Like the snow, data protection issues arrived last week in a flurry. How much can we edit our public past? Who is to judge what a society’s collective digitised memory is to retain or recall? A court in London is considering whether UK data protection law enables claimants known as NT1 and NT2 to compel Google to block online searchers from public information about their convictions for conspiracy to account falsely and to intercept communications. Meanwhile, Max Mosley called in aid data protection law to try to stop some newspapers referring to certain events from his past. And the UK parliament is due this week to debate legislation prompted by a new EU General Data Protection Regulation. It updates a directive from 1995 - pre Google, pre Facebook, pre smartphones and apps. Proponents say the GDPR will better balance individual privacy with collection and use of personal information by corporations and governments in the digital era, when, in a sense, we are our data.
In 2014 the European court of justice ruled in favour of a Spaniard who was discomfited by an archived newspaper item that contained public details about his former indebtedness. The court required Google to prevent the newspaper item being found through its search engine. Google calls this “delisting”. The item was not deleted from the newspaper’s electronic archive, but those who searched the man’s name would not have the item retrieved and shown among the links in the search results.
Delisting could occur, said the court, where “information appears, having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer relevant, or excessive”. “Inaccurate” seemed to be included, too. In NT1-NT2 preliminaries, a judge referred to “inaccurate, stale, irrelevant” information. A French court last year referred to the ECJ the issue of whether the right requires delisting by Google only in the country concerned (current practice), across Europe or worldwide.
Last week Google revealed that since it began in 2014 almost 400,000 requesters have sought the delisting of about 2.4m items (URLs). Google’s criteria for delisting were met in 43% of cases.The requests related mainly to France (20.4%), Germany (17.3%) and the UK (12.9%). Main categories of sites that attracted delisting requests were directories, news, social media and government records. Of the top 10 news sites across Europe from which people sought delisting of items between January 2016 and December 2017, half were UK sites: dailymail.co.uk, 1,793 URLs requested for delisting, 27.4% delisting rate; ricerca.gelocal.it, 1,022, 28.6%; telegraph.co.uk, 949, 29.9%; leparisien.fr, 880, 31.9%; ricerca.repubblica.it, 864, 23%; 247.libero.it, 792, 40.5%; mirror.co.uk, 781, 32.8%; ouest-france.fr, 738, 18.1%; bbc.co.uk, 712, 22.4%; thesun.co.uk, 676, 32.8%.
Guardian staff tell me that since 2014 Google has delisted 159 Guardian items, though four were relisted. Google data says the top five social media sites attracting delisting requests in the January 2016 to December 2017 period were: facebook.com, 15,416 URLs requested for delisting, 52/1% delisting rate; twitter.com, 11,408, 50.1%; plus.google.com, 11,287, 33.2%; instagram.com, 10,388, 90.8%; youtube.com, 8,110, 40.6%.
Examples from Google’s report on search removals give a sense of the variety of requests, the potential for dishonest applications (a problem in the US too), the attraction of the process for public figures, and the significant role that data protection agencies can play in delisting decisions:
UK: “A man who was convicted of benefits fraud in 2012 asked us to delist nearly 300 articles related to the conviction based on a document he provided suggesting he was later found innocent of the crime. We delisted 293 URLs pursuant to the documentation the requester provided. The requester then asked us to delist several other pages related to his separate conviction for forging documents. After re-reviewing the original document he submitted as proof of his innocence in the benefits case, we discovered that it was a forgery. We reinstated all of the URLs we had previously delisted.”
UK: “A former bank clerk who was imprisoned for stealing money from elderly people’s bank accounts asked us to delist news articles from 2008 covering the conviction. His conviction became spent under UK law in 2013. We delisted four articles after the Data Protection Authority requested that we remove.”
Germany: “We received a request to delist four news articles about an academic’s research that contained the individual’s photo because the academic changed gender and identifies under a new name. We did not delist the articles as they continue to be relevant to the academic’s professional life and research.”
Hungary: “A high-ranking public official asked us to remove recent articles discussing a decades-old criminal conviction. We did not remove the articles from search results.”
Italy: “A woman requested that we remove a decades-old article about her husband’s murder, which included her name. We have removed the page from search results for her name.”
Poland: “A prominent business person asked us to remove articles about his lawsuit against a newspaper. We did not remove the articles from search results.”
Portugal: “We received an order from the Data Protection Authority to delist a news article about the criminal investigation of a well-known businessman for alleged fraud, falsification of documents and tax evasion. We delisted the page at issue.”
Spain: “We received a request from an individual to delist a news article from 1994 and a forum post from 2007 about the individual’s former activities as the head of a political arm of a state-identified terrorist organisation. We did not delist the article for public interest reasons.”
Competing rights, jurisdictions and technologies have to be faced by policy makers. But I fear that, on this “right to be forgotten”, data protection law over-promises. When it under-delivers, it might contribute, in its own small way, to the ebbing of faith in democratic institutions.
Better, I think, to be blunt about the limits of the individual’s control over his or her personal information, especially once it is public, and to focus more on accuracy and on transparency over its uses.
Yes, there are exceptional cases when the continuing public availability of accurate information about an identifiable person can cause serious injustice without a sufficient countervailing public interest. True, the notion of wiping the slate of some old or “spent” convictions is not new. Digital realities deserve attention. But care is needed.
Information is protean. Its meaning changes with context. Its uses vary with circumstance. Retrospect illuminates facets not previously seen. New prospects may make it relevant again. Inadequate or excessive in itself for one purpose, in combination with other information it may be just right.
The ECJ’s Google Spain “right to be forgotten”, as it is misleadingly described, is fiercely defended and intensively criticised. I believe that it was poorly thought through, and re-examining it will lead to better practical handling of large public datasets of personal information and the engines that sift and sort them. A re-examination is needed.
• Paul Chadwick is the Guardian’s readers’ editor
