GOOGLE AND THE RIGHT TO BE FORGOTTEN

Original Story: newyorker.com

On October 31, 2006, an eighteen-year-old woman named Nikki Catsouras slammed her father’s sports car into the side of a concrete toll booth in Orange County, California. Catsouras was decapitated in the accident. The California Highway Patrol, following standard protocol, secured the scene and took photographs. The manner of death was so horrific that the local coroner did not allow Nikki’s parents to identify her body.

 “About two weeks after the accident, I got a call from my brother-in-law,” Christos Catsouras, Nikki’s father, told me. “He said he had heard from a neighbor that the photos from the crash were circulating on the Internet. We asked the C.H.P., and they said they would look into it.” In short order, two employees admitted that they had shared the photographs. As summarized in a later court filing, the employees had “e-mailed nine gruesome death images to their friends and family members on Halloween—for pure shock value. Once received, the photographs were forwarded to others, and thus spread across the Internet like a malignant firestorm, popping up on thousands of Web sites.”

Already bereft of his eldest daughter, Catsouras told his three other girls that they couldn’t look at the Internet. “But, other than that, people told me there was nothing I could do,” he recalled. “They said, ‘Don’t worry. It’ll blow over.’ ” Nevertheless, Catsouras embarked on a modern legal quest: to remove information from the Internet. In recent years, many people have made the same kind of effort, from actors who don’t want their private photographs in broad circulation to ex-convicts who don’t want their long-ago legal troubles to prevent them from finding jobs. Despite the varied circumstances, all these people want something that does not exist in the United States: the right to be forgotten.

The situation is different in Europe, thanks to a court case that was decided earlier this year. In 1998, a Spanish newspaper called La Vanguardia published two small notices stating that certain property owned by a lawyer named Mario Costeja González was going to be auctioned to pay off his debts. Costeja cleared up the financial difficulties, but the newspaper records continued to surface whenever anyone Googled his name. In 2010, Costeja went to Spanish authorities to demand that the newspaper remove the items from its Web site and that Google remove the links from searches for his name. The Spanish Data Protection Agency, which is the local representative of a Continent-wide network of computer-privacy regulators, denied the claim against La Vanguardia but granted the claim against Google. This spring, the European Court of Justice, which operates as a kind of Supreme Court for the twenty-eight members of the European Union, affirmed the Spanish agency’s decisions. La Vanguardia could leave the Costeja items up on its Web site, but Google was prohibited from linking to them on any searches relating to Costeja’s name. The Court went on to say, in a broadly worded directive, that all individuals in the countries within its jurisdiction had the right to prohibit Google from linking to items that were “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.”

The consequences of the Court’s decision are just beginning to be understood. Google has fielded about a hundred and twenty thousand requests for deletions and granted roughly half of them. Other search engines that provide service in Europe, like Microsoft’s Bing, have set up similar systems. Public reaction to the decision, especially in the United States and Great Britain, has been largely critical. An editorial in the New York Times declared that it “could undermine press freedoms and freedom of speech.” The risk, according to the Times and others, is that aggrieved individuals could use the decision to hide or suppress information of public importance, including links about elected officials. A recent report by a committee of the House of Lords called the decision “misguided in principle and unworkable in practice.”

Jules Polonetsky, the executive director of the Future of Privacy Forum, a think tank in Washington, was more vocal. “The decision will go down in history as one of the most significant mistakes that Court has ever made,” he said. “It gives very little value to free expression. If a particular Web site is doing something illegal, that should be stopped, and Google shouldn’t link to it. But for the Court to outsource to Google complicated case-specific decisions about whether to publish or suppress something is wrong. Requiring Google to be a court of philosopher kings shows a real lack of understanding about how this will play out in reality.”

At the same time, the Court’s decision spoke to an anxiety felt keenly on both sides of the Atlantic. In Europe, the right to privacy trumps freedom of speech; the reverse is true in the United States. “Europeans think of the right to privacy as a fundamental human right, in the way that we think of freedom of expression or the right to counsel,” Jennifer Granick, the director of civil liberties at the Stanford Center for Internet and Society, said recently. “When it comes to privacy, the United States’ approach has been to provide protection for certain categories of information that are deemed sensitive and then impose some obligation not to disclose unless certain conditions are met.” Congress has passed laws prohibiting the disclosure of medical information (the Health Insurance Portability and Accountability Act), educational records (the Buckley Amendment), and video-store rentals (a law passed in response to revelations about Robert Bork’s rentals when he was nominated to the Supreme Court). Any of these protections can be overridden with the consent of the individual or as part of law-enforcement investigations.

The American regard for freedom of speech, reflected in the First Amendment, guarantees that the Costeja judgment would never pass muster under U.S. law. The Costeja records were public, and they were reported correctly by the newspaper at the time; constitutionally, the press has a nearly absolute right to publish accurate, lawful information. (Recently, an attorney in Texas, who had successfully fought a disciplinary judgment by the local bar association, persuaded a trial court to order Google to delete links on the subject; Google won a reversal in an appellate court.) “The Costeja decision is clearly inconsistent with U.S. law,” Granick said. “So the question is whether it’s good policy.”

One of the intellectual godfathers of the right to be forgotten is Viktor Mayer-Schönberger, a forty-eight-year-old professor at Oxford. Mayer-Schönberger grew up in rural Austria, where his father, a tax lawyer, bought a primitive modem for the family in the early nineteen-eighties. Viktor became active on computer bulletin boards, and he wrote an early anti-virus program, which he sold when he was in his twenties. “My father indulged my interest in computers, but he really wanted me to take over his law practice,” Mayer-Schönberger told me. He went to Harvard Law School. His early experience with computers, combined with his anti-virus business, prompted his interest in the law of data protection.

“The roots of European data protection come from the bloody history of the twentieth century,” Mayer-Schönberger said. “The Communists fought the Nazis with an ideology based on humanism, hoping that they could bring about a more just and fair society. And what did it look like? It turned into the same totalitarian surveillance society. With the Stasi, in East Germany, the task of capturing information and using it to further the power of the state is reintroduced and perfected by the society. So we had two radical ideologies, Fascism and Communism, and both end up with absolutely shockingly tight surveillance states.”

Following the fall of Communism, in 1989, the new democracies rewrote their laws to put in place rules intended to prevent the recurrence of these kinds of abuses. In subsequent years, the E.U. has promulgated a detailed series of laws designed to protect privacy. According to Mayer-Schönberger, “There was a pervasive belief that we can’t trust anybody—not the state, not a company—to keep to its own role and protect the rights of the individual.”

In 2009, Mayer-Schönberger published a book entitled “Delete: The Virtue of Forgetting in the Digital Age.” In it, he asserts that the European postwar, post-Wall concerns about privacy are even more relevant with the advent of the Internet. The Stasi kept its records on paper and film in file cabinets; the material was difficult to locate and retrieve. But digitization and cheap online storage make it easier to remember than to forget, shifting our “behavioral default,” Mayer-Schönberger explained. Storage in the Cloud has made information even more durable and retrievable.

Mayer-Schönberger said that Google, whose market share for Internet searches in Europe is around ninety per cent, does not make sinister use of the information at its disposal. But in “Delete” he describes how, in the nineteen-thirties, the Dutch government maintained a comprehensive population registry, which included the name, address, and religion of every citizen. At the time, he writes, “the registry was hailed as facilitating government administration and improving welfare planning.” But when the Nazis invaded Holland they used the registry to track down Jews and Gypsies. “We may feel safe living in democratic republics, but so did the Dutch,” he said. “We do not know what the future holds in store for us, and whether future governments will honor the trust we put in them to protect information privacy rights.”

Without a right to be forgotten in American law, the Catsouras family had no means of forcing Google to stop linking to the photographs. “We knew people were finding the photos by Googling Nikki’s name or just ‘decapitated girl,’ but there was nothing we could do about it,” Keith Bremer, the family’s lawyer, told me. As an interim measure, Catsouras enlisted the help of Michael Fertik, who at the time had just founded Reputation.com, a company that tries to manipulate the results of Google’s search algorithm by seeding additional information on the Web. In this way, the less desirable links appear much lower in a Google search. Fertik also helped the family ask Web sites to take down the photos; many did. “We got the photos off at least two thousand Web sites,” Fertik told me. But they are still easy to find.

Convicted criminals who want to escape the taint of their records are also out of luck when it comes to petitioning Google. “Somewhere between sixty and a hundred million people in the United States have criminal records, and that’s just counting actual convictions,” Sharon Dietrich, the litigation director of Community Legal Services, in Philadelphia, told me. “The consequences of having a criminal record are onerous and getting worse all the time, because of the Web.” Dietrich and others have joined in what has become known as the expungement movement, which calls for many criminal convictions to be sealed or set aside after a given period of time. Around thirty states currently allow some version of expungement. Dietrich and her allies have focussed on trying to cleanse records from the databases maintained by commercial background-check companies. But Google would remain a problem even if the law were changed. “Back in the day, criminal records kind of faded away over time,” Dietrich said. “They existed, but you couldn’t find them. Nothing fades away anymore. I have a client who says he has a harder time finding a job now than he did when he got out of jail, thirty years ago.”

In the effort to escape unwanted attention on the Internet, individuals and companies have had success with one weapon: copyright law. It is unlawful to post photographs or other copyrighted material without the permission of the copyright holder. “I needed to get ownership of the photos,” Bremer, the Catsouras family’s lawyer, told me. So he began a lengthy negotiation with the California Highway Patrol to persuade it to surrender copyright on the photographs. In the end, though, the C.H.P. would not make the deal.

Other victims of viral Internet trauma have fared better with the copyright approach. In August, racy private photographs of Jennifer Lawrence, Kate Upton, and other celebrities were leaked to several Web sites. (The source of the leaks has not been identified.) Google has long had a system in place to block copyrighted material from turning up in its searches. Motion-picture companies, among others, regularly complain about copyright infringement on YouTube, which Google owns, and Google has a process for identifying and removing these links. Several of the leaked photographs were selfies, so the women themselves owned the copyrights; friends had taken the other pictures. Lawyers for one of the women established copyrights for all the photographs they could, and then went to sites that had posted the pictures, and to Google, and insisted that the material be removed. Google complied, as did many of the sites, and now the photographs are difficult to find on the Internet, though they have not disappeared. “For the most part, the world goes through search engines,” one lawyer involved in the effort to limit the distribution of the photographs told me. “Now it’s like a tree falling in the forest. There may be links out there, but if you can’t find them through a search engine they might as well not exist.”

The European Court’s decision placed Google in an uncomfortable position. “We like to think of ourselves as the newsstand, or a card catalogue,” Kent Walker, the general counsel of Google, told me when I visited the company’s headquarters, in Mountain View, California. “We don’t create the information. We make it accessible. A decision like this, which makes us decide what goes inside the card catalogue, forces us into a role we don’t want.” Several other people at Google explained their frustration the same way, by arguing that Google is a mere intermediary between reader and publisher. The company wanted nothing to do with the business of regulating content.

Yet the notion of Google as a passive intermediary in the modern information economy is dubious. “The ‘card catalogue’ metaphor is wildly misleading,” Marc Rotenberg, the president of the Electronic Privacy Information Center, in Washington, D.C., told me. “Google is no longer the card catalogue. It is the library—and it’s the bookstore and the newsstand. They have all collapsed into Google’s realm.” Many supporters of the Court’s decision see it, at least in part, as a vehicle for addressing Google’s enormous power. “I think it was a great decision, a forward-looking decision, which actually strengthens press freedoms,” Rotenberg said. “The Court said to Google, ‘If you are going to be in this business of search, you are going to take on some privacy obligations.’ It didn’t say that to journalistic institutions. These journalistic institutions have their own Web sites and seek out their own readers.”

Google doesn’t publish its own material, but the Court decision recognized that the results of a Google search often matter more than the information on any individual Web site. The private sector made this discovery several years ago. Michael Fertik, the founder of Reputation.com, also supports the existence of a right to be forgotten that is enforceable against Google. “This is not about free speech; it’s about privacy and dignity,” he told me. “For the first time, dignity will get the same treatment in law as copyright and trademark do in America. If Sony or Disney wants fifty thousand videos removed from YouTube, Google removes them with no questions asked. If your daughter is caught kissing someone on a cell-phone home video, you have no option of getting it down. That’s wrong. The priorities are backward.”

To see how Google’s system for complying with the Court’s decision worked, I spoke with David Price, a thirty-three-year-old lawyer for the company, in a conference room at Google headquarters. Price wore the unofficial uniform of the Googleplex: bluejeans, an untucked button-down shirt, and a cheerful demeanor. “After the decision, we all made frowny faces, but then we got down to work,” he said.

The job had two parts. The first was technical—that is, creating a software infrastructure so that links could be removed. This was not especially difficult, since Google could apply the system already in place for copyrighted and trademarked works. Similarly, Google had already blocked links that might have led to certain dangerous or unlawful activity, like malware or child pornography.

“The second issue was bigger,” Price explained. “We had to create an administrative system to intake the requests and then act on them.” The company designed a form that was accessible through the search pages for the countries covered by the decision. The form is now available in twenty-five languages. German users can find it at Google.de, Spanish users at Google.es. (It cannot be accessed directly through Google.com, the search page in the United States.) To file a claim, individuals are required to give their name—anonymous requests are not allowed—and provide the links to which they object. (Most applicants have submitted about four links each.) Petitioners are also required to provide “an explanation of why the inclusion of that result in search results is irrelevant, outdated, or otherwise objectionable,” according to the request instructions posted online. If it grants a request, Google then sends a notice to the Webmaster for the site hosting the links in question. This allows the publishers of that site to make their case for keeping the link as a search result.

To decide whether to remove the disputed links from its searches, Google has assembled dozens of lawyers, paralegals, and others to review the submissions. Price meets with the group twice a week to discuss its decisions and to try to maintain consistent standards. The main considerations are whether the individual is a public or a private figure; whether the link comes from a reputable news source or government Web site; whether it was the individual who originally published the information; and whether the information relates to political speech or criminal charges. Because the Court’s decision specifically said that a relevant factor should be “the role played by the data subject in public life,” Google is reluctant to exclude links about politicians and other prominent people. “There are hard calls,” Price told me.

Google has not released its decisions in any individual cases. But the company did tell me about some of its decisions in a way that disguises the parties involved. For example, Google agreed to what it termed a “request to remove an old document posted in an online group conversation that the requestor started,” and a “request to remove five-year-old stories about exoneration in a child porn case.” The company rejected a request from a “news outlet to remove content about it from another news outlet”; a “request from a public official to remove a news article about child pornography accusations”; and a “request for removal of a news article about a child abuse scandal, which resulted in a conviction.” The company declined, for the time being, to remove a 2013 link to a report of an acquittal in a criminal case, on the ground that it was very recent. Google also declined a request by a writer to remove links to his own work, on the ground that the articles were recent and deliberately made public by the author.

There have been controversies. Earlier this summer, the BBC received a notice that Google was deleting links to a blog post about Stanley O’Neal, the former chief executive of Merrill Lynch. Robert Peston, the BBC’s economics editor and the author of the post, wrote an indignant response, titled “Why Has Google Cast Me Into Oblivion?” The de-linking, Peston wrote, confirms “the fears of many in the industry that the ‘right to be forgotten’ will be abused to curb freedom of expression and to suppress legitimate journalism that is in the public interest.” How could a public figure like O’Neal succeed in sanitizing the links about him? When Peston looked into the decision more closely, he found that the request for the deletion appeared not to have come from O’Neal. Rather, it was “almost certain” that the deletion came from a request made by one of the commenters on his original piece—presumably, the commenter wanted his own comment forgotten. Googling “Stan O’Neal” still drew a link to Peston’s blog post, but Googling the commenter’s name did not. In any event, the contretemps illustrated the complexity of Google’s task in complying with the Court’s judgment. “We’re a work in progress,” Price told me.

The European Court’s ruling applied only to search engines, not to social-media sites, but the principles underlying the decision have also drawn attention and concern at Facebook, whose headquarters are fifteen minutes north of Google, in Menlo Park. Facebook posts are not public in the same way that search results are; most posts are generally visible only to “friends.” But the standards for access to posts are slippery and often poorly understood by the people who use the service. In light of this, the chances that photos on Facebook could stray in embarrassing directions may be even greater than the risk of unwanted results appearing in a Google search.

Elliot Schrage, Facebook’s vice-president of communications and public policy, told me, “On one thing, we are unambiguous. We always let people delete the content they create. If you put up a photo or a post, you always get to take it down.” But, while Facebook grants you the right to remove your own posts, what about others’ posts about you? Facebook allows users to “tag” photographs and videos to indicate the identity of the people who are portrayed. Users can untag themselves, but they can’t remove the actual photos. If you ask Facebook to remove photos, videos, or entire posts, a Community Operations team will consider your request. The team always removes pornographic posts, and it allows users to report a post that is “annoying” or “advocates violence” or “goes against my views.” In making these judgments, the team is guided by Facebook’s standards for acceptable expression. As with the Court’s decision on the right to be forgotten, the application of Facebook’s own terms leaves a lot of room for interpretation.

“There is an inevitable conflict between two distinct social values”—privacy and free speech, Schrage said. “The question is how do societies value those competing rights. Technology didn’t create the tension but just revealed it in a dramatic way.”

There are already signs that European regulators want to impose more restrictions on Google. At a July meeting in Brussels of European data regulators, known as the Article 29 Working Party, several officials suggested that Google had not gone far enough in complying with the Costeja decision. Some objected to Google’s practice of informing publishers when links that individuals objected to were deleted; such actions, they said, will merely encourage the republication of the material and thus cut against the Costeja decision. Some also pressed Google to eliminate the disputed search results from Google.com, the main search page, as well as from the country-specific search engines. In response to these concerns, a Google official wrote to the European working group that, in Europe, Google directs Internet searches to local country sites, and less than five per cent of European searches go to Google.com—searches by travellers, most likely. (Google has also assembled a working group of outside scholars to advise the company on complying with the Costeja decision.)

Still, the day may come when a single court decision covering twenty-eight countries, as in the Costeja case, looks downright appealing to Internet companies. Different countries draw the line on these issues in different ways, and that creates particular problems in the borderless world of the Internet. Now that the Court has issued its ruling in the Costeja case, the claim goes back to a Spanish court, since it was brought by a Spanish lawyer regarding a Spanish newspaper. “Many countries are now starting to say that they want rules for the Internet that respond to their own local laws,” Jennifer Granick, of Stanford, said. “It marks the beginning of the end of the global Internet, where everyone has access to the same information, and the beginning of an Internet where there are national networks, where decisions by governments dictate which information people get access to. The Internet as a whole is being Balkanized, and Europeans are going to have a very different access to information than we have.”

It is clear, for the moment, that the Costeja decision has created a real, if manageable, problem for Google. But suppose that the French establish their own definition of the right to be forgotten, and the Danes establish another. Countries all around the world, applying their own laws and traditions, could impose varying obligations on Google search results. “The real risk here is the second-order effects,” Jonathan Zittrain, a professor at Harvard Law School and director of the Berkman Center for Internet and Society, said. “The Court may have established a perfectly reasonable test in this case. But then what happens if the Brazilians come along and say, ‘We want only search results that are consistent with our laws’? It becomes a contest about who can exert the most muscle on Google.” Search companies might decide to tailor their search results in order to offend the fewest countries, limiting all searches according to the rules of the most restrictive country. As Zittrain put it, “Then the convoy will move only as fast as the slowest ship.”

Viktor Mayer-Schönberger believes that the European Court has taken an important first step. “It’s a pragmatic solution,” he said. “The underlying data are not deleted, but the Court has created, in effect, a speed bump.” In Germany, he explained, “if you quickly search on Google.de, you’ll not find the links that have been removed. But if you spend the extra ten seconds to go to Google.com you find them. You are not finding them accidentally, and that’s as it should be. This speed-bump approach gives people a chance to grow and get beyond these incidents in their pasts.”

The Internet’s unregulated idyll seems to be coming to an end, at least in Europe. That pleases Christos Catsouras. After the California Highway Patrol failed to turn over the copyrights, he and his family brought suit against it and the two employees who leaked the photographs, on a variety of grounds, including negligence, infliction of emotional distress, and invasion of privacy. Years passed as some of the charges were dismissed and then reinstated in the course of multiple motions and appeals. On the eve of trial, in 2012, more than five years after Nikki Catsouras’s death, the defendants settled with the family for nearly $2.4 million. Christos Catsouras believes that the ruling by the European Court of Justice represents a broader victory. “I cried when I read about that decision,” he told me. “What a great thing it would have been for someone in our position. That’s all I wanted. I would do anything to be able to go to Google and have it remove those links.”