How Google Handles 'Right To Be Forgotten' Requests

An anonymous reader writes: In response to an inquiry from European data protection regulators, Google has detailed how they evaluate and act on requests to de-index search results. Google's procedures for responding to "right-to-be-forgotten" requests are explained in a lengthy document that was made publicly available. "Google of course claims its own economic interest does not come into play when making these rtbf judgements — beyond an 'abstract consideration' of a search engine needing to help people find the most relevant information for their query. ... Google also goes into lengthy detail to justify its decision to inform publishers when it has removed links to content on their sites — a decision which has resulted in media outlets writing new articles about delisted content, thereby resulting in the rtbf ruling causing the opposite effect to that intended (i.e. fresh publicity, not fair obscurity)."

Comments

Who didn't see this coming?

[Anonymous Coward]

Anybody who expected "right to be forgotten" requests to be handled quietly is delusional. Of course the information will get additional publicity!

Re:Who didn't see this coming?

[Prof.Phreak]

So the end result will be publishers pinging google every day to see if any of the stories they published are still google-able...

This is a stupid regulation. If someone doesn't want to have their story "out there" , they should just approach the publisher directly. Google isn't the one publishing or storing (for public consumption) this data... so they're a wrong target for this regulation.

Re:Who didn't see this coming?

[wisnoskij]

I do not see how this can be considered circumvention or contempt. Google has a long history of being transparent in this way. They make public what content they delist because of copyright violations and it is only right that they inform a website when they do similar for "right to be forgotten". You might argue that it is really the website's duty to begin with to comply with rights to be forgotten, and they are the only ones responsible for any possible contempt, but since no one contacted them to begin with asking to be forgotten I think that they are legally in the clear.

Re:Who didn't see this coming?

[swillden]

I do not see how this can be considered circumvention or contempt. Google has a long history of being transparent in this way. They make public what content they delist because of copyright violations and it is only right that they inform a website when they do similar for "right to be forgotten".

Further, if you read Google's document they indicate that in the case of data protection removals they inform the webmaster of the URL that has been de-listed, with no information about the details of the request or the requester. This seems like a sensible and serious attempt to balance the right of the webmaster to know that his content is no longer being indexed (for some searches) with the right of privacy of the person requesting removal.

It also seems to be the cause of the hoopla a few weeks back which put Google in the crosshairs of many who claimed the company was trying to sensationalize the removals. Google had removed the link when the searched topic was the name of a commenter on the article (who asked for it to be removed), but not when the searched topic was person the article was about, or other relevant terms. The webmaster saw that the URL had be de-listed for some searches and the paper wrote an article about how the URL had been removed entirely, even though it was obviously in the public interest, asserting that Google was intentionally removing things that weren't justified under the law in order to provoke a backlash against it. The assumption that it had been removed entirely was incorrect, of course, but Google couldn't provide information about the rationale or scope of the removal without violating the privacy of the requester.

I, personally, think the "right to be forgotten" is ridiculous, but it appears to me that Google is trying very hard to comply with it, letter and spirit.

(Disclosure: I'm a Google employee, but I have nothing to do with any of this and know nothing about it beyond what I read in the press. Also, I'm not a company spokesperson of any sort; they pay me to sit at a desk and pound out code.)

Re:Who didn't see this coming?

[Wycliffe]

The way we find information has changed.
Why shouldn't laws change to reflect how we want to interact with the new reality?

Because that's just it, it's the way we find information, it's not the information itself.
This is the equivalent of making google maps and/or rand mcnally not list strip clubs on their maps.
The strip club is still there. It's still operating, it's just slightly harder to find.
If you don't like strip clubs then go after the strip club not the map maker.

Re:Who didn't see this coming?

[Anonymous Brave Guy]

How is a European judge going to throw an American in jail?

Again, I emphasize that I was talking somewhat hyperbolically before.

But in case you wanted a genuine answer, it is actually rather easy. Firstly, they'd go after the corporate officers based on Europe. Secondly, if any corporate officer who was American ever entered Europe (even flying over European airspace or in temporary transit through a connection at a European airport) they would be subject to arrest.

If Europeans want products run in accordance with European law and culture they should create them, and stop using American products.

As the old saying goes, be careful what you wish for, because you might just get it. Particularly in regard to the Internet, control of infrastructure, exporting of laws, and surveillance, the US is not a popular country in Europe right now. Major US tech companies are already protesting about the damage to their reputations and ultimately profits that has been caused by various US government actions in recent years.

For example, there are already on-line services that guarantee to store data only within the EEA, so the data protection rules about exports don't apply, and this is already becoming a commercial advantage for them over their US competitors. There are already questions being asked openly in security-sensitive organisations about whether once unquestioned US brands like Cisco, Dell and Apple are appropriate suppliers for computing and communications equipment. Now that governments have started doing things like seizing domain names, it is probably only a matter of time before ICANN loses its overall authority as well.

As far as I can see, there is absolutely no possible upside to any of this for US businesses, and ultimately for the US economy and government. And it has effectively been brought about by the US doing exactly what we were talking about -- using dubious mechanisms to export its laws and culture abroad -- for some time now. The only difference is that this time, some of the rest of the world decided to do the same thing back, and the US doesn't like it when that sort of thing happens. It's used to everyone taking for granted that keeping the US friendly will be more important in the long run and letting minor transgressions slide is diplomatically justified, but in the current European political climate that assumption isn't what it used to be.

Try to make me forget.

[Nyder]

Sure, I'd love for everyone to forget the stupid crap I do, but that isn't the way life works.

Re:Try to make me forget.

[diamondmagic]

It's not so much "right to be forgotten" as it is "obligation for you to shut up," is it?

Re:Try to make me forget.

[Anonymous Brave Guy]

...that isn't the way life works.

Actually, that's exactly the way life works, right up until some multi-billion-dollar megacorp decides to step in with technology that never forgets and that makes information (potentially including partial, inaccurate or misleading information) available more easily and to a much wider audience than would otherwise be the case.

Re:Try to make me forget.

[rolfwind]

Actually no, that's not how life works.

Go apply for a US government job with some clearance and see how far that forgetting works while they speak to your 1st grade teachers and anyone else that knew you since birth.

And you can also apply that to anybody that would want to put the time and money to put a detective on you.

Back in the 1960s (or today even) I could write a book with some embarrassing anecdote about someeone, would they be able to order that pulled off the shelves? No.

The only difference here is "internet." Ah yes, now we're in the era of not just negative rights, which are relatively easy to enforce, and positive rights, which usually cause a clusterfuck wherever they are tried.

Re:Try to make me forget.

[Brulath]

The Streisand Effect is quite overrated; I have serious doubts that even one percent of cases would actually invoke it, and suspect the fraction is even smaller than that. Same goes for 4chan and, actually, the news media in general; they find a couple of things and blow those up into huge scandals using creative storytelling, and let the rest slip past.

The Streisand Effect and 4chan are risks, but they're so unpredictable that it's probably not worth considering them as much of a factor in your decision to try and hide information.

Gross misunderstanding of EU ruling

[jd]

The EU ruling does not require the information on a website to be deleted. Quite the opposite, it upheld the ruling against that by previous courts.

The EU ruling does not require Google to de-index the information. No, seriously, it doesn't.

What the EU ruling states, and this is made painfully clear by the court and also in the summary document, is that the link to the information not be coupled with the personal name. How Google chooses to implement that is Google's affair.

The Statute of Anne is ultimately at the heart of this, because this is where ownership of information is first taken out of the hands of corporations and guilds, and placed squarely in the hands of individuals. The Data Protection Act, which stemmed from (again) corporations claiming ownership of information belonging to others - but this time often getting it wrong with life-threatening consequences, was in many ways a repeat of that battle.

In the case of the DPA, the stakes were higher. Computer glitches and operator errors declaring living people to be dead spread from computer to computer like an incurable cancer. With no redress, even if it meant your bank account was closed, insurance got cancelled and house repossessed. Even if you got a company to fix the data, it would merely get reinfected. Politically aligned "vetting" companies were making a fortune selling bogus information to prospective employers, ensuring only ideologically approved candidates would get hired.

I don't think people remember those days.

European privacy rules are intended to transfer rights to individuals, as per Statute of Anne, and attempt to prevent malign, inaccurate data from harming said individual. So far, so good. I'm amazed at the number of libertarians who are opposed to individuals having rights. The more they oppose such a notion, the more I'm inclined to believe the philosophy suspect. If core elements can be ignored when convenient, they're not especially core.

The EU laws and ruling might not be perfect, in fact I don't believe for a moment they are. But I reject the idea that a corporation has more rights than a person.

Some time back, when I argued that freedom of the collective could not be neglected in pursuit of freedom of the individual, there was much opposition. Mostly along the lives that collectives have no physical reality. I fully expect these to be the people most opposed to the EU ruling, on the grounds that collectives (because that's what a corporation is) have freedoms.

In other words, I believe people prefer cognitive dissonance to having self-consistent beliefs or to admitting error. Much better to split the mind than debug an ideology. Microsoft would be proud.

I'd love to see a sane, rational discussion on the issue. Particularly with experts in IT security as part of it, as they're the experts in handling the conflict between access needs and access controls, and between risks vs benefits, especially on historical data which may include flawed data.

No they are in contempt

[aepervius]

The initial judgment was clear. The person which had debt but repaid them (the initial reason there was that judgement) did not have a right to change the news article because it was a fact, but they had a right to have the search engine not report them as a result. In fact this was how it worked before there was a search engine : if you wanted something forgotten you either moved out, or waited for some time. At that point if nobody checked the primary source directly (old journal article) then you were forgotten, as there was not a service/persons standing beside you permanently always telling everybody what you did wrong in the past. With google it is the case of having that person standing beside you telling everything you did so far as google can link it.

It was clear from the judgement and the right to be forgotten that further reporting it wide of the removal would go against the very basis of it. After all there is no difference between "mister ABC has fone stuff XYZ" and "mister ABC has asked google to remove link to article where he did stuff XYZ". Even if it was an error the first time it was clear after the first reported removal went that way , that google by continuing to do that went against the spirit and the basis of the right to eb forgotten. In fact i would argue that google did it intentionally, knowingly and contemptuously, respecting the letter of the law but hoping with a two pronged way this would undermine the right to be forgotten : 1) they intentionally continued reporting the link removal when they are not forced by law to do so, and it was obviously counter productive to the spirit of the law to tell that to news agency and 2) they intentionally agreed to remove link which were not covered by the right to be forgotten, for example from politician and prominent person doing illegal stuff.


Both actions shows this was not an accident and they did it to undermine the request. "doing no evil" is long gone. google now are clearly asshole.

Re:No they are in contempt

[wisnoskij]

Of course it is not an accident, this is just Google following their long standing policy of transparency when delisting websites.