Few cases before the Court of Justice of the European Union (CJEU)
have provoked more, or more heated, debate than the 13 May ruling on the
“right to be forgotten.”
The ruling interprets existing EU data protection law to include a
right for individuals to demand that search engines refrain from linking
to specified search results under certain conditions. CDT and many
other commentators have been critical of the ruling,
primarily because we do not think the CJEU appropriately considered the
impact of its ruling on the free expression rights of Internet users in
Europe and around the world.
While the ruling is focused on search engines, it comes in the midst of EU Member States’ long-running discussions on a data protection reform package, the General Data Protection Regulation (GDPR), and were the ruling’s logic to be ported into new legislation, its implications would be much broader.
With this background, Justice Ministers from across the Union will, on 10 October, engage in a political debate on the ruling. They will take on some fundamental and difficult questions: How the right should be balanced with freedom of expression, what the proper scope of the right is, on what grounds it can be exercised, and what obligations and responsibilities should be placed on data controllers.
CDT offers its views ahead of this debate. We argue that removal or deletion requests should be made to publishers rather than intermediaries. We highlight the need for far more clarity and guidance as to when such requests should be honoured. We argue that publishers should be transparent about when and why information is suppressed or deleted, and that they should not be responsible for ensuring that third parties also comply. Finally, we make the fundamental point that freedom of expression and the right to privacy are equal rights and must enjoy equal protection. This was a major issue the Court got wrong, and it should not be replicated in the future.
One crucial question regarding the scope of the right is whether it can be invoked against data controllers who do not themselves host or maintain the personal information. Clearly, in the Google Spain case, the CJEU articulated a right for individuals to demand that a search engine cease linking to public, lawfully posted information for queries on the basis of a data subject’s name, even while recognizing that the search engines are not the hosts or sources of the data. However, this sort of obligation puts search engines and other non-host controllers in the position of having to determine when it is potentially unlawful to link or otherwise refer to information lawfully hosted by others.
This requires these entities to engage in a balancing of competing rights and interests that they are ill-equipped to do, as we discuss in more detail below. At the very least, requests to erase data should be made to the entities that host that data. Asking non-hosting intermediaries to second-guess the lawfulness of information that is publicly available online should only occur as a matter of last resort.
Read more: Seven Key Issues for EU Justice Ministers on the Right To Be Forgotten | Center for Democracy & Technology
While the ruling is focused on search engines, it comes in the midst of EU Member States’ long-running discussions on a data protection reform package, the General Data Protection Regulation (GDPR), and were the ruling’s logic to be ported into new legislation, its implications would be much broader.
With this background, Justice Ministers from across the Union will, on 10 October, engage in a political debate on the ruling. They will take on some fundamental and difficult questions: How the right should be balanced with freedom of expression, what the proper scope of the right is, on what grounds it can be exercised, and what obligations and responsibilities should be placed on data controllers.
CDT offers its views ahead of this debate. We argue that removal or deletion requests should be made to publishers rather than intermediaries. We highlight the need for far more clarity and guidance as to when such requests should be honoured. We argue that publishers should be transparent about when and why information is suppressed or deleted, and that they should not be responsible for ensuring that third parties also comply. Finally, we make the fundamental point that freedom of expression and the right to privacy are equal rights and must enjoy equal protection. This was a major issue the Court got wrong, and it should not be replicated in the future.
One crucial question regarding the scope of the right is whether it can be invoked against data controllers who do not themselves host or maintain the personal information. Clearly, in the Google Spain case, the CJEU articulated a right for individuals to demand that a search engine cease linking to public, lawfully posted information for queries on the basis of a data subject’s name, even while recognizing that the search engines are not the hosts or sources of the data. However, this sort of obligation puts search engines and other non-host controllers in the position of having to determine when it is potentially unlawful to link or otherwise refer to information lawfully hosted by others.
This requires these entities to engage in a balancing of competing rights and interests that they are ill-equipped to do, as we discuss in more detail below. At the very least, requests to erase data should be made to the entities that host that data. Asking non-hosting intermediaries to second-guess the lawfulness of information that is publicly available online should only occur as a matter of last resort.
Read more: Seven Key Issues for EU Justice Ministers on the Right To Be Forgotten | Center for Democracy & Technology
No comments:
Post a Comment