreme Court rulings, the case of Grokster (and, we also think, secondary copyright infringement) was similarly based on a qualitative criterion (the volume of illegal downloads and Grokster behavior) and not on the action itself (enabling users to exchange files) that is otherwise lawful.

The CJEU Decision Is, More Than Anything Else, An Exercise of the Principle of Proportionality.

The CJEU expressly used proportionality-related reasoning in order to reach its decision:

processing of personal data, such as that at issue in the main proceedings, carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. Furthermore, the effect of the interference with those rights of the data subject is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous”.

Subsequently, the court weighted the above against Google’s legitimate interest to process the information—also acknowledged in EU data protection law—but found an imbalance in the relationship: “In the light of the potential seriousness of that interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing”. Hence, Google processing was found unlawful —see, however Christopher Kuner’s critical approach to the same balancing here.

The CJEU Decision Has Nothing To Do with the Freedom of Expression (And Much Less, with Freedom of the Press)

The CJEU did not order the newspaper on whose webpages the information on the claimant originally appeared to delete them. The newspaper post on the claimant is still online, available for anyone to see. What the CJEU prohibited is automated perpetual linking to this information—when, more particularly, they refer to “anonymous” individuals. Google does not express an opinion—nor may what it does be considered journalism. It only brings up information, perhaps enabling others to express an opinion (See also Solove questions, under 5). Google is an accessory, not required but certainly facilitating, to the freedom of expression—and to a bunch of other freedoms as well. However, to our knowledge at least, there is to-date no such thing as protected secondary exercise of human rights—although there appears to exist secondary copyright infringement. Until that time, enabling tools have nothing to do with the freedom or rights per se.

Even More Surprisingly, the CJEU Decision Has Nothing To Do with a “Right To Be Forgotten”

A “right to be forgotten”, if ever acknowledged to humanity even in digital context—there certainly is none in the offline world context—would essentially include a “right to delete” or “to have deleted.” As already explained, this is not what the CJEU decision under consideration does. It did not ask for deletion of the original information—according to the UK ICO blog, “It is important to keep the implications in proportion and recognise that there is no absolute right to have links removed. Also, the original publication and the search engine are considered separately.” This is also not what the draft EU data protection regulation at least today speaks of. Its Article 17 asks for deletion of the actual data, not third-party links to them. If we ultimately believe that by deleting Google links people forget, then we need to seriously reconsider the mechanics of human memory today and in the foreseeable future.

The Pragmatic Approach: This May Be Only A Mid-term Problem

We often forget that the Internet has a history of only 20 years or so. After a few more years have passed and a few hundred million or even billions of new users have been added to it while several thousands of its first users will have presumably “left” it, and a couple of social networks will have gone bankrupt and several webpages will be discontinued but still online, the qualitative criterion that annoyed the EU court will have been abolished because it will be far more difficult to establish that Mr. González (the claimant), still appearing in that Spanish newspaper, is indeed the same person who had his real estate auctioned back in 1998 and not one of the millions of others carrying the same name. Until that time, however, it is probably true that unsuspecting individuals who once in their lifetime erred or, even worse, allegedly erred, may need protection from super-efficient seemingly perpetual, automated associations of that one time with their name. In essence, this is perhaps an Internet infancy disease brought by the formidable work performed by Google and its competitors. The CJEU decision is trying to balance things, perhaps assisting individuals a bit more than they deserve, until we all—Internet users, the Internet and Internet companies—get to better grips with the, still new, medium.