Hawktalk

Cartoon: Data Protection Regulators as guard-dogs; spot the British breed!

 

Please look at this cartoon in the context of the blog posted below of the same date

References:

The Cartoon is lifted from a presentation in 2006 from a European Commission data protection official: http://www.abgs.gov.tr/tarama/tarama_files/23/SC23EXP_Protection%20of%20Personal%20Data.pdf

 

Has Europe cut the UK adrift on Data Protection?

In 1805, William Pitt the Younger, after hearing about Napoleon's victory at the Battle of Austerlitz is reported to have said: "Roll up that map (of Europe): it will not be wanted these ten years". Well I have attended two meetings which suggest that the European Union has already rolled up its Data Protection Map of Europe so it excludes the UK.

The main reason for this? Anticipation of a likely UK withdrawal from European Union after the next General Election.

At the Information Commissioner’s press conference to launch his latest Annual Report (July 15), he reported that in the Working Party 29, it was difficult to get the British pragmatic view across – irrespective of the arguments. This was not because the UK was speaking in runes and riddles; it was the presumption that the UK could easily leave the European Union and therefore what it had to say carried little weight.

Indeed, perhaps it was these kinds of sentiments which prevented the UK’s Information Commissioner from becoming head of WP29 Committee of Data Protection Authorities. If the UK is debating leaving the European Union (EU), it follows that you can’t have the UK Commissioner having a key role in such a leading EU Committee.

At a meeting on Monday (July 28) held under Chatham House rules, a senior official from a European institution responsible for data protection policy said that the UK was “lost” to Europe. The result is that the UK views on the Regulation can be seen as political posturing and part of the UK’s in-out debate. In short, since the UK might leave the EU, the Government’s opinions also carried little weight.

I have already reported in this Blog that the UK Government is largely seen as blocking progress on the Data Protection Regulation (Ms Reding, the Commissioner responsible for the Regulation, was reported in the German press saying that discussions with Britain and Ireland were "not important" adding that she only had time for “constructive conversations” identifying those discussions with Great Britain as a waste of effort and "unnecessary”).

It is also well known that this Regulation was top of the Prime Minister’s “hit-list” of red-tape regulations at the Heads of States meeting in October 2013. The UK position is still that it wants a new Data Protection Directive; I should add that I was told last Monday that the Commission thinks that the UK is now isolated in this regard and that a Regulation will definitely appear in 2015.

A slice of data protection history

The European notion that the UK does not really care about data protection is not a new one; it has been around for more than two decades and developed during the protracted negotiations about the Directive 95/46/EC where the UK was instrumental as delaying agreement on the Directive for five years.

Rumour has it that in 1995 Chancellor Kohl and President Mitterrand, to avoid further delay, decided to give in to British demands and agreed a Directive that included huge carve-outs for Member States (e.g. manual files, an implementation timetable that could extend to 2008).

It was this decision which resulted in diverse implementation of Directive 95/46/EC by Member States and the consequent need for the current Regulation to establish consistent data protection rules for all Member States. Note that during these protracted Regulations negotiations, the view is also that the UK is too eager to cause delays in order minimise the impact on business.

This view is reflected in the cartoon, used in presentations about Data Protection Regulators at the time (in 2006). This depicted the Regulators as dogs protecting a block of personal data; the Spanish Regulator was depicted as a Rottweiler whilst the UK was depicted as a cuddly poodle that could easily be rolled over (see references for the cartoon).

One does not know whether the advent of the Monetary Penalty Notice has changed this view of the UK Regulator; however, given the resistance from the UK Government to implement a custodial element to the S.55 offence  and the decade of debate about enforced subject access, one could argue that very little has changed.

Data Protection consequences if the UK leaves the EU?

First, can I make some political observations?

• If Scotland votes for independence then the chances of EU withdrawal increases for the rest of the UK. The reason is that any Conservative majority in the next Parliament will derive its legitimacy from non-Scottish constituencies; indeed there is that old joke that there are more pandas in Scotland than Scottish Conservative MPs.

• If the Conservatives are returned to power after the next General Election, then it will be on a Euro-sceptic agenda as the party is likely to present an explicit Euro-sceptic manifesto in an attempt to reduce the UKIP vote.

• Any fresh UK-Euro negotiations will not result in much change in substance if the European view is that the UK has already a foot in the exit door; indeed I expect the Commission to draw up contingency plans for a UK exit.

• If there is an “in-out” referendum, then the popular tabloid press and Conservative supporting broadsheets will probably urge its readers for an “out” vote irrespective of what the UK negotiates with Europe. This referendum is likely to occur at the same time as any new Regulation will commence (i.e. in 2017).

• Any Conservative commitment to withdraw from the European Convention on Human Rights will not be understood by European Countries whose recent history is characterised by a history of rule by a totalitarian regime or dictator (e.g. East Germany, the “Iron curtain” block, Spain, Greece and Portugal).

If we then assume there is no such thing as an “amicable” separation, can we now postulate what happens the data protection context if the UK votes to leave the EU:

• The UK will be outside the EEA and the transfer rules of any new Data Protection Regulation applies to transfers of personal data to the UK.

• The European Commission has already determined that the UK’s Data Protection Act is not a proper implementation of Directive 95/46/EC (see references); it is supposed to be thinking of implementing “on-going” infraction proceedings (this is the main reason why my FOI requests have hitherto failed to confirm the nature of these deficiencies).

• The doubts surrounding transfers of personal data to the USA because of the Snowden revelations will apply to transfers to the UK because of GCHQ (and the emergency DRIP legislation which extends the range of communications data which are subject to mass retention rules). These doubts would be enhanced if a future UK Government was not committed to the text of Article 8 of the Human Rights Convention.

In other words, there is a real risk that the EU might find that the UK does not offer “an adequate level of protection” (even under the current data protection rules). I am sure the financial centres in Germany and Paris might float that idea off to their respective and presumably receptive politicians.

In 1982, Mrs Thatcher decided that the risks to a block on transfers of personal data to the City of London were such that the Data Protection Act 1984 had to be implemented.

It would be strange if a future Conservative Government came to the opposite conclusion and that any policy of withdrawal from the European Union held no risks to the transfers of personal data into the UK.

References

Ms Redings comments about the UK’s approach to Regulation discussions in: http://amberhawk.typepad.com/amberhawk/2013/09/uk-isolated-in-data-protection-regulation-discussions-is-it-a-result-of-nsa-shenanigans.html

Cameron’s speech puts UK accession to any Data Protection Regulation and Directive in doubt. http://amberhawk.typepad.com/amberhawk/2013/01/camerons-speech-puts-uk-accession-to-any-data-protection-regulation-and-directive-in-doubt.html

The history of the UK approach to data protection being more a cost on business and less of a protection of the individual: http://amberhawk.typepad.com/amberhawk/2013/04/mrs-thatchers-data-protection-legacy.html

Why the UK’s Data Protection Act is a deficient implementation of Directive 95/46/EC: http://amberhawk.typepad.com/amberhawk/2013/02/question-answered-why-does-the-european-commission-think-the-uks-data-protection-act-is-a-deficient-implementation-of.html

Link to the Cartoon depicting Regulators as dogs: http://amberhawk.typepad.com/amberhawk/2014/07/cartoon-data-protection-regulators-as-dogs-spot-the-british-breed.html

ICO confirms that Data Protection Act does not apply to emergency powers law.

In yesterday’s blog, I suggested that the haste for the Data Retention and Investigatory Powers Bill (DRIP) was because of intended legal action; it looks as if my hunch is more than 50% correct.

Secondly, I also said that the statements made by Government in relation to data protection, the national security functions and these emergency measures were complete rubbish; the ICO at his Annual Report launch yesterday confirmed that the protections afforded to data subjects by the Data Protection Act are minimal.

Intended legal action

Privacy International (PI) has taken legal action with seven internet and communications service providers. These companies include: Riseup (US), GreenNet (UK), Greenhost (Netherlands), Mango (Zimbabwe), Jinbonet (Korea) and  May First/People Link (US). Note the international nature of these organisations.

Now look at this quote from the Minister which provides the substantiation Clause 4 of DRIP:

“The territorial extent of RIPA has perhaps never been as explicit as it should have been. As a result, some overseas companies have started to question whether they are obliged to comply with warrants that are served on them. Our judgment is that that situation has reached a dangerous tipping point, and that it is necessary to put it beyond doubt that RIPA applies equally to public telecommunications services that are located overseas and those that are headquartered in the UK”. (Hansard 15 July 2014 : Column 782)

So, if RIPA was “not explicit”, what is the status of all the decade of interceptions that have occurred before this amendment? Could they be unlawful? Is the “tipping point” mentioned by the Minister PI’s legal action?

Data Protection: spot the difference

At the Annual Report meeting yesterday, the Information Commissioner said that he had been given permission to publish his evidence to the Intelligence Security Committee. In that evidence (see references), one key point said:

“The Data Protection Act provides only limited reassurance as a wide ranging exemption from its provisions can in any case be relied on where safeguarding national security is concerned”

The Explanatory Notes to DRIP:

“It is assessed that implementation of the proposed legislation is capable of being fully compliant with the Data Protection Principles and the Data Protection Act 1998”.

Note that by “fully compliant” the Government means “exempt”.

References:

A copy of the Data Retention and Investigatory Powers Bill and Notes  have moved to the Parliamentary website: http://services.parliament.uk/bills/2014-15/dataretentionandinvestigatorypowers/documents.html

Other important DRIP details on https://www.gov.uk/government/publications/the-data-retention-and-investigatory-powers-bill

Details of the Privacy International action: https://www.privacyinternational.org/blog/stop-breaking-the-internet-internet-and-communications-service-providers-take-legal-action

Previous blog “Misleading data protection statements and another reason for the emergency data retention law?”: http://amberhawk.typepad.com/amberhawk/2014/07/misleading-data-protection-statements-and-another-reason-for-the-emergency-data-retention-law.html

ICO’s evidence to the ISC: http://ico.org.uk/about_us/consultations/~/media/documents/consultation_responses/ICO-Submission-to-ISC-Committee-Privacy-and-Security-Inquiry-20140131.pdf

 

Misleading data protection statements and another reason for the emergency data retention law?

I have just read the Explanatory Notes and the clauses in “The Data Retention and Investigatory Powers (DRIP) Bill” which is being rushed through Parliament this week.

According to Ministers, the Bill is primarily to allow the national security agencies and the police continued access to communications data and the content of communications because the European Court of Justice struck out the Data Retention Directive (on the grounds that the Directive provisions facilitated mass indiscriminate surveillance).

According to Ministers, the Bill is needed because terrorists, peados, mafia members and other purveyors of human nastiness will get away with it if the legislation is not rushed through.

However, the Bill is not just about the above. In its 6 pages and 6 clauses contains only Clause 1 is about data retention; most of the Bill concerns warrants signed in relation to interception and a definition which provides wider access to communications data on the Internet. There has been little publicity about the other clauses and the extension of surveillance.

An alternative emergency?

The Notes to the Bill in relation to “Clause 4: Extra-territoriality in Part 1 of RIPA” contains a surprise. It states that “This clause clarifies certain provisions of Chapter 1 of Part 1 of RIPA to put beyond doubt that those provisions have extra-territorial effect” (my emphasis).

In other words, the Notes infer that there are now doubts as to whether GCHQ etc have acted lawfully (and give the length of this clause, these doubts are not insignificant).

So what are these doubts? This has yet to be explained; however, in Parliament, when the Snowden revelations first surfaced, Foreign Secretary Hague stated that the accusation that GCHQ acted unlawfully was “baseless”. He said:

“The signing of a warrant is not a casual process. "Every decision is based on extensive legal and policy advice. Warrants are legally required to be necessary, proportionate and carefully targeted, and we judge them on that basis"...

"....It has been suggested that GCHQ uses our partnership with the United States to get around UK law, obtaining information that it cannot legally obtain in the United Kingdom. I wish to be absolutely clear that that accusation is baseless". (My emphasis; Hansard 10 Jun 2013: Columns 32 and 33)

The above absolute statements of lawful certainty on the part of GCHQ sit uncomfortably with the comment in the Notes that there is a need to put “beyond doubt” that RIPA has extra-territorial effect.

So is there an alternative explanation for this haste? This week, the Investigatory Powers Tribunal will be sitting in the Royal Courts of Justice in order to hear cases brought against the intelligence agencies in respect of alleged interception activity involving UK and US access to communications. The complainants are Liberty, Privacy International, Amnesty International and seven overseas human rights groups.

As part of the process, both sides exchange legal arguments; this was done some weeks ago. In other words, the Government having seen these legal arguments might have decided that emergency legislation is needed, not because of jihadists and other undesirables, but because it might lose the litigation.

I don't know whether this is the correct motivation - but pre-empting a loss in the Courts certainly fits the facts.

The Data Protection aspects

Confidence in Ministerial pronouncements on the Bill is not enhanced by the comments lurking at the back of the Explanatory Notes to the Bill under the heading “Privacy Impact Statements”. Paragraph 86 states:

“In relation to data retention, in addressing the ECJ’s concerns, where possible, the new legislation will go even further in safeguarding privacy. It is assessed that implementation of the proposed legislation is capable of being fully compliant with the Data Protection Principles and the Data Protection Act 1998. (my emphasis).

Evidently there is a Privacy Impact Assessment which underpins this statement although the PIA itself remains unpublished. [Note added later: these are now published - see references].

As readers know that there is an exemption for safeguarding the national security purpose in the Data Protection Act. This exemption states that “Personal data are exempt from any of the provisions of:

(a) the data protection principles,

(b) Parts II, III and V, and

(c)  sections 54A and 55".

Part II is all the rights, Part III is notification and Part V is enforcement; section 54A is the ability of the Commissioner to inspect personal data from the Schengen information system, the Europol information system, and the Customs information system and section 55 is the data protection offence. In other words, all the important provisions in the Data Protection Act (DPA) are set aside for our national security friends.

Note that the exemption from the First Principle can be absolute. Thus, as far as the DPA is concerned, if the exemption is for the purpose of safeguarding national security there is no need for the national security agencies to consider “lawfulness” or that the processing is necessary for the legitimate functions of national security agencies.

Indeed such personal data can be disclosed to anyone for any purpose irrespective of compatability and absurdly in my view, there is no obligation under the DPA, to keep the personal data secure.

In other words, the exemption for safeguarding national security is more or less total and the Data Protection Act has no role to play; yet the claim in the Explanatory Notes is that this position is “fully compliant with the Data Protection Principles and the Data Protection Act 1998”.  

When communications data are disclosed by a telecommunications operator to the national security agencies, that disclosure is exempt from the non-disclosure provisions (in section 35(1) of the DPA).

In the context of the telecommunications operator making a disclosure, this exemption disapplies:

(a) the first data protection principle except to the extent to which it requires compliance with the conditions in Schedules 2 and 3,

(b) the second, third, fourth and fifth data protection principles, and

(c) sections 10 and 14(1) to (3).

Note that the exemption from the First Principle includes “lawfulness”; in other words, a disclosure could be “unlawful” but that might won’t breach the Data Protection Principle. The impact of other Principles identified in the exemption, as can be seen, can be totally negated.

But don’t worry, the Explanatory Notes tells us that such disclosures can be “fully compliant with the Data Protection Principles and the Data Protection Act 1998”.

The Notes are totally misleading because what happens in practice is the complete opposite of what is suggested by these Notes.

Namely, in the context of national security the emergency legislation provides for the processing of personal data that can be “fully exempt from the Data Protection Principles and there is no need to consider the Data Protection Act 1998”.

References:

A copy of the Data Retention and Investigatory Powers Bill, Notes, Impact Assessments and draft Regulations are on https://www.gov.uk/government/publications/the-data-retention-and-investigatory-powers-bill

 

A “right to be forgotten” procedure for Google; it appears to have difficulty in developing one

Robert Preston the BBC journalist has a problem about one of his blogs: he asks “Why has Google cast me into oblivion?”. His blog concerned one of those banking “Masters of the Universe” whose expertise in the financial “dark arts” led to billion dollar losses and the collapse of Merrill Lynch. Google has told Mr Preston that thanks to the ECJ judgement, his article is no longer searchable by its search engine.

James Ball, a Guardian journalist, has the same problem. He wrote a story about Google delinking a story about a retired Scottish football referee who lied about his reasons for granting a penalty in a Celtic v Dundee United match (which when exposed prompted his resignation).

Both journalists are naturally raising questions about the judgement which resulted in their writings becoming less available to us all; claims of censorship have naturally followed in the subsequent press coverage.

Of course one has to take the above with a pinch of salt. It is well known Google does not like the ECJ judgment and the suspicion is that Google is removing links and telling journalists that their scoops are no longer accessible to the public. This provokes them to go ballistic, in print, and make wild claims of censorship; the last Sunday Times editorial on “The right-to-be-forgotten law is an ass” is an example of the ill-informed outcome which, sadly, Google appears to be encouraging.

Such gamesmanship explains why I have decided to devote this (very long) blog to draft a procedure for Google to follow; I think it covers most of the issues in a way that balances the conflicting interests. There might be nuances at the edges, but I think the approach is mainly correct. Anybody who can improve it, please make a comment.

Hopefully, after a few iterations there will an “open source procedure” for Google, Yahoo! etc to adopt; clearly Google appears to be so opposed to the ECJ ruling that it is incapable of producing a balanced procedure for itself.

[Remember the processing context is that Google, as data controller, is processing personal data that indexes a website which contains personal data which are the subject to an objection for whatever reason. The objection the data subject can make, thanks to the ECJ judgement, is to Google about that  indexing].

Piggy in the middle

I should add that the procedure I am suggestion is not something I have just invented; it’s a development from the one needed to meet the requirements of the interpretation of the Fourth Data Protection Principle (Schedule 1, Part II, Paragraph 7).

This interpretation deals with the problem when a data subject tells the data controller one thing and a third party, who is consulted by the data controller, contradicts the data subject’s account. How does the data controller know whose personal data are accurate and up-to-date?

In this situation, the data controller is “piggy in the middle” between data subject and a third party; this is close to the position of Google, except it is placed between the data controller who has posted the personal data and the data subject who is complaining about the posting. (For the absence of doubt, the term data controller does not imply that controller is subject to any national data protection law; some controllers will be subject to a data protection law - many won't).

Remember that if European data protection laws do apply the domestic purpose exemption is very unlikely to apply to postings of personal data on a website (see the ECJ Judgement on Lindqvist which dealt with publication of personal data on the Internet). This means that there would be a data controller who has posted the personal data and an individual who is the subject of those data.

Two important questions to ask the data subject

So, suppose a data subject identifies himself to Google and claims that such and such a link is no longer relevant for whatever reason (e.g. the link is causing unwarranted distress to the data subject; the link is not in the public interest; the link is to a site that contains irrelevant, inaccurate or outdated personal data). I am assuming the data subject is a “normal citizen” with a low public profile.

Evidence supporting the data subject’s identity and a description of the nature of the problem and URL links should be provided (as per the current Google form). As data subjects are giving personal details about themselves, Google’s form should have a commitment to keeping such details confidential and used or disclosed only in relation to the issue of removal or non-removal of the link. This commitment to confidentiality is absent at the moment.

The first two questions Google should ask is “whether the data subject has approached the data controller that is responsible for the personal data on the website?” and “If so, what was the outcome of the attempt to resolve the issue?”. Even though Google, as data controller, has the responsibility to make its own determination of the application of any national data protection law to its own processing of personal data, it can still ask these questions.

The possible answers to the first question are: “yes”, “no”, “it is manifestly unreasonable to make contact with the data controller” (e.g. if the purpose of the personal data on the website is intended humiliate, denigrate or bully a data subject) or “it is not possible to make contact with the data controller” (e.g. when personal data are posted anonymously).

With respect to the second question, I would expect any response given to the data subject by the posting data controller to be provided to Google. However, there may be exceptional circumstances when a data subject will refuse to provide Google with the response from the controller (e.g. if the controller threatens the data subject, or has a hold over the data subject in some way, or the provision of the response to Google would in itself be an invasion of privacy). Google’s form should have a free text field to cover this eventuality.

Does Google need to take down a link?

Google should ask: “Did you voluntarily provide directly or indirectly the personal data displayed on the website?”. What I am after is whether the personal data originates from an action of the data subject (e.g. the data subject originally consented to the personal data being displayed) or whether the personal data have been posted by someone-else without the consent of the data subject.

I suspect that in many cases where the personal data originates from an action of the data subject, the issue of link removal (or not) can be resolved without the need for Google to do anything; the website data controller, if contacted, could take appropriate corrective action. For example, it has been reported that the Robert Preston article had its links withdrawn because it carried a comment from a data subject (i.e. the complaining data subject was not the financial wizard identified in the blog).

So if the data subject has not made contact with the data controller, I see no difficulty in Google being allowed 15-20 working days to ask the data subject to contact the data controller if this is reasonable, especially if the data controller (e.g. such as the BBC) is subject to data protection legislation (not necessarily just European data protection law). In the Preston example, for instance, an organisation like the BBC could easily anonymise a comment.

Note also in this situation, the data subject had originally consented to publishing a comment and at a later stage is withdrawing consent. Procedures to deal with the withdrawal of consent are a problem for the data controller in the first instance (and not for Google).

Indeed, it would be interesting to know how, for instance, the BBC would respond to such a withdrawal of consent request from the data subject; I suspect the requested change would be made. It would also be interesting to find out how newspapers in the USA would react to such a request in relation to a data subject who had posted a comment.

In a sense this is the correct position; it is the personal data on the website that is creating the problem – all Google’s searching algorithm does is amplify the problem by making the problematic personal data available worldwide.

Other questions to ask the data subject

The next two questions to ask are: “whether there is any objection from Google contacting the website data controller if this is possible or needed?” and “Can Google use the details provided by the data subject in such contact?”. I think it is reasonable for Google (as well as the data subject) to be able to communicate with such controllers.

Note that if the data subject has already stated that “it is manifestly unreasonable to make contact with the data controller” or and “further contact by Google risks a further invasion of my privacy” then Google should not make contact with the data controller (examples are given below where the public interest is served by taking a link down).

I also think Google should also be able to ask: “If relevant, have you complained about the personal data to the Data Protection Authority in the country where the data controller for the website is established, and if so, can you provide details of the complaint”. This is to facilitate communications between Google and the Data Protection Authority and would be useful if the issue raises novel aspects that need exploring.

Finally, any response given to Google by the data controller or data protection authority should be made available for comment by the data subject making the complaint to Google.

Inferences from making contact with the data controller

The questions about contact with the data controller responsible for the web-site content are important; they allow Google access to information it needs to make an informed decision about the link and helps verify what the data subject and data controller has reported to it.

Suppose the data controller responsible for the web-site content refuses the data subject’s request; Google should be able to take the controller’s response and take it into account when making its own decision. If the data subject unreasonably refuses to provide such details, it may help Google to argue that the link should be maintained.

The reverse position arises if the data controller responsible for the web-site gives the data subject the “brush-off” or fails to respond or cannot be contacted or is anonymous; here the controller’s attitude might justify the taking of a link down. That is why I think that an approach by a data subject to a reptutable USA organisation (one not subject to a data protection law) will be considered carefully.

Also, Google's page ranking algorithm could play a part.  Most reputable data controllers want incoming links to their websites; Google taking them down runs counter to this objective. This too reinforces the notion that  those controllers, not subject to a data protection law, will not treat a data subject's request in a dismissive way.

It could be that the data subject has not made contact with the data controller because the data controller is not identifiable or has made no provision for such contact. Note that if the data controller is not identifiable then the processing of personal data immediately fails to meet the fairness requirements of European data protection legislation; if the data controller is not contactable, then there are also strong arguments for unfair processing. In both circumstances the links should be removed, irrespective of any public interest argument.

Note that if the web-site data controller is in Europe, then it is likely that any personal data content of that website will be covered by a data protection regime. It might be appropriate in some cases to direct the data subject to the relevant data protection authority. This could be important if the personal data on the website carry content that is beyond common decency, is unlawful or manifestly unfair for whatever reason. Google should get privacy plaudits if it aided or directed the data subject to the relevant Data Protection Authority (and took down links) in relevant cases.

Considering the public interest

There has been much debate about “the public interest”. So the rest of this blog assumes that the data subject’s reason for the request to take down a link relates to consideration of “the public interest”; remember if the data subject has contacted the data controller responsible for content, then this information should guide where the “public interest” falls.

For each “take-down a link” request, Google as data controller, is presented with three choices:

• The link should be maintained as it is in the public interest.

• The link should be removed because there is no public interest in maintaining it.

• It is difficult to tell whether the link is in the public interest or not.

The link should be maintained as it is in the public interest

Links should be maintained whenever the data subject has a considerable amount of press coverage or seeks out public attention or seeks support for his views (e.g. celebrities, politicians, stories that resonate with the public, perpetrators of violent crime etc).

Requests to links where a Court (higher than a Magistrates Court) has made any determination (e.g. libel, breach a confidence, criminality etc) should not be removed as there is likely to be a continuing public interest in the judgement and the debate leading up to the judgement (and beyond). For instance, consider the infamous Max Mosely case; I do not think that any link to any story in the Mosely case should be removed by Google mainly because the purpose of Mr Mosely’s Court case was for a right of reply (an interesting protection for data subjects who are maligned by the press).

The same goes for footballer Ryan Giggs. He is a public figure, like it or not, who was embroiled with another public figure. In other words, widely read stories in newspapers on the internet will be maintained. As Google keeps records of page accesses, such statistics could help determine "public interest".  

The jurisprudence concerning the press and the public interest (e.g. where injunctions are granted or not granted give a clear steer on what the “public interest” means). That is why I think that links to stories about any celebrity, politician, rapists, murderers, bank robbers and other criminals with serious convictions will not (and should not) be removed by Google.

Refusal to take down the link, follows the refusal procedure identified below.

The link should be removed if there is no public interest in maintaining it.

I think this should be moderately clear cut. Suppose there is an individual who has been prosecuted for a minor offence (e.g. at a Magistrates Court) which is spent under the Rehabilitation of Offenders Act; if there is a web-site that refers to that offence, then that link should be removed. However, the data controller responsible for the site still should be asked as there might be a continuing public interest in maintaining the story (e.g. the individual concerned has graduated to more serious offences).

I can see local newspapers refusing such requests on the grounds that newspapers published on a particular date should not be changed or censored. I agree with that position. However, when Google takes the link down, it is not acting as censor; it is acting as distributor. The text of the newspaper is not changed; it is the world-wide distribution that has changed.

Links to websites that clearly involve unlawful processing of personal data or incite unlawful processing should be removed. The kind of example I have in mind is a person who publishes the actual medical record of a data subject following a data loss in the absence of any public interest in the data subject’s medical history.

Another example would be a website that publishes a list of credit cards and passwords and account numbers or websites that display overtly racist, humiliating xenophobic personal data (e.g. in breach of relevant legislation also fall in this category).

It could be that the content itself is of a nature which makes establishes the lack of public interest (e.g. a YouTube video of a data subject posted in order to bully or humiliate the data subject or images of a sexual nature made by the ex-partner to a relationship with the data subject). This is also an example where it is manifestly unreasonable for the data subject to contact the data controller (e.g. the ex-partner).

It is difficult to tell where the public interest lies

The burden of proof will be on Google to show that there is a public interest, so if it is difficult to determine where the public interest falls, then the link has to be withdrawn.

This conclusion follows the construction of the various data protection principles. For instance, the data controller has to demonstrate that personal data are “adequate, relevant and not excessive” in the context of the processing purpose. So, if the controller does not know whether the personal data are “relevant”, then the controller cannot demonstrate that the personal data are relevant. Hence the link goes.

This reinforces the need for contact with the data controller responsible for web-site in such cases.

Should Google be able to reverse “public interest”?

Yes. Google should be able to undo the removal of links as the public interest might change. However, if Google does reverse the public interest argument it should contact the data subject and allow representations to be made. This is being fair to the data subject.

Refusing to take down a link- just like FOIA

Should Google refuse the request it should refer the data subject to the relevant data protection authority (e.g. the Information Commissioner inthe UK) for an independent determination of the case, if the data subject is unhappy with the decision. Google should also explain why the public interest is served by not removing the link.

Note that this procedure is very close to the formal refusal procedure under FOI and FOISA; indeed I think it prudent for Google to offer an internal review of its original refusal decision in such cases.

Referral to the Data Protection Authority

In some cases which can be seen to be difficult or different, it could be reasonable for Google to argue that the procedures under that European Data Protection law with respect of the website controller should be determined before it deals with the issue of removing a link.

The same argument applies to any data protection law (e.g. based on OECD or APEC Guidelines or on Council of Europe Convention No 108) even though such laws are not based on Directive 95/46/EC. Obviously, this won’t work for organisations that are outside a data protection law or some laws like the Maltese data protection law which has a total exemption for a press website.

Concluding comment

Well done to readers who have got this far; please table any comment. Finally, I have not dealt with the issue of a controller transferring the personal data so it can be posted on another site; I am assuming that if Google has taken the first link down, it can take the second link down.

Google's motto is "Don't be evil"; it would be helpful if it can understand that the ECJ does not do evil also.

Note added in September. If you want to make a comment on this procedure, please use the "contact us" link, bottom left. This is because I have incorporated a "discussion time frame" for all blogs; I previously had an unlimited time frame until someone automatically added unsavory links to all my 200+postings which took an age to remove.

 References

The ECJ Judgment: C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González” can be found on http://curia.europa.eu/juris/documents.jsf?num=C-131/12:

Bodil Lindqvist ECJ judgment concerning publication of personal data on the internet, the place of publication, the definition of transfer of personal data to third countries and Freedom of expression and its compatibility with Directive 95/46/EC (Case C-101/01). http://curia.europa.eu/juris/liste.jsf?language=en&num=C-101/01

Google’s BBC tip-off to Robert Preston: http://www.bbc.co.uk/news/business-28130581

Google’s Guardian tip-off to James Ball: http://www.theguardian.com/commentisfree/2014/jul/02/eu-right-to-be-forgotten-guardian-google

Sunday Times editorial (6/7/2014):  “The right-to-be-forgotten law is an ass” on: http://www.thesundaytimes.co.uk/sto/comment/article1430718.ece

Examples of the rubbish propagated by the USA press on the ECJ judgement (ignore the satirical commentary; just look at the clips): https://www.youtube.com/watch?v=r-ERajkMXw0&feature=kp

Google’s current website form: https://support.google.com/legal/contact/lr_eudpa?product=websearch&hl=en