'The General Shape of EU Internet Regulation After Google Spain': James Leaton Gray

Alright good afternoon to you. I am now going to break the first rule of speaking at a conference and contradict the Chair. I'm going to break it in the beginning which is an even worse way of doing it which is to say I just need to correct I'm I no longer Head of Information Policy and Compliance. Google gave you the wrong information. I was until last year Head of Information Policy which is indeed in charge of data protection and freedom of information. The reasons I point this out is two-fold. First, we are the BBC and we like accuracy and secondly because I’ve left that behind and I am now sort of reflecting upon that ten years leading that team. I’ve been put on big data which I’ll come back to in a moment or two. I’m soon going to be leaving the BBC and so most of what I’m going to say today is going to be my personal reflections upon this as I move out into a new era still sticking, I hope, in the privacy sphere.

Firstly, a couple of points and I promised to David that I wouldn’t I wouldn’t spend too long in this session reflecting too much on the last session and around a media response. I do think there are just two things I would say in terms of the Article 29 Working Party response as opposed to how Google is implementing it. From a media perspective, we think that there are some problems with the Article 29 Working Party suggestions and indeed sometimes the way it is implemented by Google. There is an issue around transparency and I think that continues to be an issue. Actually I will pick up on my own personal views in a moment. If the publisher doesn't know, and the Article 29 Working Party suggests that in most circumstances the publisher does not need to know, that the URL has been taken down then actually how can Google be making a properly informed judgment? There may be issues that the data subject has raised which the publisher has counters to. Those facts need to be known. There isn’t a balance there. This comes to the date subject who has the right to appeal but the publisher doesn't according to the Article 29 Working Party because the publisher isn't appealing under the Data Protection Act or under the Directive. Again, there is an imbalance. I’d like to come back to this point about balance going forward because I do think actually we are in danger of regulating and legislating in silos and ignoring the fact that other silos that are significant and have impact in this area.

Also, I just think that I think there's a slight danger. Willem suggested there's never been a problem censorship except as in the vast majority of territories the publishers are not being informed the URLs been taken down, we don't know whether there's a problem of censorship because the publishers don't know that it's happened. That is in essence a societal problem that I think we need to tackle and it's back to this point [that] you can't have a fundamental right being judged unless you actually are balancing it.

So, that’s the BBC position. Now this is all down to me. So when I get the rest of it wrong, you can just shout at me instead. I do think I'm nervous of data protection authorities being the bodies given the responsibility to make this balance particularly reflecting upon freedom of expression, section 32 in the DPA, and more broadly. Data Protection Authorities are there to enforce a fundamental right, they're a very important part of the mechanisms but they're there to enforce one right. How can a body that's set up to enforce a right then balance other rights that it has no responsibility for? When I said this to an audience in Brussels recently a member of the CNIL said: well we deal with all sorts of industries all the time, very very important industries. We can do all sorts of balances. Yes, you deal with every industry pretty much. There are very few industries perhaps apart from chicken rearing that doesn't involve personal data. But I do think that there is essentially a problem here that actually I'm not sure a regulator for one right is the appropriate body to be balancing other rights. Eduardo from the second panel and I have an absolute agreement here. I don't think that actually Google is a data controller. Now I take Chris’s point if it's not a data controller what is it etc.? Well my answer to that is at least when it comes the new Regulation they need to put something in that makes sense in the modern world but it’s a bit too late to start. So we’ve got a mainframe idea being translated into the new Regulation which will be Web 2.0. Frankly, the idea that it is up to date is ridiculous. But the data controller has certain implications - how you do a subject access request to Google? Well, I suppose you type your name in. But data minimization? I don't know about you, but I don't won't a search engine that does data minimization. Surely the point is it's meant to go out and find stuff? Data minimisation - I could do that myself. So there are contradictions and we’re back into this disconnect between the law and reality, which has been mentioned already.

Now I do actually think, by the way, that I was accused in that same panel up not being in favour of privacy. I've been the BBC data protection officer for ten years. I believe passionately in this stuff but I do think that has to be a balance and I think where that balance comes will be in the pragmatic. We can’t get rid of the concept of controllers and data processes or introduce a third route which should seem to be the sensible thing to do in the new Regulation. We will be stuck with it. But the pragmatic solutions have to reflect the real world.

My other problem with the judgment and this is also true in - there's a case that I don’t think has been mentioned so far today – Telekabel, an Austrian case, which went to the CJEU. Where what we have is what I think is a very dangerous pattern of the courts and society, I don’t just blame the courts here, but the courts and society effectively outsourcing judgments. We said to Google actually there's a lot of really difficult stuff to balance here, freedom of expression, personal rights - you go away and do it because we haven’t got time in the courts and we don't spend the money. Getting a commercial organization, however well-meaning - I like William, I know him very well, I think he does a terrific job - but should he be doing this job? I question that. Telekabel has basically been told to go away and sort out IP infringement in Austria. Yeah, good luck with that. But why are we doing this well because actually we don't have a mechanism to deal with it accurately ourselves. We can’t get David to do it: he's got enough on his plate already. So it seems to me that that as a society we are making more and more calls upon groups to do things because actually we haven't got the resources to sort it out ourselves. I think it's a dangerous route to go down.

So there is this balance point. I did promise to talk about the other internet players because I do think it's quite important. This is where this balance point comes back. I'll come back in a moment if I have time to media archives but social networking, online forum [and] the blog posts. Some of you may know a case on the freedom of information side of my former life Sugar v BBC which was about how widely do you define journalism, art and literature. What is the definition? That was in relation to freedom of information but clearly the same phrase appears in the Data Protection Directive and in the DPA. When you look at nearly all the jurisprudence we are told to interpret it widely and yet there's a contradiction here because we're also told to interpret the data protection widely. So we have got these two wide definitions which overlap in the middle and I don't think we've really got our heads around this. The right to be forgotten I think does, as David has suggested, apply to a large number of internet players here. I don't think it's just search engines. I think the blog post is one example. I think social networks, online forums but we're not even thinking far enough ahead. I've been doing some thinking around IPTV in this last year looking at Big Data and Internet Protocol television. Once your television set is effectively a computer, search is not going to be something you sit and type in. You are going to talk to your television set. I mean sometimes you do that anyway but that's normally shouting and it’s not quite the same thing. You’re going to say "get me the news!" Whose news? What news? There will be an algorithm. It will probably be constructed by the set manufacturer. It will be Samsung’s news algorithm. Will we know that actually the section from La Vanguardia, or from the New York Post, or whatever has been removed? No we won't. I do think that although, as Julia in the second session said, this is statistically insignificant - yes it is the number of major news items that might be removed is going to be statistically insignificant - but socially I would contend it is massively significant and I think we have to be careful about wandering along this line and again forgetting the balance. This is Article 8 versus Article 10 or, if you want the Charter, 7 and 8 verses 11. And I think these are not incompatible. I think that a balance can be made. But I would contend at the moment that the two sets of arguments are being put in opposition and are not actually being balanced. I suggested something akin to this in Europe and it was suggested that somehow I haven't read the judgment. I’ve read the judgment. I would contend that putting the word "balance" in a judgment does not make a judgment balanced. Now I fully accept that coming into a room full of lawyers that's a dangerous statement to make but I do think actually it's important. I think that wasn't enough balance made and I think that's because actually to be fair to the CJEU the reality was that they had to make a call on that set of circumstances. Were they really going to lift up the rock of freedom of expression at the same time? I don't think they would have been finished now. So we've got over here the right to publish and we've got over here the right for the individual. Well that's fine but we're going to have to bring them together. We're going to have to do that sooner rather than later I would contend.

I've already said that I think this is a Directive for the mainframe - the Regulation web 2.0 – and I think we are not going fast enough to look at the future. The direction of travel has been mentioned by David: the culture point. I actually am concerned about the direction of travel not just because I think freedom of expression is being underweighted in this, although I do. But I also think that it is going to create further and further problems. The harmonization point that the Regulation is pushing toward is going to make this more difficult. We already have the majority of large companies in this space, the American companies, genuinely not understanding where we are coming from. These are people for whom the First Amendment is absolutely ingrained. We are going to make all those conversations significantly harder. Now that's not problem in itself and I don't think that should be a reason for not doing it but actually if you start thinking in a globalized world I do think that we are in danger having a conversation with ourselves rather than the rest of the world.

You are then back to what is and is not appropriate inside individual territories inside Europe. For those of you who don't look up the Wikipedia case in Germany. I can’t for the life of me remember the name of the case but effectively two people who were convicted of the murder an actor went to Wikipedia and tried to get their names removed from the Wikipedia article about that actor. They didn't deny that they had done the murder or deny anything about it. They wanted to get on with their lives. Again, a perfectly reasonable balance to be had but actually there is an element then of rewriting history. And we have to as a society to work now what we want to do about this. When we come to these new media players. When does a blog post trip over into what I would call the "casual vacancy" effect. I don't know whether you saw the dramatization but for those you didn't one of the things was a scurrilous website that was sort of telling the truth. I get very nervous. I heard earlier today when we are taking about well those circumstances where defamation or inaccuracy. Well actually what’s one what’s the other? My background before I got into privacy was as a political journalist. My exit from the BBC will be running an OB [outside broadcast] for the general election. I'm being let loose with a toy cupboard again and I’m looking forward to that. But when you try and apply those kind of absolutes that only the law can - in court when you look at the full set of facts. And you say we are going to do this on the fly, we're going to do this, we're going to outsource it to commercial companies, or we're going to have poor old David again at the ICO deciding whether that is or is not an accurate statement. I don't think that is appropriate and I think we've got to get that balance right.

So I've only got about one minute left I think. Is there a way around? Yes I think there is pragmatically. What I’ve been doing for the last year is preparing a thing called "My BBC" which is going to be going live in the autumn and is actually about personalization. The only way you can work personalization is by getting a large amount of data about people. You can do that. You can take people on board. I genuinely believe you can't make big data privacy friendly and I think they are involved in the process of doing so. But even when you do do it pragmaticly you're going to end up with some further conversations which we need to be having. What about exhaust data? What about data that you don't even know you've created just by wandering around the internet? Is that your personal data? It could describe you in certain circumstances. How do you define when it's going to be put into an anonymized form? Created data, the data that is going to be created by services for you at your request in order to supply you those services. Is that still personal data? Where does the algorithm itself become personal data? These are issues that need to be tackled and I do think that we need to look at them but we need to look at them in terms of the balance of the privacy right which is vital but some the societal benefits that the individual and society can gain by having that privacy right notched down or notched up but we need to have the conversation. We need to have it in a broad sense and we can’t just have it in terms of a single judgment.