The Right to be Forgotten in 2022

On 8 December 2022, the Court of Justice of the European Union (CJEU) in Luxembourg delivered its latest landmark judgment on the ‘right to be forgotten’ in case C-460/20 TU, RE vs Google LLC. In many aspects the Grand Chamber follows the opinion of Advocate General Pitruzella from 7 April 2022, and the verdict can be described as an incremental continuation of the established jurisprudence, which started on 13 May 2014 with case C-131/12, Google Spain.

From a legal perspective two aspects stand out: on the one hand, the court clarifies the interpretation of European Union (EU) data protection law — Article 17 of the EU General Data Protection Regulation (GDPR) in particular. On the other hand, photos and ’thumbnails’ are now included in the scope of the right to ‘de-reference’ search engine results, based on a separate assessment that has to be carried out by the operator. Despite the largely incremental character, the judgment received broad news coverage. This post analyses and comments the verdict, arguing that the continuing legal manifestation of the right to erasure/be forgotten/de-referencing raises more fundamental questions on the governance of the datafication of society in the EU.

Main facts and background to the case

The judgment from 8 December 2022 follows a request for a preliminary ruling from the Federal Court of Justice (‘Bundesgerichtshof’), which arrived in Luxembourg on 24 September 2020. It concerns the interpretation of Article 17(3)(a) GDPR, as well as Article 12(b) and point (a) of the first paragraph of Article 14 of the original EU Data Protection Directive 95/46EC. Additionally, several articles of the Charter of Fundamental Rights of the EU (CFEU) are of relevance; these are Articles 7 and 8 CFEU (Right to respect for private and family life, and data protection), Article 11 CFEU (Freedom of expression and information), as well as Article 16 CFEU (Freedom to conduct a business).

The core of the case relates to TU and RE, who were managers of a group of investment companies. TU and RE argue that three unflattering news articles should be ‘de-referenced’ from the search engine results of Google, when searching for their names. Additionally, they argue that photographs showing them on preview images — or thumbnails — when carrying out a search, ought to be removed.

In 2015, a website published material that criticized the investment model of one of the companies TU and RE were involved in, at the same time showing them in pictures that suggested a splurging and luxurious lifestyle. RE was TU’s cohabitating partner as the events took place, and held commercial power of representation of one company until May 2015 (paras. 15-16). The material was published by a news outlet which was controlled by a company that claims to contribute consistently towards fraud prevention. However, there was also criticism that the actual business model of the company behind the news outlet was to ‘blackmail’ others by first publishing negative reports, and then offering to delete news coverage and pictures — or prevent publication altogether — in exchange for money. The articles and associated pictures of TU and RE could be found through Google from June 2015, until they were de-referenced in September 2017. The articles and pictures were no longer accessible on the website of original publication as of 28 June 2018.

Google initially refused to comply with the request of TU and RE to de-reference the content, referring to the professional context, and arguing it was unaware of the alleged inaccuracy of the material (para. 21). TU and RE’s requests for de-referencing were initially also dismissed on 22 November 2017 by the Regional Court of Cologne in Germany (Landgericht Köln), and later by the Higher Regional Court (Oberlandesgericht Köln) on 8 November 2018. However, the applicants kept pursuing their cause in front of the Federal Court of Justice of Germany (Bundesgerichtshof), which ultimately led to the ruling in the preliminary procedure in Luxembourg.

Highlights of the judgment

The applicants TU and RE claim that the criticism in the news coverage was based on inaccurate information. Hence, the question emerges whether and which party must carry out an investigation of the factual circumstances, especially when it comes to the search engine operator (paras. 30 ff.). The referring Federal Court of Justice of Germany submitted two questions for interpretation by the CJEU (para. 39), which are simplified below:

1. How should courts handle requests for de-referencing in cases where applicants claim that the information presented by a news outlet are inaccurate, and in which the legality of the publication depends on whether the claims are factually true?
2. Is there an obligation of search engine providers such as Google to delete thumbnails from search engine results, even if the results contain a link to the original source?

Answer to question 1

With regards to the first question, the CJEU reiterates that the processing of information of search engine providers needs to be considered independently from the original publication of the content, which is in line with the interpretation of de-referencing following the original Google Spain judgment and subsequent jurisprudence (paras. 50 ff.). The CJEU then goes on to focus on Article 17(3)(a), and carries out a classical balancing exercise between the rights to data protection and freedom of expression. The judges reiterate that any limitation must be provided for by law, respect the essence of the rights, and be necessary, proportionate, and genuinely meet the objectives of general interest recognized by the EU (paras. 57 ff.).

From here the CJEU embarks on a discussion to consider the relevance of the published information for the general public, reiterating the controversial statement that — as a general rule — the data subject’s rights to have their privacy and data protected override the interest in accessing information (para. 62). Unless the data subject does not play a role in public life, the protection of privacy and data must be guaranteed.

The question is then how a data subject — in this case the applicants TU and RE — must manifest claims that the published information is inaccurate. Here the CJEU wants to avoid an ‘excessive burden’, such as bringing a claim for injunction against the publisher of the original information or news article (para. 68). This was mentioned by the Federal Court of Justice of Germany as a measure that would avoid restricting the operation of the search engine and the freedom of users to retrieve information. Nevertheless, the CJEU finds that the operator of a search engine cannot be required to actively verify the information provided by the applicant (para. 70). In conclusion, the CJEU strikes a compromise, stating that where the person who seeks de-referencing submits ‘relevant and sufficient evidence capable of substantiating his or her request and of establishing the manifest inaccuracy of the information found’ (para. 72), the search engine operator is required to de-reference the respective content.

In cases where the evidence provided for the inaccuracy of the information by the applicants is not obvious, search engine operators are not required to de-reference the results without a judicial decision. In such a scenario, the applicants making the request must be able to bring the matter before the supervisory (read: national data protection) authority, or a national judicial authority. Additionally, while such a procedure is ongoing, the CJEU requires that search engine operators warn internet users of the existence of administrative/judicial proceedings concerning the alleged inaccuracy of the content.

Answer to question 2

The question whether thumbnails in search engine results need to be de-referenced has been approached through the legal framework of Directive 95/46EC by the referring court. However, the CJEU clarifies that those provisions are substantively equivalent to the GDPR, which has replaced the 1995 Directive (paras. 78-80). The judges then go on to emphasize the relevance of pictures and thumbnails for the credibility of the reporting and information (paras. 88-100).

Unsurprisingly, the CJEU applies a similar approach as demonstrated for the first question: search engine operators must carry out an assessment when it comes to using thumbnails and pictures, considering the added value to the public discourse, and taking into account that the protection of personal data prevails by default. In the case at hand, the availability of thumbnails on the search engine would still enable access to the original article, since the link to the original source would still be easily retrievable. Therefore, when it comes to the removal of pictures and thumbnails from search engine results, an independent assessment by search engine operators must take place, balancing the value of the photographs for the public discourse, and taking into consideration any text which accompanies the images.

Stop balancing, start conceptualizing

There are two ways to interpret this judgment in the context of the legal manifestation of the right to erasure/be forgotten/de-referencing in the EU. The first way is to consider it as a logical and decent continuation of the existing jurisprudence that started with the Google Spain judgment in 2014. TU, RE vs Google LLC expands the scope of de-referencing slightly and enhances the duty of Google to check and present accurate information. This is certainly not surprising when considering the general societal sentiment about the roles of large platforms when it comes to information sharing. It has recently manifested in the EU with new legal frameworks such as the Digital Services Act (DSA), and the Digital Markets Act (DMA). The underlying dynamic unfolded from a mostly liberal/libertarian understanding of cyberspace (see e.g. ‘A Declaration of the Independence of Cyberspace’ from Barlow, 1996), towards a more nuanced understanding of multi-stakeholder Internet Governance (see e.g. Hill, 2016), to an increased emphasis of the role of governance (see e.g. ‘Facebook’s faces’ by Arun, 2022) and intervention (e.g. Helbing et al., 2017) to preserve democracy, human rights, and the rule of law.

The other way of looking at this judgment and the sequence of steps that led to it, is to critically reflect on the possibilities of the law and power of an institution such as the CJEU. The debate around establishing a right to be forgotten was initiated with the 2009 book ‘Delete’. Anticipating many challenges of a profound shift in information recording and data collection, the author, Mayer-Schönberger, discusses ‘the hazards of perfect memory in the digital age’, as a consequence of persistent tracking and ever expanding datafication. He explores regulatory, technical, economic, and other strategies to mitigate potential harms for personal development in light of constant measurement. More than a decade later the EU has responded with more capable data protection laws such as the GDPR. At the same time, it stirs up a flurry of additional legal frameworks such as the already mentioned DSA and DSM, as well as the Data Act, the Data Governance Act, and last but certainly not least, the Artificial Intelligence Act. There is a point where one — as one tries to desperately follow these parallel developments — wonders whether someone has an overarching societal vision on where all these frameworks should lead us to, once they are finally negotiated and in force/enforced.

Unfortunately, if the establishment of a right to erasure/be forgotten/de-referencing is an indicator for what we can expect, there is not too much optimism warranted on the clarity of this vision. This starts from the simple observation that after a decade of political negotiations and high-level court cases, it is still not entirely clear what we are talking about. Quite noticeably, in TU, RE vs Google LLC, the CJEU consistently uses the term de-referencing, whereas previously this specific manifestation of a right to erasure — or was it a right to be forgotten? — ‘delisting’ was the term of choice in English, in French ‘déréférencement’, and in German ‘Nicht-Indexierung’. Is the consistent use of de-referencing in the English translation of the judgment available at the time of writing coincidence, sign of a right lost in translation somewhere on the Kirchberg in Luxembourg, or rather a deliberate choice of the judges? At the same time, before this recent judgment, the European Data Protection Board adopted guidelines on the practical implementations of a right to be forgotten in December 2019, which will certainly be revised according to the new jurisprudence.

Many EU lawyers will remind us that the precise wording in EU law is less important than the correct teleological interpretation of the essence of the right (‘effet utile’). However, with new and emerging concepts such as a right to erasure/be forgotten/de-referencing it is next to impossible to deduct what constitutes the essence. In a forthcoming chapter together with my colleague Ausloos, we conclude that the right to be forgotten should be considered as a family of rights. This even more so, when expanding the horizon beyond Europe and considering the international expansion of the concept, as studied by Erdos and Garstka, among others.

Expanding this further beyond the legal domain(s), the lack of vision and precision in framing and implementing legal frameworks such as the GDPR raises even more challenges. Sticking to the definition of a right to erasure/be forgotten/de-referencing, it has been claimed that Google had a disproportionate influence on defining the right in practice. The 2022 decision does little to change this and further adds the requirement to factually check information. Google is a private company that has its own economic interests in focus, with staff that seems to prefer quantitative methods to tackle legal and societal challenges. However, fundamental rights do not run on budgets, and they do not come with business targets. They also cannot be managed like a cable car, where the cable and gondolas are fine as long as tolerance and clearance margins are observed, and maintenance rules are complied with.

In essence, the current state of the implementation of the right to erasure/be forgotten/de-referencing is a testament to the lacking capabilities of multidisciplinary approaches to manifesting progressive and ground-breaking concepts relating to datafication. Judges will keep balancing, Data Scientists will keep producing statistics, and economists will keep calculating the cost of compliance versus the cost of ‘doing business as usual’. One way to possibly make sustainable progress could be by opening up venues towards more interdisciplinary collaboration (we made a modest contribution here), and working on developing and fostering practices that demand cross-cutting discussion of the issues at stake; such as data protection impact assessments, as well as the development of similar methodologies such as the proposed conformity assessments when it comes to the development and use of AI.

Conclusion

With this judgment, the court in Luxembourg further manifests the right to erasure/be forgotten/de-referencing in the EU legal order, by clarifying the scope of de-referencing in the context of search engines when it comes to publication of inaccurate information. The CJEU also expands the scope to pictures shown when searching for a person using the name, so-called thumbnails. Here a separate assessment needs to be carried out by the search engine operator, which follows the guidelines established to balance fundamental rights such as privacy and data protection, freedom of expression, freedom to conduct a business, as well as the interest of the public to access information and a diversity of opinions.

While the judgment might be seen as a logical and consistent step in enhancing the jurisprudence of the CJEU on the matter, the history of the right to be forgotten in the EU and beyond also highlights the lack of a shared societal vision on how datafication should manifest in European and Western democracies. It remains to be seen whether society and legislators can establish structural mechanisms to tackle this challenge, for instance by fostering cross-sectoral and interdisciplinary exchange through data protection impact assessments and conformity assessments. Until then, the judges in Luxembourg and elsewhere continue to surf the void.

PS: Some readers might enjoy reading this text more with the fitting soundtrack, which helped tremendously while writing.