The EU’s Right to be Forgotten: Overly Burdensome?

In May earlier this year, the European Union’s top court held in favor of an individual who requested that Google remove the search results associated with his name.  In this particular case, a Spanish citizen requested that Google Spain remove an auction notice of his repossessed home from its search results, as the proceedings had been resolved for a number of years. The court held that individuals have the right to require search engines to remove personal information about them if the information is “inaccurate, inadequate, irrelevant or excessive.” This precedent established the “right to be forgotten,” which gives Europeans the right to require search engines to remove information about them from search results for their own names.  The ruling has not been met with universal applause, and in fact a U.K. House of Lords subcommittee recently declared the right to be forgotten misguided in principle and unworkable in practice.

Over the past few months, there has been an opportunity to see the scale of the impact of the right to be forgotten.  Since the decision Google has responded to upwards of 91,000 requests from individuals to remove links from its European search results. This number only represents 50% of the links that it has processed, with the remaining percentage of requests requiring follow-up by Google with the individual requestor in order to process the request. This creates a burden on Google for a number of reasons:

· Google must dedicate personnel to receiving and responding to requests.  Given that the standard for removal is subjective (is the information inaccurate, inadequate, irrelevant or excessive?),
Google itself has to be the arbiter of the requests.

· Google has to maintain and bear of the cost of tools needed to track the information and remove it from its search results.

· Even if the requested information is removed, what happens if the same information can be inferred through the analysis of Big Data? If the data is anonymized and analyzed through software analytics, it is no small task to try to reverse engineer the removal of the information. Where does Google’s responsibility to scrub the information end?

This is not just an issue for companies located in Europe.  The EU Court said that “even if the physical server of a company processing data is located outside of Europe, EU rules apply to search engine operators if they have a branch or a subsidiary in a Member State which promotes the selling of advertising space offered by the search engine.”

Meanwhile, in the White House special report on Big Data issued in May earlier this year, the report recommended that “[t]he United States should lead international conversations on big data that reaffirms the Administration’s commitment to interoperable global privacy frame-works.” How will the right to be forgotten factor into establishing a global privacy framework? Neither Congress nor the U.S. courts have shown much of an appetite for adopting a stance similar to the European court, so there is little chance that the right to be forgotten will be established in the United States. The fact that the EU has adopted the right to be forgotten while the United States appears unwilling to walk down the same path serves to highlight some of the difficulties that we face in establishing a global privacy framework.