If the European Court has established a right to be forgotten, it has also established a right to object to marketing

 

Yesterday’s European Court of Justice (ECJ) Ruling which established that Google was a data controller because its search engines processed personal data has been widely reported as establishing an automatic “right to be forgotten”. This view is incorrect and in this blog, I explain why.

Also overlooked in the furore is the simple matter of the right to object to marketing; this has the potential to be far more problematic for Google’s business model.

The ECJ Judgment

First I should explore how the ECJ came to its conclusions that Google was acting as a data controller when its search engine was used; the main context, remember, is a data subject searching the Internet for records that contained details about himself by using his name as the search term.

• Are personal data being processed by Google? According to the Court, the  answer is “yes” because “the operator of a search engine ‘collects’ such data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of search results”.

• Is Google a data controller? Answer “yes” because as ‘controller’ it is determining the purpose (e.g. gaining revenue by providing personal data to a requestor) and the means of the processing of personal data (e.g. transmitting particular personal data to the requestor).  For instance, a search engine’s ranking algorithm chooses, under a ranking formula specifically designed for that purpose, what personal data are more important to the requestor. The fact that the ranking formula can by by-passed if any person is prepared to pay Google for the privilege (e.g. Adwords) shows that Google controls the means of the processing.

The issue is made more complex than stated above because the Judgement concerns the relationship between two organisations: Google Inc., which delivers the search functionality and Google Spain which is a subsidiary of Google Inc. incorporated in Spain. Google argued that this separation meant that Google Inc. processed the personal data whilst Google Spain had nothing to do except collect and administer the subsequent advertising revenue.

The Court rejected this argument citing Recitals 19 and 20 of the Directive 95/46/EC. Recital 19 states that “establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements” and that “the legal form of such an establishment … is not the determining factor”.  Recital 20 states that the fact that” the processing of data is carried out by a person established in a third country must not stand in the way of the protection of individuals provided for in this Directive”.

The Court effectively decided that the processing of personal data was for the benefit Google Spain’s revenues. It then followed that the processing was “in the context of the activities’ of an establishment of the controller on the territory of a Member State” and that the Data Protection Directive (and the Spanish Data Protection Act) applied to the processing.  So when I use the term “Google as data controller”, it is convenient shorthand for a rather complex position.

Note that the processing under Google’s control is not the content of another individual’s website, just the personal data used to deliver the content to a requestor. For instance, if I write a blog on a specific data subject, my blog’s content is unaffected; what will be affected is a random reader’s ability to find my blog on the data subject using a search engine. It is this restriction that gives rise to the free expression/speech concerns (which I think are allayed).

Setting the judgement in the context of the UK Act

In the context of the UK’s Data Protection Act (DPA), if Google is a data controller processing personal data, all the Data Protection Principles and rights apply, subject to an exemption.

The DPA is purpose driven, so what are the purposes of the processing? I think there are two purposes; these are something like: “at the request of a data subject, searching personal data in public domain about the data subject and displaying such personal data on the data subject’s terminal”. Another purpose is the processing of personal data “for the making of profits by displaying advertisements to the data subject making the request”.

Any “right to be forgotten” dispute applies to the first purpose; it is the right to object to marketing that applies to the second.

In addition, the application of the DPA, if the data subject has placed his own personal data in the public domain, is likely to be different to the application of the Act when personal data about the data subject has been put into the public domain by someone else.

In the former case, the processing originally had the consent of the data subject; the latter case (the one described by the ECJ judgement) occurs when the processing does not have data subject consent (i.e. a newspaper that decided to publish its text online and an outdated story about the data subject). In the former case, the data subject knows about the processing; in the latter case, the data subject might not know (until he does his Google search using his name).

The “right to be forgotten”

Let us imagine the application of the Data Protection Act to the latter case; one can see that the most likely justification for Google’s processing of personal data is Schedule 2, paragraph 6. Namely that the processing is in the legitimate interests of the data controller (e.g. to sustain free speech and make money) except “where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject”? (e.g. their privacy).

Note that the data subject has to possess an overriding legitimate interest in any particular case to claim that his view should prevail. To do this the data subject has to identify that overriding legitimate interest to the data controller, and one assumes that if this happened, Google would resist, citing the detriment to free speech. The data subject would then argue that free speech is not affected as the original document (e.g. in this case, the newspaper article is still in the newspaper). The result would be a Section 42 assessment winging its way to the Commissioner.

Alternatively, the data subject could claim the Third Principle is infringed; Google would argue that the processing is necessary to sustain free speech/expression, the data subject will argue that it is excessive to do so in his particular case. Finally, the data subject could try the Section 10 right to object to the processing. This means that the data subject would have to show that the processing is causing or likely to cause the data subject substantial unwarranted distress or substantial unwarranted damage.

In all these cases, I suspect the data subject’s approach to Google will be rejected and a Section 42 assessment wings its way to the Commissioner; in the case of Section 10, the matter could be directed to the Courts (but having been mugged by Durant, I would not risk this!).

In other words, if there is a dispute about the processing of the personal data by the search engine, the issue will eventually be put before the Information Commissioner who will no doubt make a decision which by necessity has to be a balance competing claims. If the decision is in favour of the data subject, one assumes that Google will appeal, all the way to the Supreme Court (and then perhaps to the European Court of Human Rights).

We can now see that this “right to object” is not automatic; it will take a few years before the jurisprudence surrounding this argument will be settled.

That is why I say that the ECJ Judgement has not established a “right to be forgotten”; it has established a mechanism whereby the two conflicting interests that has bedevilled the Internet (freedom of expression versus individual privacy) can be resolved using an independent judicial mechanism. Before this judgement, freedom of speech or expression (and making money) always prevailed (and Google was the only judge).

So, in ten years hence, I expect the Commissioner (or Courts) to be balancing conflicting interests, more or less in the same way, the Courts balance the public interest in cases involving the press. Guidance will be available and the fuss will pass over except for the occasional flare up on new issues of balance.

Finally, I am a cynical enough to imagine circumstances where it is possible that Ministers will use their powers to influence events (e.g. in Schedule 2, paragraph 6(2) or in Section 10(2)(b) of the DPA). This might be especially the case if Google (and Facebook, Yahoo! etc) lobby effectively (and whisper that it may be willing to pay more Corporation Tax in the UK)!

The right to object to marketing

Although Google does undoubtedly enhance freedom of speech and expression, let us not forget its prime concern is to make money; it does this by “enhancing our internet experience” and providing targeted advertisements. Now, thanks to the ECJ, we now know that Google is using personal data to provide such advertising, and as such the section 10 right to object to marketing applies. That right, as everybody knows, is absolute.

So, as far as I can see it, if I formally object to Google about marketing and then (after a reasonable time of course), I put my name in to its search engine, that search should not be accompanied by any targeted marketing blurb (as my personal data are processed)! Indeed, if I append my name to the end of any search term I use, I should not get marketing as my personal data are being processed.

Unlike the “right to be forgotten”, this right to object does not balance any interests – it is totally on the side of the data subject and can be exercised now.

Interesting eh? I don't know how this angle will develop, but does anybody want to buy my Google shares?

References

“C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González” can be downloaded from http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=257894

 

Comments

[PC]

Not sure I agree. CJEU is quite clear that rights to privacy, as a general rule, override Google's commercial interests and the interests of other internet users (presumably this is getting at freedom of expression). Only in particular cases can the information be retained. Read paras. 80 & 81.

So the ruling is quite clear on the scope of this right. Whether it is enforced is another matter.

Peter C

CP COMMENT ADDED:

Paras 80 and 81 fall under the “Question 2(c) and (d), concerning the extent of the responsibility of the operator of a search engine under Directive 95/46”; this relates to the obligation of a controller to apply the national law based on the Directive.

Para 81 says that “a fair balance should be sought in particular between that interest (of freedom of speech) and the data subject’s fundamental rights under Articles 7 and 8 of the Charter”. So I don't interpret this section as being a preference to maintain privacy over freedom of expression at all - its a balance.

In the section on the DPA, I set out the detail of that balance.

[pete c]

And para 81 goes on to say "the data subject's rights protected by [art 7 & 8 of the Charter] also override, as a general rule, that interest of internet users" - i.e. my right to privacy is more important than the rights of others to stalk me on Google.
So technically still a "balancing exercise" but one with heavily weighted scales. Or am I still missing something?