Alessandra Silveira (Editor) and Alexandre Veronese (Professor at University of Brasília)
▪
Thoughts regarding the right to deindexation and the weaknesses of the idea of “being forgotten” online – marking the Data Protection Day
28 January 2021 marks the 15th “Data Protection Day” and the 40th anniversary of the Council of Europe’s Convention 108 – the first international legal instrument regarding personal data protection – which was opened for signature on 28 January 1981.
What began as a European celebration is now a yearly commemoration all around the world. This year, to mark the occasion, the Ibero-American Network for Data Protection and the Council of Europe promoted an event targeted to Latin America. It is interesting to know that, coincidentally, the Brazilian Federal Supreme Court (STF) will hear on 3 February a case regarding a type of “right to be forgotten.” This right is the subject inspiring this essay. In light of this fact, it is essential to assess the (jus)fundamental dimension of the right to deindexation and the weakness of the idea of “being forgotten” online.[i]
That Brazilian case does not deal with a matter related to deindexation/dereferencing/delisting[ii] from search engines, as known to European Union law. The question sub judice relates to a television program that covered old crimes (“Linha Direta”[iii]). The victim’s family requested excluding the content since it is widely accessible through several digital spaces. From this case, the Brazilian Superior Court of Justice (STJ) drew inspiration to bring about a broader debate regarding the matter of the “right to be forgotten” and the possibility (or lack of it) of this exclusion. In addition to this case,[iv] the STJ analyzed (or is in the process of analyzing) two other cases that may have relevance to being forgotten online. The first of the other cases determined the exclusion of the name and image of a police officer who was acquitted in a criminal case known as “Chacina da Candelária,”[v] in which minors were brutally assassinated in the middle of the street.[vi]/[vii]
The second case has a more specific link to the concept of deindexation from search engines. It addresses a pledging from a member of the Public Prosecutors Office of Rio de Janeiro State, which requests the deindexation of her name from Google and Yahoo results. When someone types for a piece of old news about some fraud, her name appears. The case does not discuss the deletion of the news pieces to which the hyperlinks connect, but only the search engines’ deindexation. For now, the case is still open since an appeal to the STF is still possible. However, the STJ upheld the Court of the State of Rio de Janeiro’s decision, which ordered the hyperlinks’ deindexation.
However, the case currently before the STF and scheduled to be judged on 3 February may go significantly further and have a more significant impact on the legal order. One must not forget that it is an Extraordinary Appeal whose decision will establish a leading case, with a binding effect on courts nationwide.[viii]
In the meantime, the question persists, can one be indeed “forgotten” on the internet?
In Google Spain (C-131/12), the Court of Justice of the European Union (CJEU) address whether data subjects have the right to request that some search results connecting to specific personal data-related search queries cease to be available online. Through its preliminary ruling, the CJEU recognized the right to deindexation of personal data contained within a third-party website accessible through a search engine’s results. The search engine is responsible for carrying out the deindexation. The results make it available that users can find the personal data source (any page on the internet).
The question under judgment is related to protecting fundamental rights, namely the fundamental right to data protection (as established in Article 8 of the Charter of Fundamental Rights of the European Union). One can only pledge this right against search engines acting as a data controller like Google, Bing, Ask, and others. These entities use their technology, collect, temporarily store and finally make available to the internet users in an ordered manner, certain information uploaded by others. In this case, the CJEU considers that Google engages in data processing operations as a controller. After all, its business model raises profits from the user’s data by selling target advertising space. This whole context makes Google a for-profit controller of personal data. Therefore, Google is also responsible for delisting entries when some legal circumstances are present.
The data subject requests protection against disseminating one’s data by the right to deindexation against search engines. This right exists regardless of whether the inclusion in the search engine’s results causes damages to the data subject. It is a fundamental rights-based analysis in which the CJEU considers that the data subject’s rights and interests overrule the search engine’s economic interests and general public knowledge to access the information. An exception to this general understanding is some situation in which the pledging person plays a relevant role in public life, therefore requiring public access to information. However, even in those cases, it is still necessary to assess how sensitive the information.
Because the search engine is required to suppress the connection to the results that the data subject does not wish to see disseminated, scholars quickly describe this right as a “right to be forgotten.” Such a conclusion is, in fact, not correct. No one will be forgotten from the internet since there no content deletion. Some confusion may arise due to the wrongful use by the Advocate-General Niilo Jääskinen of the expression “right to be forgotten” in his conclusions in Google Spain. The European legislator would then use the same expression in the General Data Protection Regulation. Still, it is essential to keep in mind that Google Spain was the first time the CJEU was called upon to address personal data processing legislation when applied to search engines. Understandably, some considerations need some time to be adequately developed. Of course, the legal scholars must cooperate in this development.
It is relevant to note that the idea of “being forgotten” has some tradition in the western legal culture. It directly comes from the 1969 German Lebach case. In this case, the German Constitutional Court forbade a television broadcaster from broadcasting a documentary about killing soldiers protecting an arms and ammunition dump, considering that one of the perpetrators’ personality rights should supersede the public interest in watching the documentary. There are plenty of nuances to this judgment that we will not be able to address here.[ix] However, one must question whether it is possible to think of the concept and the idea of forgetting on the internet nowadays in the same manner of the past century. We deem it unlikely since suppressing the hyperlink will not delete information from the original website. It only requires the search engine to break the connection between the queries, the responses, and the personal data. In other words, the right to deindexation requires the search engine to delist some search results. However, the original information is still there, and whoever wants it will still find it.
In this manner, the ruling in Google Spain was sufficiently clear on several extremely relevant aspects. First, the existence of processing of personal data by search engines. Second, the search engines status as data controllers under EU law. Third, the EU’s data protection rules’ applicability even if the defendant does not has its headquarters in the EU. Fourth, a search engine should suppress specific results containing personal data at the data subject’s request. Fifth, the ruling defines the extension, range, and substantial limits to specific the data subjects’ rights. In this ruling, the CJEU considers that everyone has the right not to have all kinds of information about oneself widely available on the internet through results from search engines. Some limits may apply. Also, this right does not require previous proof of actual damage.
[i] For further development in Portuguese, see Alessandra Silveira, A dimensão jusfundamental do direito à desindexação – deslindando as fragilidades de um suposto “esquecimento” online, Rogério Gesta Leal/Carlos Aymerich Cano/Alessandra Silveira (eds.), “V Seminário Internacional Hispano-Luso-Brasileiro sobre Direitos Fundamentais e Políticas Públicas” (University of Santa Cruz do Sul – UNISC, Santa Cruz do Sul/RS/Brazil, 2019), https://www.unisc.br/pt/home/editora/e-books?id_livro=493.
[ii] We will not address the controversy around which of these three concepts is the most adequate to describe the right set out in the Google Spain ruling. This conceptual debate is not relevant to the point we are trying to make here. For all purposes, within this blog post, the concepts shall be used interchangeably.
[iii] In English, “Direct Line.”
[iv] Extraordinary Appeal Nº 1.010.606/RJ in the STF and Special Appeal N.º 1.335.153/RJ in the STJ. See, https://www.conjur.com.br/dl/direito-esquecimento-acordao-stj.pdf.
[v] In English, the “Candelária Killings.”
[vi] Special Appeal Nº 1.334.097/, https://www.conjur.com.br/dl/direito-esquecimento-acordao-stj.pdf.
[vii] For further information regarding the case-law in Brazil regarding the right to be forgotten, see Mario Viola de Azevedo Cunha and Gabriel Itagiba, Between privacy, freedom of information and freedom of expression: Is there a right to be forgotten in Brazil?, Computer Law & Security Review 32,4 (2016): 634-641.
[viii] Through the legal institute of “Repercussão Geral,” the most recent attempt in Brazilian constitutional law of establishing a binding precedent in line with what exists, for example, in the US, with US Supreme Court decisions, though not entirely analogous the Court of Justice’s decisions in the EU, despite also binding and to be followed by national courts.
[ix] For further information, Nicole Jacoby, Redefining the Right to Be Let Alone: Privacy Rights and the Constitutionality of Technical Surveillance Measures in Germany and the United States, Georgia Journal of International and Comparative Law 35,3 (2007): 433-493.
Pictures credits: Social Media by Daniel_B_Photos.
Official Blog of UNIO 