Remember the "right to be forgotten"? It's been a year since the EU Court of Justice ruled that search engines must "delist" out-of-date or inaccurate links in results if requested, and the anniversary has been marked with a set of stats from Google—and a demand for more data from 80 academics.
The law was actually in place well before last May, but it was then that it was upheld in a court case brought by a Spanish man. From that point, the EU required Google's European sites—as well as rivals such as Bing—to remove links when requested if they meet a set of data protection criteria. Regulators left it for Google to decide which requests to approve or not, and it now has a team of lawyers analysing each one.
The controversy around the right to be forgotten hasn't calmed: the UK's data watchdog is questioning Google's decisions, academics are calling for more transparency over the process, and the EU is pushing to extend the delinking effort to Google's global sites.
In the year since Mario Costeja Gonzalez set a precedent by asking for a news page to be removed from results for his name, Google has received 254,271 requests to delink 922,638 URLs across Europe, of which fewer than half have been approved for removal.
Those numbers may sound high, but Paul Bernal, law lecturer at the University of East Anglia, put them into context for me. "In practice, [the statistics] reveal that there is a real desire or need for the right to be forgotten, but that this need is not so huge to be either unmanageable or a really significant threat to freedom of expression or the right to information," he said. Those are all arguments are commonly brought up against the EU ruling. "They pale into insignificance, for example, compared to the figures for delisting in relation to copyright, and Google's resources should easily be able to cope with them," added Bernal.
Of the requests it's processed so far, Google has approved 41 percent, meaning the majority of demands are being refused. Here in the UK, the number of approvals is slightly smaller, at 37 percent.
Google highlighted a few cases to show the types of requests it receives. One from Belgium reads: "An individual who was convicted of a serious crime in the last five years but whose conviction was quashed on appeal asked us to remove an article about the incident. We removed the page from search results for the individual's name."
Here's another from the UK: "A media professional requested that we remove four links to articles reporting on embarrassing content he posted to the internet. We did not remove the pages from search results."
"For the most part, Google are getting the balance right."
While such examples sound reasonable, some Europeans have complained to their local data protection watchdogs about Google's refusal to delink in some cases. In the UK, the Information Commissioner's Office told the BBC it was in talks with Google over 48 requests that it believed the web giant had judged incorrectly.
The ICO has received 183 complaints in total so far, and in three-quarters of cases it agreed with Google. That suggests that "for the most part, Google are getting the balance right," the watchdog said, but added that there were still "a significant number of cases where we believe Google haven't got it quite right and they have been asked to revise their decision."
So is the right to be forgotten working? In Bernal's opinion, the overall idea is sound, but there are some flaws in practice. The most important to him "is that Google is not being nearly transparent enough about the delistings."
Time for transparency
The transparency of Google's implementation of the right to be forgotten is an issue that was raised Thursday in an open letter from 80 academics—including Bernal and Julia Powles, a law researcher at the University of Cambridge who told me she'd been asking the same questions of Google about the right to be forgotten every month "and got fed up".
"They understand the power of information more than anyone."
The academics are looking for aggregate data from Google about the requests it receives and how it deals with them, which would let data watchdogs and the public scrutinise the decisions it's making and reveal the sorts of information people consider most private. This could help inform privacy and data policy going forward.
"We should know if the anecdotal evidence of Google's process is representative: What sort of information typically gets delisted (e.g., personal health) and what sort typically does not (e.g., about a public figure), in what proportions and in what countries?," the letter notes.
Powles argued that Google clearly has such data, and its apparent unwillingness to share is not about privacy, but power. "They understand the power of information more than anyone," she said.
Google hasn't yet responded to Motherboard's request for comment, but told the Guardian: "Our transparency report is always evolving and it's helpful to have feedback like this so we know what information the public would find useful. We will consider these ideas, weighing them against the various constraints within which we have to work—operationally and from a data protection standpoint."
EU regulators, meanwhile, are eyeing up increased coverage. At the moment, Google delinks URLs in results on its European websites, but not Google.com. European Commissioners and data regulators have suggested they want that to change.
"We want the removals to be applicable on all Google sites," Isabelle Falque-Pierrotin, head of France's data protection regulator, CNIL, told The Wall Street Journal. "Their position will have to change."
That may be seen as overreach—why should European laws extend to the US?—but it's worth noting that Google already delinks many more websites across all of its properties deemed to contain copyright infringement under American laws.
"I don't think it's likely that Google will roll it out globally in the short term—the First Amendment argument in the US is still too strong—but I wouldn't rule it out in the long term," noted Bernal. "Google is being subject to more regulation generally, on both sides of the Atlantic, and this can only be expected to continue. The next year or so will be very interesting for Google and regulators generally."