Hawktalk

Press and Google misrepresent European Court’s Google judgement

A tsunami of misinformation has overwhelmed the ECJ’s ruling on Google: high-tech corporate America, NGOs and parts of the UK media are claiming that the judgement constitutes shocking defeat for the concept of freedom of expression. In support of this claim, these organisations are publishing statements that are simply not true.

This blog reviews this coverage in the hope that in this sea of error, a life-raft of objectivity can continue to float on the surface.

The rhetoric

The UK Press has widely reported the case as creating an unrestricted “right to be forgotten” on demand; the Daily Express headlined its coverage as “EU rules Google must delete search results if requested because of 'right to be forgotten'” whilst the Daily Mail settled “EU court will force Google to remove people's personal data from search results on request” (my emphasis).

The USA dominated Computer & Communications Industry Association, which includes Facebook Inc., Yahoo, Google, and Microsoft, issued a colourful statement which claimed that the ruling "opens the door to large scale private censorship in Europe" adding that "our concern is it could also be misused by politicians or others with something to hide who could demand to have information taken down".

The USA press does something similar to the UK; the New York Times reports “European Court Lets Users Erase Records on Web”. However, my favourite headline was in the Irish edition of the Sunday Times; it ran a story on the judgement under the headline: “Future predators will use EU’s Google whitewash to cover their tracks”.

Google has widely misrepresented this judgment. According to yesterday’s Daily Telegraph (Wednesday 28 May 2014) Google’s Executive Chairman Eric E. Schmidt told shareholders: “A simple way of understanding what happened here is that you have a collision between a right to be forgotten and a right to know”. He added “from Google’s perspective that’s a balance, Google believes, having looked at the decision which is binding, that the balance that was struck was wrong.”

I should state that Google’s statement is not only misleading, it is simply plain wrong. Prior to the ECJ judgement, there was no balance between a “right to be forgotten” and freedom of expression, as freedom of expression always prevailed.

Even the NGOs that are concerned about freedom of expression have published commentary on the ECJ judgment that is way off-beam. Index on Censorship in its press release stated that the judgement “allows individuals to complain to search engines about information they do not like with no legal oversight” (my emphasis).

Index’s Press Release then dramatically continued: “This is akin to marching into a library and forcing it to pulp books. Although the ruling is intended for private individuals it opens the door to anyone who wants to whitewash their personal history”.

Clearly, that old newspaper adage is to the fore: “never let the facts get in the way of a good story”; perhaps, indeed, it is a case of “getting one's retaliation in first”.

So what are the facts?

Data protection has its roots in Article 8 of the Human Rights Convention and the respect for private and family life; freedom of expression has its roots in Article 10. These two Articles are always in contention and resolution of these two opposite objectives depends on the facts of the case. All the ECJ has done is said that when personal data are published on any website and a search engine is used to locate such personal data, this balance is engaged. In short, the Court has determined that it is no longer a one-way street for freedom of expression.

There is evidence that the Information Commissioner is already performing the balance between freedom of expression and privacy. It has been reported by this week’s Press Gazette (see references) that the Commissioner has not enforced the removal of a man’s fraud conviction from a newspaper’s website. The data subject’s argument was that the report related to an offence that happened in January 2000 and was now spent under the terms of the Rehabilitation of Offenders Act 1974; the personal data should therefore be removed.

According to the Press Gazette, the decision was made in March and focused on the Special Purpose exemption (Section 32 of the Act). The Gazette reported that the ICO took "a fairly broad view of what counts as 'processing only for the purposes of journalism' so as to ensure proper protection for the right to freedom of expression under Article 10 of the European Convention on Human Rights".

So if this balancing act happens now, why would one expect that the Information Commissioner would do differently with respect to the ECJ ruling on Google? This view is reinforced by what the Commissioner has just published re this judgement. He says:

“There are some who are seeking to draw out much wider implications of the judgment for freedom of expression in general. It is important to keep the implications in proportion and recognise that there is no absolute right to have links removed. Also, the original publication and the search engine are considered separately: the public record of a newspaper may not be deleted even if the link to it from a search website is removed”.

“We recognise that there will be difficult judgments to make on whether links should be removed. It is also important to remember that the exemption for journalism, art and literature under section 32 of the Data Protection Act can be applied by media organisations, bloggers and other publishers of information, depending on the circumstances”. Comment: look at the Press Gazette case mentioned above.

“We believe the judgment provides space to strike a balance between the right to privacy and the public’s right to know, recognising the role search engines play in facilitating access to information in today’s society. Guidance will be needed from data protection authorities to ensure search providers take the right approach”.

That is why I wrote in last week’s blog: “So, in ten years hence, I expect the Commissioner (or Courts) to be balancing conflicting interests, more or less in the same way, the Courts balance the public interest in cases involving the press. Guidance will be available and the fuss will pass over except for the occasional flare up on new issues of balance”.

Concluding comment

Readers should wary of what they read on this judgment. Any commentary from search engine sources (e.g. Google, Yahoo!) and the UK press should be taken with a large pinch of salt as this is being used to season a huge slice of ulterior-motive pie.

Google because its revenue depends on providing complete searches as possible, and the UK Press because they are seeking supporters for their alternative Press Complaints regime (and their opposition to Leveson). Their support for freedom of expression is only half the story; the profit motive is the other half.

References

“C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González” can be downloaded from http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=257894

ICO commentary on the judgment on: http://iconewsblog.files.wordpress.com/2014/05/key-points-of-cjeu-case.pdf and on http://iconewsblog.wordpress.com/2014/05/20/four-things-weve-learned-from-the-eu-google-judgment/

ICO refusing to enforce the removal of personal data from a press archive: http://www.pressgazette.co.uk/fraudster-loses-bid-make-newsquest-remove-report-spent-criminal-conviction-online-archive

Daily Mail coverage: http://www.dailymail.co.uk/sciencetech/article-2626998/The-right-forgotten-EU-court-rules-Google-remove-personal-data-search-results-request.html

Sunday Times coverage: http://www.thesundaytimes.co.uk/sto/news/ireland/article1411895.ece?CMP=OTH-gnws-standard-2014_05_17

Daily Express coverage: http://www.express.co.uk/news/uk/475657/EU-rules-Google-must-delete-search-results-if-requested-because-of-right-to-be-forgotten

New York Times coverage: http://www.nytimes.com/2014/05/14/technology/google-should-erase-web-links-to-some-personal-data-europes-highest-court-says.html?_r=0

Index on Censorship: http://www.indexoncensorship.org/2014/05/index-blasts-eu-court-ruling-right-forgotten/

Computer & Communications Industry Association quote: widely reported - example on http://dailyread.me/article/140

If the European Court has established a right to be forgotten, it has also established a right to object to marketing

 

Yesterday’s European Court of Justice (ECJ) Ruling which established that Google was a data controller because its search engines processed personal data has been widely reported as establishing an automatic “right to be forgotten”. This view is incorrect and in this blog, I explain why.

Also overlooked in the furore is the simple matter of the right to object to marketing; this has the potential to be far more problematic for Google’s business model.

The ECJ Judgment

First I should explore how the ECJ came to its conclusions that Google was acting as a data controller when its search engine was used; the main context, remember, is a data subject searching the Internet for records that contained details about himself by using his name as the search term.

• Are personal data being processed by Google? According to the Court, the  answer is “yes” because “the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results”.

• Is Google a data controller? Answer “yes” because as ‘controller’ it is determining the purpose (e.g. gaining revenue by providing personal data to a requestor) and the means of the processing of personal data (e.g. transmitting particular personal data to the requestor).  For instance, a search engine’s ranking algorithm chooses, under a ranking formula specifically designed for that purpose, what personal data are more important to the requestor. The fact that the ranking formula can by by-passed if any person is prepared to pay Google for the privilege (e.g. Adwords) shows that Google controls the means of the processing.

The issue is made more complex than stated above because the Judgement concerns the relationship between two organisations: Google Inc., which delivers the search functionality and Google Spain which is a subsidiary of Google Inc. incorporated in Spain. Google argued that this separation meant that Google Inc. processed the personal data whilst Google Spain had nothing to do except collect and administer the subsequent advertising revenue.

The Court rejected this argument citing Recitals 19 and 20 of the Directive 95/46/EC. Recital 19 states that “establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements” and that “the legal form of such an establishment … is not the determining factor”.  Recital 20 states that the fact that” the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive”.

The Court effectively decided that the processing of personal data was for the benefit Google Spain’s revenues. It then followed that the processing was “in the context of the activities’ of an establishment of the controller on the territory of a Member State” and that the Data Protection Directive (and the Spanish Data Protection Act) applied to the processing.  So when I use the term “Google as data controller”, it is convenient shorthand for a rather complex position.

Note that the processing under Google’s control is not the content of another individual’s website, just the personal data used to deliver the content to a requestor. For instance, if I write a blog on a specific data subject, my blog’s content is unaffected; what will be affected is a random reader’s ability to find my blog on the data subject using a search engine. It is this restriction that gives rise to the free expression/speech concerns (which I think are allayed).

Setting the judgement in the context of the UK Act

In the context of the UK’s Data Protection Act (DPA), if Google is a data controller processing personal data, all the Data Protection Principles and rights apply, subject to an exemption.

The DPA is purpose driven, so what are the purposes of the processing? I think there are two purposes; these are something like: “at the request of a data subject, searching personal data in public domain about the data subject and displaying such personal data on the data subject’s terminal”. Another purpose is the processing of personal data “for the making of profits by displaying advertisements to the data subject making the request”.

Any “right to be forgotten” dispute applies to the first purpose; it is the right to object to marketing that applies to the second.

In addition, the application of the DPA, if the data subject has placed his own personal data in the public domain, is likely to be different to the application of the Act when personal data about the data subject has been put into the public domain by someone else.

In the former case, the processing originally had the consent of the data subject; the latter case (the one described by the ECJ judgement) occurs when the processing does not have data subject consent (i.e. a newspaper that decided to publish its text online and an outdated story about the data subject). In the former case, the data subject knows about the processing; in the latter case, the data subject might not know (until he does his Google search using his name).

The “right to be forgotten”

Let us imagine the application of the Data Protection Act to the latter case; one can see that the most likely justification for Google’s processing of personal data is Schedule 2, paragraph 6. Namely that the processing is in the legitimate interests of the data controller (e.g. to sustain free speech and make money) except “where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject”? (e.g. their privacy).

Note that the data subject has to possess an overriding legitimate interest in any particular case to claim that his view should prevail. To do this the data subject has to identify that overriding legitimate interest to the data controller, and one assumes that if this happened, Google would resist, citing the detriment to free speech. The data subject would then argue that free speech is not affected as the original document (e.g. in this case, the newspaper article is still in the newspaper). The result would be a Section 42 assessment winging its way to the Commissioner.

Alternatively, the data subject could claim the Third Principle is infringed; Google would argue that the processing is necessary to sustain free speech/expression, the data subject will argue that it is excessive to do so in his particular case. Finally, the data subject could try the Section 10 right to object to the processing. This means that the data subject would have to show that the processing is causing or likely to cause the data subject substantial unwarranted distress or substantial unwarranted damage.

In all these cases, I suspect the data subject’s approach to Google will be rejected and a Section 42 assessment wings its way to the Commissioner; in the case of Section 10, the matter could be directed to the Courts (but having been mugged by Durant, I would not risk this!).

In other words, if there is a dispute about the processing of the personal data by the search engine, the issue will eventually be put before the Information Commissioner who will no doubt make a decision which by necessity has to be a balance competing claims. If the decision is in favour of the data subject, one assumes that Google will appeal, all the way to the Supreme Court (and then perhaps to the European Court of Human Rights).

We can now see that this “right to object” is not automatic; it will take a few years before the jurisprudence surrounding this argument will be settled.

That is why I say that the ECJ Judgement has not established a “right to be forgotten”; it has established a mechanism whereby the two conflicting interests that has bedevilled the Internet (freedom of expression versus individual privacy) can be resolved using an independent judicial mechanism. Before this judgement, freedom of speech or expression (and making money) always prevailed (and Google was the only judge).

So, in ten years hence, I expect the Commissioner (or Courts) to be balancing conflicting interests, more or less in the same way, the Courts balance the public interest in cases involving the press. Guidance will be available and the fuss will pass over except for the occasional flare up on new issues of balance.

Finally, I am a cynical enough to imagine circumstances where it is possible that Ministers will use their powers to influence events (e.g. in Schedule 2, paragraph 6(2) or in Section 10(2)(b) of the DPA). This might be especially the case if Google (and Facebook, Yahoo! etc) lobby effectively (and whisper that it may be willing to pay more Corporation Tax in the UK)!

The right to object to marketing

Although Google does undoubtedly enhance freedom of speech and expression, let us not forget its prime concern is to make money; it does this by “enhancing our internet experience” and providing targeted advertisements. Now, thanks to the ECJ, we now know that Google is using personal data to provide such advertising, and as such the section 10 right to object to marketing applies. That right, as everybody knows, is absolute.

So, as far as I can see it, if I formally object to Google about marketing and then (after a reasonable time of course), I put my name in to its search engine, that search should not be accompanied by any targeted marketing blurb (as my personal data are processed)! Indeed, if I append my name to the end of any search term I use, I should not get marketing as my personal data are being processed.

Unlike the “right to be forgotten”, this right to object does not balance any interests – it is totally on the side of the data subject and can be exercised now.

Interesting eh? I don't know how this angle will develop, but does anybody want to buy my Google shares?

References

“C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González” can be downloaded from http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=257894

 

Can the Commissioner enforce the correct part of the First Principle, please?

I have just looked at the Undertaking accepted by the Disclosure and Barring Service in March 2014.  I think it represents a missed opportunity by the Commissioner to cement the concept of unlawful processing in relation to the First Principle, or to enforce the absence of a Schedule 2/3 criterion that legitimises the processing of personal data, or to reinforce the link between unlawful processing and Article 8 of the Human Rights Act.

As you know, the ICO has taken two cases to the Courts (see references), trying to limit the Police from disclosing old criminal convictions in the context of employment; he lost both. However, with a separate case in January 2013, the Court of Appeal decided that the disclosure of all convictions and cautions in a criminal record certificate, irrespective of the circumstances, contravened Article 8 (Right to Respect for Private and Family Life), of the European Convention on Human Rights (as implemented into UK law by the Human Rights Act).

This judgement followed three cases, one of which was a Mr. T who was born on 3 May 1991. When he was 11 years of age, he received two warnings from the Manchester Police in connection with two stolen bicycles. Apart from these police warnings, the Court found that “he is a man of good character and believed that his warnings were spent. But he was disabused of this in 2008 when (aged 17) he sought a part-time job at the local football club”.

It was cases like this that made the Court of Appeal award Mr. T a declaration that the 1997 Police Act (which set up the vetting arrangements via the Criminal Record Certificate) was incompatible with Article 8. In response to this judgment, the Government changed that law so that the very minor offences related to cautions and warnings did not have to be disclosed after 6 years (assuming that recidivism was absent and the minor offence was not a sex related).

The Disclosure and Barring Service was behind the pace with respect to the change in the law; Question “e55” of its DBS application form still asked applicants “Have you ever been convicted of a criminal offence or received a caution, reprimand or warning”. According to the ICO, the DBS had thus “Collected details that had no need to be collected as a result of the change of the law” and that an “individuals positive response to question e55 was then seen by prospective employers who withdrew their job offers”.

In other words, the DBS vetting procedures had not taken the change of the law fully into account and some data subjects had their job offers taken away.

The Commissioner’s Undertaking is couched in terms in relation to fair processing in that the application form collected details that were not needed. The Commissioner required DBS “to change by 31 March 2014, question e55 of the application form” to “Do you have any convictions, cautions, reprimands or final warnings, which would not be filtered in line with guidance?” (this is a reference to the guidance that identified the types of minor convictions that should not be disclosed).

I would have preferred in the Undertaking had described the First Principle breach in terms of “lawfulness”. In other words, without the change of the wording of question e55, the DBS form would contravene Article 8 of the Human Rights Act by making an unnecessary and unlawful collection of personal data (i.e. unlawful processing), or that there was no Schedule 2 grounds that legitimised the collection of these minor criminal records (e.g. the DBS were collecting personal data that are not necessary for its functions or not necessary for any legal obligation imposed on DDS).

I think that such a step would send a message to any public authority that if it acts outside its statutory remit when processing personal data then it is unlawfully processing such data.  This is the issue at the heart of the Snowden revelations about the lawfulness of certain national security data collections, or about the issues about the lawful retention of communications data, or the lawful use of CCTV images by local authorities when it fines motorists for minor traffic infringements at off peak times in order to collect revenue.

The “unlawfulness” message was also central to the Enforcement Notices issued to Southampton City Council (audio CCTV in all taxis) or to Hertfordshire Police (ANPR covering all roads into Royston).

In these cases above, the concept of fairness is irrelevant as the processing is unlawful; any unfair processing has been undertaken by the employer who used an old, inconsequential and minor criminal conviction to debar someone from employment.

References

The DBS Undertaking: http://ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/disclosure-and-barring-service-undertaking.pdf

R on the application of T, JB and AW v Chief Constable of Greater Manchester, Secretary of State for the Home Department and Secretary of State for Justice; Neutral Citation Number: [2013] EWCA Civ 25 (on 29 January 2013)

Changes in the vetting law introduced by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (Amendment)(England and Wales) Order 2013 and the Police Act 1997 (Criminal Record Certificates: Relevant Matters)(Amendment)(England and Wales) Order 2013

ICO attempts: Chief Constable of Humberside Police & Ors v The Information Commissioner & Anor [2009] EWCA Civ 1079  and Chief Constable of South Yorkshire Police v The Information Commissioner [2011] EWHC 44 (Admin) (21 January 2011).

Data Protection: CRB could stop misuse of irrelevant criminal data in employment vetting http://amberhawk.typepad.com/amberhawk/2009/10/data-protection-crb-could-stop-misuse-of-irrelevant-criminal-data-in-employment-vetting.html