Applying the right to erasure to Bing, Yahoo! and other internet search engines
At a recent event at which we participated in a reputation panel discussion; we were asked how a data subject’s right to erasure (right to be forgotten) under the General Data Protection Regulation (GDPR) impacted internet search engines other than Google. That question, including the fact that it was asked, raises a number of issues that we discuss below.
The right to be forgotten
The concept of the ‘right to be forgotten’ is not a new one – relatively speaking and in the context of ‘internet years‘ – and can be traced back to as early as 2006, and a claim pursued against two fledgling internet search engines, namely Yahoo and Google, by Argentine model and musician, Virginia Da Cunha, who demanded the removal of content and sought injunctions in respect of search results of her name providing links to websites of an adult nature.
Fast-forward to 2014 and the case of Google Spain SL V Agencia Espaola de Proteccion de Datos (aepd) (C-131/12) (Google Spain) and the Court of Justice of the European Union’s (CJEU) landmark decision that data subjects do, indeed, enjoy the right to be forgotten. The CJEU interpreted the European Data Protection Directive (the Data Protection Directive) and the Charter of Fundamental Rights of the European Union as creating a qualified right to be forgotten. It ruled that the complainant, a Spanish man who requested the removal of URLs from a Google search result that linked to a copy of a 1998 article about an auction of his home for the recovery of a social security debt that he subsequently paid, was entitled to have Google de-list the URLs. It ruled that, on application by a data subject, a national data protection authority or the court can order an internet search engine (so not just Google) to remove URLs to webpages published by third parties containing information relating to that person from search results. The decision of the CJEU in Google Spain was not without its critics, with concerns raised as to its impact on the right to freedom of expression as well as censorship.
Since Google Spain
Since the decision in Google Spain, and at the time of writing, Google states that it has received 793,583 requests to de-list URLs, in respect of 3,079,297 URLs; and has de-listed 55.6% of these URLs. Google currently removes URLs EU-wide and since 2016 it also restricts access to such information on non-EU Google sites when accessed from the EU country where the person concerned by the information is located.
We had to wait a further four years before an English court considered and ruled on the application of the right to be forgotten principle established in Google Spain. When it did, there was a familiar face in court. The cases of NT1 and NT2 (whilst they were heard together and shared similar anonymising pseudonyms the cases were not related) concerned complaints made by two businessmen about Google’s refusal to de-list URLs from its search results that linked to third-party content about their respective criminal convictions many years ago. Both argued that the URLs linked to content which conveyed inaccurate information about their offending which was, in any event, out of date, irrelevant and of no public interest. Whilst NT2’s complaint was upheld, NT1’s complaint was refused. It was clear on any reading of the judgment in this case that the decisions reached by Warby J were on their own merits and specific to the particular facts and circumstances of each Claimant.
Shortly after judgment was handed down in the cases of NT1 and NT2, on 25 May 2018, the GDPR came into force codifying, at Article 17, the right to be forgotten. With reference to the impending implementation of the GDPR, Google’s own counsel in the NT1 & NT2 case referred to Article 17 as a setting out of the law as declared by the CJEU in Google Spain. Article 17 is in fact headed ‘Right to erasure (right to be forgotten)’. The principles are broadly the same and case law decided prior to the coming into force of the GDPR will no doubt be relevant to interpretation of Article 17.
Having become so synonymous with the internet and the world wide web, you might be excused for thinking that that Google is the only internet search engine available to users or that, at some point during the life of the internet, savvy Google executives manage to tie up the exclusive right to provide and operate the internet.
Whilst that is, of course, not the case, Google’s rise over its relatively short lifetime spanning 20 years has rarely been seen before. It is the world’s most popular and, you might say, powerful search engine. However, you choose to quantify that growth, by reference to its revenues; the number of its employees; the volume of advertisers; or simply by reference to the number of people using its search engine to query “what exactly does Brexit mean”, the statistics do not lie. Google’s global search engine market share currently stands at over 90%. A share of the market which it has maintained for many years.
There is a very real risk that all matters internet related will become genericised by reference to Google. If we have a question that we don’t know the answer to, we ‘Google’ it. If we need to carry out a search of the internet, we ‘do a Google search’. Even when we are not using Google’s Search to search the internet, we are still ‘Googling’.
As a legal practitioner, one particular issue that it might be said has already become genericised, or is at danger of becoming so, is the right to be forgotten. Frequently we read in the media that this is ‘Google’s right to be forgotten’, or ‘the right to be forgotten by Google’. It is true that Google has been the focus of litigants’ attention in recent years concerning its making available of information containing personal data published on the internet by third parties, however, this is a direct result, and natural consequence, of its market share.
What we appear, ironically, to have forgotten in amongst Google’s success is that other products are available – to borrow the BBC’s familiar caveat.
Google’s significant other(s)
There are other search engines that exist that will do the same job as a Google search, and are capable of returning information relevant to the terms of your search query.
Following a ‘close’ second to Google in the global search engine market share stakes is Bing, with a respectable market share of circa 3%. Yahoo! is hot on the heels with a market share of circa 2%, followed by a cast of others, mainly regional internet search engines, with market shares hovering around 1%.
Just like Google are, Bing, Yahoo and others are internet search engines. They find information on the internet, indexing and store it, before making it available to the public on their respective platforms. Such performance of activities on personal data amounts to processing of the same. The operators of these internet search engines are data controllers and are therefore under an obligation to comply with relevant laws including, in the case of the processing of personal data of data subjects located in the EU, the GDPR. Just like Google are, Bing, Yahoo and others are subject to the same laws, and data subjects enjoy the same right to be forgotten in respect of their activities.
Whilst we might not necessarily acknowledge this, the internet search engines certainly have. Taking Bing and Yahoo as examples, both provide a process by which data subjects can request that URLs to webpages published by third parties containing information relating to them are removed from search results returned by their search engines. What’s more, they have done so for many years.
Indeed, commentators noted that following the decision of the CJEU on 14 May 2014, Bing in particular made available its right to be forgotten form online only a matter of weeks later on 15 July 2014, and by December that year it was taking steps to respond to, and action, requests that had been submitted. Whilst Bing, or to be more accurate Microsoft who owns the search engine, are not as transparent at Google in respect of the disclosure of statistics relating to such requests, in the course of its corporate social responsibilities does produce a report concerning content removal requests, in which it notes that for the period to June 2018, since the decision in Google Spain, it has received over 26,000 requests to de-list URLs, in respect of 78,000 URLs. Bing states that it has de-listed 42% of these URLs.
For all of Google’s success and dominance in the market, it must be remembered, in particular by individuals that seek to enforce their right to be forgotten, that Google does not have the exclusive right to the internet search engines. Around 100 billion internet searches are carried out every year using ‘other’ search engines, which is not insignificant. Google’s significant others must, therefore, form part of any reputation strategy that includes the right to be forgotten.
Challenges to Google, change and opportunities
And that not insignificant number of internet searches may well increase, especially if Google’s dominance in the market starts to wane. You do not have to look very far – indeed an internet search using its own search engine will point you in the right direction – to learn that challenges lie ahead for Google, which may well have an impact in the market.
Even Google’s dominance in the internet search engine market takes a back-seat to what many consider to be its primary business activity, namely the collection and compiling of user data. Claims that Google has been guilty of putting its own interests first, rather than protecting its users, has done nothing to diffuse concerns over privacy and security. 2018 was the year of data scandals, and global legislative action on privacy, prompting a popular awareness of these issues. The number of facets of our daily lives that the big tech companies are privy to is ever increasing, whether that is through the use of smart or hub technology inside the home, or ventures into banking with a number of the big tech firms said to have partnered with banking institutions. The business model of a company like Google relies on users’ willingness to entrust it with information and data about them, but might we begin to reflect upon that concept of trust and power that tech-companies have.
Google has long been accused of being a monopoly. In proceedings launched in the High Court during the course of 2018 by Unlockd Ltd, in which it claimed that Google had breached UK and EU competition law, Unlockd was granted an injunction against Google preventing it disabling AdMob-generated advertising content and removing Unlockd apps from the Google Play Store in the UK. Only recently there was speculation that a number of State officials in the United States were considering whether Google had fallen foul of competition and consumer privacy laws. The threat of government intervention is inescapable. It is clear that inquiries, if they have been made, are at a very early stage and that action, should any be taken, is down the road, however, whether you consider Google to engage in anti-competitive practices, or just to have a much better product, such claims show no signs of abating. Indeed, closer to home MPs have agitated for change and an end to the monopolies of large tech companies in the market.
Such issues present opportunities for others in the market, and the significant others are taking steps to try and break the monopoly. Bing, in particular, has taken the battle to Google in recent years – embedding its search engine in more Microsoft products, with Bing being the default search engine in Microsoft’s reworked Edge browser; lower costings; better conversions for advertisers; more tailored and responsive account management and support, amongst other things. Regionally, Bing has seen a greater share of the market.
And so as conscientious consumers in modern society, we must make informed decisions about technology and, more and more, we are being encouraged to consider how we share our personal data and with whom we share it, which may well lead to us making different decisions about whose products and services we use. Particularly when it comes to the use of internet search engines, this could mean a gradual recalibration of the market share and less dominance by Google.
However, the market plays out in the foreseeable future, when deploying a reputation strategy, it is essential that it is considered, organised and consistent, and that is particularly the case when thinking about the right to be forgotten.
First: Don’t forget the rest! Whilst obviously important to any right to be forgotten strategy, Google is not the be all and end all. When seeking to enforce the right to be forgotten, you are only asking the search engine to block access to the URL where content is published. Right to be forgotten in the context of internet search engines does not secure the deletion of content at source. It remains available, and if you are only securing the blocking of that URL by Google, there will be a gaping hole in your strategy because the content could, for example, simply be accessed using Bing or Yahoo! instead.
Second: Be alive to regional differences. Whilst not strictly relevant to the issue of right to be forgotten, but purely for demonstrative purposes, the Chinese technology company Baidu provides an internet search engine in China and enjoys a market share of over 65%, compared to a paltry 3% market share for Google. This is an extreme example but take time to consider all relevant territories and how the market lies. It might not always be that Google heads up the list of internet search engines that you will need to contact.
Finally: Persistence and patience are key. Google, Bing and Yahoo! all cite as part of the right to be forgotten process, that a request will be considered in a way which is compliant with the law and appropriately balances individual’s rights to privacy with the general public’s interest in freedom of expression and the free availability of information online. In our experience, there will be some To-ing and Fro-ing with an internet search engine concerning a removal request. There is a balance to be struck and it might not immediately be apparent to the internet search engine how that balance ought to be struck. As a general rule of thumb, 50% of removal requests are successful, which only serves to indicate that further explanation and persuasion may be required. Of course, in the event of an unsuccessful and/or unsatisfactory outcome, a removal request may be referred to a supervisory authority or the courts.