How Google Handles 'Right To Be Forgotten' Requests

An anonymous reader writes: In response to an inquiry from European data protection regulators, Google has detailed how they evaluate and act on requests to de-index search results. Google's procedures for responding to "right-to-be-forgotten" requests are explained in a lengthy document that was made publicly available. "Google of course claims its own economic interest does not come into play when making these rtbf judgements — beyond an 'abstract consideration' of a search engine needing to help people find the most relevant information for their query. ... Google also goes into lengthy detail to justify its decision to inform publishers when it has removed links to content on their sites — a decision which has resulted in media outlets writing new articles about delisted content, thereby resulting in the rtbf ruling causing the opposite effect to that intended (i.e. fresh publicity, not fair obscurity)."

Comments

Who didn't see this coming?

[Anonymous Coward]

Anybody who expected "right to be forgotten" requests to be handled quietly is delusional. Of course the information will get additional publicity!

Re:Who didn't see this coming?

[Anonymous Brave Guy]

Of course the information will get additional publicity!

<kneejerk>Sure it will, right up until the police turn up at Google's European workplaces and start arresting their corporate officers for contempt of court.</kneejerk>

That possibility may or may not be hyperbole, of course.

However, one certainty is that US corporations are playing with fire if they attempt to circumvent the spirit of European court rulings based on technicalities. I do wonder whether, sooner or later, some European judge is going to make an example of someone, even if it's not in this particular case. And in practice there may be little that person can do to defend themselves if a judge does decide to throw them in jail for a few days for contempt just to make their point abundantly clear.

Also, given the US government's much-discussed powers to compel organisations to do things and keep quiet about it, clearly these organisations are aware of the possibility. And given that the entire point of the original court ruling in this case was the remove what the court considered inappropriate attention, it's not as if any search engine is going to get much sympathy claiming they didn't understand what they were being told to do or why.

Re:Who didn't see this coming?

[Prof.Phreak]

So the end result will be publishers pinging google every day to see if any of the stories they published are still google-able...

This is a stupid regulation. If someone doesn't want to have their story "out there" , they should just approach the publisher directly. Google isn't the one publishing or storing (for public consumption) this data... so they're a wrong target for this regulation.

Re:Who didn't see this coming?

[wisnoskij]

I do not see how this can be considered circumvention or contempt. Google has a long history of being transparent in this way. They make public what content they delist because of copyright violations and it is only right that they inform a website when they do similar for "right to be forgotten". You might argue that it is really the website's duty to begin with to comply with rights to be forgotten, and they are the only ones responsible for any possible contempt, but since no one contacted them to begin with asking to be forgotten I think that they are legally in the clear.

Re:Who didn't see this coming?

[swillden]

I do not see how this can be considered circumvention or contempt. Google has a long history of being transparent in this way. They make public what content they delist because of copyright violations and it is only right that they inform a website when they do similar for "right to be forgotten".

Further, if you read Google's document they indicate that in the case of data protection removals they inform the webmaster of the URL that has been de-listed, with no information about the details of the request or the requester. This seems like a sensible and serious attempt to balance the right of the webmaster to know that his content is no longer being indexed (for some searches) with the right of privacy of the person requesting removal.

It also seems to be the cause of the hoopla a few weeks back which put Google in the crosshairs of many who claimed the company was trying to sensationalize the removals. Google had removed the link when the searched topic was the name of a commenter on the article (who asked for it to be removed), but not when the searched topic was person the article was about, or other relevant terms. The webmaster saw that the URL had be de-listed for some searches and the paper wrote an article about how the URL had been removed entirely, even though it was obviously in the public interest, asserting that Google was intentionally removing things that weren't justified under the law in order to provoke a backlash against it. The assumption that it had been removed entirely was incorrect, of course, but Google couldn't provide information about the rationale or scope of the removal without violating the privacy of the requester.

I, personally, think the "right to be forgotten" is ridiculous, but it appears to me that Google is trying very hard to comply with it, letter and spirit.

(Disclosure: I'm a Google employee, but I have nothing to do with any of this and know nothing about it beyond what I read in the press. Also, I'm not a company spokesperson of any sort; they pay me to sit at a desk and pound out code.)

Re:Who didn't see this coming?

[wisnoskij]

Google collects metadata about people, but since that is secret stuff they keep to themselves no one asks them to forget it. Google also collects metadata about websites, which is publically searchable. But when Joe Smith wants some comment removed, Google did not have that data collected to begin with.

Re:Who didn't see this coming?

[Uecker]

I bet the most "right to be forgotten" requests will never get additional publicity. There is a reason it is called the Barbara Streisand effect and not the Jon Doe effect.

I also do not fully understand the hatred against these rights. We aleady have intellectual property laws which limit the information flow on the internet in extreme ways. Why should indviduals not have some rights on information about themselves?

Re:Who didn't see this coming?

[Wycliffe]

The way we find information has changed.
Why shouldn't laws change to reflect how we want to interact with the new reality?

Because that's just it, it's the way we find information, it's not the information itself.
This is the equivalent of making google maps and/or rand mcnally not list strip clubs on their maps.
The strip club is still there. It's still operating, it's just slightly harder to find.
If you don't like strip clubs then go after the strip club not the map maker.

Re:Who didn't see this coming?

[yacc143]

Well, it's simple.

The American way of life (or understanding Privacy) is that information about Mr. X, that is collected by some company is the property of said company.

The European concept in Privacy is that any data about Mr. X is basically always the property of Mr. X, and any company wanting to store/process/... that data needs a legal authorization to do so. (That can be explicit by law, there are some general cases where other laws imply the right to process data, e.g. accounting/taxing rules, or by personal consent.) Even if a a company processes data about Mr. X legally, Mr. X has a number of rights (e.g. withdrawal of permission => deletion, correction of data, and naturally as a first, a right to query any data linked with him by the company). The stuff is complicated by the fact that privacy protection is currently regulated by the member countries, based on a common guideline.

If you think about this for a moment, you'll realize that these two concepts are very incompatible. The Politicians decided to paper over this with the "US-EU Safe Harbour Agreement", and currently some of the high level courts in the EU are finding that the Agreement is not exactly working as advertised.

Considering the right to be "forgotten", if you think about this, it's obviously covered by existing law:

* Google is not some kind of Publisher (that would be an argument that they have a legal authorization from laws covering Journalism), so it's a data processor of data that can be linked to an individual.

* Hence the right to delete stuff (withdraw the permission to process data about Mr. X.) obviously applies.

Re:Who didn't see this coming?

[Uecker]

We aleady have intellectual property laws which limit the information flow on the internet in extreme ways. Why should indviduals not have some rights on information about themselves?

Because Google is an American company. In America speech about something, particularly critical speech, is strongly protected. One of the protections for speech is ownership and rights to your own speech. Person X has no right to control what person Y says about them. That's the very meaning of free speech.

But how is this even related to free speech? It is not really about speech (opinions and ideas) but entries in a data base. It is not even a person speaking, it is a search engine. Also, the right to free speech is not absolute, but already limited even in the US in various ways, see hate speech, *bleep*, copyright...

Re:Who didn't see this coming?

[N1AK]

This is a stupid regulation. If someone doesn't want to have their story "out there" , they should just approach the publisher directly.

It is stupid regulation, but your alternative solution is also pretty stupid. Firstly, it makes no sense for publishers to put any effort into deciding if they need to remove content or not without a potential legal consequence, and secondly the majority of web content is outside UK jurisdiction. They are going after search engines because trying to get a website hosted in Buenos Aires to take down a misleading and outdated article related to the Falklands war isn't viable for example.

Now the reason the law is stupid, isn't because it targets search engines but because it expects private corporations to make judgements on what should or shouldn't be forgotten.

Re:Who didn't see this coming?

[Anonymous Brave Guy]

How is a European judge going to throw an American in jail?

Again, I emphasize that I was talking somewhat hyperbolically before.

But in case you wanted a genuine answer, it is actually rather easy. Firstly, they'd go after the corporate officers based on Europe. Secondly, if any corporate officer who was American ever entered Europe (even flying over European airspace or in temporary transit through a connection at a European airport) they would be subject to arrest.

If Europeans want products run in accordance with European law and culture they should create them, and stop using American products.

As the old saying goes, be careful what you wish for, because you might just get it. Particularly in regard to the Internet, control of infrastructure, exporting of laws, and surveillance, the US is not a popular country in Europe right now. Major US tech companies are already protesting about the damage to their reputations and ultimately profits that has been caused by various US government actions in recent years.

For example, there are already on-line services that guarantee to store data only within the EEA, so the data protection rules about exports don't apply, and this is already becoming a commercial advantage for them over their US competitors. There are already questions being asked openly in security-sensitive organisations about whether once unquestioned US brands like Cisco, Dell and Apple are appropriate suppliers for computing and communications equipment. Now that governments have started doing things like seizing domain names, it is probably only a matter of time before ICANN loses its overall authority as well.

As far as I can see, there is absolutely no possible upside to any of this for US businesses, and ultimately for the US economy and government. And it has effectively been brought about by the US doing exactly what we were talking about -- using dubious mechanisms to export its laws and culture abroad -- for some time now. The only difference is that this time, some of the rest of the world decided to do the same thing back, and the US doesn't like it when that sort of thing happens. It's used to everyone taking for granted that keeping the US friendly will be more important in the long run and letting minor transgressions slide is diplomatically justified, but in the current European political climate that assumption isn't what it used to be.

Try to make me forget.

[Nyder]

Sure, I'd love for everyone to forget the stupid crap I do, but that isn't the way life works.

Re:Try to make me forget.

[diamondmagic]

It's not so much "right to be forgotten" as it is "obligation for you to shut up," is it?

Re:Try to make me forget.

[Anonymous Brave Guy]

...that isn't the way life works.

Actually, that's exactly the way life works, right up until some multi-billion-dollar megacorp decides to step in with technology that never forgets and that makes information (potentially including partial, inaccurate or misleading information) available more easily and to a much wider audience than would otherwise be the case.

Re:Try to make me forget.

[martin-boundary]

Hmm... in small-town communities, you really "can't be forgotten" for stupid shit you do in your life.

That's not actually true either. Small towns historically have been limited to local knowledge about residents, which actually helps enormously the right "to be forgotten". All anyone who ever wanted to be forgotten had to do was move about two towns down the road.

Re:Try to make me forget.

[rolfwind]

Actually no, that's not how life works.

Go apply for a US government job with some clearance and see how far that forgetting works while they speak to your 1st grade teachers and anyone else that knew you since birth.

And you can also apply that to anybody that would want to put the time and money to put a detective on you.

Back in the 1960s (or today even) I could write a book with some embarrassing anecdote about someeone, would they be able to order that pulled off the shelves? No.

The only difference here is "internet." Ah yes, now we're in the era of not just negative rights, which are relatively easy to enforce, and positive rights, which usually cause a clusterfuck wherever they are tried.

Re:Try to make me forget.

[Brulath]

The Streisand Effect is quite overrated; I have serious doubts that even one percent of cases would actually invoke it, and suspect the fraction is even smaller than that. Same goes for 4chan and, actually, the news media in general; they find a couple of things and blow those up into huge scandals using creative storytelling, and let the rest slip past.

The Streisand Effect and 4chan are risks, but they're so unpredictable that it's probably not worth considering them as much of a factor in your decision to try and hide information.

Re:Try to make me forget.

[DMUTPeregrine]

That's the way life worked up until the invention of writing.

Re:Try to make me forget.

[AmiMoJo]

Go apply for a US government job with some clearance and see how far that forgetting works while they speak to your 1st grade teachers and anyone else that knew you since birth.

In the EU many things are specifically "forgotten" by law, e.g. spent criminal convictions don't have to be declared to potential employers. Employers could hire private detective agencies to dig that kind of information up, but generally they don't unless there is some very high level of security required. That was considered an acceptable balance - the information was not erased from history, but by not having to inform the employer most non-notable people could rehabilitate themselves successfully.

Unfortunately search engines change all that. It's got so bad that people accused of things like rape but then found innocent sometimes have to change their names. There isn't any benefit that I can see to society of having such information readily available, and it does huge damage to the subject of the data. Maybe the EU's solution isn't perfect, but it's better than the alternative.

Supress the Press!

[aNonnyMouseCowered]

Let's just censor the press and get it over with. /sarcasm

Saying things will be forgotten if it can't be Googled/Binged is like saying you won't get robbed so long as you don't post a sign that your door isn't locked. If a news outlet decides to "unforget" a person, then why not go after that media outlet, which is the source of the link that Google has indexed. I'm sure Google, even from a purely commercial point of view, won't keep serving dead links.

Gross misunderstanding of EU ruling

[jd]

The EU ruling does not require the information on a website to be deleted. Quite the opposite, it upheld the ruling against that by previous courts.

The EU ruling does not require Google to de-index the information. No, seriously, it doesn't.

What the EU ruling states, and this is made painfully clear by the court and also in the summary document, is that the link to the information not be coupled with the personal name. How Google chooses to implement that is Google's affair.

The Statute of Anne is ultimately at the heart of this, because this is where ownership of information is first taken out of the hands of corporations and guilds, and placed squarely in the hands of individuals. The Data Protection Act, which stemmed from (again) corporations claiming ownership of information belonging to others - but this time often getting it wrong with life-threatening consequences, was in many ways a repeat of that battle.

In the case of the DPA, the stakes were higher. Computer glitches and operator errors declaring living people to be dead spread from computer to computer like an incurable cancer. With no redress, even if it meant your bank account was closed, insurance got cancelled and house repossessed. Even if you got a company to fix the data, it would merely get reinfected. Politically aligned "vetting" companies were making a fortune selling bogus information to prospective employers, ensuring only ideologically approved candidates would get hired.

I don't think people remember those days.

European privacy rules are intended to transfer rights to individuals, as per Statute of Anne, and attempt to prevent malign, inaccurate data from harming said individual. So far, so good. I'm amazed at the number of libertarians who are opposed to individuals having rights. The more they oppose such a notion, the more I'm inclined to believe the philosophy suspect. If core elements can be ignored when convenient, they're not especially core.

The EU laws and ruling might not be perfect, in fact I don't believe for a moment they are. But I reject the idea that a corporation has more rights than a person.

Some time back, when I argued that freedom of the collective could not be neglected in pursuit of freedom of the individual, there was much opposition. Mostly along the lives that collectives have no physical reality. I fully expect these to be the people most opposed to the EU ruling, on the grounds that collectives (because that's what a corporation is) have freedoms.

In other words, I believe people prefer cognitive dissonance to having self-consistent beliefs or to admitting error. Much better to split the mind than debug an ideology. Microsoft would be proud.

I'd love to see a sane, rational discussion on the issue. Particularly with experts in IT security as part of it, as they're the experts in handling the conflict between access needs and access controls, and between risks vs benefits, especially on historical data which may include flawed data.

Re:Gross misunderstanding of EU ruling

[jbolden]

There isn't much to debate. The argument for most Americans (not just libertarians, I'm not a libertarian at all) is pretty clear. You own your opinions. You don't own other's opinions about you. If X has the right to control Y's speech then you simply don't have freedom. Americans simply do not want and will not tolerate a situation where their own government has the right to tell X what he can and cannot say about Y. They certainly do not want such a situation being imposed by governments in which they have no voice.

I can get Europeans want different rules. So stop using Google and use European search engines.

Re:Gross misunderstanding of EU ruling

[jbolden]

Assume that every opinion about you ever held by anyone who ever knew you was known and fully indexed.
Assume that this was true about everyone in the world.
Everyone has all sorts of people that hate them and have strongly negative opinions about them.
Everyone has people that like them and have strongly positive opinions about them.

Given this infinite database a reader can make a fairly good assessment of your actual character. Of the 18,700 that have an opinion about you if 400 think you are a liar and 12,700 think you are truthful (with the other 5600 having no opinion) you probably are mostly pretty honest but lie once in a while. If 12,700 think you are liar and 400 think you are truthful you likely are a liar. If you start becoming truthful then the data will overtime show a trend.

The solution to bad speech is more speech.

Re:Gross misunderstanding of EU ruling

[jd]

Findings by researchers:

Bad news/opinions spread faster than good.
Bad news/opinions stay in the mind longer.
Critical thinking is absent from the overwhelming majority.
People don't think chronologically.
Everyone is guilty of cognitive dissonance.
People are less likely to hold good opinions of people they don't know.
People will cling onto false beliefs even when shown their falseness.

Conclusion: The average will always be against you. By a spectacularly large margin.

No they are in contempt

[aepervius]

The initial judgment was clear. The person which had debt but repaid them (the initial reason there was that judgement) did not have a right to change the news article because it was a fact, but they had a right to have the search engine not report them as a result. In fact this was how it worked before there was a search engine : if you wanted something forgotten you either moved out, or waited for some time. At that point if nobody checked the primary source directly (old journal article) then you were forgotten, as there was not a service/persons standing beside you permanently always telling everybody what you did wrong in the past. With google it is the case of having that person standing beside you telling everything you did so far as google can link it.

It was clear from the judgement and the right to be forgotten that further reporting it wide of the removal would go against the very basis of it. After all there is no difference between "mister ABC has fone stuff XYZ" and "mister ABC has asked google to remove link to article where he did stuff XYZ". Even if it was an error the first time it was clear after the first reported removal went that way , that google by continuing to do that went against the spirit and the basis of the right to eb forgotten. In fact i would argue that google did it intentionally, knowingly and contemptuously, respecting the letter of the law but hoping with a two pronged way this would undermine the right to be forgotten : 1) they intentionally continued reporting the link removal when they are not forced by law to do so, and it was obviously counter productive to the spirit of the law to tell that to news agency and 2) they intentionally agreed to remove link which were not covered by the right to be forgotten, for example from politician and prominent person doing illegal stuff.


Both actions shows this was not an accident and they did it to undermine the request. "doing no evil" is long gone. google now are clearly asshole.

Re:No they are in contempt

[wisnoskij]

Of course it is not an accident, this is just Google following their long standing policy of transparency when delisting websites.