Lux In Arcana: Decoding the Right to Be Forgotten in Digital Archives

Abstract

On 13 May 2014, the European Court of Justice ruled that search engines such as Google had a duty to respect EU citizens’ right to be forgotten. That is, the search engines—deemed “controllers” of information under the Directive—were obligated in some circumstances to remove or de-list links from search results that pertain to information that infringes on an individual’s rights under the Directive. In the fall of 2015, the Spanish Supreme Court found itself obligated to determine the application of the digital right to be forgotten in a different context: This time in a digital newspaper archive. However, since the right to be forgotten is purely judicially-created and not yet memorialized in a regulation (other than through judicial interpretations of the European Directive 1995/46/EC of the European Parliament and Council of 24 October on the protection of individuals with regard to the processing of personal data and on the free movement of such data), it is therefore appropriate to analyze Spain’s recent Supreme Court ruling as an indicator of the future of the right. What does this decision mean for the future of the right to be forgotten?

1. Introduction

In 2012, in celebration of the IV Centenary of the foundation of the Vatican Secret Archives, the Vatican Museum uncovered a selection of the Pope’s previously-secret records, covering a time-span that stretches from the VIII to the XX century. The stated purpose of the curated exhibition, named Lux in arcana, was “making the invisible visible” [1]. According to the museum, the exhibition’s Latin name, meaning light into darkness, “conveys the exhibition’s main objective: the light piercing through the Archive’s innermost depths enlightens a reality which precludes a superficial knowledge and is only enjoyable by means of direct and concrete contact with the sources from the Archive, that opens the doors to the discovery of often unpublished history recounted in documents.” Only through the inspection of original documents could the visitor “experience some famous events from the past” and “‘re-live’ the documents, that [would] come to life with tales of the context and the people involved.” Indeed, the first stage of the exhibition was named “Custodians of Memory.”

In a coincidental twist, a similar debate—about a different kind of “Custodian of Memory”—was raging among the highest levels of European legal circles: What would be the appropriate balance of privacy and freedom of speech for previously-published documents online? Who would be the custodian of their memories? Would search engines themselves be tasked with the gargantuan project of curating the exhibition of human history?

The same year, the European Union Commission (“EU Commission”) proposed a new General Data Protection Regulation (“GDPR”) that, amongst other things, specifically included a “right to be forgotten”[2]. The GDPR gives data subjects:

[T]he right to have his or her personal data erased and no longer processed […] where one of the following grounds applies:

(a)

[T]he personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed;

(b)

[T]he data subject has withdrawn his or her consent of objects to the processing of personal data concerning him or her;

(c)

[T]he processing of his or her personal data does not otherwise comply with this Regulation [3].

This provision requires a “controller” of personal data processing activities to erase certain personal data that is outdated, irrelevant, or inaccurate, to preclude further dissemination of such data, and to oblige third parties (such as search engines) to delete links to such potentially harmful data.

The proposed regulation was based on deeply-held and widely-accepted European privacy values: The European Convention on Human Rights protects privacy as a basic human right [4]. The European Union Data Protection Directive (“EU Privacy Directive”), adopted in 1995, requires “controllers” of personal data processing activities to adhere to certain standards with respect to the processing, dissemination, and accuracy of the information, as well as consent by the data subject to processing of certain classes of information [5]. While the GDPR and its formal codification of the right to be forgotten would not be fully implemented until 2018, European scholars and courts [6,7]—particularly in Spain—have repeatedly held that the right to be forgotten is implicit in extant laws, including the Privacy Directive , Article 8 of the European Convention for Human Rights , and Articles 1, 7, and 8 of the European Union’s Charter of Fundamental Rights [8]. The fundamental right to privacy has also been incorporated into the laws of EU member states, including Spain [9].

Yet, without governing regulation or consensus, the right to be forgotten seemed to be on unstable ground. Who would enforce the right? Would it be taken seriously? How would it be applied? To whom?

The definitive case became Google Spain SL v. Agencia Española de Protección de Datos [10]. When an Internet user entered plaintiff Mario Costeja Gonzalez’s name in Google’s search engine, the searcher was presented with links to pages of the La Vanguardia newspaper from 1998 that contained an announcement listing Costeja’s name in connection with a real-estate auction in an attachment proceeding. In 2010, the Spanish Data Protection Authority, ordered Google Spain and Google, Inc. to adopt the necessary measures to erase the data from its index and to render their future access impossible. Google Spain and Google, Inc. appealed, and these pressing issues were posed to the Court of Justice of the European Union (“CJEU”).

In May of 2014, the CJEU decided Google Spain v. Agencia Española de Protección de Datos (hereinafter, Google Spain) [10]. The CJEU held that a search engine like Google could be classified as a “controller” of personal data processing and may be obliged to delete certain search results that are found to be inaccurate, out-of-date, or irrelevant to the purposes for which they were originally processed.

By holding the search engines liable, the court legitimized the right to be forgotten and gave it international attention. Takedown requests rained on search engines, as EU citizens took advantage of a new system to remove their inaccurate, outdated, or irrelevant information from general search engine results.

A year later, the Spanish courts—the breeding ground of the fateful 2014 CJEU case—would again struggle with the particulars of the implementation of the right to be forgotten. This time, courts would determine the right’s vigor vis-à-vis a newspaper’s digital archive controlled by a news publisher, rather than the activity of a search engine. This Article studies in detail the 15 October 2015 ruling of the Spanish Supreme Court (hereinafter referred to as A & B v. El País) [11]. This Article argues that the reasoning and conclusions evidenced by this case may be a harbinger of an instable future for this burgeoning right.

2. Factual and Procedural Background of A & B v. El País

On 15 October 2015, the Spanish Supreme Court issued a decisive ruling interpreting the EU’s right to be forgotten.

The two plaintiffs (referred to as A & B) were former drug addicts. In the 1980s, A & B, along with a larger group, were arrested for drug trafficking. Upon detainment, the plaintiffs were treated for severe drug withdrawal. Neither plaintiff was a public figure, but someone accused alongside them was a relative of a known politician. In the days immediately following the arrests, El País Publications (hereinafter, El País or Ediciones El País, in Spanish) published a news story in El País newspaper identifying the plaintiffs by their full names and professions and detailing the affair, including the plaintiffs’ alleged drug addiction and withdrawal syndrome. The plaintiffs were found guilty of smuggling drugs into Spain and served prison terms. Subsequently, they fully rehabilitated and went on to reintegrate themselves into society, living otherwise uneventful lives as private citizens and professionals.

In November 2007, El País allowed general public access, free of charge, to its digitized periodical archive library, including the original story naming the plaintiffs and detailing their crimes. The archive was indexed by Internet search engines, and the plaintiffs’ full names appeared as keywords in the heading of the web page’s source code. As a result, a casual Internet search of the plaintiff’s names revealed a clear and prominent path to the original archived article, which appeared in a top position of search results. In fact, when one plaintiff’s full name was searched, the link to the old article appeared as the first result on both Google and Yahoo.

El País denied the plaintiffs’ requests to cease processing their personal data pursuant to Spanish and EU law. In 2011, the plaintiffs sued El País for violation of the right of privacy and honor in a Barcelona court [12]. A and B did not object to the original news story, but rather to its subsequent digital disclosure, indexing, and searchability, years after the events occurred. As such, the complaint requested that the publisher immediately cease processing the plaintiffs’ data and take down the article. Alternatively, the plaintiffs asked the trial court to order El País to implement technological measures to prevent indexing by search engines and by its own internal engine and anonymize the article to prevent any further identification of the plaintiffs. The plaintiffs also requested that request that any news story published on the pending legal matter leave out their identifying information and sought monetary damages for the violation of various personality rights.

The trial court concluded that disclosure of a person’s criminal record threatened that person’s honor, privacy, and the right to protection of personal data [12]. It noted that the information about A & B was no longer truthful, because they had already served their prison sentences and had their criminal records canceled (according to Spanish law, individuals who have served their sentences, have not committed another crime within a stated period of time, and have met other legal requirements may petition the Ministry of Justice for a cancelation of their records) [13].

Reasoning that only the original publication of the news story in the 1980s could be “informational”, the court held that the current digital dissemination was predominantly commercial, rather than informational, in nature. The dissemination of the story in digital format had the purely commercial purpose of increasing advertising revenues for the publisher—and El País’s financial interest could not take precedence over the rights to honor, privacy, and data protection of nonpublic figures [12].

Consequently, the Barcelona trial court found that El País’s dissemination of the news story beyond its own archive was a violation of the plaintiffs’ right to privacy, honor, and data protection [12]. It ordered El País to implement the appropriate technological measures to stop its indexation with search engine results. In addition, the court awarded the plaintiffs 7000 euros each in damages, plus court costs and attorneys’ fees. The ruling, however, did not require the publisher to eliminate the article from its archive or anonymize it by replacing full names with initials. The article would remain in its original form on El País’s website.

El País appealed, arguing that freedom of the press should prevail, given the article’s veracity and newsworthiness. The plaintiffs also challenged the trial court’s decision as inadequate: they demanded El País cease processing their personal data, eliminate their personal information from the source code, and/or anonymize the article.

The appeals court, known as the Provincial Court, affirmed the lower court’s judgment and found in favor of the plaintiffs’ challenge [14]. It ordered that Ediciones El País (1) cease using the plaintiffs’ personal information in the article’s source code; (2) anonymize the article to remove all identifying information; and (3) refrain from identifying the plaintiffs in news stories regarding the proceeding [14].

Against this procedural backdrop, the Spanish Supreme Court took up the first major case in a European national high court after Google Spain. The Court sought to define the scope of a budding right involving a set of new legal issues and a host of technical ones.

3. The Spanish Supreme Court’s Verdict: Balancing Freedom of Information against Rights to Honor, Privacy, and Data Protection

The Spanish Supreme Court was faced with balancing press freedom against the privacy of truthful, but long-past, information about a private figure. Google Spain provided clear guidance on this balancing:

“[the right to be forgotten] override[s], as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of inclusion in the list of results, access to the information in question.”

[10]

In other words, Google Spain suggested that the right to be forgotten should be robustly in favor of the individual, unless the information subject is a public figure, disclosure is in the public interest, or the information has a historic interest.

However, in this case, the Court concluded that none of the three exceptions were applicable: the data subject was a private figure, the amount of time lapsed faded the public’s interest in the matter, and the issue was not one of historical interest. As such, the defendant’s information processing violated the principles of data quality, including adequacy, relevance, and proportionality. Simply put, the fact that a simple Internet search of private citizens’ names revealed damaging information that occurred more than twenty years ago caused disproportionate damage and was not justified by the public interest.

The Supreme Court required Ediciones El País to take technological measures to ensure that generalist search engines could not index the subject articles [11]. A prohibition against general indexing allows for potentially noxious information to exist online in archives, without making it readily appear each time the person’s name is searched online when there is neither a public nor historical interest.

The Supreme Court rejected the lower court’s grant of other protective measures. First, it rejected the Provincial court’s order to anonymize or censor the original article and delete the plaintiffs’ personal data from the source code. It did so reasoning that digital newspaper archives are in a special category protected by freedom of information, so past news contained therein can never be erased or altered retrospectively [11].

The Court also allowed El País to continue indexing the plaintiff’s names on its own internal search engine. The Court reasoned that general search engines such as Google and Yahoo are fundamentally different from internal search engines because the latter are “only used to locate the information contained in the website itself once the user has accessed that website” [11].

4. Commentary on the Decision

Google Spain and other sources of the right to be forgotten can be criticized for their idealistic ambiguity. Although it is laudable to protect the individual from the real, undue, and indefinite reputational harm the internet can inflict, A&B v. Ediciones El País proves what many commentators feared: the practical reality of assessing what should be “forgotten” is anything but straightforward [15]. Additionally, in the interests of both privacy and freedom of speech, clarity is required. Unfortunately, the case does more parsing than clarifying and opts for sliding scales instead of bright lines. In the end, the Court may be offering distinctions that confuse, or worse, may serve to dilute the hard-fought right to be forgotten.

4.1. Digital Archives

Instead of conducting a case-specific balancing of interests, the Court put more focus on the “location” of information, rather than the nature of the information itself. In other words, the Court’s logic turns from the “what” of the information (the inquiry inherent in the data quality principle) to the “where” of the information—and in that inquiry spends an undue amount of time on assessing the status of a newspaper’s digital archive as if it were a cognizable place.

The Court reasoned that although the European Court for Human Rights (“ECHR”) had held that digital archives are protected by well-established tenets of press freedom [16], digital archives deserved less protection than current news reporting because it is a secondary function of the press [11]. According to the Court’s logic, the internet—and, by extension, digital archives—are fundamentally different from print journalism reporting current news, because the digital form allows for wider accessibility for an indefinite duration. Moreover, the Court notes that journalists are bound to tighter controls and rules.

This focus on digital newspaper archives poses more questions than it answers. First, the Court is clear that archives are not a primary function of news agencies. Since it is secondary to current news reporting, somehow the Court concludes that they are less protected by freedom of the press. Second, the Court’s entire argument is centered on archives of traditional journalism. It remains unclear how other archives would fare under this reasoning. How about the digital archives of topical magazines or digital books? Or the archives of blogs or internet media? Do the archives of neighborhood magazines receive less protection because they are not nationally recognized? The assumption running through the judgment is that traditional print journalism holds a more revered place than other forms of disseminating knowledge and current events. In today’s world, this is a premise that will likely soon fall short and be further tested in the courts.

Moreover, the misguided focus on digital newspaper archives will establish an unprecedented legal circumvention: the task of filing information published in digital newspapers in the periodicals archives may leave the right to be forgotten diluted. Digital archives then turn into surprising guests to the legal drafting and specification of the right to be forgotten, as places unassailable to the filtering of information, which thus becomes hidden, but inerasable. Thus, the classic postulates for the protection of personality rights are disregarded. Protection of personal data, as one of the specific embodiments of the rights to reputation, personal, and family privacy—and to one’s image—cannot take place while a news story, being truthful and having been newsworthy (even though it currently may not be), has been housed in the periodicals archive. The right will then only serve to eliminate the trail of subjective, biased, and/or disturbing information that is not found in a periodicals archive.

The Spanish Supreme Court’s blunder takes shape in offering news editors (thus stated, without qualification) a suitable refuge immune to any legitimate claim to “forget” (should be stated as “erase”) data that, even though they were truthful, are now proven irrelevant; but irrelevant relative to the subject’s personality rights.

4.2. Data Quality and the Effect of Time on Privacy

While the Court saved the right to be forgotten from the twisted logic of the lower courts (as discussed below), the Court struggled with its own reasoning—specifically on the effect of time on relevance. According to the decision, truthful, current news receives the highest protection; however, truthful news on digital archives receives less-intense protection due to its presumed diminishing relevance. The Spanish High Court takes great pains to explain that while time does not make the information less true, it does make it less relevant, and therefore more susceptible to be taken down by its subjects under their right to be forgotten.

The Supreme Court first analyzes the qualities of the subject information: Does the digital re-publication of an original article reporting a crime that occurred over twenty years ago violate the standards of data quality? Is the data accurate and truthful? Is it adequate? Relevant? Is it excessive relative to the scope and purposes for which they have been obtained? Does it have to be true and relevant today, or is the test applied to the date of its original publication? Once true, accurate, and relevant, would it always remain so?

The Court first focuses on the truthfulness and adequacy of the subject information as key indicators of data quality. Unlike the lower court, the Supreme Court concedes that the news is indeed true [11]. The passage of time has not caused it to lose its original truthfulness. However, the Court adds a significant nuance in analyzing the information’s adequacy. In order to observe the principle of data quality, the subject data must be adequate both at the time when information was collected and made available to the public and it must remain true to its original purpose over time. According to the Supreme Court, then, adequacy of information must be related to its principal measurement parameter: time. As the news becomes older, it becomes stale and no longer in line with its original purpose. One can imagine that the story’s original purpose was to report current events and keep the public informed of crime in their community. As time wore on, the news was no longer current, and the crimes reported became less relevant vis-à-vis the public’s need to know. The Court cited what it viewed as parallel examples: a Spanish law clearing negative credit history after six years and other bankruptcy norms that render the debtor’s personal information inaccessible after a given time period [11]. The Court suggests that these rules mirror its current reasoning: the fact of the debts or negative credit does not become untrue with the passing of time, but it does (in the Court’s estimation) become inadequate to report.

The Court’s logic is laudable in its effort to protect privacy, yet it falls short in several important ways. First, the only truth the public can be assured of is the fact that the article accessed was part of the digital archive, and therefore likely appeared as shown in the original print newspaper. In other words, we cannot be assured of the truth of the content merely because it was printed in the newspaper of the day (Note, however, that the truthfulness of the article was not in dispute here).

Second, the Court concludes that time necessarily diminishes informational relevance, pointing to several well-established statutes and norms providing a statute of limitations for the disclosure of certain harmful information, such as bankruptcies and criminal judgments. If the Court’s intention is to provide a time-limited safe-harbor for certain information, it should have suggested clearer time limits and boundaries for such, instead of generally suggesting that events that took place “long ago” somehow lose relevance because of their age. In the case at hand, the crime was committed over twenty years ago—a clear slam-dunk in the court’s assessment of irrelevance. However, how would the court judge a crime that took place 15 years ago? 10? 5? What if it was twenty years ago, but many people were harmed by a criminal, but otherwise not historic, happening? The public and the legal community would have greatly benefited from a clearer test giving guidance.

For many reasons, judging “relevance” becomes tricky and overly subjective, especially when the conclusion forces information on or off the internet forever. For one, relevance can only be judged from today’s vantage point. We can all conjure scenarios in which subsequent events revive the relevance or newsworthiness of information. What if years from now a copycat crime occurred? What if a now-unknown effect of the crime later comes to light? What if the data subject decides to run for office subsequent to the article’s removal? These hypotheticals show that while the likelihood of relevance may diminish with time, it never disappears. For these reasons, and for the health of the right to be forgotten, it is imperative that courts and legislatures give instruction on the right’s ambiguous guideposts.

4.3. Internal versus General Indexing

When the affected individual is not a public figure, the right to be forgotten grants them the opportunity to remove general search engine indexing of their names, but not the total removal from the site’s internal archive. In other words, the Court split the baby: the information would remain intact and internally searchable in the digital archive, but not generally accessible on an Internet search. In this way, the Court’s decision is line with the recommendations of the Article 29 Working Group, which specifically stated that “as a rule the right to delisting should not apply to search engines with a restricted field of action, particularly in the case of search tools of websites of newspapers.” [17].

Denying a newspaper archive the ability to internally index and search may be akin to throwing away the card catalog in a physical library. A person’s inability to easily find information would severely limit the functionality of a library or a digitized archive—and certainly harm the public. However, the Court was cognizant of the magnified reputational harm that would ensue if an archival search were made even easier on universal search engines. So, as a compromise of sorts, it opted to place the burden on the searcher to go to the right website first, thus rendering the information slightly less accessible. In effect, the decision creates more work for searchers and filters the information from those who have no specific information or reason to know of its availability elsewhere. By making it harder to find information, the Court is taking us back to the days when the information was accessible in a library basement on microfiche. Those who seek, may find—but not without labor.

4.4. Erasing, Altering, or Editing History

The Spanish Supreme Court should nevertheless be commended for cleaning up the mess the lower courts left behind. In analyzing the data quality, the trial court found that the information about A & B was no longer truthful, because they had already served their prison sentences and had their criminal records canceled. The Supreme Court clarified the error in noting that the information remained truthful and that time would not diminish its truthfulness, but instead refocused the argument on relevance and newsworthiness. The lower court’s conclusion—that a truthful event can become less so with the passing of time—is clearly erroneous, and generally points to the difficulty of assessing data quality, even by experienced courts.

The Supreme Court also reached the correct conclusion in reversing the lower courts’ orders to anonymize the article information. Anonymizing the article does not serve the public interest in having the information available. It leaves the plaintiffs uncertain because it did not finish profiling their right to data protection, and leaves the defendants with empty content. After all, what good is an article on a story that has been anonymized? Although some would say it is better than no article at all, that middle-of-the road solution neither inures the individual nor serves press freedom. Further, obliging publishers to anonymize or redact would certainly open a Pandora’s Box of questionably ethical journalistic behavior, not to mention a nightmare in practical terms.

5. Conclusions

In A & B v. El País, the Spanish Supreme Court had the unenviable task of acting as the Custodian of Memory—operationalizing the right to be forgotten in a case with many potential social and dignitary repercussions. Its seemingly straightforward task was to assess whether the data adhered to regulatory requirements, specifically whether it was accurate, adequate, relevant, and not excessive relative to the scope and purposes for which they have been obtained. To date, this exercise has been so underestimated that it has been delegated to the search engines themselves.

In analyzing data quality, the Court concluded that preservation of a news story about a private figure is only justified when its newsworthiness is not diminished. This is true, according to the Court, even when it is about a crime—generally an issue of public interest. One would imagine that under this rubric, the great majority of news stories would disappear from the collective record, so it is clear that the Court found that result to be disproportionately—and unreasonably—in favor of privacy. Instead, the Court opted to focus on place—and decide the case on that tenuous basis.

In the end, the most important lesson A & B v. El País offers about the right to be forgotten is that it needs further elucidation. Although a seemingly straightforward analysis, judging data quality and balancing it against the public’s right to know (however that is construed) is a formidable legal exercise with the power to shift the balance of information, privacy, and the future of the internet. Without clearer jus cogens and generally accepted principles of law and public policy, both privacy and freedom of information stand to lose going forward in the inevitable battles over the right to be forgotten.