'The Changing Landscape for Search Engines After Google Spain': Willem Debeuckelaere

Thank you Mr Chair, and I certainly want also to thank David for this fantastic opportunity, this setting here in this auditorium. I will come back to that because for me it’s a sort of an ideal place to exchange ideas on this issue, and I think that it is very important to talk about this landmark decision which had enormous influence on data protection and on the work of the European Data Protection Authorities. I only have twenty minutes so it will be difficult to really go into all the details of this six-point presentation, so I will skip a lot of them. I will skip certainly some of the ideas from the cornerstone document that is the Guidelines. In November of last year the Working Party 29 adopted guidelines on how they understand, how they are reading, and how they are interpreting the case, the Google Spain ruling, and also giving thirteen guidelines how to work with the specific cases that will be asked.

It would be witness to an improbable Ivory Tower mindset to only invest in the protection of privacy or in a pure judicial approach. The issue imagined from the Google case is not only about the right to be forgotten, about applicable law - very important - about jurisdiction, but also on decision-making power – power in general.

Law is always a reflection of the balance of power. Since Machiavelli, Hobbes, we are very aware of this. But in the twentieth century, we have accepted by trial and error, that a broad general human rights approach is possible. I know, I know "it's the economy stupid" - but if you want to resolve the issue in a democratic perspective, we have to realize that human rights have brought an important. That's why in this great building of the rule of law, there has been provided an additional floor, a solid roof, a shield that wants and has to protect the citizens from attacks against their freedom and integrity. So dear listeners, you will immediately understand that I won’t limit myself to a judicial analysis. I think that if we are looking through the looking glass of Google Spain, we have also been impressed by the importance of the Charter of Fundamental Rights of the European Union of 12 December 2007. The judgments make the clear distinction between fundamental rights on the one hand, human rights, and interests in economic interests, of interests of the public. It's in the section 99, the four last sections, that it is really very clearly stated by the Court. And it’s amazingly remarkable that not much attention is paid to this issue in the comments that recently has been written on the judgment just after the pronunciation. You could almost become cynical about it. I have read and heard different arguments such as "you Europeans have missed the point", "the internet doesn't work that way", "the ICT world has and imposes its own rules", "it’s the technology", and as a final quote "that is not how our business model works."

Why is it so difficult to accept the ruling of the Court? Maybe because privacy or data protection has not been considered as a human right, but only as an interest? Should interests, rights in general, not be treated on the same level? There this one major exception: freedom of speech, free collection of information. I would be unfair to countless commentators if I wouldn't take this into consideration in my analysis. But even here I strongly would like to point out the clear and detailed assessment made by the Court of Justice in the ruling. There were lots of checks and balances that were carefully expressed. The task of a Data Protection Commissioner is embedded in the protection of the whole human rights [and] fundamental rights, and need to find the correct and safe balance between the different basic rights such as personality rights, privacy, protection of personal data, freedom of speech, free gathering of information, the right to the integrity of a person, security, freedom of trade, right of property, education, the house of the rule of law provides a lot of rules, countless floors. And if it can be sometimes difficult to find your way, this is one of the reasons why we today are gathering here in this conference. This auditorium should be a perfect power-free space. In Germany they talk about Herrschenfrei of Jürgen Habermas, where we can practice the art of the veil of ignorance.

So that was an introduction, now back to business. We tried, as Working Party 29, to find already in 2008 solutions for the questions [which] arise by the upcoming search engines. And we have this first document of 2008 and Artemi has already mentioned it. I don't think that today it is useful to read it, so I skip and turn to the next one.

What was the reception of the Court ruling? First thing, we were relieved because - can you imagine that the court should say, "well, European law is not applicable". In that moment, I think a lot of data protection authorities can close their doors. There was also a surprise. The surprise was that the Court clearly stated that the right to be forgotten is a fundamental right, is something that should be applied on the level of a human right. And it was a surprise because the Advocate General had not accepted this point of view.

There was also a lot of uncomfortable feelings – "how will we manage it?", because we thought thousands, tens of thousands, of applications would come to us. And also, will this sentence not have an inverse effect. Will the reaction, because it was certainly in the first weeks there was a very hostile reaction of a lot of comments. Should it not have the effect that yes, that legislators, that law-making will try to avoid the principles of this ruling? And lastly, I think that there was also a very important boost into the world of the data protection authorities. We considered ourselves empowered because not only data protection can be empowered by the maintenance of law and order, but also because the Court has given us real practical tools to do our job protecting the citizens. We try to implement this ruling. There were exchange between different data protection authorities. We have also had a lot of meetings with people from Google - Peter Fleischer was practically every week in another capital in Europe. It was good to talk about it and we tried to seek a common position from all the twenty-eight countries. We made them make these guidelines, working out all the experiences that in the different countries we were confronted with. And then we adopted on the 26th of November these guidelines on the implementation. The structure of this document is one interpretation of the judgment - very interesting to read how we were also struggling with a lot of concepts in it - and secondly, trying to be effective, making a list of common criteria for the handling of complaints. Important do say to you, these are guidelines. In the letter that the document was sent to Google it was also clearly stated by Isabelle Falque-Pierrotin, the chairwoman the Working Party, that these are guidelines that can be reviewed, can be made better, in the course of time.

What is very interesting also is the first two pages of these guidelines because you have an executive summary; an executive summary that gives you a very short but very sharp introduction to the concepts that we find as Working Party 29 in the ruling Google Spain. Thirty nine of these are mentioned, and if you look to them you will see that a lot of these questions will arise also in the second, the third and the fourth panel today.

The criteria are of course the most the important of these guidelines, and then we have thirteen, I will not say that that they are really in a scientific way, criteria that you can use, but it also sometimes are more questions – questions that should help to resolve very practical situations where not only Google - because its Google in the first time who has to look to the applications - but then after appeal to the Data Protection Authority, they have to consider where we remove the URL, were we delink, and where indexation. Sometimes a question is divided because there are a lot of sub-questions. For example is the data relevant and not excessive. Of course that is not an easy question to answer.

Sometimes you have questions that are not completely in line with the ruling - for example the question of prejudice. It's clear that the Court has said you don't need to prove a prejudice, you don't have to demonstrate that for having the right to remove your data. After that we had issued these guidelines, we have tried in the Working Party to find also more substantial solutions for questions that were answered but in a way that not everybody was happy with, and I think there are still a lot of questions. But the most important, I think, is the question of the territorial validity and the enforcement. You can say "oh, it’s only for the country involved", but that’s not true. It’s a European law so it should be implemented in the whole of Europe, which is what Google accepted. But maybe it is worldwide? Why is it worldwide? Well it is a personal right, and once a judicial decision has been taken about a personal right, it should be worldwide accepted. There is another question which is what do you do with a country without establishment, but that is really a question for the specialists. Another problem is a problem of more political weight is the Barbara Streisand effect: the more you are crying to be delisted, the more you are exposing yourself. A little criticism of Google: in the first weeks and months they were not speaking of the Google Spain case, but of the Costeja ruling. I tried to change that and to say let’s talk about Super Mario, because it is Mario Gonzales Costeja, so I think we have to use the normal general denomination which is Google Spain and the rest. But there you see that this is also a question of power, who had the power to give a name to a certain sentence. There is also sometimes a problem of inaccurate data. I will not go into the details, but that is sometimes a very difficult thing to do.

But what is the reality? The reality and now I take this example from Belgium. We started with this one case, and ended yesterday with thirty-four complaints. Thirty four complaints – that is practically nothing. If you take into consideration that according to the numbers that Google has given, forty five per cent were not accepted from these items of request. So that means that only 1 cases out of 210 cases are coming to data protection authorities. We handled already twenty-one of them, sixteen have been accepted by Google, six were accepted by the Data Protection Authority, and only one is a question where we could not reach an agreement. The biggest problem for us in the beginning was censorship. We did not want to have this censorship. But in all the thirty four cases we have had, we have never had a problem with on censorship. And I will give you one little example. This is an extract of a letter of Google where they denied to delete an index. The only thing they are saying is that the person in question was somebody who is a dangerous person, and, then, in that moment they say that we should be aware of the fact that he can in future relations also be dangerous. But I think we have also a solution for that. Google has accepted that if there is a court ruling to find a solution that he gets a clear criminal record that they should remove also this URL.

So I will come to my conclusion. I think that the question of this example is once again giving an example that the right to be forgotten, and also the questions that are arising by the Google case, will after all end here in judicial debate, but also in court rooms. And once again, today we are in a court room, because I understand also today in the High Court in Great Britain there is a sentence according to a problem arising from the use of Google search engines. And I think that I will again invoke the power-free space as requested by John Stuart Mill, Rawls, Hannah Arendt, and especially by Jürgen Habermas, because I think it is important to take that into account also in this auditorium. And such a sphere happened also yesterday in the premises of the CNIL in Paris where several data protection officials from European met a delegation of Google to discuss the terms and conditions that were put in place two years ago, and that were subject to several rulings of several data protection authorities. And that now Google has accepted to review them, and to give new terms and conditions I think in the month of June, that is, it will be this year. That is a very positive evolution, I think. That Google accepted the Google Spain sentence, that they comply fully and that they set up a system to implement this sentence.

And what we all should learn from this case is: one, that the data protection authorities must be brave and courageous like the Spanish, that we should be brave and courageous to impose instructions and decisions. Secondly, that human rights really exist. Not because they have been proclaimed, but by the fact that we are using them in litigation in courts. And third, at least, it is a question of power. And that in a democratic and a decent society this power is laid down in the law, executed by those who are bound by the law, and enforced by courts of justice.