The Right to Be Forgotten: Who Should Decide?
The right to official oblivion makes its entrance, with a bit too much fanfare, at the Luxembourg high court. This could be the summary of the by now famous May 13 decision of the Court of Justice of the European Union on Google Spain vs. Agencia Española de Protección de Datos. Whoever deems information available on the Internet neither relevant nor current, or, even if not defamatory, still capable of hurting one's reputation, can ask the search engine to remove from its results the link to the web page on which such information appears.
This way the Luxembourg judges take the right to digital privacy extremely seriously, in its particular expression as the Right to Be Forgotten, thus trying to update that Right to Privacy that Warren and Brandeis had theorized in the pages ofHarvard Law Reviewin 1890.
Perhaps they took the issue a bit too seriously. They were so serious that they omitted to reflect upon the fact that a radical application of the EU Directive 95/46 on the protection of personal data, thought out in a moment of transition from analogic to digital and certainnly not drafted with the Internet as dominant media technology in mind, could have systemic repercussions, firstly, on other rights and interests as worthy of protection, and, secondly, on the fundamental dynamics of the web economy.
Regarding the first point, it is evident that the asymmetric balancing between the right to be forgotten and the protection of the right of access to information made by the Court could well weaken the latter. It is no coincidence that in the reasoning of the Court, while making several references at articles 7 and 8 of the EU Charter of Fundamental Rights, which defend privacy and data protection, respectively, there is never an explicit reference to article 11 that protects freedom of expression.
Regarding the second point, the fact that a search engine handles personal data is sufficient reason for the Court of Justice to identify it as data controller for legal purposes, since it supposedly determines the aims and supplies the tools for the treatment of personal data.
In this regard, the new framework advanced by the Court seems to overlook the fact that the position of data controller comes with the obligations attached to this role by Directive 95/46, which, if applied to a search engine company, would undermine the business model of the search industry, which is likely to swamped by requests for the removal of links.
The obligation to remove links is strictly responsibility of the search engine, independently from what the publisher of content does on the website whose link to it has been ranked by the search engine. This could lead to a situation where the publisher is let off the hook, while the search company is unduly burdened. And this is not only about altering business models, i.e. limiting economic freedom in the name of the right to privacy, which could be argued with some justification, but about undermining the freedom of information and expression, not so much of the search engine, but rather of content suppliers, and, especially, of content users.
Are we really sure that a private actor, which on the web is currently performing a public function of quasi-constitutional nature, is actually able to strike a neutral balance between the right to privacy and the right to be informed, properly evaluating when the freedom of the press must prevail on the right to oblivion, as theorized by the Court? But even before that, shouldn't such a trade-off be assessed by a judicial authority instead, or failing that, by an independent administrative authority?