The Fourth Year of Forgetting: The Troubling Expansion of the Right to Be Forgotten

Abstract

In its “right to be forgotten” decision, the European Court of Justice ruled in 2014 that search engines like Google must, upon request from an individual, remove links that result from searches for an individual’s name when those results are “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes… carried out by the operator of the search engine.” Europeans have since invoked this right to require the delisting of web sites that contain information about them that is embarrassing, disparaging, or that violates their privacy. The initial implementation of the right to be forgotten was limited in several ways. First, it was limited in geographical scope to European domains of search engines. Google—the primary search engine affected by the decision—limited delisting to its European domains (such as Google.es and Google.de) and refrained from delisting within its global Google.com search engine. While Google has consistently sought to limit the geographical reach of the right to be forgotten, European data regulators have insisted upon its global implementation. Second, the implementation of the right to be forgotten was limited to search engines; it did not extend to the underlying content at issue, such as newspaper archives or other online content. As such, the right to be forgotten mandated only indirect—not direct—censorship of content. Recently, however, European courts have expanded the scope of the right to be forgotten (and related privacy rights) to mandate how newspapers and other Internet content providers make available content, in some instances requiring erasure or anonymization of such content. These expansions of the right to be forgotten pose substantial threats to freedom of expression, including to the rights of United States citizens and members of the press to access information on the Internet regarding U.S. court decisions. In addition, the European Union’s General Data Protection Regulation (GDPR)—which went into effect in May 2018—imposes even greater infringements on freedom of expression and does not accord the fundamental due process rights of notice or the opportunity to be heard to affected speakers and publishers. To make matters worse, the right to be forgotten is expanding beyond Europe—to countries such as India, Russia, Mexico, Japan, and Colombia—and these countries are imposing expansive obligations on search engines and content providers to censor the Internet. While the right to be forgotten began as a right that was limited in scope—and had a limited effect on the free flow of information on the Internet—in the past four years it has rapidly expanded into a formidable global threat to freedom of expression.