INFOSEC

If You Live in Europe, You Can Now Sanitize Your Online History

INFOSEC
May 13, 2014 at 3:11 PM ET

We’ve all done or said stupid things that have later wound up online—and then wished we could take them back. Of course, you can’t do that.

Unless you live in Europe.

In a landmark case, Europe’s top court decided today that “Google must listen and sometimes comply when individuals ask the Internet search giant to remove links to newspaper articles or websites containing their personal information.”

In other words, users in Europe now have the “right to be forgotten.”

The European court’s decision was based on the case of a Spanish man, Mario Costeja Gonzalez, who wanted Google to remove a link to a newspaper article that referenced personal debts going back to 1998. In 2010, the man brought his case to the Spanish Data Protection Agency, arguing the personal debts were private and should not be accessible to the public. When Google refused to scrub the links, the case worked its way up the European court system, eventually reaching Europe’s top court in Luxembourg, the Court of Justice of the European Union.

Before anything goes into effect, the 28 European Union governments will need to vote on whether to make the court decision law. That won’t happen until later this year.

In one sense, the decision is a victory for privacy advocates. The case paves the road to a future in which individuals have better control over their personal data, and can petition Google and other search engines to remove unsavory personal details from the search results. Not surprisingly, that thought makes Google queasy.

Google spokesman Al Verney told the AP that Tuesday’s ruling was “disappointing…for search engines and online publishers in general” and added that the company will “now need to take time to analyze the implications.”

On the other hand, the decision is riddled with such vague language that it seems to raise more questions than it answers. Most importantly, it does lay out how the law should actually be implemented in day-to-day life. “What does that mean specifically?” writes Jonathan Zittrain, a Harvard law professor and Internet scholar, referring to the decision. “Not easy to say.”

In fact, the language in the decision doesn’t help clarify things at all: It says that whether or not a company like Google must remove personal information depends “on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”

Whatever that means.

And no private individual or institution—let alone Google itself—has yet offered guidance on how to distinguish between what can and cannot be removed. If the decision passes into law, Google will likely set up new departments to handle take-down requests, similar to their team devoted to removing copyright infringements. It will likely be an expensive and cumbersome process.

It’s important to remember that the decision was rendered in Europe, and its fallout isn’t likely to migrate to the United States anytime soon. Europe is known to be consumer-friendly than the U.S. when it comes to privacy laws. (Germans especially have a complicated relationship with Google’s privacy rules; the German government has even fined Google for breaching laws in the past.)

Still, privacy groups like the ACLU have been pushing the United States to consider “right to be forgotten” legislation. In a report from 2010, Chris Conley of the ACLU argues for a “right to delete” law. In it, he writes:

“As we move into a world where memory is perfect and permanent, we should consider whether we need some mechanism to replace the ability to forget. Without such a mechanism, we may lose our ability to invent and reinvent ourselves, and instead find ourselves constrained by actual records of our past or feared records in our future. The right to privacy, a right many consider fundamental to our society, may be rendered impotent if our private actions can be reconstructed from countless permanent records.”