The Expansion of European Union Citizens’ “Right to be Forgotten”
Written by: A.J. Battey
Internet search engines operating within the European Union can now be compelled to remove specific search results when requested to by private citizens. In May, the European Court of Justice in Google Spain v. AEPD and Mario Costeja Gonzalez (Costeja) ruled that Internet search engines such as Google are obliged to consider requests from individuals to delete specific hyperlinks to third-party websites from their search results. If a search engine refuses to do so, EU citizens have legal recourse through domestic authorities. Search engines that perform the act of indexing information outside of the European Union are not shielded from this ruling. Because Google promotes, sells, or advertises space in its search results within Spain, the Court reasoned, it was subject to the domestic data privacy law of Spain. Narrowly construed, Costeja will require major search engines to reform their policies and practices concerning the ability of individuals to control their presence on the Internet. Further, search engines can expect increased regulation and tighter supervision over how search results are viewed and recorded. More broadly, Costeja represents a shift in the balance of key fundamental rights and individual liberties in the EU, a trend that is in sharp contrast to traditional U.S. practice.
The European Union has been progressively expanding its data privacy laws since it proposed new guidelines in 2012, including the “right to be forgotten.” The “right to be forgotten” is the concept that an individual has the right to remove factually accurate but potentially damaging information from the Internet to prevent third-parties from accessing such information. Critics of the “right to be forgotten” declare it a direct assault on the well-established freedoms of speech and information and would undermine the significant public interest of Internet users to gain access to publically available information. However, contrary to the contention that requests to delete information will allow individuals to “whitewash” their personal presence online, the Court limited legitimate requests to search results that “appear to be inadequate, irrelevant, or no longer relevant or excessive in the light of the time that had elapsed.” However, Costeja was decided according to the current data protection laws in place, namely the 1995 European Data Protection Directive. The 2012 EU proposal is intended to be adopted in late 2014 and enforceable by 2016. Under the 2012 proposal, a “right to be forgotten” (the current preferred lexicon is the “right to erasure”) provides for the deletion of information “if there are no legitimate reasons for retaining it.” This formulation of the right is more expansive than the approach taken by the Court of Justice of the European Union. If the EU adopts this broader interpretation of the “right to be forgotten,” than it will likely come into direct conflict with the freedoms of speech and information.
United States data privacy law by contrast does not typically respect a “right to be forgotten.” The First Amendment right to free speech is so entrenched in American judicial practice that any attempt to limit it must pass constitutional scrutiny of the “highest order” of public interest, making a challenge unlikely to succeed.Additionally, Internet search engines are generally immune from suits concerning their provision of links to content provided by third-parties. While Internet search engines may have enjoyed the benefits of protection under a U.S. legal regime, Google and other search engines must enact protocols to successfully navigate the uncertain legal future of EU data protection law in respect to the individual’s right to control what is seen when their name is Googled by others.
 James Ball, Costeja Gonzalez and a memorable fight for the ‘right to be forgotten’, The Guardian (May 14, 2014, 11:34 AM), http://www.theguardian.com/world/blog/2014/may/14/mario-costeja-gonzalez-fight-right-forgotten.
 Case C-131/12, Google Spain v. Agencia Espanola de Proteccion de Datos and Mario Costeja Gonzalez, E.C.R. (May 13, 2014) available at http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&docid=152065 [hereinafter Google Spain v. APEC and Costeja].R 21.5.2(a).
 Commission Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), art. 17(1), at 51. COM (2012) 11 final (Jan. 25, 2012), available at http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf; See also Dave Lee, What is the ‘right to be forgotten’?, BBC News (May 13, 2014), http://www.bbc.com/news/technology-27394751.
 Rolf H. Weber, The Right to be Forgotten: More than a Pandora’s Box?, 2 JIPITEC 120, 120-21 (2011), available at http://www.jipitec.eu/issues/jipitec-2-2-2011/3084/jipitec%202%20-%20a%20-%20weber.pdf.
Index blasts EU court ruling on “right to be forgotten,” Index on Censorship (May 13, 2014), http://www.indexoncensorship.org/2014/05/index-blasts-eu-court-ruling-right-forgotten/.
 Google Spain v. APEC and Costeja, supra note 2.
 Volker Wodianka, Timeline to EU General Data Protection Regulation, Privacy Europe (April 29, 2013), http://www.privacy-europe.com/blog/timeline-to-eu-general-data-protection-regulation/.
 European Commission, How does the data protection reform strengthen citizens’ rights?, available at http://ec.europa.eu/justice/data-protection/document/index_en.htm (last visited Oct. 2, 2014).
 Weber, supra note 6, at 122.
 47 U.S.C. § 230 (1996) (amended 1998).