European Court limits right to be forgotten to E.U.
curia.europa.eu
curia.europa.eu
However, it means the real effect of the RtBF law is that it impedes less technically proficient internet users to search other person's data, but absolutely doesn't achieve stated goals (as nothing is forgotten, and entities which do personal data checks will for sure be able to use non-EU IPs to get unrestricted results). What it essentially does is limitation of low-skilled users search results. And that's all.
Which proves the whole thing was a combination of PR stunt, and incompetence on behalf of wide array of EU politicians, and NGO activists.
That sounds like it's still something though. If someone gets falsely accused of e.g. being a pedophile, and their prospective employer does not run into that information when researching them during the interview process, that seems like it achieves one of the goals people had in mind with this legislation.
USA privacy laws are bad enough you can get sicced by a private investigator most of the time with no questions asked, no repercussions.
They would, of course. Unless, someone's planning to build a whole Chinese-style censorship state, it's not possible to disallow to obtain information through VPN.
I've never encountered one in Germany and we certainly don't do them with potential applicants at my place of employment. (No idea whether this is because of a law or for different reasons)
Sure, but nothing to celebrate: it puts average Joe in even more disadvantaged position compared to organized entities (corporations, and gov't agencies) when searching, while still won't save anyone from professional info gathering. E.g. all headhunting companies certainly will use VPNs, or similar technologies when compiling data.
It seems like this is the now-missing part of the puzzle: other countries still have sovereignty over their data but explicitly using a vpn to access legally protected pii should be itself a violation.
I realize that for these types of heinous crimes not everybody will agree with that but on the other hand letting these people free but living as pariahs shunned by the rest of society doesn't seem like a good solution (especially if we want to prevent them from acting on their impulses again).
Anyone that society deems to still be a risk is still on the list, regardless of the right to be forgotten removing newspaper entries about them.
But that's effectively the opposite of that. It's the government that mandates that private corporations implement the "right to be forgotten", regardless of the reason. The corporation has no say on the matter.
On the other hand if you do not have something like that then you live it up to private entities to effectively implement vigilante justice by listing supposed pedophiles forever on their websites for instance.
If you really think that people who commit pedophilia and other heinous crimes are forever unfit to live in society you should get your government to enact laws that make sure they're never released without supervision for instance. I mean unless you're a proponent of vigilante justice, but then you are effectively delegating justice to private entities, corporations or otherwise.
In 2014, this is how the Court explains it (my emphasis):
"35 In this connection, it should be pointed out that the processing of personal data carried out in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page.
36 Moreover, it is undisputed that that activity of search engines plays a decisive role in the overall dissemination of those data in that it renders the latter accessible to any internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published.
37 Also, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet enabling them to establish a more or less detailed profile of the data subject."
[...]
"80 It must be pointed out at the outset that, as has been found in paragraphs 36 to 38 of the present judgment, processing of personal data, such as that at issue in the main proceedings, carried out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. Furthermore, the effect of the interference with those rights of the data subject is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous (see, to this effect, Joined Cases C‑509/09 and C‑161/10 eDate Advertising and Others EU:C:2011:685, paragraph 45)."
http://curia.europa.eu/juris/document/document.jsf?text=&doc...
They could get out of it by not being a source.
Say you search "John Doe crimes". Consider these Google results:
1) <some url>
2) <some url> John Doe was accused of kicking a baby in Brussels...
In case 1) Google is just pointing you to a url and isn't a source. In case 2), Google is hosting some of the content itself and has become a source. So any law that says "if you have the story about John Doe kicking the baby, remove it", then it should apply to the summary Google gives in 2.
Well most of the users are "low skilled" so I think it works good enough. After all a skilled user could do a comprehensive background check which may reveal more than Google.
2. Low skilled level will be different in 5 years from today. I'm old enough to remember when people asked me to push 'on' button on a computer, just in case.
The goal of "right to be forgotten" in this context is precisely to make the information less ubiquitous, not to delete it altogether. E.g. it does not apply to newspapers etc.
> [...] that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.
This ruling is not the end of the case -- this is the EU law's top court ruling -- the case now goes back to the French court, to decide.
I sure hope this gets turned down. I'm not ready for international law where courts ruling over 65 million people (French population) can enforce their laws worldwide. If a single nation has that power, what's stopping China from making Tienanmen Square unsearchable worldwide?
China is not waiting for this ruling to try to do just that. It's up to operators like Google to decide whether they want to do business in China or whether they prioritise human rights.
Hypothetically, if EU law says their ruling applies worldwide and Google stops doing business in the EU, does that mean they would be exempted? Can they then show all results or does the EU still try to charge them with breaking their law?
Obviously that's a lot of ifs. I'm just trying to wrap my head around how this ruling would even work if they decide that it does apply to everyone.
Sounds like previous rulings on agricultural products which later became void as the countries matched the law.
The point really is: how to protect or remedy against the privacy infringement felt by someone in France's jurisdiction? And what the EU Court is saying at point 72 is: EU law does not prohibit the French judge from finding that it is necessary to have a stringent measure, i.e. to order a search engine to really prevent infringement even if coming from outside the EU.
We live in a global, connected world. This goes both ways if you want effective protection of rights of individuals. The only concern here really is to protect an individual's right to have a bit of control over the information about themselves that are so easily made available by serach engines.
> Hypothetically, if EU law says their ruling applies worldwide and Google stops doing business in the EU, does that mean they would be exempted? Can they then show all results or does the EU still try to charge them with breaking their law?
The rules are different between the previous law and the GDPR. The GDPR will apply to a company which has no business in the EU, if the data processing activity relates to:
"(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or "(b) the monitoring of their behaviour as far as their behaviour takes place within the Union."
Nothing, and they're already doing that sort of thing in a variety of cases.
https://www.nytimes.com/2019/09/22/business/china-social-cre...
"United, Delta and American received letters last year from Chinese aviation officials saying their social credit score could be hit unless their websites labeled Macau, Hong Kong and Taiwan as part of China. Lower scores would lead to investigations, the possibility of frozen bank accounts, limitations on local employees’ movement and other punishments, according to a letter sent to United and seen by The New York Times."
righttoberemembered.eu hasn't be registered yet.
1. It is not the end of the case -- this ruling is from the European Union law's top court (the CJEU) to give the ultimate interpretation of European Union law on the topic.
2. The case now goes back to France, where the French judge will decide, taking into account both EU law and French law, whether the Data Protection Authority's (CNIL) ruling against Google was correct or not. The most crucial point that most media reports miss is that the CJEU ruling states clearly that French courts are not prohibited from ordering a global de-listing of all versions of Google, if the protection of privacy requires so (Point 72 of the ruling).
3. The CJEU ruling restates many points from its 2014 ruling against Google Inc (US) and Google Spain - i.e. this is about an individual's right to remove certain results from the list of results based on the individual's name. It is not a right to remove content per se, nor is it a right to remove results entirely (i.e. the de-listed results should be searchable through any other search query)
4. As in 2014, the Court rules that as a general rule/principle, the individual's right to opt-out prevails over the public's freedom to access search results -- but this is not absolute, and the other way around may be true depending on the circumstances (e.g. if the result is particularly relevant for the public's interest). [This "general rule" is the part of the ruling which I find most open to criticism, as in my opinion this is not what the law provides]
5. This ruling is based on law before the GDPR. While the GDPR will continue to apply this mutatis mutandis as we say, this ruling has nothing to do directly with GDPR.
The goal is that it becomes harder to resurface irrelevant information from someone's past.
Now these differences may well be only for the searches related to someone who invoked his/her right to be forgotten, but the moment the results of a same search from different places can be different, it opens all possible avenues to remove (or add) other kind of information selectively.
Assuming laws and regulations will only be used for good by well intentioned people is a serious mistake.
A healthy amount of cynicism is an important life skill!
Just surprised this court hasn’t had its Marbury v Madison moment when it rules for itself to take over the government
We've seen it used against newspapers. I worry about that.
It also doesn't help that the country they'd be targeting provides for their military defense.
This law should really be called, "The right to stop other people saying true things about me to people who request that information."
We are now worst that when we started: Still no right to privacy and now, loosing our companies.
thanks for trying
The implications of what's been said here will on some level impact how EU law will apply to countries outside of the EU. Considering the right to be forgotten is closely married to the right to erasure, GDPR is in the crosshairs. Remember, GDPR was supposed to apply globally. It's clear from today's ruling, there's some doubt in the courts whether or not that is even responsible, let alone possible.
How? The right to be forgotten is just basically asking google/yahoo/bing/qwant not to put articles that can hurt one's reputation if asked. Imagine the only thing you're known for is a pedophilia case were you were first condamned, then release because it appears the children (and some of the really guilty) have lied: https://en.wikipedia.org/wiki/Outreau_trial You might want your name removed from google. Maybe.
The right to erasure is just your furnishing your own personnal data to a service provider and then asking them to remove all the data they have on you they can delete.
In the last case, you have a direct, business relation to the service provider. In the first one you don't.
"The correspondingly-named rule primarily regulates erasure obligations" https://gdpr-info.eu/issues/right-to-be-forgotten/
GDPR even labels the right to erasure as "the right to be forgotten" http://www.privacy-regulation.eu/en/article-17-right-to-eras...
Yep, the right to be forgotten (or to oblivion) predates GDPR.
> The implications of what's been said here will on some level impact how EU law will apply to countries outside of the EU.
Not really, each country still decide by itself.
> Remember, GDPR was supposed to apply globally
It is not about GDPR.
The ruling on one side talks about "versions".
Facebook has only one version of its social network, while Google has been known of running different versions of their search engine.
For example: Google China is a subsidiary of Google
The other side of the ruling is that EU court just said that Europe could not impose the right to be forgotten on countries that did not recognize the law, which is fairly obvious.
USA cannot enforce patents on countries that do not recognize them.
They also feared - disproportionally given the status of things - that allowing it globally would mean that if North Korea do the same (which they already do BTW) that could lead to state censorship, as if it wasn't already a reality.
GDPR is more about the ownership of personal data, the right to data portability, for example, still makes perfect sense and it's not put in danger by this ruling.
Where there are differences between political bodies, the options are:
* Negotiate to resolve them via treaties, etc.
* Coerce via other means - usually loops back to the first bullet once sufficient force has been applied[1]: http://curia.europa.eu/juris/document/document.jsf?text=&doc...
And the 2014 ruling, as this ruling, are clear that there is no absolute right to "erase" the result on a name.
It is not a wildcard to erase every bit of relevant data about anyone, and Google regularly denies requests to de-list result on this basis.
As the 2014 ruling provides:
"Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life. (§81 of 2014, Case C-131/12)"
And for example the court provides that "for particular reasons" the right does not apply. Such reasons include "the role played by the data subject in public life" that would be "justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question. (§97)"
As always, the actual ruling is much more nuanced and balanced than many media reports or corporations would have you believe.