1
The “right to be forgotten”: finding the balance between the right to privacy and the right to freedom of expression
Momchil Tsonev Student # 10746412 Master’s
International and European Law 2015-2016
University of Amsterdam
Master’s thesis supervised by Professor Yvonne Donders 29 July 2016
2
Abstract
The objective of this research paper is to explore the character and the legal implications of the “right to be forgotten” for the Council of Europe legal system with emphasis on the ECHR. Through this process, the paper seeks to distill how the right to freedom of expression of web publishers and the general public can be sufficiently and adequately safeguarded against “the right to be forgotten”. The methodology used is based on the descriptive method given from the internal perspective.
Data protection is established extensively and dynamically in the secondary EU law, and is entrenched as an independent human right in the EUCFR. In the CoE data protection has a limited application as it is not envisaged in the ECHR. Both Strasbourg and Luxembourg Courts interpret data protection as connected to privacy, but none is conclusive on its content (Chapter I). This paper analyzes the Costeja judgment and supports the view that the “right to be forgotten” is a specific remedy under the EU data protection regime enabling the individuals to control the processing of their data. Once exercised it would always require the weighing of the public interest against the interest of the individual by search engine operators. That raises some risks and questions especially as to what are the balancing criteria (Chapter II). In is argued that this right has far reaching implications that it would have a complementary protection for the right to privacy as protected under the CoE. It enables the individual to limit the access of the public to data related to him, but functions also as an assertive right for his informational self-determination. The “right to be forgotten” serves as additional protection to the data subjects that the CoE does not accommodate. On a larger scale, necessary consistency between the two legal orders will be ensured provided that the EU law respects the minimum level of protection under the CoE specifically envisaged in the ECHR. To those ends, a notification to the web publishers that links to his page are de-indexed is endorsed as a safeguard against over removal and against private censorship (Chapter III).
3
Abbreviations
Council of Europe – CoE European Union – EU
European Court of Human Rights – ECtHR
European Convention for the Protection of Human Rights and Fundamental Freedoms – ECHR
Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 28 January 1981, ETS No.108 - Convention 108
European Union, Charter of Fundamental Rights of the European Union, 26 October 2012, 2012/C 326/02 - EUCFR or “the Charter”.
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995 ] OJ 2 281/0031 - Directive 95/46
Regulation (EU) 2016/679 of the European Parliament and the Councli of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [2016] OJ 2 119/01 - General Data Protection Regulation
4 Table of Contents
Introduction ... 5
Part I. Legal framework of the Council of Europe and the EU ... 8
1. Introduction ... 8
2. Council of Europe ... 8
3. European Union ... 14
4. Sub-conclusion ... 20
Part II. The Costeja judgment – analysis, issues, divergence ... 22
1. Introduction ... 22
2. Facts ... 22
3. Content of the right ... 23
4. Balancing test ... 26
5. The rights of the web publishers ... 28
6. The position of the data controller ... 29
7. Developments ... 30
8. Sub-conclusion ... 32
Part III. Implications of the “right to be forgotten” and the GDPR ... 33
1. Introduction ... 33
2. Do the balancing criteria of the ECtHR matter? ... 33
3. Necessary consistency... 34
4. Social implications for privacy in the digital era ... 36
5. Legal implications of the “right to be forgotten” for the ECtHR ... 38
6. Rights of web publishers – notification ... 40
7. Sub-conclusion ... 40
5 Introduction
I Introduction
In May 2014, the Court of Justice of the European Union (CJEU) rendered the landmark
Costeja judgment.1 Two of the main questions in the preliminary ruling were whether search
engine operators such as Google can be considered data controllers and whether the data subject (Mr. Costeja) had a right against Google to request removal of the results based on his name. The list of links highlighted the financial troubles Mr. Costeja experienced in the late 1990’s which had a negative impact on his reputation.
The facts of the case represent the contemporary Catch-22 situation caused by the role of technology in our lives: we are not our digital selves, but the fingerprint of our digital selves may impact who we are or the way we are perceived by the others. From a legal perspective, the Costeja case entails a plethora of actors with a variety of rights and interests - data subjects, search engine operators, non-journalistic publishers, media publishers, Member States and the general public – and brings the right to privacy, data protection and freedom of expression into competition. The case was referred to the CJEU by the Spanish authorities. The applicable law was the EU Charter of the Fundamental Rights (EUCFR) as a primary EU law and the Data Protection Directive as the relevant secondary Union legislation. The fundamental rights involved are also protected by the European Convention of Human Rights (ECHR); the most significant Council of Europe legal instrument. Both the Luxembourg and the Strasbourg Courts operate in an intersecting human rights acquis as their relationship has – for a long time - been one of cooperation, mutual respect and deference.
In Costeja the CJEU took a very specific approach that put into question the consistency between the EUCFR and the ECHR. In that case, the CJEU interpreted the “right to be forgotten” and focused on the responsibilities of the search engine operators like Google. The judgment opts for a broad interpretation of that right and raises a lot of question as to the manner it will be applied by the search engine operators. The most controversial matter was that the exercise of this specific right would always require balancing of opposing fundamental rights that would be rendered by a private party.
1
Case C‑131/12, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González, (of 13 May 2014).
6
The objective of this research paper is to explore the legal implications of the “right to be forgotten” for the Council of Europe (CoE) legal system with emphasis on the ECHR. The
Costeja judgment purports that this right has its legal basis both in the right to privacy and
data protection, and a specific character. The paper identifies the character of that right and whether it is linked to the standard of protection under the ECHR. Through this process, the paper seeks to distill how the right to freedom of expression of web publishers and the general public can be sufficiently and adequately safeguarded against the “right to be forgotten”.
II Structure and Methodology
The paper will proceed along the following lines: Chapter I will analyze separately how the rights to privacy, data protection and freedom of expression are established in the legal systems of the EU and CoE and how they are interpreted in relevant case-law of each the Strasbourg and the Luxembourg Courts. Next, (Chapter II) will examine the facts and the interpretation of the Costeja case and the problematic points set by this judgment. Finally, (Chapter III) will explore whether balance between the two systems may be achieved on the basis of a common approach and how the application of the “right to be forgotten” may influence the protection of the fundamental rights before the ECtHR. The thesis will point towards the new Data Protection Regulation and the relevant solutions in regards of the main topic here.
The methodology used is based on the descriptive method: the regulation and the scope of the rights to privacy, data protection and freedom of expression in the CoE and EU are presented. The interpretative approaches of the ECtHR and the CJEU are compared in terms of the conflict of those rights. The analysis of the “right to be forgotten” explores the nature of that right and its scope of application. The final part compares the standard of protection in the EU and the CoE and renders a normative suggestion on how consistency would be achieved in the light of the new Regulation. The comparisons and the description are derived from the internal point of view of the author.
7
The research is based mainly on the following relevant legal instruments: the European Convention of Human Rights (ECHR);2 Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data;3 the Charter of Fundamental Rights of the European Union;4 Data Protection Directive 95/46,5 and (EU) General Data Protection Regulation 2016/679 (GDPR).6
2 Council of Europe, European Convention for the Protection of Human Rights and Fundamental Freedoms, as amended by Protocols Nos. 11 and 14, 4 November 1950, ETS 5, (ECHR).
3 Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 28 January 1981, ETS No.108, (Convention 108).
4 European Union, Charter of Fundamental Rights of the European Union, 26 October 2012, 2012/C 326/02 (EUCFR or the Charter).
5 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995 ] OJ 2 281/0031 (Directive 95/46).
6 Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ 2 119/01.
8
Part I. Legal framework of the Council of Europe and the EU
1. Introduction
The first chapter examines the general framework of the right to privacy and freedom of expression in the legal systems of the CoE and the EU. Firstly, we will look at the traditional understanding of their scope ratione materia and ratione personae. Then, we will try to determine the new legal challenges imposed by the right to data protection as established in Directive 95/46 and Article 8 EUCFR. In comparison, the Strasbourg Court comprehends and applies “data protection” as a right included under the material scope of Article 8 of the Convention. The chapter presents the legal context of the Costeja judgment and outlines the existing differences in-between the two legal systems.
2. Council of Europe
2.1. Privacy and data protection
2.1.1. Sources
The right to privacy and data protection has several sources in the Council of Europe system. Article 8 (1) of the European Convention of Human Rights (1950) guarantees everyone “the right to respect for his private and family life, his home and his correspondence”. This is the most important source because it forms the very essence of privacy and ensures its protection. However, this right is not absolute and States may impose restrictions that are provided by law, pursuing a legitimate aim and necessary in a democratic society.7
In the 1970’s, it became obvious that information technologies were growing in influence and the legislation at the time did not address those risks properly. It was considered that the concept of “private life” under Article 8(1) ECHR also could not provide adequate protection.
7
9
This led to the adoption of Convention 108. It is the first binding international instrument, aimed specifically at dealing with protection of personal data, adopted in 1981. Data protection is closely connected to privacy but goes much further. The purpose and the object of Convention 108 are to “secure (…) for every individual (…) respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him ("data protection")”.8
Convention 108 provides for a number of concepts that form the basis of the special regime of data processing and data protection. Firstly, “personal data” is “any information relating to an identified or identifiable individual ("data subject")”. That marks the very broad scope
ratione personae and ratione materiae of Convention 108. Secondly, “automatic processing”
includes operations carried out by automated means – “storage of data, carrying out of logical and/or arithmetical operations on those data, their alteration, erasure, retrieval or dissemination”.9
Finally, it provides for a set of requirements with respect to the quality of data going through automatic processing. According to Article 5, such data shall be: (a) obtained and processed fairly and lawfully; (b) stored for specified and legitimate purposes and not used in a incompatible way; (c) adequate, relevant and not excessive in relation to the purposes; (d) accurate and kept up to date; (e) preserved in a form which permits identification of the data subjects for no longer than is required.10 In addition to these constraints, Convention 108 envisages that the individual has the right to know if and where information relating to him has been stored. He may also request rectification or erasure of the data in case that the principles of data quality and special categories of data have not been complied with.11
2.1.2. Judicial supervision
The Strasbourg Court (ECtHR) oversees the implementation of the ECHR, having competence to examine individual’s complaints for Convention violations submitted to it.12 The individual has to exhaust all domestic remedies in order to file a complaint before the 8 Convention 108, Art.1. 9 Ibid., Art.2(c). 10 Ibid., Art.5. 11 Ibid., Art.8. 12 ECHR, Art.19.
10
Court within a period of six months from the final domestic judicial decision.13 Not only natural persons, but also legal entities may file an application before the Court. Every applicant has to prove victim status – that a State (party to the Convention) directly or indirectly affected him through an alleged violation.
Throughout the years, the scope of the Convention rights has been vastly expanded by the Court under the doctrine of dynamic interpretation. This doctrine declares that the Convention is a “living instrument” that should be interpreted in the present-day conditions.14 This led to the gradual widening of the content of all rights in the Convention. In the light of this development, the Court considered that it is not “possible or necessary to attempt an exhaustive definition of the notion of "private life"” under Article 8 ECHR.15 In principle, there is no reason to understand this notion as excluding “activities of a professional or business nature”.16 To a certain extent Article 8 should include also a “right to establish and develop relationships with other human beings”.17
In contrast to the ECHR, Convention 108 does not envisage adjudicatory body that will supervise the protection of the rights and the enforcement of the obligations related to “data protection”. Nevertheless, on a very fundamental level those two treaties are linked as their object of protection partly overlaps. The ECtHR gave due regard to Convention 108 in several of its judgments. The practice of the Court is mostly based on the right to privacy enshrined in Art. 8 ECHR; privacy is seen as the main value which data protection aims to protect.18
In Rotaru v Romania the Court reaffirmed its broad interpretation of privacy under Article 8 ECHR and declared that it corresponds to the right to “data protection” in Article 1 of Convention 108. From that, the ECtHR concluded that “public information can fall within the scope of private life where it is systematically collected and stored in files held by the authorities”.19 In Z v Finland the ECtHR established that “the protection of personal data, not
13
ECHR, Art.35.
14 Tyrer v United Kingdom App no 5856/72 (ECtHR, 25 April 1978); Jacobs, White and Ovey, The European Convention on Human Rights (6th edn. OUP 2014) 74.
15 Niemietz v Germany (1992), A251-B [29], [33] - [34]. 16
Ibid. 17 Ibid.
18 M. Tzanou, 'Data protection as a fundamental right next to privacy? ‘Reconstructing’ a not so new right' [2013] 3(2) International Data Privacy Law 91.
19
11
least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention” (ECHR).20
In conclusion, Convention 108 is a subsidiary source of law and the ECtHR will render systematic interpretation so long as privacy is affected. Clearly, the rights proclaimed in Convention 108 cannot be invoked as such before the ECtHR, because it will lack competence to adjudicate. The court expanded the material scope of “private life” finding that where the collection and storage of personal data by the State are affecting seriously the privacy of individuals, it will fall in the ambit of Article 8 ECHR. In such cases, the final judgment will be based predominantly on the Strasbourg Court’s assessment whether or not that specific provision of the ECHR has been violated, and Convention 108 will be interpreted as “relevant international law”.21
The ECHR has a leading significance, but there are other relevant instruments that evidence for evolving opinio juris. The most recent soft law source is the Council of Europe Recommendation on the Internet Freedom. It tackles issues related to balancing data processing and freedom of expression. The recommendation highlights that all personal data is protected under Article 8 ECHR and Convention 108 and any restriction imposed on private and family life shall be undertaken in compliance with Article 8 ECHR (provided by law, pursuing a legitimate aim necessary, proportionate and).22
2.2. Freedom of expression
The most important source of the right to freedom of expression in the Council of Europe legal system is Article 10(1) ECHR:
20
Z v Finland, App no 22009/93 (ECtHR, 25 February 1997), RJD 1997-I, [95]. 21 Ibid.
22 Council of Europe, Recommendation CM/Rec(2016)5 of the Committee of Ministers to member States on Internet freedom (adopted by the Committee of Ministers on 13 April 2016 at the 1253rd meeting of the Ministers’ Deputies), [4.1.1.] [4.1.2]. (CM/Rec(2016)5).
12
“Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises”.23
This legal norm can be completely and precisely understood only through examining the interpretation of the Strasbourg Court as the body having the competence to adjudicate on cases where freedom of expression has been allegedly violated by the States Parties.
Firstly, Article 10(1) encompasses a wide material scope as “freedom to hold opinions and to receive and impart information” without the interference by State. The ECtHR has emphasized that freedom of expression “constitutes one of the essential foundations of a democratic society and one of the basic conditions for its progress and for each individual’s self-fulfillment”.24 This fundamental right includes all forms of expression: through books, paintings, cartoons, video-recording, films, statements in radio/television interviews and the internet, with any content including incitement to hatred and pornography.25 Moreover, free expression includes ideas and information that “offend, shock or disturb the State or any sector of the population” because those are the requirements of “pluralism, tolerance and broadmindedness” essential features of “democratic society”.26
Article 10(2) ECHR allows States to impose limitations on the right which are provided by law, pursuing a legitimate aim and necessary in democratic society.27 In such situations the State Parties have certain margin of appreciation. The ruling in the Handyside case establishes that the margin shall be given both to the domestic legislator and the domestic authorities that apply and interpret the laws. National authorities are, in principle, better placed to establish the need for and the content of the limitations. The margin, however, goes “hand in hand with a European supervision” – the ECtHR retains its position to render a final judgment on whether such restrictions are compatible with Article 10 ECHR.28
23 ECHR, Art.10(1).
24
Handyside v United Kingdom (7 December 1976) Series A no 24, [49]. 25 White and Ovey, n14, p.435-436.
26 Handyside v United Kingdom, n24, [49]
27 Here “limitations” shall be understood as State interference - “conditions”, “restrictions”, “penalties”. 28
13
As mentioned above, the Committee of Ministers addresses that any measure undertaken by State authorities or private parties to “block, filter or remove Internet content shall be in compliance with Article 10 ECHR “regarding the legality, legitimacy and proportionality of restrictions”.29 While the Recommendations are not binding on the Member States, they may have considerable influence on domestic legislation as well as the ECtHR. The latter, may consider the Recommendations as relevant international law in the course of dynamic interpretation of Convention.
2.3. Relevant jurisprudence of the ECtHR
Considering those developments, in the Council of Europe legal system, the rights to privacy and freedom of expression have their most efficient protection under the ECHR. The ECtHR has repeatedly declared that the rights to privacy and freedom of expression deserve equal respect. When balancing those rights the outcome of the cases shall not be dependent on whether the complaint was filed under Article 8 by the individual subject to a journalistic article, or under Article 10 by the publisher. The margin of appreciation will be the same.30 According to the Court in Von Hannover (no.2) and Axel Springer the relevant balancing criteria are: (a) contribution to a debate of general interest (of the published photos or articles); (b) how well known is the person concerned and what is the subject of the report; (c) prior conduct of the person concerned; (d) method of obtaining the information and its veracity; (e) content, form and consequences of the publication; and (e) severity of the sanction imposed.31 Both cases concern public figures, but subsequent case-law of the Court evidences that the criteria are also applicable to ordinary persons.32 However, those principles are not one-size-fits all kind of solution. We find a different but influential approach when it comes to allegedly libelous articles balancing opposite on-line archives of publishers.
The ECtHR has developed a different position regarding the role of news portals as intermediaries and their duty of care for third party comments. In Delfi the Court found that the comments amounted to hate speech/incitement to violence and speech incompatible with
29
CM/Rec(2016)5, n22, [2.2.2.]
30 Von Hannover v Germany (No 2) [GC] (2012) 55, (“Von Hannover (no.2)”), [106]; Axel Springer AG v Germany App no 39954/08 (ECtHR, 7 February 2012), (“Axel Springer”), [87].
31 Ibid. Von Hannover (No 2), [95] – [113]; Axel Springer, [89] – [109]. 32
14
the values of the Convention is not protected by freedom of expression (Article 10) by virtue of Article 17 ECHR.33 The Strasbourg Court examined Delfi’s activity in conformity with the Council of Europe’s “differentiated and graduated approach” which establishes that the “duties and responsibilities” of the Internet news portals may differ from the traditional publishers.34 For the ECtHR it was sufficient that under the domestic laws it was foreseeable that Internet news portal run on a commercial basis could be held liable for third-party unlawful comments.35 It had a substantial degree of control over the comments section connected also to its economic interest, therefore, Delfi’s role was way beyond a passive intermediary.36 The news portal’s duty of care included an “obligation to take effective measures to limit the dissemination of hate speech and speech inciting violence”.37
In Times Newspapers Ltd (Nos. 1 and 2) the ECtHR emphasized that news archives were an important source of educational and historical information, accessible to the general public and free. Potentially defamatory articles shouldn’t be removed from the media archives as it would violate press freedom under Article 10. 38
The case-law of the ECtHR evidences an evolution in weighing of the rights to privacy and expression. The criteria of content and nature of the information will be always be examined by the ECtHR and may determine the outcome of the cases. The Court acknowledges that the Internet poses a higher risk to privacy and there are stricter policies for on-line dissemination. Web-publishers shall place filters or notification mechanisms enabling them to prevent or remove timely unlawful comments. However, over-monitoring of user comments without clear criteria or runs the risk of private censorship.39
3. European Union
3.1. General framework
33 Delfi AS v Estonia App no 64569/09 (ECtHR, 16 June 2015), [136]. 34 Ibid., [113].
35 Ibid., [128]. 36
Ibid., [145]. 37 Ibid., [157].
38 Times Newspapers Ltd (nos. 1 and 2) v the United Kingdom App no 3002/03 and 23676/03 (ECtHR, 10 March 2009).
15
The EUCFR explicitly recognizes and protects the right to privacy and the right to data protection, in Article 7 and Article 8 respectively. The Charter entrenches the protection of fundamental human rights and together with the founding Treaties on the European Union form the primary EU (source of) law, since the Treaty of Lisbon entered into force on 1st December 2009.40 Article 51 EUCFR determines that the bearers of the obligations arising from the Charter are “the institutions and bodies of the Union” and “the Member States only when they are implementing Union law”. The timing, wording and the context EUCFR make it a more - if not the most - contemporary instrument in comparison to other regional and universal human rights treaties. It also protects some rights and freedoms that the ECHR did not explicitly envisage.41
The CJEU has a very broad jurisdiction – it ensures that the rule of law is observed in the interpretation and the application of the Treaties, adjudicates on actions brought by Member States, EU institutions, natural or legal persons, and in other cases provided in the Treaties.42 The individual who complaints that his human rights are violated under the EU law may access the CJEU through the domestic courts referring a case to the Luxembourg Court for a preliminary ruling.43
The Charter protects the fundamental rights and freedoms of individuals and private entities against violations. When adjudicating on human rights issues, the CJEU shall respect that the provisions of EUCFR do not “extend the competences of the Union as defined in the Treaties”.44 Secondly, Chapter VII EUCFR determines the substantive scope of the rights and the limitations they could be subject to.
The proper interpretation EUCFR may require deference to the Explanations prepared by the original drafters. They do not have the status of law, but they are a valuable tool for interpretation EUCFR.45 The CJEU has stated that “national authorities and courts remain free to apply national standards of protection of fundamental rights, provided that the level of protection provided for by the Charter, as interpreted by the Court, and the primacy, unity and
40
Art. 6(1) TEU. European Union, Treaty of Lisbon Amending the Treaty on European Union and the Treaty Establishing the European Community, 13 December 2007, 2007/C 306/01 (TEU). European Union,
Consolidated version of the Treaty on the Functioning of the European Union, 13 December 2007, 2008/C 115/01 (TFEU).
41
Transparent administration (Art. 41), etc. 42 TEU, Art.19.
43 TEU, Art.6(2); TFEU, Art.267(1). 44 TEU, Art.6(1).
45
16
effectiveness of European Union law are not thereby compromised”.46 This is a different approach in comparison to the ECtHR, which gives preference to the teleological (in the light of the object and purpose of the Convention) and the evolutive interpretation.47
3.2. Content of the fundamental rights
Regarding the content of the fundamental rights, the ECHR has a special significance. Article 52(3) EUCFR explicitly states that, so far as the Charter contains a right that corresponds to the ECHR, their meaning and scope should be the same. Union law may provide “more extensive protection”. The Explanations purport that Article 52(3) is aimed “to ensure the necessary consistency between the ECHR and the Charter”.48 Not only the meaning and the scope of the rights should correspond, but also when national authorities put limitations on the fundamental rights they should be the same as those in the ECHR, provided that it would not affect adversely the autonomy of the Union law and that of the CJEU. The Explanations refer explicitly to the case-law of the ECtHR as well and clarify that the level of protection EUCFR cannot be lower than the protection granted by the ECHR.
The practice of the CJEU dealing with the status of the ECHR and its case-law is inconclusive. On the one hand some judgments purport that “where Charter rights are derived from ECHR rights, the ECJ should follow the clear judgments of the ECtHR”.49 On the other hand, the latest developments in the jurisprudence of the CJEU suggest that it refers to the Charter as the source of fundamental rights and “primary basis for judicial review” and the ECHR has a residual role.50 This has found a clear expression in the CJEU finding in
Fransson”.51 The practice of the CJEU marginalizing the role of the ECHR and establishing its own standard of human rights protection is also seen in Opinion 2/14 rejecting the
46 Case C-617/10 Åklagaren v. Hans Åkerberg Fransson [2013] (ECJ 7 May 2013), [29]; Case C-399/11 Stefano Melloni v Ministerio Fiscal [2013], [60].
47
White and Ovey, n14, p.81. 48 Explanations, n45, “Article 52”
49 Case C-400/10 PPU J. McB. v L.E. 5 October [2010] ECR I, [53]; Case C‑279/09 DEB v Germany [2010] ECR I-13849.
50 Sionaidh Douglas-Scott, The relationship between the EU and the ECHR Five Years on from the Treaty of Lisbon. S de Vries, et al (ed.), The EU Charter of Fundamental Rights as a binding instrument: five years old and growing (Hart Publishing 2015), pp. 42-45.
51
17
accession of the EU to the ECHR.52 That affects the necessary consistency for the human rights protection.
3.3. Privacy and data protection
3.3.1. Sources
Data protection stems from the right to respect for privacy. It is the contemporary response to the challenges individuals face in a digital era, where privacy is shrinking due to the ever expanding role played by technology.
Article 7 (“Respect for private and family life”) and Article 8 (“Protection of personal data”) EUCFR are the primary source of those rights in the EU legal order. The wording and the material scope of Article 7 EUCFR correspond to Article 8 ECHR. Article 8 EUCFR functions in a three-fold manner: it establishes the right; it determines the conditions under which personal data must be processed adding that everyone shall be able to access that data and has “the right to have it rectified”; thirdly, it provides that there shall be independent body that would observe the compliance with those rules.53
The sources of the right to data protection are complex.54 What is confusing here is that Article 8 EUCFR (primary source of EU law) is confined by an earlier enacted secondary law - Directive 95/46. Not only it is among the main sources of inspiration for Article 8 EUCFR, but in practice it serves as a key instrument for the understanding of the special scope and the nature of the “data protection”. Directive 95/46 elaborates on the scope of application of the right to data protection and shall be assessed thoroughly. Firstly, “personal data” is any information “related to an identified or identifiable natural person (“data subject”)”.55 It circumscribes the material scope – “the processing of personal data wholly or partly by
52 Opinion 2/13 of the Court of 18 December 2014: Accession by the Union to the European Convention for the Protection of Human Rights and Fundamental Freedoms, [179] – [200].
53 Explanations, n45, Art.7.
54 Explanations, n45, referring to Art.16 TFEU, Art.39 TEU, Art.8 ECHR, Convention 108; Dir.95/46/EC and Regulation 45/2001.
55
18
automatic means”.56 Article 6 of the Directive contains detailed provisions on the principles of “data processing” which are almost identical to the abovementioned Convention 108 principles. Article 7 (“Criteria for making data processing legitimate ”) Directive 95/46 proclaims that personal data may be processed only if the subject has given his consent or in the absence of consent only in specific cases where it is necessary for the achievement of legitimate purposes (public interest, compliance with legal obligation, etc. ).
The technical wording and the main principles of Directive 95/48 are closely related to the Council of Europe Convention 108 and to Article 8 ECHR, and it specifically refers to both of them in its introductory part.57 It is important to note that the Directive was enacted in time when the Internet did not have the strong impact it has today. It was aimed to ensure the free float of data between the Member States, its protection and to enhance the functioning of the internal market.58 Notably, Directives do not have horizontal effect; they cannot be invoked by private parties against other private parties.59
3.3.2. Concept of the right to data protection
There is an ongoing academic debate on concept of data protection. It is a right that is clearly linked to the right to privacy. In terms of the object of protection privacy is “one if not the major” value that data protection laws aim to protect”.60 However, many authors consider that there are significant differences in their scope, rationale and logic and support the interpretation of data protection independently from the right to privacy.61
In the current research paper, it is argued that data protection is to be seen as closely connected, but nevertheless separate fundamental right from privacy. Both rights “promote many of the same goals” and “heavily overlap”.62 However, data protection establishes special principles for data quality and data legitimacy that do not correspond to the traditional scope of privacy. What will be the object of the protection of personal data will vary as it will
56 Ibid., Art.3.
57 Ibid., Recital(10)-(11). 58 Ibid., Recital(3)-(6). 59
Case C-91/92 Paola Faccini Dori v Recreb Srl. [1994] ECR I-03325. 60 Tzanou, n18, p.91.
61 O Lynskey, 'Deconstructing data protection: the 'added-value' of a right to data protection in the EU legal order' [2014] 63(3) International and Comparative Law Quarterly 592.
62
19
be “in relation to its specific function in society” (in each particular case).63 There is a strong legal basis for that argument in the new GDPR which deems that “processing of personal data should be designed to serve mankind”.64 The conceptual flexibility of data protection affects also the broad concept of the “right to be forgotten”.
3.4. Freedom of expression
The right to freedom of expression is proclaimed in Art. 11 EUCFR and includes the freedom to “hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers”. Moreover, the CJEU has recognized freedom of expression as a general principle of the EU law that shall be understood as it is proclaimed in Article 10 ECHR.65 The CJEU jurisprudence that interprets the general principles of the EU law refers also to the case-law of the Strasbourg Court. The Explanations point out that the meaning and scope of Art. 11 EUCFR correspond to Art. 10 ECHR, and any eventual limitations shall not exceed those in Art. 10(2) ECHR.66
The right to freedom of expression has a very broad scope and that is acknowledged in the case-law of the CJEU. Issues related new technologies and Internet have also been interpreted dynamically.67 It shall be reminded that the scope of application EUCFR pertains to the EU law matters as delimited by Article 52(1) CFREU and the development of the Digital Single Market is among the leading priorities of the EU Commission.
For the purposes of the current research topic will focus on the freedom of expression envisaged in Article 9 Directive 95/46. It proclaims that Member States may provide exemptions or derogations for the processing of personal data “carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression”.68 Currently,
63
See Joined cases C-92 and C-93/09 Volker and Marcus Schecke Eifert [2010] ECR I-11063, [48]; Case C-543/09 Deutsche Telekom AG v Germany (CJEU 5 May 2011) I-03441, [51]
64 GDPR, n6, Recital(4).
65 Case C-260/89 Elliniki Radiophonia Tiléorassi AE and Panellinia Omospondia Syllogon Prossopikou v Dimotiki Etairia Pliroforissis [1991] ECR I-02925, [41]; Case C-219/91 [1992] ECR I-05485, [35]. 66 Explanations, n45, Art.11.
67 Lorna Woods. Article 11 – Freedom of expression and information. The EU Charter of Fundamental Rights: a commentary (Hart Publishing 2014), pp. 331-39.
68
20
there is a great variety of exemptions from data processing under Article 9 (Directive 95/46) between the different Member States that goes against the equivalent level of protection envisaged in Recital 8 of Directive 95/46.69
3.5. Privacy and freedom of expression in the CJEU jurisprudence
The Schecke case concerned the validity of two Community regulations providing for the disclosure of personal information of the recipients of agricultural funds.70 The main preliminary question was whether the requirement for such publication on the Internet was an unjustified interference with the right to data protection (Article 8 EUCFR). The CJEU determined that the validity of the regulations should be assessed on the basis of both Article 7 and 8 EUCFR. The Court made two important references to ensure necessary consistency between the rights in the EUCFR and the ECHR. It summarized that “the right to respect for private life with regard to the processing of personal data is recognized by Articles 7 and 8 EUCFR. Justifiable limitations that may be imposed on data protection (under Article 52 (3) EUCFR) shall correspond to those under Article 8 ECHR”.71 The CJEU stressed that when the EU Council and the Commission were drafting the two regulations, they did not consider measures that would achieve the same objective (transparency), while at the same time being less intrusive for the right to privacy and data protection. In sum, “no automatic priority can be conferred on the objective of transparency over the right to protection of personal data”.72
4. Sub-conclusion
The fundamental rights to privacy/data protection and freedom of expression are all recognized and protected in the Council of Europe and in the EU legal order. Their wording,
69 David Erdos, 'European Union data protection law and media expression: fundamentally off balance ' [2016] 65(1) International and Comparative Law Quarterly 139-83.
70 Schecke, n63.
71 Ibid, [51] – [52]. Nothing in the Charter shall be interpreted in a way that restricts or adversely affects the rights under the ECHR.
21
scope and objectives significantly overlap. However, their field of application differs as the rights in the EUCFR are limited to EU law. The application of the ECHR remains related to more traditional privacy-expression issues (defamation, slander, censorship, liability for third party comments, hate speech, etc.). Data protection issues are included in the broad notion of privacy and the Strasbourg Court has limited case-law. The ECtHR cannot adjudicate on purely data protection complaints as it does not have the competence under the ECHR. In contrast, the legal framework of data protection in the EU law is very technical, disperse and voluminous. Directive 95/46 elaborates on data protection, but the balancing of this fundamental right and freedom of expression is mostly left to the domestic authorities.
22
Part II. The Costeja judgment – analysis, issues, divergence
1. Introduction
This Chapter analyzes the Costeja judgment and the novel concept of the “right to be forgotten”. It consists of the following – the facts of the case, the content of that right, how did the court reach the conclusion of its existence, and the right’s material and personal scope. The CJEU determines that search engine operators are the first to decide what content shall be deleted and what will stay online, as a result of a search request based on a person’s name. In the end, we will examine the consequences of that specific role for the balancing of the rights to privacy and expression.
2. Facts
A Spanish citizen, Mr. Costeja Gonzalez, filed a complaint before the national Data Protection Agency (DPA) against La Vanguardia, a daily newspaper and against Google Spain and Google Inc. He complained that upon entering of his name in the “Google Search” engine, links to two pages of La Vanguardia appeared. Those pages contained an announcement from 1998 about real-estate auction for the recovery of Mr. Costeja’s debts. He claimed that his financial problems were solved; the reference was entirely irrelevant and requested the removal of the articles by the newspaper and the removal of the links by Google. The Spanish DPA rejected the claim against the newspaper, but upheld the one against Google. The search engine brought separate actions before the Spanish courts against the DPA. In a subsequent referral to the CJEU, there were several questions regarding the interpretation of the Directive 95/46, the applicable EU instrument.73
73
23
3. Content of the right
3.1.Interpretation by CJEU
In essence, the Luxembourg Court had to decide whether Article 12(b) and 14(a) of Directive 95/46 enable the individual (data subject) to require from search engine operators (SEOs), to remove from the list of results following a search on the basis of his name, web pages that are lawfully published, but include information which may be harmful to him or he wishes to be “forgotten” after certain time.74
Article 12(b) allows individuals the right to obtain from the controller “…erasure or blocking of data …which doesn’t comply with the … Directive, in particular because of the incomplete or inaccurate nature of the data”.
The incompatibility will be determined on the basis of the criteria envisaged in Article 6(1)(c) to (e) (“Principles of data quality”) Directive 95/46. The Court stressed that even lawfully published information by third parties may become incompatible in the course of time and more specifically, because the information appears to be inadequate, irrelevant or no longer relevant or excessive for the purposes of processing. When such data appears in the results following a search based on an individual’s name, the links must be erased upon his request.75
Article 14(a) grants to the data subjects the right to object to the processing of their data at any moment, based on compelling legitimate grounds in referred to in Article 7(e) and (f). If the objection is justified, the controller may no longer involve their data.76 However, such objection will require balancing between the legitimate interests pursued by the controller or third parties to whom the data are disclosed and the interests [or] fundamental rights and freedoms of the data subject which require protection under Article 1(1).77
The CJEU determines that in the balancing of opposing fundamental rights and the interests under Article 7(f), account must be taken of the data subject’s rights to privacy and data
74 Ibid., [89] – [99]. 75 Ibid., [94]. 76 Directive 95/46, Art.14(a). 77 Directive 95/46, Art.7(f).
24
protection as enshrined in Article 7 and 8 EUCFR.78 Further, the Court analyzes and compares the rights of the web pages publishers to the SEOs (in relation to Article 7(f)). The CJEU concludes that their position is not the same, because the legitimate interests justifying the processing and the consequences of processing for the privacy of the individuals are different.79
In sum, the Court gives a broad interpretation of Article 12(b) and 14(a) of Directive 95/46. It interprets the request for removal of the list of search results of the data subject’s name in the light of Article 7 and 8 EUCFR. The CJEU concludes that, as a rule, those rights override the economic interests of the SEO, and the general interest of the public in having access to that information upon a search of the individual’s name. However, for particular reasons such as the role played by the subject in public life, the interference with his fundamental rights may be justified by the “preponderant interests of the general public” in having access to that information.80
3.2. The nature of the “right to be forgotten”
Firstly, the “right to be forgotten” doesn’t correspond to its broad name. The purpose of the removal request is to limit the public’s access to links generated from a person’s name. That will result in erasure/ blocking of the links, but the original article will remain online. 81 Secondly, it is worth exploring the nature of the “right to be forgotten”, an issue that has been much debated on. 82 The Advocate General in the Costeja case denied the existence of the “right to be forgotten” both under the Directive and on Charter grounds. He argues that recognizing such right would lead to violation of on the right to freedom of expression and information and on the right to conduct a business. He supported that also with references to the Article 8 ECHR and case-law of Strasbourg. 83 Some scholars considered that the “right to be forgotten” is implied in the Directive, but has a very limited scope, under Art. 12(b) and
78 Costeja, n1, [74]. 79 Ibid., [86]. 80 Ibid., [99]. 81
The “right to be forgotten”, right to request removal/ de-listing/ de-indexing are synonymous.
82 On the different views of the nature of the “right to be forgotten”, see Anna Bunn, 'The curious case of the right to be forgotten' [2015] 31(3) International Journal of Technology Law and Practice 336-350.
83 Case 131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González [Judgment of 13 May 2014], Opinion of AG Jääskinen [101] – [111], [126] – [137].
25
Art. 14 of Directive 95/56.84 We will not review each theory but below we will examine the critical and the off balance points.
Regarding the nature of the “right to be forgotten” this paper will adopt a practical approach – focusing on the legal consequences of the right.
The “right to be forgotten” has a procedural aspect enshrined in Article 12(b) and 14(1) of Directive 95/46. It is a right that highly depends on the discretion of the data subject and his/her own understanding of information. It has to be exercised against the data controller (SEOs), but the Member States are obliged to guarantee that the controller will comply with the obligations under Directive 95/46.85 Simultaneously, the “right to be forgotten” has also a substantive aspect – Article 6 (“Principles relating to data quality”) and Article 7 (“Criteria for making data processing legitimate”) of Directive 95/46. All data quality requirements shall be present and they shall be cumulatively combined with at least one of the legitimacy conditions in Article 7 of Directive 46/95.86
In sum, the procedural and substantive aspects go hand-in-hand. However, the procedural aspect (Article 12(b) and 14(a)) is dependent on the substantive aspect (Article 6 and 7). Therefore, we consider that the “right to be forgotten” is a legal remedy that enables the individual to request de-indexing of results containing his name. It is a measure of secondary EU law with procedural character that is closely connected to privacy and data protection and it serves as a means to achieve their protection. However, the “right to be forgotten” has far reaching implications for other fundamental rights, mostly for freedom of expression as removal of links will affect the public’s right to know. It may affect the right of the publisher to inform the public indirectly – it is more likely to search for information through a general search engine rather than a search engine embedded on the web site of a publisher.
Moreover, the CJEU purports that the “right to be forgotten” will be exercised in light of Article 7 and Article 8 EUCFR.87 Therefore, a refusal to grant a removal request will lead to limitation of privacy/data protection as a necessary consequence. It follows that every removal request will require a justification under Article 52(1) EUCFR. The right to request
84
Jef Ausloos, ‘The “Right to be Forgotten” – Worth remembering?’ [2012] 28(2) International Journal of Technology and Practice 149-152.
85 Directive 95/46, Arts.12 & 14(a). 86 Costeja, n1, [71].
87
26
removal cannot operate alone, but requires a legal basis in either the right to privacy or data protection, which is why we see it as a legal remedy.
The aspect of necessary balancing of various fundamental rights and interests is referred in Article 7(f) of Directive 95/46. We shall examine whether the CJEU’s approach in Costeja for the balancing of the opposing fundamental rights struck a fair balance.
4. Balancing test
What were the balancing criteria of the CJEU in Costeja? In paragraph 81 of the judgment, the Court submits that the economic interest of the operator cannot justify the potential seriousness of the interference. Further, in the same paragraph the CJEU declares that a fair balance shall be achieved between the legitimate interest of the Internet user to have access to the data (that the data subject wants to be removed) and the individual’s fundamental rights under Article 7 and 8 EUCFR. The Court concludes that while the data subject’s rights protected by those two provisions “override as a general rule the interest of the internet users”, the balance may depend on the (a) nature of the information; (b) its sensitivity for his private life; (c) interest of the public in having that information; (d) that interest may vary because of the role played by the individual in the public life.88
The Court develops that argument in the part dealing with the extent of the responsibilities of the data controllers.89 It merely refers to this paragraph in the part of the judgment analyzing the “right to be forgotten”. There the CJEU repeats that the fundamental rights of Article 7 and 8 EUCFR “override as a rule” the interest of the general public in having that information. That would not be the case if for particular reasons such as the role played by the data subject in the public life, the general public interest may prevail and the list of result will remain accessible.
There are several problematic points here. The CJEU argues that a balance between privacy and data protection (Article 7 and 8 EUCFR) and the interest of the Internet users to have access to the information shall be achieved. De-indexing search results will interfere with the right of the public to seek information on-line and “the public has a right to receive
88 Ibid., [81]. 89 Ibid., [62] – [88].
27
information of general interest”.90 Some authors suggest that the impact will be limited as the original source is still available to the general public.91 This paper argues that when balancing fundamental rights and interest, one cannot be considered as overriding, by definition, the opposite right. It deems the whole balancing exercise pre-determined. If that was justifiable for the economic interest of the operator it cannot be merely extended to the position of the general public.
The CJEU constructed some balancing criteria in paragraph 81 (nature of the information; privacy sensitivity; general public interest), but did not elaborate on them. It somehow narrowed down this approach at the end of the judgment and focused on the concept that the public interest will especially depend on the role of the data subject.92
Under EU law every limitation of fundamental rights shall adhere to the justification test requirements envisaged in Article 52(1) EUCFR. In Costeja the CJEU didn’t follow this test and adopted its own questionable approach. This runs in contradiction to the Charter as a primary EU law and is inconsistent with the CJEU’s jurisprudence. It strongly diverges from the reasoning in the Schecke case, where the CJEU concluded that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 EUCFR, as long as the limitations imposed follow the criteria laid down in Article 52(1) EUCFR – provided by law, respect the essence of the right, proportionate, necessary, respect the general interest of the EU or the need to protect the rights and freedoms of the others.93
In the Costeja judgment there was also a lack of deference to the ECHR, which has a special significance in the EU legal order.94 According to Article 52(3) Charter, corresponding rights shall have the same meaning and scope. The EUCFR cannot be interpreted in a way that will restrict or adversely affect the rights under the ECHR.95 Thus, it’s not entirely clear whether the CJEU’s approach -“override as a rule”, and the lack of justification test are in conformity with Article 8 and Article 10 ECHR.96
90
S Kulk and F Borgesius, 'Google Spain v González: Did the Court Forget about Freedom of Expression?' [2014] 3(3) EJRR 392.
91 Diana Sancho-Villa, 'Developing search engine law: it is not just about the right to be forgotten ' [2015] 42(4) Legal Issues of Economic Integration 362.
92
Costeja, n1, [97], [99]. 93 Schecke, n63, [50].
94 S Kulk and F Borgesius , n90. 95 EUCFR, Art.53.
96
28
In Schecke the CJEU paid significant attention to the ECHR and also to the jurisprudence of the Strasbourg Court. AG Jääskinen in his Opinion stated that Article 8 EUCFR is a restatement of the EU and the Council of Europe acquis and doesn’t add new meaning for the interpretation of Directive 95/46.97 Article 7 EUCFR is identical to Article 8 ECHR. Article 8 ECHR covers issues related to data protection. In his Opinion for those reasons and in conformity with Article 52(3), Article 8 ECHR and the case-law of the Strasbourg Court shall determine the interpretation of Article 7 EUCFR and the conformity of Directive 95/46 with Article 8 EUCFR.98
5. The rights of the web publishers
One of the questions referred to the CJEU was regarding the consequences of the exercise of removal request for the web publishers. The Luxembourg Court compared “publication of a piece of personal data on a website” and search engine activity in indexing results including personal information. CJEU argued that SEOs activity when including a list of results based on a data subject’s name is different because of the (a) easy access to that information of (b) any internet user and (c) the decisive role this information is disseminated. Those factors determine that dissemination of information via Internet search engines is liable to cause more significant interference to the right to privacy than web page publications.99
There is a lack of proper balancing of the rights involved also in regards to the rights of the web-publishers and no explicit reference to the freedom of expression. The CJEU infers that when the conditions of Articles 12(b) and 14(a) Directive 95/46 are complied with, the operator of a search engine is obliged to remove the links. This will be regardless whether or not the original publication was erased beforehand by the web publisher. That extends also to cases when the publication is lawful.100
The position establishes different protection for data subjects. An assessment for removal request is independent from any proceedings against the original publisher. There is no requirement for harm which is typically considered as a condition for liability claims against
97 Opinion AG Jääskinen, n83, [113] – [114].
98 Ibid., [115]. He referred to Schecke and ECtHR cases (his footnotes 79, 82, 83). 99 Costeja, n1, [87].
29
publishers and no time limitations. This evidences for the broad scope of the “right to be forgotten”.
The CJEU however doesn’t say what legal remedies are left to the publisher. If the list of results doesn’t include links forwarding to his article that would normally appear, this will indirectly limit his freedom to disseminate information. According to the AG Opinion – the publisher “would not enjoy adequate legal protection in such a situation notice and take down procedure is a private matter between the data subject and the SEO, and “would amount to the censuring of his published content by a private party”.101 This point was not addressed in the judgment.
The Court merely mentions that web publications may benefit from the journalistic derogations under Article 9 of Directive 95/46. In Costeja the Court doesn’t engage in an analysis of Article 9 and how a web publisher that engages in journalistic activity will be able to protect his right to disseminate information. This is particularly important in cases when the “right to be forgotten” may lead to the de-indexation of online content of new media outlets (blogs, news portals, etc.). The CJEU should have pointed out that such media would benefit from Article 9 of Directive 95/46.
6. The position of the data controller
Compelled by Directive 95/46 and Costeja, Member States have delegated to data controllers like Google the power to do the balancing test themselves – to weigh individuals’ complaints under Article 12(b) and 14(a) against private actors who disseminate information.
What is alarming is that the enforcement of the “right to be forgotten” is left firstly in Google’s hands. This broad power of search engines is dangerous as it begs the question of what kind of balancing test will they adopt. The CJEU didn’t elaborate on specific balancing criteria of the fundamental rights involved in Costeja. It mostly referred to some “particular reasons” such as the case of well-known figures where the public interest may prevail over de-indexing requests. Therefore, it remains unclear what the criteria are of the SEOs and whether they shall operate under specific time restraints. On the one hand, their inaction or
101
30
slow response could lead to grave reputational harms; on the other hand, having the incentive to fulfill their duties under the directive and the national legislation, they could prematurely block web pages of publishers that would amount to “censorship”. SEOs as data controllers could be held for damages.102
Due to this delegation of authority over the appropriate flow of information, Member States will have expanded obligations – they will need to ensure compliance by the SEOs with the right to request de-listing.103 In practice, this means that for every refusal from SEOs to de-list results including data subject’s name, the individual shall have legal recourse to the national courts for such removal.
7. Developments
In order to understand the implications of the “right to be forgotten” it is important to see the post-Costeja developments.
Firstly, A29WP Guidelines for the implementation of that judgment gave specific directions to the national data protection authorities of the Member States. This is a collective body formed by the representatives of all national DPAs and has mostly advisory functions and non-binding decisions.104
The Guidelines emphasized that the balancing of the fundamental rights will depend on the: (a) nature and sensitivity of the processed data;
(b) interest of the public in having access to that particular information as the outcome may depend on the role played by the individual in the public life.105
The A29WP didn’t consider that it was necessary for the original publisher to be informed in case of removal of links from his website. However, in specific cases, when it is “necessary
102 Directive95/46, Art.23. On the SEO liability see B. van der Sloot, 'Welcome to the Jungle: the Liability of Internet Intermediaries for Privacy Violations in Europe' [2015] 6(3) Journal of intellectual property,
information technology and electronic commerce law 211-228. 103
Directive 95/46, Art.22. 104 Directive 95/46, Art.29.
105 Article 29 Data Protection Working Party, WP 225, Guidelines on the implementation of the Court of Justice of the European Union judgment on “Google Spain and inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González” C-131/12, (Brussels: WP 225, 2014).
31
to get a fuller understanding about the circumstances of the case” the SEOs may contact the original publisher, but should safeguard the rights of the data subject. A29WP concludes that “search engines do not recognize a legal right of publishers to have their contents indexed and displayed, or displayed in a particular order”.106
The Guidelines ensured that de-listing will have very limited impact on freedom of expression and access to information. The interest of the public to have access to information will always have to be taken into consideration.107 The second part of the A29WP Guidelines provides a broad list of common criteria for the national DPAs to handle removal requests.108 The Guidelines also covered some points that fall under the scope of privacy as envisaged in Article 8 ECHR (ex. privacy of “public figures”, cases of slander, libel, hate speech).109 We will compare the approach of A29WP to those cases with the approach of the ECtHR next Chapter.
It is to be noted that Google has implemented a special policy to deal with removal requests called “Transparency report”. It purports that when evaluating such requests it follows the criteria of A29WP.110 As part of the policy, Google provides a single online form where anybody may submit his request for de-indexation.111 However, the SEO makes it clear that the original publishing remains online and advises the Internet users in all circumstances to request a removal from the publisher. Moreover, for every “right to be forgotten” submission, Google will inform the webmaster only for the URL, but not the requester’s name. Once a page is de-listed, Google notifies the webmasters, who may request a review of the decision.112
Practically, the right to erasure may be exercised in three steps.
1) Firstly, it functions as a private complaint – an individual files an application for removal against SEO. The basis for that is in the Directive 95/46 and in the national legislation transposing the directive. This is one of the obligations that SEOs undertake as “data controllers”.
106 Ibid. 107 Ibid., p.2. 108 Ibid., pp.12-20. 109 Ibid., p.12-16. 110 https://www.google.com/transparencyreport/removals/europeprivacy/faq/?hl=en#who_may_request (28 July 2016). 111 https://support.google.com/legal/contact/lr_eudpa?product=websearch(28 July 2016). 112 https://www.google.com/transparencyreport/removals/europeprivacy/faq/?hl=en (28 July 2016).
32
2) Secondly, if the SEO refuses to perform removal, the individual may complain before the national Data protection authorities. This is optional and will depend on whether the national legislation provides it.
3) Thirdly, in case of refusal, the data subject may complain before the domestic courts.
8. Sub-conclusion
From the judgment and the subsequent practice it is evident that the “right to be forgotten” conveys a removal request based on search results that include a person’s name. Its aim is to protect privacy and personal data and it has a broad scope – harm is not a precondition for this right to be successfully exercised and is available to any natural person. It is based on the “right to access” your own data under Articles 12(b) and 14(a) and is dependent on the data quality and data legitimacy criteria. Those essential criteria are closely connected to Article 7 (privacy) and Article 8 (data protection) EUCFR. The very nature of this right is debatable, but it functions as a remedy that enables the individual to exercise control over the processing of data concerning him/her. In practice however, the “right to be forgotten” has a broader impact which is the major research point of the next chapter.
33
Part III. Implications of the “right to be forgotten” and the GDPR
1. Introduction
In this chapter we will focus on the legal implications of the “right to be forgotten” (as interpreted in Costeja by the CJEU and subsequently expanded by the A29WP Guidelines) for the right to privacy and freedom of expression in the Council of Europe legal system. More specifically, we will examine whether the legal frameworks of online privacy-expression issues have common applicability or whether they are merely linked. After that, we will explore how necessary consistency in the application of the ECHR and the EUCFR can be achieved for the better balancing of privacy and expression. Thirdly, we will examine the practical implications of the Costeja judgment.
2. Do the balancing criteria of the ECtHR matter?
In the previous chapter we concluded that the “right to be forgotten” functions as a measure that will limit the access of the public to data linked to an individual through his name. The criteria that CJEU uses in Costeja for the balancing of internet users right to have access to the information (nature of the data, sensitivity, public interest, role of the individual) resemble some of the criteria that the ECtHR uses in Von Hannover an Delfi. On a surface level, there are some partly overlapping points between the case-law of the CJEU and ECtHR. For example both courts agree, albeit in a different factual context, that the economic interest of the operator cannot prevail over the fundamental rights involved and that the Internet poses higher threats to the right to privacy. The point where the views of both Courts almost coincide is that well–known figures will have lesser degree of protection of their private life.113 However, as we stated the facts of the cases are quite different and regardless that
113
