CHAPTER 3: THE CONSEQUENCES OF THE JUDGMENT
The task of the Committee
23. It is not for this Committee to decide whether
the judgment of the Court of Justice is correct as a matter of
law. The interpretation of the Directive is the task of the courts,
and ultimately of the Court of Justice. It is however very much
the task of the Committee to consider the consequences of this
judgment and whether, following this judgment, the law on data
protection continues to achieve a fair balance between the competing
fundamental rights of privacy, and of the freedom to seek and
impart accurate information lawfully acquired.
24. We also have to consider how far it is practical
for search engines to comply with this judgment, or to do so without
disproportionate expense. A judgment which cannot be complied
with brings the law into disrepute.
25. Since, fortuitously, this judgment has been
given at a time when the EU law on data protection is in the course
of radical revision, this is an opportune moment to consider the
issues raised by this case, and in particular whether there should
continue to be a 'right to be forgotten' and if so, how broad
it should be.
Should a search engine be classed
as a data controller?
26. Under the current Directive, this is an all-important
question, since if a search engine is not a data controller the
data subject has no rights against it under Article 12. The Court
has ruled that it is. We asked our witnesses whether this should
continue to be the case.
27. Chris Scott, a partner at Schillings who
advises businesses and prominent individuals on protecting their
privacy, told us that Google was rightly classed as a data controller:
"Google does not merely passively deliver information; Google
sculpts the results." Jim Killock, the Executive Director
of Open Rights Group, a civil society organisation that works
on digital and free-speech issues from the citizen's point of
view, said that it "seemed fair" for Google to be classed
as a data controller given that it has offices in the EU and processes
the data of EU citizens.[25]
Neil Cameron, a management consultant advising legal firms on
IT issues, thought not, and agreed with the Advocate General's
Opinion.[26] Professor Floridi
said he agreed "only partially" with the Court's ruling.
He felt the definition of "data controller" was so wide
and inclusive that it could not fail to support the Court's ruling,
but he too preferred the view of the Advocate General.[27]
28. We received evidence from Steve Wood, the
Head of Policy Delivery at the Information Commissioner's Office
(ICO). He said firmly that the ICO agreed with the Court's ruling:
"It was a position we had reached ourselves,
and we were hopeful that the court was going to reach that position
… we did not agree with the analogy of a search engine as
a mere conduit, if you like, of the information just passing through
it. Given the level of interaction a search engine has and the
interest it takes using algorithms when it is interacting with
personal information and spidering the internet, we felt that
the way in which the court advanced that issue was correct."[28]
29. We also received evidence from Rt Hon Simon
Hughes MP, the Minister for Justice and Civil Liberties.
He believed that the Court was right to class search engines as
data controllers "because they are the gateway to the systems;
they generally decide whether to process personal data in the
first place." He added: "it is not a precondition to
being a controller that you have sole responsibility for deciding
on either the means of processing or the purpose of processing
… The fact that you are only an intermediary—you are
the gateway into the system—does not mean you are not a
controller."[29]
30. In fact, if the European Parliament has its
way, for the purposes of the right to be forgotten it will become
irrelevant whether or not a search engine is a data controller.
On 12 March 2014 the European Parliament adopted its final version
of 207 proposed amendments to the Commission text of the draft
Regulation. Amendment 112, one of many amendments proposed to
Article 17, would result in the data subject having a 'right to
erasure' (as they prefer to call it), not just against data controllers
but against third parties. The opening words of Article 17 would
read as follows. Box
3: European Parliament draft of opening words of Article 17 of
the new Regulation (emphasis in the original)
| The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, and to obtain from third parties the erasure of any links to, or copy or replication of, that data where one of the following grounds applies: [and there follows a list of five grounds].
|
Can the judgment in practice
be complied with?
31. Google are the search engine directly concerned
in the litigation before the Court of Justice, but the Court's
ruling will of course be binding on all search engines, large
and small. Google are by far the largest search engine in Europe
in terms of market share, and likely to be the recipients of the
majority of requests for removal of links. They have supplied
us with statistics which show the magnitude of the task they face.
32. At our request, Google sent us on 9 July
2014 a note with the statistics for the requests they had received
to the end of June, then the most recent date available. Box
4: Statistics from Google
| Google's webform went live on 30 May 2014, 17 days after the Court's judgment. In the first 24 hours they received 12,000 requests (European totals), and in the first four days approximately 40,000.
Up to 30 June 2014 they had received more than 70,000 removal requests with an average of 3.8 URLs per request, a total of over a quarter of a million. The top five countries were:
|
| France | 14,086
|
| Germany | 12,678
|
| United Kingdom | 8,497
|
| Spain | 6,176
|
| Italy | 5,934
|
| By 9 July 2014 the level of requests was approximately 1,000 per day across Europe.
|
33. The requests received in June alone mean
that Google's staff have to review over a quarter of a million
URLs to see whether the information appears to be "inadequate,
irrelevant or no longer relevant, or excessive in relation to
the purposes of the processing" carried out by them. If their
initial view is that these criteria are satisfied, they have to
make the further value judgment to assess whether it appears "for
particular reasons, such as the role played by the data subject
in public life, that the interference with his fundamental rights
is justified by the preponderant interest of the general public
in having, on account of inclusion in the list of results, access
to the information in question."
34. Even by the standards of a global corporation
the size of Google, this is a massive burden. In response to the
question whether it was in practice possible for Google to comply
with this ruling, Professor Floridi gave an unequivocal "Yes
… Feasibility is not the real issue here."[30]
His view is particularly persuasive given that he is a member
of the Advisory Council appointed by Google to advise on their
implementation of the judgment.
35. Plainly smaller search engines would not
necessarily be able to comply with this judgment as easily as
Google if they receive a large number of requests. They might,
as the Advocate General warned,[31]
automatically withdraw links to any material objected to because
they would not have the resources to examine requests on a case
by case basis. This would effectively allow any individual an
uncontested right of censorship.
36. There is a further question, whether it is
right that the judgment on issues such as this should be left
to Google and other search engines. Neil Cameron thought not:
he did not trust Google's judgment.[32]
Jim Killock was "deeply uncomfortable" about leaving
such judgments to commercial enterprises.[33]
Morrison & Foerster made the point that, self-evidently, a
request to Google which they comply with will not cause information
to be removed from Bing.com, Yahoo.com or Ask.com. Individuals
would have to make the same request to each search engine separately,
and different search engines might well reach different conclusions.[34]
Particular data which could no longer be found on one search engine
might still be easy to find on another.
37. Ministers have been consistent in their views.
On 22 November 2012 the then Minister described the right to be
forgotten as "unworkable".[35]
In his oral evidence to us Simon Hughes said: "Anything that
is impractical, impossible and undeliverable is a nonsense, and
we should not countenance it."[36]
How would the judgment affect
the Information Commissioner and other European data protection
regulators?
38. Up to the end of June more than 12% of the
requests received by Google originated in the United Kingdom.
It is impossible to tell what proportion of these Google may decide
to refuse on the ground that the data are not, in their view,
"inadequate, irrelevant or excessive", or that they
fall within the Court's exception for "particular reasons".
It is however easy to see that there are potentially a very substantial
number of cases where a dissatisfied data subject may wish to
take the matter further. If so, the first port of call will be
the Information Commissioner's Office. We asked Mr Wood whether
the ICO would be able to cope with this. He agreed that this would
be a serious addition to their workload; it was something they
were concerned about, and they were "doing some modelling
in the office to work out what the impact could be. Will we have
to have a little specialist team of complaints officers who become
skilled in dealing with these complaints? How many cases might
be challenged and appealed on, which then means that we have to
defend ourselves in the courts as well? There are potential financial
implications for our office."[37]
39. Referring to this evidence, the Minister
said:
"You have heard from the Information Commissioner's
Office: there is inevitably going to be additional work going
in their direction, because there may well be challenges to the
decisions Google make. There may also be more tribunal appeals,
so we are very conscious in the Ministry of Justice that suddenly
a whole new work stream may open up as a result of the judgment,
and has started to open up already."[38]
How would the judgment affect
other data controllers?
40. Morrison & Foerster pointed out that
"the Court's finding that search engines are data controllers
… has broad implications. The Court appears to be suggesting
that any company that aggregates publicly available data is a
data controller."[39]
41. The logic leads to further absurdities. If
search engines are data controllers, so logically are users of
search engines. The Advocate General said: "The finding of
the Article 29 Working Party[40]
according to which 'users of the search engine service could strictly
speaking also be considered as controllers' reveals the irrational
nature of the blind literal interpretation of the Directive in
the context of the internet. The Court should not accept an interpretation
which makes a controller of processing of personal data published
on the internet of virtually everybody owning a smartphone or
a tablet or a laptop computer."[41]
42. The Minister made an additional point:
"There is another reason why it will not work
as well, which is that there is a new obligation to inform all
other data controllers. We are not just talking about huge companies
like Google. I am a data controller, registered under the Act,
as a Member of Parliament … There are data controllers on
a global scale and there are little data controllers."[42]
The economic impact of the judgment
43. The Minister told us that the economic impact
on UK businesses of the draft Regulation, if enacted in its current
form, could be as high as £360 million, of which up to £290
million would be the impact on small and medium enterprises (SMEs).
He did not give a figure for the impact of the provision on the
'right to be forgotten', and we doubt whether it is possible to
estimate this with any accuracy. What is beyond doubt is that
it will be substantial, all the more so following the judgment
of the Court. We are particularly concerned about the impact on
SMEs. Jennie Sumpster, Senior Associate, Schillings, said that
it would be a necessity for organisations and companies in the
future, even at the start-up phase, to incorporate 'privacy by
design' and to bear in mind what impact the technology and business
methods they employ will have on the privacy of individuals.[43]
We fear this might result in many SMEs not getting beyond the
start-up phase.
44. Nor will the impact be confined to business.
Morrison & Foerster told us that "the Court's decision
will require search engines, Data Protection Authorities and Courts
to divert considerable resources to respond to myriad requests
that have been and will be received".[44]
25 Q2 (Chris Scott and Jim Killock) Back
26
Q2 (Neil Cameron) Back
27
Written evidence from Prof Floridi (TRF004) Back
28
Q13 (Steve Wood) Back
29
Q29 (Simon Hughes MP) Back
30
Written evidence from Prof Floridi (TRF004) Back
31
Opinion, paragraph 133 Back
32
Q6 (Neil Cameron) Back
33
Q4 (Jim Killock) Back
34
Written evidence from Morrison & Foerster (TRF005) Back
35
Letter of 22 November 2012 from Helen Grant MP, Parliamentary
Under-Secretary of State for Justice, to Lord Boswell, Chairman
of the European Union Select Committee. Back
36
Q38 (Simon Hughes MP) Back
37
Q19 (Steve Wood) Back
38
Q28 (Simon Hughes MP) Back
39
Written evidence from Morrison & Foerster (TRF005) Back
40
The Working Party of representatives of the national data protection
authorities of the Member States, set up under Article 29 of the
1995 Directive. Back
41
Opinion of the Advocate General, paragraph 81 Back
42
Q38 (Simon Hughes MP) Back
43
Q6 (Jennie Sumpster) Back
44
Written evidence from Morrison & Foerster (TRF005) Back
| 
