:format(webp)/cdn.vox-cdn.com/uploads/chorus_image/image/32976119/cour_2010.0.jpg)
On the morning of May 13, the European Court of Justice — the EU's top judicial body — offered a landmark ruling against Google that could have wide-ranging consequences for American technology companies' operations in Europe and set the stage for substantial fragmentation of the global internet. The ruling appears to entrench a legal concept known in Europe as the "right to be forgotten" — the idea that Internet users have the right to remove information about themselves from search engines, social media services, and other websites. That concept is alien to both the business practices of major American firms and to the American legal system. It also runs the risk of spurring clashes between the EU and the United Kingdom, which has previously sought to exempt itself from the right to be forgotten.
What did the court rule?
The case at hand concerned a Spanish man who asked Google to take down a link that led to information about the sale of his house at auction due to failure to pay taxes. Google refused to comply with the request, citing a range of jurisdictional and legal objections, all of which the high court overrode.
One important aspect of the ruling is ECJ's recognition of the right to be forgotten. Another, equally important aspect, as noted by European Union Justice Commissioner Viviane Reding, is the ECJ's assertion that European law applies to services offered by US-based companies operating off US-based servers. In her words "companies can no longer hide behind their servers being based in California or anywhere else in the world." From a multinational technology company's viewpoint, this means that no longer can a single service be offered globally since it will be subjected to a fragmented regulatory landscape.
What is the "right to be forgotten"?
The "right to be forgotten" is a legally enforceable right to have personal information deleted from internet companies' servers. It was proposed in draft European legislation in 2012, but has not yet been enacted by the rather cumbersome European Union lawmaking process.
In the United States, companies like Facebook typically have published privacy policies and takedown procedures that exist to avoid scaring users off. But each firm establishes the policies that they think best serve its business strategy, it's up to potential customers to judge for themselves which services to use, and companies often change their privacy policies in midstream. European politicians and courts have pushed to create a more uniform set of standards and enforce it through regulations. Revelations about the extent to which the American government and its allies can and do peer into private web services has only strengthened this impulse.
The ECJ ruled that, even though the right to be forgotten hasn't formally been enacted, they can still order Google to take down the link concerning the Spanish man's tax situation on the basis of a 1995 law written without modern web services specifically in mind.
But wait, this was just a link in a search engine?
Yes. One of Google's legal arguments was that, in this context, the company is not a controller of data at all. It maintains an index of current web pages and lets people search them. If people have a problem with the contents of old, inaccurate, outdated, or defamatory content on the web, they should take that up with the original publishers.
The ECJ rejected that argument, holding that a version of the right to be forgotten is already implicit in existing European law and that Google's search results are covered by it. Citizens should, according to the court, have the right to demand the removal of information that is "inadequate, irrelevant, or no longer relevant."
What's the case against the right to be forgotten?
Technology companies have argued from the beginning that the right to be forgotten is unworkable and that EU institutions do their citizens a disservice by raising unrealistic expectations. Previous iterations of rule-making have acknowledged tension between the right to be forgotten and freedom of expression, while the ECJ's ruling acknowledges that they would have seen this case differently if it concerned a public figure about whom there is a greater public interest in having information be widely accessible. It's not clear how these considerations are supposed to be balanced in practice. The concern is that attempting to implement this right will either be a logistical disaster or, worse, a form of de facto censorship.
More generally, technology companies argue that the marketplace has proven that people prefer free, ad-supported services that make money by commercially deploying user data. Nothing is stopping people from using paid ad-free email clients or social networks with ironclad privacy policies, but they overwhelmingly choose not to.
Does Google have any recourse here? What's next?
Google appears to be out of options. There is no appeal from the European Court of Justice. What's less clear is what this means for the drive for European legislation on the right to be forgotten. On one level, the court's ruling seems to make the proposed rules irrelevant.
On another level, if practical efforts to implement this ruling turn out as badly as Google argues they will, then the need for a more thorough rewrite of European privacy law will only become more urgent.
