By Wanjiku Karanja

The so called “right to be forgotten” has arisen from claims of individuals who wish to have certain data relating to them deleted from the internet, so as to prevent 3rd parties from accessing it. Such requests encompass a wide scope of concerns ranging from revenge porn sites to references to crimes committed, appearing in search engine listings for a persons name, forming a prominent part of their digital footprint.
While such requests are made as an extension of a person’s right to privacy, the “right to be forgotten” is distinct in the sense that it involves the removal of information that is already in the public domain. The notion of this right is derived from European data protection laws such as the European Data Protection Directive (EU Directive 95/46EC) which was enacted to regulate the processing of personal data. Further, the European Court of Justice legally solidified this right in the case of Google Spain v AEPD & Mario Costeja Gonzalez.

In 1998, La Vanguardia, a Spanish newspaper, published two announcements of the forced sale of properties arising from social security debts. One of the properties described belonged to a Mario Costeja Gonzalez. Costeja “googled” himself in 2009 and found that the prominent result was the foreclosure notice of 1998. He then requested the newspaper to remove the data relating to him on the grounds that, the foreclosure, having been conducted nearly 10 years earlier, was no longer relevant. The newspaper however declined his request claiming that the data erasure would be inappropriate since its publication had been on orders from the Spanish Ministry of Labor and Social Affairs. Costeja then directed his concerns to Google Spain in February 2010, who then forwarded his request to Google Inc. in California. Costeja subsequently lodged a complaint with the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos; AEPD) asking that both the newspaper and Google Spain or Google Inc. be compelled to remove the links to the data. The Director of AEPD rejected the complaint against the newspaper but upheld the complaint against Google Spain and Google Inc., calling on them to remove the links in question and make access to the data impossible.
Google Spain and Google Inc. subsequently brought separate actions against the decision before Spain’s National High Court. This appeal was based on the following:
1. Google Inc. was not within the scope of the EU Directive 95/46/EC i.e. Data Protection Directive and its search engines did not fall under the purview of Google Spain.
2. The Search Engines did not process personal data i.e. data relating to a living individual who can be identified from the data or from the data in conjunction with other information that is, or is likely to come into, the possession of the data controller.
3. Even if the search engines processed personal data, neither Google Inc. nor Google Spain could be regarded as a data controller.
4. The data subject (Costeja) did not have the right to erasure of lawfully published material.
This action raised questions with regard to the interpretation of the Data Protection Directive as to its territorial scope, legal position of an Internet service provider under the Directive, if search engines could be regarded as data controllers and most importantly if the Directive established a so-called right to be forgotten.
Advocate General Jääskinen, while paying cognizance to the fact that the Data Protection Directive predates the Google era, gave his opinion as to these questions as:
1. Google’s business model brought both Google Inc. and Google Spain within the Directive’s scope.
2. While Google’s search activities involve the processing of personal data, it could not be regarded as a data controller when processing is carried out in an indiscriminate manner.
3. The rights of freedom of expression take precedence over any such “right to be forgotten”.

In a landmark judgment delivered on the 20th of June 2014, the Court of Justice of the European Union upheld the right of erasure stating that an internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties. The Court in its ruling considered the material scope of the Directive and rejected Google’s submission that it was not a data controller.
The Court further observed that Google Spain as a subsidiary of Google Inc. on Spanish territory qualified as an ‘establishment’ within the meaning of the Directive. It thus rejected Google Inc.’s argument that it was not carrying out its data processing in Spain and held that Google Inc. and Google Spain should be treated as a single economic unit.
The Court also stated that Article 7(f) of the Directive, relating to legitimacy of processing, required a balancing of the opposing rights and interests of the data subject (Costeja) and the data controller (Google), taking into account the data subject’s rights to respect for privacy and family life and protection of personal data, deriving from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, respectively. The Court did not explicitly grant the right to be forgotten, but held that processing of data which is “inadequate, irrelevant or excessive” (i.e. not merely inaccurate) is incompatible with Articles
6(1e-f) of the Directive and in such cases, the information and links in the list of the results must be erased. It is not necessary that the information is prejudicial to the data subject.
The significance of this judgment is that an internet search engine must consider requests from individuals to remove links to freely accessible web pages resulting from a search on their name. Grounds for removal include cases where the search result(s) are inadequate, irrelevant or excessive in the light of the time that had elapsed. As of 21st of August 2014, Google has received over 30 million deletion requests, mostly due to copyright violations and the Digital Millennium Copyright Act.
Questions have however been raised as to the practicality of establishing a “right to be forgotten” as an internationally recognized human right, due in part to the scarcity of jurisprudence and precedence on the issue. Furthermore, concerns have been raised as to its impact on: freedom of expression and the quality of the internet.
Proponents of the right to be forgotten argue that it is and should be treated as an extension of the right to privacy as an individual should not be stigmatized due to their actions in the past especially when such information is obtained and put on the internet without their consent, where it remains for posterity.
Opponents however argue that the recognition of this right impedes freedom of expression and amounts to censorship of the internet and rewriting of history. This is the case in the United States (US) where it is difficult to reconcile this right with the First Amendment to the US Constitution. The Index on Censorship described the Costeja ruling as “akin to marching into a library and forcing it to pulp books. Although the ruling is intended for private individuals it opens the door to anyone who wants to whitewash their personal history”.
Ultimately the Internet is a public space and the World Wide Web is a public record. While it is important to protect the privacy of individuals as regards to information on the Internet, public interest demands that relevant information is accessible should be upheld. It is also important to note that the Costeja ruling solely addressed the prominence of information in search engine results not the source material itself.