The Ballad of Google Spain

For National Poetry Day, with apologies to anyone with any sense of poetry….

 

There was a case, called ‘Google Spain’

That caused us all no end of pain

Do we have a right to be forgotten?

Are Google’s profits a touch ill-gotten?

 

From over the pond came shouts of ‘Free Speech!’

So loud and so shrill they were almost a screech

From the ECJ came a bit of a gloat

‘We’ve got that Google by the throat!’

 

Said Google “If it’s games you play”

“We’ll do that too, all night and day”

So they blocked and blocked, and told the press

“It’s that evil court, we’re so distressed”

 

“Such censorship,” they cried and cried

Though ’twas themselves who did the deeds

They didn’t need to block the links

They were just engaging in hijinks

 

And many stood beside them proudly

Shouting ‘freedom’, oh so loudly

‘Google is our free-speech hero!’

‘We’ll fight with them, let’s be clear-oh!’

 

Others watched and raised their eyebrows

Listening wryly to these vows

And thought ‘is Google really pure?’

‘From what we’ve seen, we’re far less sure.’

 

For Google blocks all kinds of sites

‘Specially for those with copyright

And, you know, this isn’t funny,

When blocking things will make them money

 

This isn’t just about free speech

No matter how much Google preach

What matters here is really power

Is this truly Google’s hour?

 

Does Google have complete control

Or do the law courts have a role?

Time will tell – but on the way

Our privacy will have to pay…

 

 

 

 

 

 

The right be forgotten roadshow – and the power of Google.

I read with interest Professor Luciano Floridi’s report from the first two legs of what the Guardian described as ‘Google’s privacy ethics tour of Europe’. Floridi is Professor of Philosophy and Ethics of Information at the Oxford Internet Institute, and one of the experts appointed by Google to its ‘Advisory Council’ on the right to be forgotten.

As would be expected from such an expert, it is a well crafted report and explains very well some of the key ethical questions being addressed through this public consultation. As Floridi puts it:

“The two words most frequently used by all participants in the meetings were “complex” and “balance”, and they describe the situation well. The debate is complex because there are many elements interacting with each other.

The actual ruling, with its pro and contra, including its inconsistency with the advocate-general’s opinion; the role of search engines as intermediaries or data controllers; the difference between availability and accessibility of information online; the so-called rights (to be forgotten, to information), the real rights behind them (privacy and freedom of expression), and the ways in which they are interpreted on the two sides of the Atlantic; the concepts of relevance and of public interest, both very slippery; the procedural uncertainty about who should decide which links are rightfully removed and who should be informed about it.”

There is one element, however, conspicuous by its absence from Floridi’s analysis: a consideration of the power of Google. That power is considerable, and wielded in many different ways. Indeed, it could be said that the power of Google is at the heart of the whole debate over the right to be forgotten, and without taking it properly into account it will be impossible to come to sensible, practical and effective conclusions over how to deal with the right to be forgotten.

Power over what is found – and not found

The reason behind the Google Spain ruling, to start with, was connected with the power that Google wields: ‘Googling’ someone is probably the most important way to find out information about a person. The Spanish man about whom the ruling was concerned felt that when he was Googled the information was misleading and unfair. Google is at the heart of things: how they set their algorithms, how they index the web, what they include and exclude, what they rate highly – and what they rate as insignificant – matters in ways that are often hugely underestimated. And yet, if you read a lot of commentary – even the expert commentary of Professor Floridi – it seems as though Google are a mere conduit, their algorithm organic and their results generated purely in the interests of freedom of expression. If it’s interesting and relevant, those algorithms will find it for you. Google, in this view, are a purely neutral organisation, providing a service to the planet.

That’s a deeply naive assumption. Google is a business – and like all businesses, its bottom line is the bottom line. Google will do what is best for Google as a business. That may often turn out to be what serves freedom of expression best – if we can’t find what we need to find by using Google, we’ll find another way – but sometimes it won’t be. Google takes down masses of links on the basis of copyright claims – because its interests are best served by complying with the law of copyright and by keeping cordial relations with the rights-holders. That’s an infringement of freedom of expression – but in the eyes of the law and the eyes of Google, an acceptable one. Google doesn’t link to child abuse images – and quite rightly so – but that’s also an infringement of freedom of expression. Google complies with local laws and other considerations as and when Google finds it appropriate to do so – and there’s absolutely nothing wrong with that approach. Indeed, it’s an entirely appropriate approach – but it means that casting Google as the great champion of freedom of expression is only telling part of the story.

Power to set the agenda

The second aspect of power that needs to be taken into account is Google’s power to control the process and indeed to set the agenda. This whole roadshow was set up by Google – the advisory council was set up by Google, where they visit and when, who is called to give evidence, what the agenda of their meetings are and so forth is all, directly or indirectly controlled by Google. Again, there’s nothing wrong with this, and in some ways it’s entirely appropriate, but it does mean that it should be viewed in that context. This isn’t some neutral, independent body making an academic analysis of the ethics of the right to be forgotten – it’s a Google appointed body, somewhat akin to a board of trustees, taking soundings on Google’s terms. They wouldn’t have been appointed if they weren’t either predisposed to be on Google’s side, or at least seen to be malleable. It also reflects an apparent tactic that Google has employed in the internet governance and regulation space more generally. By giving individuals with high personal reputation positions of importance, flying them on private jets, and generally treating them like royalty, Google creates powerful external allies. Google’s eight experts are already acting in some ways as though they were more expert than the DPAs and other European organs: it gives Google a chance to blend its choices between the best of a set of alternatives. The DPAs do, at least, appear to have noticed this.

Google seems to have been setting the agenda over the reporting of the right to be forgotten since the day it came out – many (including myself) have wondered whether Google has been deliberately overreacting to the ruling, deleting links to stories when they really didn’t have to, to try to make the ruling look ridiculous. Those stories began very shortly after the ruling, but they continue to this day – the most recent being the story that links to a positive story about an artist being removed seemingly at the artist’s desire. It’s a deeply unconvincing story, and generally couched in terms that misunderstand the ruling. Suggestions that Google was ‘forced’ to remove the link are quite wrong: a request is made, and then Google can decide to delete or not to delete – deletions being if the information is old or irrelevant – and if they choose not to, the requester can either take legal action or ask the data protection authority to adjudicated. Even in the Guardian, which really should know better, it was suggested that “Google was required to enact the court’s decision”. No. Google was not required to do so. They could, and on the face of it they should, have refused to do so. If they were really the guardians of freedom of expression, they would have – but there are wheels within wheels here, and making the ruling look ridiculous seems, again, at least on the face of it, to matter more to them.

Power in other ways

Google’s immense resources mean that it can wield its power in many more ways. Lobbying, both open and hidden, is a big deal – the amount of effort put into shaping the reform of the data protection regime so it suits Google better has been colossal. Current and ex-Googlers are now in the House of Lords (Joanna Shields, appointed by David Cameron in August, used to run Google’s Europe division) and in the White House (Megan Smith, Google VP for Development is Obama’s new Chief Technology Officer and senior technology advisor, appointed earlier this month). Google provides funding to think tanks, and to academic organisations – indeed, they’re one of the biggest funders in these areas. Though this funding is given without strings attached, it is hard not to feel that there is at least some influence on the subjects that are researched, and the terms on which they are researched. No-one bites the hand that feeds them without at least thinking about it. Google has a critical role to play in how technology functions, how businesses function – and in how the media functions. The media in particular sometimes seems far less critical of Google than it might be – except in terms of its taxation policies.

None of this should detract from the way that Google does provide great products – and that things like its search engine do provide a huge amount of help for freedom of expression and so forth. That, however, should not prevent us from seeing the impact of the power that it wields – and taking that power into account when looking at things like privacy and freedom of expression. When trying, as Professor Floridi says, to find the right balance, with all those complex factors to deal with, that power must be taken into account. If it isn’t, that balance will never be found.

 

 

 

Wikipedia and the Right to be Forgotten…

…or why Jimmy Wales might want to support a right to delete.

One of the more strident critics of the Google Spain ruling by the ECJ, bringing into action at least a form of the much derided ‘right to be forgotten’, has been Jimmy Wales, co-founder of Wikipedia. He has spoken and written about it in highly critical terms, calling it ‘one of the most wide-sweeping internet censorship rulings that I’ve ever seen’ and, since Wikipedia itself started receiving notifications, ‘completely insane’. His statements, amplified by the obliging British press, were followed by his appointment to Google’s advisory committee on implementation of the court’s ruling. He has so far stood firmly by Google’s side, and against the ECJ – and yet, if looked at from the perspective of ‘openness’, there are arguments that he should shift his position. The so-called right to be forgotten – in some forms at least – is far from incompatible with the principles of openness that underpin Wikipedia. Indeed, it can be argued to be supportive of those principles – or even necessary to produce more openness in the way the internet operates for most ordinary people.

Wikipedia and ‘openness’

Wikipedia is viewed by many as the epitome of the new(ish) idea of ‘openness’ (e.g. http://www.theguardian.com/technology/2014/aug/10/wikipedia-isnt-perfect-model-channel-4-government) . Crowdsourcing information, allowing edits by anyone. Words like ‘participatory’, ‘collaborative’, even ‘democratic’ are used to describe it – indeed, it’s often used as an example of what those terms mean. These are words that are almost always used positively: participation, collaboration and democracy are seen as fundamentally ‘good’ things. Specifically, they’re seen as good things in relation to the internet: the fight for an ‘open’ and ‘free’ internet, a fight which the Wikimedia Foundation often seems to see itself at the forefront of, is a fight for the sort of internet built around participation, collaboration and openness.

But what does that mean in practice? Take a look at Wikipedia. As a teacher of university students, I often discuss the use of Wikipedia for research. In the old days, universities frowned on the use of Wikipedia – and we generally still disapprove of its use as a primary source (a citation of a Wikipedia page will raise both eyebrows and hackles in any university teacher) – but now it is usually seen as something very useful. You can get a broad brush view of a subject from reading the Wikipedia page – and you can find links to better, more reliable information about the subject. You don’t cite the Wikipedia page, but you can find sources that you can cite by looking at the Wikipedia page.

This all comes from both the strength and the weakness of Wikipedia. It is generally reliable – because crowdsourcing works, and because people with an intimate knowledge of all the various subjects contribute to it – but it is also, and just as importantly, ever-changing. It changes as events develop – new information appears, new views come in and, crucially, errors are corrected, biases revealed and changes made. Inaccurate and out of date information – and irrelevant information – is corrected or deleted from Wikipedia pages.

Deletion of information…

Let me repeat that.

Inaccurate, out of date and irrelevant information is corrected or deleted from Wikipedia pages.

That’s the strength of Wikipedia. Indeed, it is a key virtue of digital publishing – it is dynamic, not static. When errors creep in – whether by accident, by error, by biased editing, by malice (and cases of falsification of Wikipedia pages are well known, as are the strong and consistent critiques of both Wales and Wikipedia) the openness of the Wikipedia platform means that those errors, those biases, and so forth are open to being corrected. Information is deleted. That’s what makes Wikipedia great – and also what shapes the way we use it. We know Wikipedia isn’t set in stone, and that at any particular moment it may include errors or misunderstandings. We know that, so we don’t treat it with undue reverence. We check what we see against other sources. We look for alternative views and compare them to what we see on Wikipedia. We sometimes even help to edit Wikipedia. We treat Wikipedia as ‘organic’, growing and changing all the time.

Treating the internet as ‘organic’

Isn’t it appropriate – and desirable – to treat the whole internet in the same, open way? As organic, growing and changing all the time? Why should other material in the free floating internet be treated as inviolable; privileged by virtue of their form, if we are happy to see it otherwise with Wikipedia? In many ways we know that this is how the internet really is anyway – we know that when we look at a page we need to consider who created it, what sort of people they are, what biases they might have and so on. We know that new material is appearing all the time – every blog post, every newspaper article, every uploaded photo – and we should also understand that other material is being deleted or edited every day. Old, irrelevant or inaccurate information disappears every day. That’s part of the process – life and death are part of the same cycle.

What the internet isn’t, is a perfect archive of truth, set in stone as a record of perfect accuracy. To evoke otherwise, as Wales and the Wikimedia foundation have done, is simply false. It isn’t Asimov’s vision (deliberately misleading) of an Encyclopaedia Galactica in his seminal ‘Foundation’ books, designed to preserve and maintain humanity’s store of knowledge against barbarians and the decline of civilisation. It’s much closer to the reality of Wikipedia. Somewhere were things are being deleted all the time. Somewhere where routes to things are being corrected all the time. Somewhere that should be treated with respect but not reverence.

The right to delete – or the right to be forgotten

That’s where a right to delete – and yes, sometimes, a right to be forgotten fits in. It’s not such a big deal, really – things get deleted and forgotten all the time on the internet. Eric Schmidt and Jimmy Wales’ things, too. The right to be forgotten is just one of many mechanisms through which such deletions might take place. Almost completely overlooked in the media coverage, and the runaway notion that this is a ‘right for the rich and famous’ is the fact that already people with resources and knowledge use ‘reputation management’ services to hunt down and remove uncomplimentary things about them. Already ‘rights holders’ use copyright law to have things that breach their rights removed from the net – and routes to them removed, obscured or deleted. Already companies choose to cleanse old websites, to rebrand themselves and so forth. The right to be forgotten – both in its ‘Google Spain’ form and in a purer deletion of data form – would be just one of many tools through which the internet changes form. That constant changing should be understood and celebrated – and refined not fought and feared. It’s part of what makes the internet so great.

That doesn’t, of course, mean that it shouldn’t be treated critically. It should, very much so. It doesn’t mean that the Google Spain ruling is without fault – it isn’t, and the way that Google has implemented it to date has highlighted many of those faults. And yes, it’s a tool that could well be misused – most tools are, but we don’t outlaw kitchen knives because they could be used to stab people. For ordinary people, in extraordinary circumstances, it could be a real boon. Ordinary people need to be given a chance to contribute, to participate, to be part of that great community that so many of us hope the internet can become. Of course we need to find a way to make it work better. We need to set out more appropriate rules and good, solid guidelines as to how it should be operated – and to reduce the possibility of its misuse. We need all of this, both to help Google and to keep the internet open….

…because that’s the bottom line. Having ways to delete information isn’t the enemy of the internet of the people, so much as an enemy of the big players of the internet. In terms of the ordinary people, it’s very much the internet’s friend. Wikipedia demonstrates the need to have deletion and correction as well as addition as part of its toolkit. Jimmy Wales knows this, I suspect, though I’m not sure he’s applied this knowledge to the internet as a whole. He may not like the way that this particular tool has been developed – for judges and courts are often seen as the enemies of openness, and from an America perspective, European judges and courts may be the worst of all. Nobody wants to be told what to do – and often they’re quite right to resist what they’re told to do.

However, an excessive faith in the ‘record’ of the internet, and an excessive reverence for the way that the internet (and Google in particular) currently works are also enemies of real openness. We need to be open to changes – and yes, even changes in all of these.

—————-

This blog post was inspired in part by reading Nathaniel Tkacz’s work on Openness.

A right to delete – not a right to be forgotten…

One of the many things people are getting angry about the ‘right to be forgotten’ is in the name… something that I’ve been banging on about for some years. I talk about the right quite a lot in my book Internet Privacy Rights… so I thought I’d just give a quick flavour of it. Here are a couple of paragraphs from Chapter 7:

---

“This idea of a right to delete is subtly but importantly different from the idea of a ‘right to be forgotten,’ as currently under discussion by European Regulators for inclusion in the forthcoming revision of the Data Protection regime. Quite how such a right might work in practice is still not entirely clear – but the connotations of the name of the right as well as the implications of its implementation are of concern and have been subject to criticism. A right to be forgotten looks like the rewriting or erasing of history, or a kind of censorship. The right to delete is about the control of data, not about censorship – and if properly understood and implemented is not in conflict with freedom of expression. It should not be seen as a way to rewrite or conceal history or as a tool for celebrities or politicians; it is rather a basic and pragmatic right available to all.

Equally importantly, a right to delete imposes different duties on different people that what might be understood by a right to be forgotten. It changes the rights being balanced, and the duties that are imposed on others: it is balanced against businesses’ ‘right’ to hold data rather than against individuals’ rights to remember. Of course we have the right to remember things – it is much more questionable whether businesses have a right to hold our personal data. We can impose duties (both moral and legal) on businesses to delete – but we can’t impose duties on people to forget.”

---

 

So far, we seem to be stuck with the name. I wish we weren’t… but we are. That shouldn’t, however, detract from the underlying issues.

Dave Eggers’ The Circle: a book for our times…

I was introduced to Dave Eggers’ novel, The Circle, by Professor Andrew Murray – one of the pre-eminent scholars in IT Law in the UK, and also on of my PhD supervisors. I know I’m very late to this game – the book came out in 2013, and all the cool people will already have read it or reviewed it, but in this case I think it’s worth it. And the fact that someone like Andrew Murray would recommend it should give pause for thought: this isn’t just an entertaining piece of science fiction, it’s a book that really makes you think. It’s not just a dystopian vision of the future, it’s one that is far, far closer to reality than almost any I’ve read – and dystopian novels and films are pretty much my favourite genre.

It’s a book that reminded me why, unlike most of my schoolmates, I always preferred Brave New World to 1984 – and why, of the various privacy stories of the last few months I suspect, ultimately, the Facebook Experiment and the ruling over the Right to be Forgotten will matter more than the passing of the deeply depressing DRIP. In the end, as The Circle demonstrates graphically, we have more to fear from corporate domination of the Internet than we do from all the spooks and law enforcement agencies.

The Circle from which the novel gets its name is a technology company that combines a great deal of Google and Facebook with a little dash of Apple and a touch of Twitter. It dominates search and social media, but also makes cool and functional hardware. Egger’s triumph in the Circle is that he really gets not just the tech but the culture that surrounds it – little details like sending frowns to paramilitaries in Guatemala echo campaigns like #BringBackOurGirls in their futility, superficiality and ultimate inanity. The lives portrayed in the Circle should send shivers down the spines of any of us who spend much time on Twitter or Facebook: that I read the book whilst on a holiday without much Internet access made the point to me most graphically.

Privacy is theft

Eggers echoes both 1984 and Brave New World in using slogans to encapsulate concepts – exaggerating to make the point. For the Circle, these are:

Secrets are lies
Sharing is caring
Privacy is theft

All three are linked together – and connected to the idea that there’s something almost mystical about data. We don’t just have no right to privacy, we have a duty to disclose, a duty to be transparent. A failure to disclose means we’re depriving others of the benefits of our information: by claiming privacy, we’re stealing opportunities and advantages that others have the right to. If we care about others, we should share with them. This is Facebook, this is Google Flu Trends – and it’s the philosophy that implies that those of us who oppose the care.data scheme through which all our health data will be shared with researchers, pharmaceutical companies and many others, are selfish Luddites likely to be responsible for the deaths of thousands.

It is also the philosophy behind a lot of the opposition to the right to be forgotten. That opposition is based on the myth – one that Eggers exposes excellently – that the records on the Internet represent ‘the truth’ and that tampering with them, let alone deleting anything from them, is tantamount to criminality. Without spoiling the plot too much, one of the characters is psychologically and almost physically destroyed by the consequences of that. Eggers neatly leaves it unclear whether the key ‘facts’ that do the damage are actually real – he knows that this, ultimately, isn’t the point. Even if it all were true, the idea that maintaining it and exposing it would be a general good, something to be encouraged and fought for, is misguided at best.

It’s about power – and how it’s wielded

In the novel, The Circle has the power – and it wields it in many ways. Emotional manipulation, keeping people happy and at the same time keeping them within the Circle, is the key point – and the echoes of the Facebook Experiment, about which much has been written, but much has missed the deeper points, are chilling here. One of the real functions of the experiment was for Facebook to find ways to keep people using Facebook…

Another of the key ways that the Circle wields power is through its influence over lawmakers – and the same is sadly evident of Google and Facebook, in the UK as much as in the US. In the UK in particular the influence over things like opposition to data protection reform – and the right to be forgotten – are all too clear. It would be great if this could change, but as in the novel, the powers and common interests are far too strong for much chance. More’s the pity.

As a novel, The Circle is not without fault. I guessed the main plot twist less than half-way through the book. There’s a good deal of hyperbole – but this is dystopian fiction, after all – and the tech itself is not exactly described convincingly. What’s more, the prose is far from beautiful, the characters are mostly rather two-dimensional, and often they’re used primarily to allow Eggers to make his points, often through what amount to set speeches – but Huxley was guilty of that from time to time too. Those speeches, however, are often worth reading. Here, one of the dissidents explains his objections:

“It’s the usual utopian vision. This time they were saying it’ll reduce waste. If stores know what their customers want, then they don’t overproduce, don’t overship, don’t have to throw stuff away when it’s not bought. I mean, like everything else you guys are pushing, it sounds perfect, sounds progressive, but it carries with it more control, more central tracking of everything we do.”

“Mercer, the Circle is a group of people like me. Are you saying that somehow we’re all in a room somewhere, watching you, planning world domination?”

“No. First of all, I know it’s all people like you. Individually you don’t know what you’re doing collectively. But secondly, don’t presume the benevolence of your leaders.”

In that brief exchange Eggers shows how well he gets the point. A little later he nails why we should care much more about this but don’t, focussing instead on the spooks of the NSA and GCHQ.

“Here, though, there are no oppressors. No one’s forcing you to do this. You willingly tie yourself to these leashes.”

That’s the problem. We don’t seem to see the risk – indeed, just as in the novel, we willingly seem to embrace the very things that damage us. Lawmakers, too, seem not to see the problem – and as noted all too often allow themselves to be lobbied into compliance. The success of Google’s lobbyists over the right to be forgotten is testimony to this. Even now, people who really should know better are being persuaded to support the Circle sorry, I mean Google’s business model rather than address a real, important privacy issue.

Coming to a society near you…

We’re taking more and more steps in the direction of the Circle. Not just the Facebook experiment and the reaction to the ‘right to be forgotten’ ruling – but even in the last week or two a House of Lords committee has recommended an end to online anonymity, effectively asking service providers to require real names before receiving services. This is one of the central planks of the way the Circle takes control over people’s lives, and one which our lawmakers seem to be very happy to give them. There are also stories going around about government plans to integrate various databases from health and the DVLA to criminal records… another key tenet of the Circle‘s plans… The ‘detailed’ reasons for doing so sound and seem compelling – but the ultimate consequences could be disastrous…

Anyway, that’s enough from me. Read the book. I’ll be recommending it to
my Internet Law and Privacy students, but I hope it’s read much more widely than that. It deserves to be.

Are Google intentionally overreacting to the Right to be Forgotten?

In one of my original reactions to the Google Spain ruling on the Right to be Forgotten, which I wrote for The Justice Gap, I said this, about Google’s response to the ruling.:

“How they respond to the ruling will be interesting – for the moment they’re saying very little. They have creative minds working for them – if they can rise to the challenge and find a way to comply with the ruling that enables ordinary people to take back a little control, that could be a very good thing. If, instead, they retrench and withdraw – or go over the top in allowing censorship too easily, it could be very bad.”

From what I’ve seen so far, it looks as though they’ve taken the ‘over the top’ approach, and are allowing censorship too easily. Two particular stories have come out today, one from the Guardian (here), the other from the BBC (here). In both cases, the journalists concerned are high profile, influential and expert – James Ball at the Guardian and Robert Peston at the BBC – and the stories, to be frank, do not seem to fall within the categories that the CJEU ruling in the Google Spain case suggested might be suitable for the right to apply. James Ball’s stories were mostly pretty recent – from 2010 and 2011 – as well as being fairly easy to argue as being ‘relevant’ in terms of public interest. Robert Peston’s stories are not so recent, but even more clearly relevant and in the public interest.

So why have they been caught by Google’s net as appropriate for the ‘right to be forgotten’? It looks very much as though this is the intentional overreaction that I was concerned about in my original posting for the Justice Gap. They’re trying to say, I think, ‘you know, we were right! This ruling means censorship! This is dangerous!’ They’re also trying to get journalists like James Ball and Robert Peston to be on their side, not on the side of the CJEU – and in Ball’s case, at least, they seem to be succeeding to an extent. Peston is more critical, saying that Google’s implementation of the ruling ‘looks odd, perhaps clumsy.’

Clumsy or intentional?

I’m not convinced that it’s clumsy at all, but intentional. I hope I’m wrong, and that, as Google themselves have said, they will be refining the method and sorting out the details. If they’re really trying to fight this, to prove that the ruling is unworkable, we’re in for some serious trouble, because the ruling will not be at all easy to reverse. Rather the opposite – and the wheels of the European legal system grind very slowly, so the fight and the mess could be protracted.

What’s more, what this should really highlight for people is not just the problem with the Google Spain ruling, but the huge power that Google already wields – because, ultimately, it is Google that is doing this ‘censorship’, not the court ruling. And Google does similar things already, though without such a fanfare, in relation to copyright protection, links to things like obscene content and so forth. Google already are acting like censors, if you see it that way, and without the drama of the right to be forgotten.

What can we do now?

In the meantime, people will develop coping mechanisms – or find ways to bypass Google’s European search systems, either going straight to google.com or using alternatives like duckduckgo, or even not using search at all, because there are other ways to find information such as crowdsourcing via Twitter. The more people use these, the more they’ll like them, and the more they’ll move away from Google.  I hope that Google see this, and find a more productive way forward than this excessive, clumsy implementation of the ruling. What’s more, I hope they engage positively and actively with the reform process for the Data Protection Regime – because a well executed reform, with a better written and more appropriate version of the right to be forgotten (or even better, the right to erasure) is the ultimate solution here. If that can be brought in soon – rather than delayed or undermined – then we can all move on from the Google Spain ruling, both legally and practically. I think everyone might benefit from that.

A week not to be forgotten….

…for those of us interested in the right to be forgotten. I’ve found myself writing and talking to people about it unlike any time before. Privacy is becoming bigger and bigger news – and I have a strong feeling that the Snowden revelations influenced the thinking of the ECJ in last week’s ruling, subconsciously if nothing else. That should not be viewed as a bad thing – quite the opposite. What we have learned through Edward Snowden’s information should have been a wake-up call for everyone. Privacy matters – and the links between the commercial gathering and holding of data and the kind of surveillance done by the authorities are complex and manifold. If we care about privacy in relation to anyone – the authorities, businesses, other individuals, advertisers, employers, criminals etc – then we need to build a more privacy-friendly infrastructure that protects us from all of these. That means thinking more deeply, and considering more radical options – and yes, that even means the right to be forgotten, for all its flaws, risks and complications. More thought is needed, and more action – and we must understand the sources of information here, the nature of those contributing to the debate and so forth.

Anyway, this isn’t a ‘real’ blog post about the subject – I’ve done enough of them in the last week. What I want to do here is provide links to what I’ve written and said in the last week, as well as to my academic contributions to the subject, both past and present, and then to link to Julia Powles’ excellent curation of the academic blogs and articles written by many people in the aftermath of the judgment.

Here’s what I’ve written:

For CNN, a summary of the judgment and its implications, written the same day as the judgment.

For the Justice Gap, a day later, looking at the judgment in context and asking whether it was a ‘good’ or a ‘bad’ thing for internet freedom.

My interview for CBC (Canada)’s Day 6 programme – talking about the implications, and examining the right for a non-European audience.

For my own blog, looking at Google’s options for the future and suggesting that the judgment isn’t the end of the world

Also for my own blog, a day later, trying to put the judgment into context – it’s not about paedophiles and politicians, and it won’t be either a triumph or a disaster.

This last piece may in some ways be the most important – because already there’s a huge about of hype being built up, and scare stories are being leaked to the media at a suspiciously fast rate. There are huge lobbies at play here, particularly from the ‘big players’ on the internet like Google, who will face significant disruption and significant costs as a result of the ruling, and seem to want to make sure that people view the conflict as one of principle, rather than one of business. People will rally behind a call to defend freedom of expression much more easily than they will behind a call to defend Google’s right to make money, particularly given Google’s taxation policies.

Then here are my academic pieces on the subject.

‘A right to delete?’ from 2011, for the European Journal of Law and Technology. This is an open access piece, suggesting a different approach.

‘The EU, the US and the Right to be Forgotten’, published in early 2014, a chapter in a Springer Book on data protection reform, arising from the CPDP conference in Brussels 2013. This, unfortunately, is not open access, but a chapter in an expensive book. This does, however, deal directly with some of the lobbying issues.

The right to be forgotten – and my particular take on it, the right to delete, is also discussed at length in my recently released book, Internet Privacy Rights. There’s a whole chapter on the subject, and it’s part of the general theme.

Finally, here’s a link to Julia Powles’ curation of the topic. This is really helpful – a list of what’s been written by academics over the last week or so, with a brief summary of each piece and a link to it. Some of the academics contributing are from the very top of the field,  including Viktor Mayer-Schönberger, Daniel Solove and Jonathan Zittrain. All the pieces are worth a read.

This subject is far from clear cut, and the debate will continue on, in a pretty heated form I suspect, for quite some time. Probably the best thing that could come out of it, in my opinion, is some more impetus for the completion of the data protection reform in the EU. This reform has been struggling on for some years, stymied amongst other things by intense lobbying  by Google and others. That lobbying will have to change tack pretty quickly: it’s no longer in Google’s interests for the reform to be delayed. If they want to have a more ‘practical’ version of the right to be forgotten in action, the best way is to be helpful rather than obstructive in the reform of the data protection regime. A new regime, with a well balanced version of the right incorporated, would be in almost everyone’s best interests.

The Right to be Forgotten: Neither Triumph Nor Disaster?

“If you can meet with triumph and disaster
And treat those two imposters just the same”

Those are my two favourite lines from Kipling’s unforgettable poem, ‘If’. They have innumerable applications – and I think another one right now. The Right to be Forgotten, about which I’ve written a number of times recently, is being viewed by some as a total disaster, others as a triumph. I don’t think either are right: it’s a bit of a mess, it may well end up costing Google a lot of time, money and effort, and it may be a huge inconvenience to Data Protection Authorities all over Europe, but in the terms that people have mostly been talking about it, privacy and freedom of expression, it seems to me that it’s unlikely to have nearly as big an impact as some have suggested.

Paedophiles and politicians – and erasure of the past

Within a day or two of the ruling, already the stories were coming out about paedophiles and politicians wanting to use the right to be forgotten to erase their past – precisely the sort of rewriting of history that the term ‘right to be forgotten’ evokes, but that this ruling does not provide for. We do need to be clear about a few things that the right will NOT do. Where there’s a public interest, and where an individual is involved in public life, the right does not apply. The stories going around right now are exactly the kind of of thing that Google can and should refuse to erase links to. If Google don’t, then they’re just being bloody minded – and can give up any claims to be in favour of freedom of speech.

Similarly, we need to be clear that this ruling only applies to individuals – not to companies, government bodies, political parties, religious bodies or anything else of that kind. We’re talking human rights here – and that means humans. And, because of the exception noted above, that only means humans not involved in public life. It also only means ‘old’, ‘irrelevant’ information – though what defines ‘old’ and ‘irrelevant’ remains to be seen and argued about. There are possible slippery slope arguments here, but it doesn’t, at least on the face of it, seem to be a particularly slippery kind of slippery slope – and there’s also not that much time for it to get more slippery, or for us to slip down it, because as soon as the new data protection regime is in place, we’ll almost certainly have to start again.

We still can’t hide

Conversely, this ruling won’t really allow even us ‘little people’ to be forgotten very successfully. The ruling only allows for the erasure of links on searches (through Google or another search engine) that are based on our names. The information itself is not erased, and other forms of search can still find the same stories – that is, ‘searches’ using something other than a search engine, and even uses of search engines with different terms. You might not be able to find stories about me by searching for ‘Paul Bernal’ but still be able to find them by searching under other terms – and creative use of terms could even be automated.

There already are many ways to find things other than through search engines – whether it be crowdsourcing via Twitter or another form of search engine, employing people to look for you, or even creating your own piece of software to trawl the web. This latter idea has probably occurred to some hackers, programmers or entrepreneurs already – if the information is out there, and it still will be, there will be a way to find it. Stalkers will still be able to stalk. Employers will still be able to investigate potential employees. Credit rating agencies will still be able to find out about your ancient insolvency.

…but ‘they’ will still be able to hide

Some people seem to think that this right to be forgotten is the first attempt to manipulate search results or to rewrite history – but it really isn’t. There’s already a thriving ‘reputation management’ industry out there, who for a fee will tidy up your ‘digital footprint’, seeking out and destroying (or at least relegating to the obscurity of the later pages on your search results) disreputable stories, and building up those that show you in a good light. The old industry of SEO – search engine optimisation – did and does exactly that, from a slightly different perspective. That isn’t going to go away – if anything it’s likely to increase. People with the power and knowledge to be able to manage their reputations will still be able to.

On a slightly different tack, criminals and scammers have always been able to cover their tracks – and will still be able to. The old cat-and-mouse game between people wanting to hide their identity and people wanting to uncover those hiding them will still go on. The ‘right to be forgotten’ won’t do anything to change that.

But it’s still a mess?

It is, but not, I suspect, in the terms that people are thinking about. It will be a big mess for Google to comply, though stories are already going round that they’re building systems to allow people to apply online for links to be removed, so they might well already have had contingency plans in place. It will be a mess for data protection agencies (DPAs), as it seems that if Google refuse to comply with your request to erase a link, you can ask the DPAs to adjudicate. DPAs are already vastly overstretched and underfunded – and lacking in people and expertise. This could make their situation even messier. It might, however, also be a way for them to demand more funding from their governments – something that would surely be welcome.

It’s also a huge mess for lawyers and academics, as they struggle to get their heads around the implications and the details – but that’s all grist to the mill, when it comes down to it. It’s certainly meant that I’ve had a lot to write about and think about this week….

 

It’s not the end of the world as we know it….

Over the weekend, I was asked by CNN if I would be able to write something about the ruling that was due on the right to be forgotten – it was expected on Tuesday, they told me. I said yes, partly because I’m a bit of a sucker for a media gig, and partly because I thought it would be easy. After all, we all knew what the CJEU was going to say – the Advocate-General’s opinion in June last year had been clear and, frankly, rather dull, absolving Google of responsibility for the data on third party websites and denying the existence of the right to be forgotten.

On Monday, which was a relatively free day for me, I drafted something up on the assumption that the ruling would follow the AG’s opinion, as they generally do. On Tuesday morning, however, when the ruling came out, all hell broke loose. When I saw the press release I was doing a little shopping – and I actually ran back from the shops straight home to try to digest what the ruling meant. I certainly hadn’t expected this – and I don’t know anyone in the field who had. The ruling was strong and unequivocally against Google – and it said, clearly and simply, that we do have a right to be forgotten.

I rewrote the piece for CNN – it’s here – and the main feeling I had was that this would really shake things up. I still think that – but that this isn’t the end of the world as we know it, despite some pretty apocalyptic suggestions going around the internet.

On the positive side, the ruling effectively says that individuals (and only individuals, not corporations, government bodies or other institutions) can ask Google to remove links (and not the stories themselves) that come up as a result of searches for their names. It’s a victory for the individual over the corporate – in one way. The most obvious negative side is that it could reduce our ability to find information about other individuals – but there are other risks attached too. Most of those concern what Google does next – and that’s something which, for the moment, Google seem to be keeping very close to their chest.

On the surface, Google’s legal options seem very limited – there’s no obvious route of appeal, as the CJEU is the highest court. If they don’t comply, they could find themselves losing case after case after case – and there could be thousands of cases. There are already more than 200 in Spain alone, and this ruling effectively applies throughout Europe. If they do choose to comply, how will they do so? Will they create a mechanism to allow individuals to ask for things to be unlinked automatically? Will they ‘over-censor’ by taking things down at a simple request – they already do something rather like that when YouTube videos are accused of breaching copyright?

My suspicion that one thing they will do is to tweak their algorithm to reduce the number of possible cases – they will look at the kinds of search results that are likely to trigger requests, and try to reduce those automatically. That could mean, for example, setting their systems so that older stories have even less priority than before – producing an effect similar to Viktor Mayer-Schönberger’s ‘expiry dates’ for data, something that in my opinion might well be beneficial in the main. It could also mean, however, placing less priority on things like insolvency actions (the specific case that the ruling arose from was about debts) or other financial events, which would not have such a beneficial effect. Indeed, it could well be seen as detrimental.

The bigger risk, however, is to Google’s business model. Complying with this ruling could end up very costly – it effectively asks Google to make a kind of judgment call of privacy vs public interest, and making those kinds of calls is very difficult algorithmically. It might mean employing people – and people are expensive and slow… and reduce profits.  Threatening Google’s business model doesn’t just threaten Google’s shareholders – it threatens the whole ‘free services for data’ approach to the net, and that’s something we all (in general) benefit from. I don’t currently think this threat is that big – but we’re still digesting the possibilities, I think.

One other possible result – in the longer term – which I would hope to see (though I’m not holding my breath) is less of a reliance on search, and on Google in particular. There are other ways to find information on the internet, ways that this ruling would not have an impact on. One of the most direct is crowdsourcing via something like Twitter – these days I get more of my information through Twitter than I do through Google. If you have a body of informed, intelligent and helpful people out there who are scouring the internet for information in their own particular way, they can supply you in a very different way to Google. They can bypass the filters that Google already put in place, and the biases that Google has (but pretends not to have) – with your own connections there are of course other biases but they’re more obvious and out in the open.

Indeed, I would also hope that this ruling is the start of our having a more objective view of what Google is – though the reactions of some that this ruling is the end of the world suggest rather the opposite. Further, we should start to think more about the kind of internet we want to have – and how to get it. I would hope that those bemoaning the censorship that this ruling might bring are equally angry about the censorship that our government in the UK, and many others around the world, have already brought in inside the Trojan Horse of ‘porn filters’. That kind of censorship, in my opinion, offers far more of a threat to freedom of expression than the idea of a right to be forgotten. If we’re really keen on freedom of expression, we should be up in arms about that – but we mostly seem to be acquiescing to it with barely a murmur.

What this ruling actually results in is yet to be seen – but if we’re positive and creative it can be something positive rather than something negative. It should be seen as a start, and not an end.

Dear Larry and Mark….

Larry Page, Google

Mark Zuckerberg, Facebook

8th June, 2013

Dear Larry and Mark

The PRISM project

I know that you’ve been as deeply distressed as I have by the revelations and accusations released to the world about the PRISM project – and I am delighted by the vehemence and clarity with which you have denied the substance of the reports insofar as they relate to your services. The zeal with which you wish to protect your users’ privacy is highly commendable – and I’m looking forward to seeing how that zeal produces results in the future. To find that the two of you, the leaders of two of the biggest providers of services on the internet, are so clearly in favour of individual privacy on the internet is a wonderful thing for privacy advocates such as myself. There are, however, a few ways that you could make a slightly more direct contribution to that individual privacy – and seeing the depth of feeling in your proclamations over PRISM I feel sure that you will be happy to do them.

Do Not Track

As I’m sure you’re aware, people are concerned not just about governments tracking their activities on the net, but others tracking them – not least since it appears clear from the PRISM project that if commercial organisations track people, governments might try to get access to that tracking, and perhaps even succeed. As you know, the Do Not Track initiative was designed with commercial tracking in mind – but it has become a little bogged down since it began, and looks as though it might be far less effective than it could be. You could change that – put your considerable power into making it strong and robust, very clearly do not track rather than do not target, and most importantly ensure that do not track is on by default. As you clearly care about the surveillance of your users, I know that you’ll want them not to be tracked unless they actively choose to let advertisers track them. That’s the privacy-friendly way – and as supporters of privacy, I’m sure you’ll want to support that. Larry, in particular, I know this is something you’ll want to do, as perhaps the world leader in advertising – and now also in privacy – your support of this will be both welcome and immensely valuable.

Anonymity – no more ‘real names’ policies

As UN Special Rapporteur on Freedom of Expression and Opinion, Frank La Rue, recently reported, privacy, and in particular anonymity is a crucial underpinning of freedom of expression on the internet. I’m sure you will have read his report – and will have realised that your insistence on people using real names when they use your services is a mistake. I imagine, indeed, that you’re already preparing to reverse those policies, and come out strongly for people’s right to use pseudonyms – particularly you, Mark, as Facebook is so noted for its ‘real names’ policy. As supporters of privacy, there can’t be any other way – and now that you’re both so clearly in the privacy-supporting camp, I feel confident that you’ll make that choice. I’m looking forward to the press releases already.

Data Protection Reform

As supporters of privacy, I know you’ll be aware of the current reform programme going on with the European Data Protection regime – data protection law is strongly supportive of individual privacy, and may indeed be the most important legal protection for privacy in the world. You might be shocked to discover that there are people from both of your companies lobbying to weaken and undermine that reform – so I’m sure you’ll tell them at once to stop that lobbying, and instead to get solidly behind those looking for better protection for individual privacy and stronger rights to protect themselves from tracking and misuse of their data.  As you are now the champions of individual privacy, I’m sure you’ll be delighted to do so – and I suspect memos have already been issued from your desks to those lobbying teams ordering them to change your stance and support rather than undermine individuals’ rights over their data. I know that those pushing for this reform will be delighted by your new found support.

That support, I’m sure, will build on Eric Schmidt’s recent revelation that he thinks the internet needs a ‘delete’ button – so you’ll be backing Viviane Reding’s ‘right to be forgotten’ and doing everything you can to build in easy ways for people to delete their accounts with you, to remove all traces of their profiling and related data and so on.

Geo-location, Facial Recognition and Google Glass

Your new found zeal for privacy will doubtless also be reflected in the way that you deal with geo-location and facial recognition – and in Larry’s case, with Google Glass. Of course you’ve probably had privacy very much in the forefront of your thoughts in all of these areas, but just haven’t yet chosen to talk about it. Moving away from products that gather location data by default, and cutting back on facial recognition except where people really need it and have given clear and properly informed consent will doubtless be built in to your new programs – and, Larry, I’m sure you’ll find some radical way to cut down on the vast array of privacy issues associated with Google Glass. I can’t quite see how you can at the moment, but I’m sure you’ll find a way, and that you’re devoting huge resources to do so.

Supporting privacy

We in the privacy advocacy field are delighted to have you on our side now – and look forward greatly to seeing that support reflected in your actions, and not just in relation to government surveillance. I’ve outlined some of the ways that this might be manifested in reality – I am waiting with bated breath to see it all come to fruition.

Kind regards

Paul Bernal

P.S. Tongue very firmly in cheek