If Google remembers whom it has forgotten, has it complied with the ECJ Judgment? – Chris Pounder

Google has received all kinds of plaudits for quickly introducing its “right to be forgotten” procedure; however from what I have read in the press, its procedure for the removal of URLs is not fit for purpose. In this blog, I explain why Google’s procedure appears to be so defective.

So, for the sake of argument, let’s assume that you want to have a URL removed for whatever reason. As I explained in my previous blog, this will engage a balance between freedom of expression and privacy; it is not an automatic removal of links as is still commonly asserted.

Google’s “right to be forgotten” form is fairly straight-forward. It asks for your photo identity (to make sure the data subject is completing the form), contact email address (e.g. to tell you of the outcome of your request), the country where you live (to identify which country’s Data Protection Act applies), the URL(s) that you object to and an explanation why you find each “URL in search results is irrelevant, outdated, or otherwise inappropriate”.

As an aside, an inference from the above is the possibility that Google might not be offering its URL removal procedure to USA citizens who apply for URL links to be removed by European Google companies. As readers know the definition of “data subject” depends on whether the applicant is alive and not nationality (i.e. European data protection law is not limited to European data subjects). Google should be asked, for example, the extent to which the procedure is open to USA citizens.

Google says on the form that before making a decision, it will balance your interests in having an URL removed (i.e. your privacy) versus the right of the public to know the information (i.e. keep a URL).

As a data controller, Google will come to a decision about the URL you want removed. If that decision goes against you, you will have to ask the Information Commissioner for an assessment under Section 42 of the Data Protection Act. However, if Google UK accepts your request, your URL will be removed from all Google companies in any EEA state. However, this means that the URL will be accessible from Google.com which is based in the USA.

I have been unable to find any indication of whether or not Google intends to retain a record of any removed URL against the data subject’s name (e.g. stored in the USA at Google.com); someone should seek clarification from Google as to the position here.

However, Google’s form goes further; it says that “we may inform webmaster(s) whose content is removed from our search results as a result of your complaint”. In other words, Google’s implementation of your right to be forgotten includes the functionality of Google remembering that that you exercised the right to be forgotten.

Indeed a Google spokesperson told “Search Engine Land” that:

“To be very clear about this: if someone asks for a URL to be removed from the listings for their name, and that’s approved, the URL will go away — but anyone who looks at the bottom of the result will know that they must have asked for something to be removed.”

“It’s also likely that Google will provide a link to ChillingEffects.org, as it does with many other types of censorship requests, where people can learn more about what is removed. Names wouldn’t be revealed, though those can be deducted from the search. The URLs taken-down probably wouldn’t be revealed. But it’s possible there would be some general explanation about what was removed or maybe why something was removed.”

To get an idea of what this means, please open another tab and Google “Frozen movie”. In the UK, you will see Google provides a comment on several pages (from page 2) that “In response to a complaint we received under the US Digital Millennium Copyright Act (DMCA), we have removed 1 result(s) from this page. If you wish, you may read the DMCA complaint that caused the removal(s) at ChillingEffects.org”.

In other words, if someone searched for an individual in the UK, Google’s search results under its procedure to comply with the ECJ ruling could include a statement that is something like: “In response to a complaint, we have removed some links”. This is a message to the searcher to go to Google.com site in the USA, and repeat the search on the data subject to obtain the links that have removed from Google’s European companies.

Clearly, therefore, a data subject who wants to be forgotten is not even half-forgotten. Indeed, if there exists a flag that says the data subject wanted to be forgotten then this might be more damaging (e.g. to the data subject’s employment prospects) than a URL that the data subject wants removed. After all, some employers will argue there is no smoke without fire and won’t take an employment risk.

This may be the case even if the data subject who requested the URL removal shares his name with other individuals. In this way, individuals with the same name as the data subject who used Google’s procedure could be impacted.

So back to a question that should be asked of Google; namely: “is the above kind of avoidance procedure Google’s deliberate intent?”.

This post originally appeared on the Hawktalk blog and is reproduced with permission and thanks