[P2P-F] Fwd: [opennetcoalition] Recommendations On The Right To Be Forgotten By La Quadrature du Net and Reporters Without Borders

Wed Oct 1 15:25:16 CEST 2014

---------- Forwarded message ----------
From: La Quadrature du Net <contact at laquadrature.net>
Date: Wed, Oct 1, 2014 at 8:22 PM
Subject: [opennetcoalition] Recommendations On The Right To Be Forgotten By
La Quadrature du Net and Reporters Without Borders
To: opennetcoalition at laquadrature.net

Themes: NET FILTERING, PRIVACY, PERSONAL DATA, RIGHT TO BE FORGOTTEN,
SURVEILLANCE

La Quadrature du Net – For immediate release

Permanent link:
https://www.laquadrature.net/en/recommendations-on-the-right-to-be-forgotten-by-la-quadrature-du-net-and-reporters-without-borders

Recommendations On The Right To Be Forgotten By La Quadrature du Net and
Reporters Without Borders

The European Union Court of Justice ruling of 13 May 2014 [1] on a case
brought by Google Spain highlighted the problems for the protection of
freedom of expression and the right to information posed by the right to
de-indexation from search engine results and, more broadly, the right to be
forgotten. Privacy and freedom of expression are fundamental rights of
equal value (articles 8 and 10 of the European Convention on Human Rights
and articles 8 and 11 of the Charter of Fundamental Rights of the European
Union). Whenever one conflicts with the other, a balance must be reached
under a judge’s authority because, as a matter of principle, one cannot be
given more importance than the other.

The EUCJ ruling requires search engine operators such as Google to deal
with requests made by members of the public for the removal of search
engine results attached to their names. Responsibility for a decision
involving individual freedoms that should be handled by a court is thereby
delegated in practice to a private sector company. This delegation of
responsibility is all the more dangerous because the ruling is based on
vague and general principles that provide no guarantee for freedom of
expression.

In response to the EUCJ ruling, Google established an advisory committee
that is currently working on the formulation of more precise rules for
search engine operators on how to respond to requests to be removed from
results. The questions that Google is asking on how to strike a fair
balance between the right to de-indexation from results and the public’s
freedom of expression and information are perfectly legitimate, but the
fact that a private sector company is posing these questions accentuates
the growing trend to privatize the implementation of Internet regulation,
and is therefore unacceptable.

National data protection bodies such as the the CNIL – the French data
protection authority –,are meanwhile also working on the formulation of
precise rules in response to the EUCJ’s ruling. But, in so doing, they too
are exceeding their powers. In the absence of sufficiently clear
legislation, such government agencies have neither legitimacy nor
competence for the formulation and application of rules designed to ensure
a balance between the protection of privacy and freedom of expression.

The response must therefore come from national and European legislators. It
is their duty to establish a clear legal framework that takes full account
of freedom of expression and is implemented by the courts.

With this in mind, Reporters Without Borders and La Quadrature du Net
jointly drafted this paper, which identifies points of concerns and makes
recommendations designed to reconcile the right to privacy with freedom of
expression in a reasonable manner under the aegis of the courts and not the
private sector or government agencies. We now present them as a
contribution to the ongoing debate on the right to be forgotten.

1. Misapplying The Right To Privacy To Editorial Content

In France

The provisions on the protection of persondal data from the directive of 24
October 1995 have been applied to editorial content and other informations
of public interest, based on the fact that they broadly define “data of a
personal nature” as “any information concerning an identified or
identifiable physical person,” . This is so even though both article 9 of
this directive and article 67 of the France’s Law on Information Technology
and Freedoms provide an exception for journalistic purposes.

As a result, under the CNIL’s supervision, data protection laws are already
widely used to curtail freedom of expression before the EUCJ ruling on the
right to be removed from search engine results. This was made clear in a
recent statement by CNIL president Isabelle Falque-Pierrotin: “Complaints
involving the right to be forgotten are almost all honoured and the content
is withdrawn. They concern comments in blogs, an unwanted photo or a court
decision that someone wants suppressed.” [2]

Using data protection laws to obtain the removal of published content and
restrict freedom of expression (through the right to opposition and
rectification) under the ruling of administrative authority, constitutes an
extremely dangerous circumvention of the traditional principle of the
judicial protection of freedom of speech (established, in France, with the
Law of 29 July 1881 on press freedom).

This is why the vice-president of a Paris high court said in a ruling on 12
October 2009: “The constitutionally and conventionally guaranteed principle
of freedom of expression forbids (...) any violation of the rules
established by the Law of 6 January 1978, which is not one of the laws that
was specially created to restrict this freedom in according with the second
section of article 10 of the European Convention [on Human Rights].”

Similarly, a Paris appeal court ruling of 26 February 2014 said that
suppressing online links to an article may violate media freedom: “The
court is of the view that forcing a media outlet to modify its online
archive of articles (...) either by suppressing information itself,
withdrawing surnames and first names of persons concerned by judicial
decisions, thereby depriving the article of any interest, or by restricting
access by modifying the usual online links, exceeds the restrictions that
may be placed on media freedom.”

In Europe

At the European level, a ruling by the European Court of Human Rights on 16
June 2013 rejected a request by two Polish lawyers for the suppression of a
newspaper article that had been deemed libellous by a Polish court but
continued to be accessible on the newspaper’s website. Seeking a balance
between the right to defend one’s reputation and the right to information,
the European Court ruled that withdrawal of the article “would amount to
censorship and to rewriting history.”

These decisions shed light on the appropriate scope that should be given to
the exception for journalism. Provisions on the protection of personal data
should not affect freedom of expression. They should remain inapplicable to
all editorial content and all information of public interest.

Given a certain desire on the part of European Union member states to
follow up on the EUCJ ruling by considerably reinforcing the right to be
forgotten and the right to deletion, it is important to restrict these
rights in order to protect freedom of expression. The rules must be amended
to reinforce the exception for journalism by extending it to all editorial
content and other information of public interest.

After this legislative clarification has been enacted, the right to privacy
and the freedom of expression can be properly balanced under national and
international law and the relevant jurisprudence (for example, in France,
article 9 of the civil code or articles 226-1 and 226-2 of the penal code),
while respecting the existing guarantees of freedom of expression (such as
those in the 1881 media law).

Recommendations

    Base arbitration between the right to privacy and freedom of expression
on common law provisions or, when appropriate, on respect for the
guarantees applicable to media rights, and not on special data protection
laws.
    As part of the negotiations under way on European regulation on
personal data, extend the exception for journalism to all editorial content
and information of public interest and restrict application of the right to
be forgotten under article 17 to data put online by the data subject
himself.
    Pending the adoption of the European regulation, establish a moratorium
on measures based on this special right that restrict freedom of expression
and the right to information. Or otherwise adopt interim measures that
fully respect freedom of expression.
    At the European level, consider complementing the rules on protection
of privacy with legislation that protects freedom of expression, above all
in order to reconcile these two fundamental rights.

2. The Role Of Search Engines In Access To Information

By interpreting the concept of “controller of the personal data” broadly,
the EUCJ has extended it to search engine operators and has put private
sector companies in charge of handling requests for the deletion of links
in search engine results.
The EUCJ’s decision seems to stem from a conservative and erroneous vision
of the Internet and what search engines do. At no point did the court
mention the role of search engines in gathering information and their
contribution to freedom of expression. Instead it limited itself to
stressing the dangers resulting from the “important role played by the
Internet and search engines in modern society, which render the information
contained in such a list of results ubiquitous.”

While the Internet and search engines may indeed make it harder to protect
privacy, they also play a very positive role from the viewpoint of freedom
of expression. A recommendation on the protection of human rights in
connection with search engines, adopted by the Committee of Ministers of
the Council of Europe on 4 April 2012 [3] said: “search engines enable a
worldwide public to seek, receive and impart information and ideas and
other content in particular to acquire knowledge, engage in debate and
participate in democratic processes.”

France’s Council of State pointed out in a recent report that “removing
links from search results affects the freedom of information of the
website’s publisher by making the published information less accessible and
thereby returning it to the pre-Internet situation.” [4]. Because of the
role of search engines in facilitating access to editorial content and
information of public interest, there are significant dangers involved in
treating search engine operators as personal data “controllers.” It removes
measures directly affecting online freedom of expression and information
from the judicial domain and prevents sufficient account being taken of the
different interests and rights at play.

Moreover, as EUCJ advocate-general Niilo Jääskinen said in a preliminary
report on the Google Spain case, it would be “absurd” to hold search
engines responsible for the personal data on the web pages to which their
search results refer. He said: “If Internet search engine service providers
were considered as controllers of the personal data on third-party source
web pages and if on any of these pages there would be ‘special categories
of data’ referred to in Article 8 of the Directive (e.g. personal data
revealing political opinions or religious beliefs or data concerning the
health or sex life of individuals), the activity of the Internet search
engine service provider would automatically become illegal, when the
stringent conditions laid down in that article for the processing of such
data were not met.”

For this reason, among others, search engine operators should not be
regarded as the personal data “controllers.” The plaintiff must go to the
source, asking the personal data “controller” to withdraw or correct the
information that was posted online and was then indexed by the search
engine. This also applies to links to content that is neither editorial in
nature nor of public interest.

Data protection authorities should nonetheless be empowered to order search
engine operators to update their results. After getting a personal data
“controller” to remove or correct content, individuals should be able to
ask their national agency to order search engine operators to correct or
suppress the relevant information in their web page excerpts or in their
caches (in the same manner as courts have ordered search engines to remove
links to illegal.

Recommendations

    Amend European personal data regulations to reflect the fact that
search engines and other Internet “facilitators of access to information”
are essential for exercising the right to information and provide links to
editorial content and information of public interest and should therefore
be covered by a broad interpretation of the exception for journalism and
should not be regarded as personal data “controllers.”
    In the case of links to personal data with no editorial content and no
information of public interest, give data protection agencies the power to
order search engine operators to update the information displayed in their
results, while not treating them as personal data “controllers.”

 3. Defence Rights And Appropriate Procedures

In a democracy, it is not the role of private sector companies or even
France’s CNIL (or its equivalent in other European countries) to determine
the right balance between the protection of privacy and freedom of
expression.

In its decision on the Law on the Confidence in the Digital Economy in
2004, France’s Constitutional Council said with reference to the withdrawal
of online content by private sector companies: “determining whether a
message is illegal can be delicate, even for a lawyer.” This would also
apply to search engine operators trying to determine whether search engine
result deletions would restrict freedom of expression and the right to
information. The publishers of online content have the right to a fair
hearing if requests are made for the removal of links to their content, and
this right cannot be respected if a private sector company is taking the
decisions.

Similarly, the authorities in charge of protecting privacy do not have the
required competence or legitimacy for examining such requests and
determining the limits that should be set on freedom of expression. As
France’s Constitutional Council said in its ruling of 10 June 2009 on the
HADOPI law, legislators cannot give an administrative agency, even an
independent one, the power to restrict the right to express oneself freely.
As this is about balancing fundamental rights, it can only be a judge, the
guarantor of individual freedoms, who can perform the task of reaching a
decision in a dispute, thereby also fully guaranteeing the right to a fair
hearing.

If some cases, the judge’s intervention could follow mediation process
aimed a reaching an out-of-court settlement of a dispute involving the
right to be forgotten. In such mediation, both parties (the plaintiff who
claims that his or her privacy has been violated and the publisher of the
disputed content) should be able to defend their viewpoint and obtain legal
advice.

Finally, in the event that it is determined that freedom of expression was
indeed abused in order to violate privacy, various types of measure should
be envisaged. The EUCJ ruling focuses on deleting links from search engine
results, but updating the disputed content, deleting only some of the
information it contains, anonymization or use of pseudonyms may be more
appropriate and proportionate, according to each case.

Recommandations

    In accordance with the principle of judicial protection for freedom of
expression, ensure that only a judge has the power to reconcile freedom of
expression and respect for privacy.
    Consider creating a multistakeholder mediation body that allows the
parties to the dispute to reach an out-of-court settlement (with recourse
to a judge clearly still being possible in the event of failure to reach an
agreement).
    Bear in mind that deleting links from search engine results is just one
of several possible measures for reconciling freedom of expression with the
right to privacy, and that updating the disputed content, deleting some of
its information, anonymization or use of pseudonyms may prove more
appropriate.

PDF version:
https://www.laquadrature.net/files/Recommendations_Google_LQDN_RSF_en_0.pdf

* References *

1.
http://curia.europa.eu/juris/document/document_print.jsf?doclang=FR&text=&pageIndex=0&part=1&mode=lst&docid=152065&occ=first&dir=&cid=411047
2. Le Monde, 19 May 2014
3. Committee of Ministers, 4 April 2012, recommendation on protecting human
rights in connection with search engines
4. French Council of State, 2014 Annual Report. Digital technology and
fundamental rights, p. 188

** About La Quadrature du Net **

La Quadrature du Net is an advocacy group that defends the rights and
freedoms of citizens on the Internet. More specifically, it advocates for
the adaptation of French and European legislations to respect the founding
principles of the Internet, most notably the free circulation of knowledge.

In addition to its advocacy work, the group also aims to foster a better
understanding of legislative processes among citizens. Through specific and
pertinent information and tools, La Quadrature du Net hopes to encourage
citizens' participation in the public debate on rights and freedoms in the
digital age.

La Quadrature du Net is supported by French, European and international
NGOs including the Electronic Frontier Foundation, the Open Society
Institute and Privacy International.

List of supporting organisations:
https://www.laquadrature.net/en/they-support-la-quadrature-du-net

** Press contact and press room **

contact at laquadrature.net, +33 (0)972 294 426

https://www.laquadrature.net/en/press-room

_______________________________________________
Opennetcoalition mailing list
Opennetcoalition at laquadrature.net
https://laquadrature.net/cgi-bin/mailman/listinfo/opennetcoalition

-- 
Check out the Commons Transition Plan here at:
http://en.wiki.floksociety.org/w/Research_Plan

P2P Foundation: http://p2pfoundation.net  - http://blog.p2pfoundation.net

<http://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation>Updates:
http://twitter.com/mbauwens; http://www.facebook.com/mbauwens

#82 on the (En)Rich list: http://enrichlist.org/the-complete-list/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ourproject.org/pipermail/p2p-foundation/attachments/20141001/e3a950e1/attachment-0001.htm 