EU Data Protection law: a 'right to be forgotten'? - European Union Committee Contents


The task of the Committee

23.  It is not for this Committee to decide whether the judgment of the Court of Justice is correct as a matter of law. The interpretation of the Directive is the task of the courts, and ultimately of the Court of Justice. It is however very much the task of the Committee to consider the consequences of this judgment and whether, following this judgment, the law on data protection continues to achieve a fair balance between the competing fundamental rights of privacy, and of the freedom to seek and impart accurate information lawfully acquired.

24.  We also have to consider how far it is practical for search engines to comply with this judgment, or to do so without disproportionate expense. A judgment which cannot be complied with brings the law into disrepute.

25.  Since, fortuitously, this judgment has been given at a time when the EU law on data protection is in the course of radical revision, this is an opportune moment to consider the issues raised by this case, and in particular whether there should continue to be a 'right to be forgotten' and if so, how broad it should be.

Should a search engine be classed as a data controller?

26.  Under the current Directive, this is an all-important question, since if a search engine is not a data controller the data subject has no rights against it under Article 12. The Court has ruled that it is. We asked our witnesses whether this should continue to be the case.

27.  Chris Scott, a partner at Schillings who advises businesses and prominent individuals on protecting their privacy, told us that Google was rightly classed as a data controller: "Google does not merely passively deliver information; Google sculpts the results." Jim Killock, the Executive Director of Open Rights Group, a civil society organisation that works on digital and free-speech issues from the citizen's point of view, said that it "seemed fair" for Google to be classed as a data controller given that it has offices in the EU and processes the data of EU citizens.[25] Neil Cameron, a management consultant advising legal firms on IT issues, thought not, and agreed with the Advocate General's Opinion.[26] Professor Floridi said he agreed "only partially" with the Court's ruling. He felt the definition of "data controller" was so wide and inclusive that it could not fail to support the Court's ruling, but he too preferred the view of the Advocate General.[27]

28.  We received evidence from Steve Wood, the Head of Policy Delivery at the Information Commissioner's Office (ICO). He said firmly that the ICO agreed with the Court's ruling:

"It was a position we had reached ourselves, and we were hopeful that the court was going to reach that position … we did not agree with the analogy of a search engine as a mere conduit, if you like, of the information just passing through it. Given the level of interaction a search engine has and the interest it takes using algorithms when it is interacting with personal information and spidering the internet, we felt that the way in which the court advanced that issue was correct."[28]

29.  We also received evidence from Rt Hon Simon Hughes MP, the Minister for Justice and Civil Liberties. He believed that the Court was right to class search engines as data controllers "because they are the gateway to the systems; they generally decide whether to process personal data in the first place." He added: "it is not a precondition to being a controller that you have sole responsibility for deciding on either the means of processing or the purpose of processing … The fact that you are only an intermediary—you are the gateway into the system—does not mean you are not a controller."[29]

30.  In fact, if the European Parliament has its way, for the purposes of the right to be forgotten it will become irrelevant whether or not a search engine is a data controller. On 12 March 2014 the European Parliament adopted its final version of 207 proposed amendments to the Commission text of the draft Regulation. Amendment 112, one of many amendments proposed to Article 17, would result in the data subject having a 'right to erasure' (as they prefer to call it), not just against data controllers but against third parties. The opening words of Article 17 would read as follows.

Box 3: European Parliament draft of opening words of Article 17 of
the new Regulation (emphasis in the original)
The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, and to obtain from third parties the erasure of any links to, or copy or replication of, that data where one of the following grounds applies: [and there follows a list of five grounds].

Can the judgment in practice be complied with?

31.  Google are the search engine directly concerned in the litigation before the Court of Justice, but the Court's ruling will of course be binding on all search engines, large and small. Google are by far the largest search engine in Europe in terms of market share, and likely to be the recipients of the majority of requests for removal of links. They have supplied us with statistics which show the magnitude of the task they face.

32.  At our request, Google sent us on 9 July 2014 a note with the statistics for the requests they had received to the end of June, then the most recent date available.

Box 4: Statistics from Google
Google's webform went live on 30 May 2014, 17 days after the Court's judgment. In the first 24 hours they received 12,000 requests (European totals), and in the first four days approximately 40,000.

Up to 30 June 2014 they had received more than 70,000 removal requests with an average of 3.8 URLs per request, a total of over a quarter of a million. The top five countries were:

United Kingdom8,497
By 9 July 2014 the level of requests was approximately 1,000 per day across Europe.

33.  The requests received in June alone mean that Google's staff have to review over a quarter of a million URLs to see whether the information appears to be "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing" carried out by them. If their initial view is that these criteria are satisfied, they have to make the further value judgment to assess whether it appears "for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question."

34.  Even by the standards of a global corporation the size of Google, this is a massive burden. In response to the question whether it was in practice possible for Google to comply with this ruling, Professor Floridi gave an unequivocal "Yes … Feasibility is not the real issue here."[30] His view is particularly persuasive given that he is a member of the Advisory Council appointed by Google to advise on their implementation of the judgment.

35.  Plainly smaller search engines would not necessarily be able to comply with this judgment as easily as Google if they receive a large number of requests. They might, as the Advocate General warned,[31] automatically withdraw links to any material objected to because they would not have the resources to examine requests on a case by case basis. This would effectively allow any individual an uncontested right of censorship.

36.  There is a further question, whether it is right that the judgment on issues such as this should be left to Google and other search engines. Neil Cameron thought not: he did not trust Google's judgment.[32] Jim Killock was "deeply uncomfortable" about leaving such judgments to commercial enterprises.[33] Morrison & Foerster made the point that, self-evidently, a request to Google which they comply with will not cause information to be removed from, or Individuals would have to make the same request to each search engine separately, and different search engines might well reach different conclusions.[34] Particular data which could no longer be found on one search engine might still be easy to find on another.

37.  Ministers have been consistent in their views. On 22 November 2012 the then Minister described the right to be forgotten as "unworkable".[35] In his oral evidence to us Simon Hughes said: "Anything that is impractical, impossible and undeliverable is a nonsense, and we should not countenance it."[36]

How would the judgment affect the Information Commissioner and other European data protection regulators?

38.  Up to the end of June more than 12% of the requests received by Google originated in the United Kingdom. It is impossible to tell what proportion of these Google may decide to refuse on the ground that the data are not, in their view, "inadequate, irrelevant or excessive", or that they fall within the Court's exception for "particular reasons". It is however easy to see that there are potentially a very substantial number of cases where a dissatisfied data subject may wish to take the matter further. If so, the first port of call will be the Information Commissioner's Office. We asked Mr Wood whether the ICO would be able to cope with this. He agreed that this would be a serious addition to their workload; it was something they were concerned about, and they were "doing some modelling in the office to work out what the impact could be. Will we have to have a little specialist team of complaints officers who become skilled in dealing with these complaints? How many cases might be challenged and appealed on, which then means that we have to defend ourselves in the courts as well? There are potential financial implications for our office."[37]

39.  Referring to this evidence, the Minister said:

"You have heard from the Information Commissioner's Office: there is inevitably going to be additional work going in their direction, because there may well be challenges to the decisions Google make. There may also be more tribunal appeals, so we are very conscious in the Ministry of Justice that suddenly a whole new work stream may open up as a result of the judgment, and has started to open up already."[38]

How would the judgment affect other data controllers?

40.  Morrison & Foerster pointed out that "the Court's finding that search engines are data controllers … has broad implications. The Court appears to be suggesting that any company that aggregates publicly available data is a data controller."[39]

41.  The logic leads to further absurdities. If search engines are data controllers, so logically are users of search engines. The Advocate General said: "The finding of the Article 29 Working Party[40] according to which 'users of the search engine service could strictly speaking also be considered as controllers' reveals the irrational nature of the blind literal interpretation of the Directive in the context of the internet. The Court should not accept an interpretation which makes a controller of processing of personal data published on the internet of virtually everybody owning a smartphone or a tablet or a laptop computer."[41]

42.  The Minister made an additional point:

"There is another reason why it will not work as well, which is that there is a new obligation to inform all other data controllers. We are not just talking about huge companies like Google. I am a data controller, registered under the Act, as a Member of Parliament … There are data controllers on a global scale and there are little data controllers."[42]

The economic impact of the judgment

43.  The Minister told us that the economic impact on UK businesses of the draft Regulation, if enacted in its current form, could be as high as £360 million, of which up to £290 million would be the impact on small and medium enterprises (SMEs). He did not give a figure for the impact of the provision on the 'right to be forgotten', and we doubt whether it is possible to estimate this with any accuracy. What is beyond doubt is that it will be substantial, all the more so following the judgment of the Court. We are particularly concerned about the impact on SMEs. Jennie Sumpster, Senior Associate, Schillings, said that it would be a necessity for organisations and companies in the future, even at the start-up phase, to incorporate 'privacy by design' and to bear in mind what impact the technology and business methods they employ will have on the privacy of individuals.[43] We fear this might result in many SMEs not getting beyond the start-up phase.

44.  Nor will the impact be confined to business. Morrison & Foerster told us that "the Court's decision will require search engines, Data Protection Authorities and Courts to divert considerable resources to respond to myriad requests that have been and will be received".[44]

25    Q2 (Chris Scott and Jim Killock) Back

26    Q2 (Neil Cameron) Back

27   Written evidence from Prof Floridi (TRF004) Back

28    Q13 (Steve Wood) Back

29    Q29 (Simon Hughes MP) Back

30   Written evidence from Prof Floridi (TRF004) Back

31   Opinion, paragraph 133 Back

32    Q6 (Neil Cameron) Back

33    Q4 (Jim Killock) Back

34   Written evidence from Morrison & Foerster (TRF005) Back

35   Letter of 22 November 2012 from Helen Grant MP, Parliamentary Under-Secretary of State for Justice, to Lord Boswell, Chairman of the European Union Select Committee. Back

36    Q38 (Simon Hughes MP) Back

37    Q19 (Steve Wood) Back

38    Q28 (Simon Hughes MP) Back

39   Written evidence from Morrison & Foerster (TRF005) Back

40   The Working Party of representatives of the national data protection authorities of the Member States, set up under Article 29 of the 1995 Directive. Back

41   Opinion of the Advocate General, paragraph 81 Back

42    Q38 (Simon Hughes MP) Back

43    Q6 (Jennie Sumpster) Back

44   Written evidence from Morrison & Foerster (TRF005) Back

previous page contents next page

© Parliamentary copyright 2014