'The Changing Landscape for Search Engines After Google Spain': Julia Powles
Duration: 15 mins 46 secs
Share this media item:
Embed this media item:
Embed this media item:
About this item
| Description: |
Julia Powles, University of Cambridge delivers the third lecture from the "The Changing Landscape for Search Engines After Google Spain" section of the "EU Internet Regulation After Google Spain" conference.
This conference was held at the Faculty of Law, University of Cambridge on 27 March 2015, and brought together leading experts on Data Protection and Privacy from around the World. The conference was held with the support of the Centre for European Legal Studies (CELS). This entry provides an audio source for iTunes U. |
|---|
| Created: | 2015-04-15 10:08 |
|---|---|
| Collection: | EU Internet Regulation After Google Spain: Conference 2015 MOVED |
| Publisher: | University of Cambridge |
| Copyright: | Julia Powles, Mr D.J. Bates |
| Language: | eng (English) |
Transcript
Transcript:
It takes a rare legal case to capture the public imagination, and an even rarer one to stay there. I want to talk about why Google Spain, particularly in the context of search, is such a case. Why it is so fascinating, miserable, and inexhaustible as a source of debate from boardrooms to dinner tables. This requires us to roam somewhat out of the usual terrain of lawyers. This case raises questions most importantly of power, particularly, informational power. It’s about promises, particularly the law’s promises. And it’s about privacy, particularly about privacy in a surveillance-based economy.
Before I get to those deep, subterranean issues, I’ve been told I can be a bit provocative so I’m going to take the opportunity and react a bit to some of what we heard this morning and in the last few, probably much more diplomatic presentations. I have two outstanding challenges or concerns that I think date right back to when this case was decided. The first, and this might sound a bit shocking, is that we don’t really know what we are talking about. Sure, we might know about the law, about institutions, about balances between rights and interests. But what we don’t know is anything more than a vague notion of the problem we are trying to solve.
At last count, 234,000 people had made requests to Google under the right to be delisted procedure. Their concerns range across the full spectrum of human experience. And yet Google has spoken publicly about only thirty one cases. Now we’ve had, I just counted, another four from William. But we have no indication of the relative frequency of these examples, any sort of greater representation of which balances they involve, how complicated they are, and so on. We have heard that the great majority of these requests are in fact a straight delisting – yes or no. But in the cases that are complex, do we need extra layers of information and intervention? I would argue that this isn’t just about extra detail or embellishment; it goes to the core of what we are trying to deal with. The paucity of information prevents us from actually developing robust, useful, enduring, and considered solutions. It exacerbates misunderstandings and it promotes ideological and intercultural conflict. It means that we, the citizens, are faced with appeals from a variety of actors who all have their own vested interests, whether it is from private companies, from regulators, from politicians and the media; all of whom are saying: "trust us". There is evolution in the system. But I would say it is still unsatisfactory.
When I have spoken to people at search engines, I’m told that the detail can’t be exposed because of privacy concerns. "We don’t want to talk about individual cases", they say. But I’m not asking to be told for example, that somebody stabbed their ex-girlfriend eight years ago and now cannot have a relationship anymore, or to ask about somebody’s medical results and the particular details that have been put on Google’s index. It is to know whether two percent or twenty per cent of these delisting requests involve criminal cases, the sort of examples that William was talking about. It is to know whether , in relation to the large number of requests to Facebook, are these people who are delisting results on their own name, on posts that they themselves have done, and for which they are not utilizing the opportunity within Facebook itself to take down posts? Or are they things another person has posted, or indeed on some of the more despicable sites that you have on Facebook, are they from people they don’t know?
What proportion of these requests concern mainstream media? The entire public debate has been about mainstream media outlets. But in the UK, the mainstream publications, the BBC, the Guardian, the Telegraph have all had in the order of thirty to sixty delistings. That’s a tiny proportion of 234,000 requests. So I think that we end up generalizing from the particular if we don’t have a greater understanding of the contours of the landscape.
Now in saying this, it is not that I want to criticize what Google is doing. It’s to improve the processes, and so ensure that the law and the principles that we have are adapted to the problems we are actually trying to solve. I think that here the DPAs have an important role to play in leadership – Willem talked about that they have thirty four cases in the Belgian DPA. There are about two hundred in the ICO. We should have the cases de-identified, and reveal some greater information. We shouldn’t bury information about how those cases are being dealt with. I think we have a right to know how they are being dealt with.
The other reason why I don’t buy the search engine defence that this is about not revealing private information is because if that concern was real we wouldn’t have the notifications to webmasters. From the webmasters I have spoken to at media publications, it is trivial to re-identify from a notice who has made a request, because you can have a one-click search at the bottom of a Google search result on a European page, and it flips over to Google.com, so you can identify immediately by putting in the URL, and the names in the articles, who it’s about.
The second outstanding issue, if that’s what we’re talking about, is who is talking. Every indication I’ve seen suggests that the bulk of these requests are about people with no public profile. They are victims of algorithmic failure. They are about normal people, and they don’t have a platform to redress speech with more speech.
By contrast, almost all of the people talking about the right to be forgotten, do come from such a platform. Polling suggests that most people don’t have information they want delisted online, but those that do, really do. And I’m concerned that those who speak out most about the right to be forgotten are not representative of those who really are at stake.
On that note, and this has been suggested on a number of occasions to me anecdotally, but I don’t think anyone has said it in public, I think there is a huge unacknowledged gender issue too in who is speaking about the cases, and how the differential impacts of the rights of the right to be forgotten are felt. This is particularly the case in some of the examples that are brought up a lot in the media about revenge porn, for example, but I think I have yet to see a panel where there is anything more than a couple of women speaking, and I think that this affects how we discuss these issues in public.
So that is who is or who is not talking, and what we are and what we are not talking about. But let me get to why it matters. I said it is about power, promises and privacy. I think the Google Spain case is an externality of at least three much deeper issues. The first is about the vast informational power of search engines, and particularly the search engine, over so-called truth, memory, and history. As distinct from the comparatively disenfranchised individuals, who create, are the subjects of and consume indexed content. The second issue, since I’m not going just critique the private companies, is about the fundamental tension between the aspirations of European data protection law, and the capabilities and expectations of ordinary internet users. And the third issue is what we might call the surveillance-industrial complex of the twenty first century.
The force and hostility of many of the loudest reactions to the prospect of modifying search results on the basis of data protection requests, shows the extent to which we have comprehensively and largely unwittingly come to rely on privately-owned culturally biased black box services in navigating digital space. We have outsourced, the raw material, design and execution of multi-layered search strategies in return for easy, efficient interfaces and mysterious algorithms. They are of course wonderful, and deservedly Google has benefitted from network and economic effects, gaining an extraordinarily dominant market share, particularly in Europe. But this has created asymmetries of power.
For Google, completeness and trust are essential virtues of search, and this is why the case is so significant, and why it has amassed extraordinary resources in responding to it. By highlighting one way in which search results become incomplete, and I’d say it’s by far not the most significant way, as privacy requests are outnumbered one thousand to one by copyright requests, and there we see nowhere near the same level of public debate.
But by highlighting one way that search index is incomplete, it brings the issue of consumer trust in Google to the forefront, and it has knock-one consequences for its financiers, the advertisers. From the beginning, it has been identified by Google’s founders that search engines driven by advertising are "inherently biased towards advertisers and away from the need of consumers". This merchantability concern we have to keep at the heart of our consideration of the issues, because it explains the enthusiasm for analogies like "Google is a library card catalogue", happily we haven’t heard any of them today, and that it is "a curator of history, truth and memory."
And of course this implies a pure and mutual collation service, rather than one that operates dynamic statistics-based search services over indexes that are only partially complete, and of course fall short of the much vaster, richer canvas of social history, truth and memory. So I think in all of this there is an opportunity for consumers and regulators to see search engines and other privatized engines of public space as, not catalogues, but also as dealers that can be optimized and gamed.
We also have to confront an impossible conflict that has been maintained to date by intermediaries, which is when accused of bias, they are exercising scientific opinion, and when they are asked to address privacy, they are merely neutral intermediaries. I think that this is a real opportunity, and we have seen a very willing approach to try to redress that imbalance. But so far, particularly on that copyright/privacy concern, we see that economic interests have driven what intermediaries have done, rather than human interests or personal interests.
The nub of the problem is that internet companies have been successful in making us believe that the internet is public space, when it is just a representation of privately owned services. They are not public parks, they are not the Greek agora to build politics, and yet the notion of public space is critical to democratic community-oriented rule. If we concede that the internet is a public space, then do we want privatized engines, and Jeff touched on this, to be the custodian of our public records? Or do we want to have them to be accountable according to what we would traditionally have for public utilities? I think this issue is only just starting to be addressed in Europe as the sort of leader. It is also in the competition case that’s ongoing in Brussels, and it’s a question of how we deal with these private companies that are the core of our public information goods.
Since I have to move on, I will just say that this power dynamic flows into the second issue, which is the question of the disconnect between European data protection law and how people use the internet. Even if, as Artemi said, the Spaniards championed this case on their lonesome, and then the CJEU was emboldened, as Orla said, it has been the case that the entire debate has been quite narrowed by the rapid and somewhat idiosyncratic response of Google into the actual application of the decision. A lot of this has been validated by the regulators [in the Article 29 Working Party’s November 2014 Guidelines], but we are dealing only with post-hoc notice about whether information should or should not be processed. There has been no discussion of the issue of sensitive data, which has under European data protection law a near blanket ban on processing by data controllers without consent. The issue has been constrained to name searches, when, in fact, if you give me three pieces of information - your address, your profession, and where you were, or an image - then it might be very easy to identify somebody. And the question of the regional localization has been dealt with through the frame of what is Google’s version of national localization, rather than anything that’s IP address-based, or based on physical real location.
Continuing then with the second issue, the disconnect between data protection law and reality, I think that the general public has never really appreciated the staggering reach of European data protection law, and this is the first time for many that they are grappling with it. The system we have, it’s been promoted, and is politically at the moment being championed as a real solution to issues of privacy online, but I think it is woefully inadequate. The clear normative core of data protection is missing, and the reforms maintain some of those inadequacies. It may be, and some of the more heretical advocates in this area talk about the fact that we may need to have more public law style remedies or ombudsman-type remedies, rather than relying entirely on private processors and privacy agencies.
I don’t have time to get into that anymore, but I think that the final point, the third aspect that I wanted to just say is that I do think this case, and the issues it embodies, are a step towards data sovereignty and freedom in an ever more connected reality where nearly every instance of our social and private lives is mediated by private companies. It’s no exaggeration to say that this is about the struggle for freedom and control in a digital eco-system that is defined by surveillance. And it may be a fight in only a tiny corner of that eco-system, but it is important nonetheless.
I haven’t made that connect too strong due to time, but I think that the connection between having real and meaningful rights against ownership of personal data in private search engines is an important essential first step. It is a litmus test of whether we could actually countenance these rights in any of our other interactions with digital media, which becomes ever more important as we have ubiquitous computing environments mediating every aspect of daily life.
Before I get to those deep, subterranean issues, I’ve been told I can be a bit provocative so I’m going to take the opportunity and react a bit to some of what we heard this morning and in the last few, probably much more diplomatic presentations. I have two outstanding challenges or concerns that I think date right back to when this case was decided. The first, and this might sound a bit shocking, is that we don’t really know what we are talking about. Sure, we might know about the law, about institutions, about balances between rights and interests. But what we don’t know is anything more than a vague notion of the problem we are trying to solve.
At last count, 234,000 people had made requests to Google under the right to be delisted procedure. Their concerns range across the full spectrum of human experience. And yet Google has spoken publicly about only thirty one cases. Now we’ve had, I just counted, another four from William. But we have no indication of the relative frequency of these examples, any sort of greater representation of which balances they involve, how complicated they are, and so on. We have heard that the great majority of these requests are in fact a straight delisting – yes or no. But in the cases that are complex, do we need extra layers of information and intervention? I would argue that this isn’t just about extra detail or embellishment; it goes to the core of what we are trying to deal with. The paucity of information prevents us from actually developing robust, useful, enduring, and considered solutions. It exacerbates misunderstandings and it promotes ideological and intercultural conflict. It means that we, the citizens, are faced with appeals from a variety of actors who all have their own vested interests, whether it is from private companies, from regulators, from politicians and the media; all of whom are saying: "trust us". There is evolution in the system. But I would say it is still unsatisfactory.
When I have spoken to people at search engines, I’m told that the detail can’t be exposed because of privacy concerns. "We don’t want to talk about individual cases", they say. But I’m not asking to be told for example, that somebody stabbed their ex-girlfriend eight years ago and now cannot have a relationship anymore, or to ask about somebody’s medical results and the particular details that have been put on Google’s index. It is to know whether two percent or twenty per cent of these delisting requests involve criminal cases, the sort of examples that William was talking about. It is to know whether , in relation to the large number of requests to Facebook, are these people who are delisting results on their own name, on posts that they themselves have done, and for which they are not utilizing the opportunity within Facebook itself to take down posts? Or are they things another person has posted, or indeed on some of the more despicable sites that you have on Facebook, are they from people they don’t know?
What proportion of these requests concern mainstream media? The entire public debate has been about mainstream media outlets. But in the UK, the mainstream publications, the BBC, the Guardian, the Telegraph have all had in the order of thirty to sixty delistings. That’s a tiny proportion of 234,000 requests. So I think that we end up generalizing from the particular if we don’t have a greater understanding of the contours of the landscape.
Now in saying this, it is not that I want to criticize what Google is doing. It’s to improve the processes, and so ensure that the law and the principles that we have are adapted to the problems we are actually trying to solve. I think that here the DPAs have an important role to play in leadership – Willem talked about that they have thirty four cases in the Belgian DPA. There are about two hundred in the ICO. We should have the cases de-identified, and reveal some greater information. We shouldn’t bury information about how those cases are being dealt with. I think we have a right to know how they are being dealt with.
The other reason why I don’t buy the search engine defence that this is about not revealing private information is because if that concern was real we wouldn’t have the notifications to webmasters. From the webmasters I have spoken to at media publications, it is trivial to re-identify from a notice who has made a request, because you can have a one-click search at the bottom of a Google search result on a European page, and it flips over to Google.com, so you can identify immediately by putting in the URL, and the names in the articles, who it’s about.
The second outstanding issue, if that’s what we’re talking about, is who is talking. Every indication I’ve seen suggests that the bulk of these requests are about people with no public profile. They are victims of algorithmic failure. They are about normal people, and they don’t have a platform to redress speech with more speech.
By contrast, almost all of the people talking about the right to be forgotten, do come from such a platform. Polling suggests that most people don’t have information they want delisted online, but those that do, really do. And I’m concerned that those who speak out most about the right to be forgotten are not representative of those who really are at stake.
On that note, and this has been suggested on a number of occasions to me anecdotally, but I don’t think anyone has said it in public, I think there is a huge unacknowledged gender issue too in who is speaking about the cases, and how the differential impacts of the rights of the right to be forgotten are felt. This is particularly the case in some of the examples that are brought up a lot in the media about revenge porn, for example, but I think I have yet to see a panel where there is anything more than a couple of women speaking, and I think that this affects how we discuss these issues in public.
So that is who is or who is not talking, and what we are and what we are not talking about. But let me get to why it matters. I said it is about power, promises and privacy. I think the Google Spain case is an externality of at least three much deeper issues. The first is about the vast informational power of search engines, and particularly the search engine, over so-called truth, memory, and history. As distinct from the comparatively disenfranchised individuals, who create, are the subjects of and consume indexed content. The second issue, since I’m not going just critique the private companies, is about the fundamental tension between the aspirations of European data protection law, and the capabilities and expectations of ordinary internet users. And the third issue is what we might call the surveillance-industrial complex of the twenty first century.
The force and hostility of many of the loudest reactions to the prospect of modifying search results on the basis of data protection requests, shows the extent to which we have comprehensively and largely unwittingly come to rely on privately-owned culturally biased black box services in navigating digital space. We have outsourced, the raw material, design and execution of multi-layered search strategies in return for easy, efficient interfaces and mysterious algorithms. They are of course wonderful, and deservedly Google has benefitted from network and economic effects, gaining an extraordinarily dominant market share, particularly in Europe. But this has created asymmetries of power.
For Google, completeness and trust are essential virtues of search, and this is why the case is so significant, and why it has amassed extraordinary resources in responding to it. By highlighting one way in which search results become incomplete, and I’d say it’s by far not the most significant way, as privacy requests are outnumbered one thousand to one by copyright requests, and there we see nowhere near the same level of public debate.
But by highlighting one way that search index is incomplete, it brings the issue of consumer trust in Google to the forefront, and it has knock-one consequences for its financiers, the advertisers. From the beginning, it has been identified by Google’s founders that search engines driven by advertising are "inherently biased towards advertisers and away from the need of consumers". This merchantability concern we have to keep at the heart of our consideration of the issues, because it explains the enthusiasm for analogies like "Google is a library card catalogue", happily we haven’t heard any of them today, and that it is "a curator of history, truth and memory."
And of course this implies a pure and mutual collation service, rather than one that operates dynamic statistics-based search services over indexes that are only partially complete, and of course fall short of the much vaster, richer canvas of social history, truth and memory. So I think in all of this there is an opportunity for consumers and regulators to see search engines and other privatized engines of public space as, not catalogues, but also as dealers that can be optimized and gamed.
We also have to confront an impossible conflict that has been maintained to date by intermediaries, which is when accused of bias, they are exercising scientific opinion, and when they are asked to address privacy, they are merely neutral intermediaries. I think that this is a real opportunity, and we have seen a very willing approach to try to redress that imbalance. But so far, particularly on that copyright/privacy concern, we see that economic interests have driven what intermediaries have done, rather than human interests or personal interests.
The nub of the problem is that internet companies have been successful in making us believe that the internet is public space, when it is just a representation of privately owned services. They are not public parks, they are not the Greek agora to build politics, and yet the notion of public space is critical to democratic community-oriented rule. If we concede that the internet is a public space, then do we want privatized engines, and Jeff touched on this, to be the custodian of our public records? Or do we want to have them to be accountable according to what we would traditionally have for public utilities? I think this issue is only just starting to be addressed in Europe as the sort of leader. It is also in the competition case that’s ongoing in Brussels, and it’s a question of how we deal with these private companies that are the core of our public information goods.
Since I have to move on, I will just say that this power dynamic flows into the second issue, which is the question of the disconnect between European data protection law and how people use the internet. Even if, as Artemi said, the Spaniards championed this case on their lonesome, and then the CJEU was emboldened, as Orla said, it has been the case that the entire debate has been quite narrowed by the rapid and somewhat idiosyncratic response of Google into the actual application of the decision. A lot of this has been validated by the regulators [in the Article 29 Working Party’s November 2014 Guidelines], but we are dealing only with post-hoc notice about whether information should or should not be processed. There has been no discussion of the issue of sensitive data, which has under European data protection law a near blanket ban on processing by data controllers without consent. The issue has been constrained to name searches, when, in fact, if you give me three pieces of information - your address, your profession, and where you were, or an image - then it might be very easy to identify somebody. And the question of the regional localization has been dealt with through the frame of what is Google’s version of national localization, rather than anything that’s IP address-based, or based on physical real location.
Continuing then with the second issue, the disconnect between data protection law and reality, I think that the general public has never really appreciated the staggering reach of European data protection law, and this is the first time for many that they are grappling with it. The system we have, it’s been promoted, and is politically at the moment being championed as a real solution to issues of privacy online, but I think it is woefully inadequate. The clear normative core of data protection is missing, and the reforms maintain some of those inadequacies. It may be, and some of the more heretical advocates in this area talk about the fact that we may need to have more public law style remedies or ombudsman-type remedies, rather than relying entirely on private processors and privacy agencies.
I don’t have time to get into that anymore, but I think that the final point, the third aspect that I wanted to just say is that I do think this case, and the issues it embodies, are a step towards data sovereignty and freedom in an ever more connected reality where nearly every instance of our social and private lives is mediated by private companies. It’s no exaggeration to say that this is about the struggle for freedom and control in a digital eco-system that is defined by surveillance. And it may be a fight in only a tiny corner of that eco-system, but it is important nonetheless.
I haven’t made that connect too strong due to time, but I think that the connection between having real and meaningful rights against ownership of personal data in private search engines is an important essential first step. It is a litmus test of whether we could actually countenance these rights in any of our other interactions with digital media, which becomes ever more important as we have ubiquitous computing environments mediating every aspect of daily life.