Search Engine Operators Research Articles

Право на забвение: понятие, содержание, проблемы законодательного регулирования

The article examines the issues of legislative regulation of the right to be forgotten, the relationship of this right with the right to delete information. The concept of “right to be forgotten” is defined, its structure and content are revealed. As a result of the study, the author proposes to enshrine in federal law no. 149-FZ of July 27, 2016 “On Information, Information Technologies and the Protection of Information” the ability to demand that the search engine operator stop issuing links to information on personal data, except for information subject to placement on the Internet; to grant the right to be forgotten to children, parents and the surviving spouse of a person in the event of the death of the latter; to specify the mechanism for filing claims by the applicant to remove a link to the search engine operator.

Od zasady do praktyki. Wyzwania dotyczące ogólnounijnej realizacji „prawa do bycia zapomnianym” po sprawie Google przeciwko CNIL

While scholarly attention largely gravitates towards the debate on regional versus global delisting under EU law, this paper scrutinizes the Google v CNIL ruling concerning the conditions and methods of EU-wide delisting in light of the preliminary reference questions posed. The focus lies in the intricate analysis absent from the dispositif, which leaves many complexities to the evaluation of the national data protection authorities and the courts, and, concerningly, to the solely discretion of the search engine operators. Nuanced analyses absent from the dispositif address the crucial aspects in defining the territorial scope such as the role of geo-blocking, the possible public interest variations within the EU and the regulatory cooperation frameworks, particularly in light of Google’s standard delisting procedure. Furthermore, the research highlights the concerns about the varying levels of protection for EU citizens, contrasting the delisting procedure before the search engine operator and the formal proceedings involving the data protection authorities and the courts. By exploring a significant decision by the Belgian data protection authority, the author illustrates the possibilities for regulatory cooperation to achieve a cohesive and comprehensive approach to EU-wide delisting. The author advocates for regulatory transparency in this legal area and explicit guidance from the European Data Protection Board toward ensuring that the “right to be forgotten” is applied consistently and in a manner that genuinely protects individuals’ rights across the EU.

Case C-460/20, TU, RE v. Google LLC (C.J.E.U.)

On December 8, 2022, in a case relating to a de-referencing request to an internet search engine operator on the basis of inaccurate information, the Grand Chamber of the Court of Justice of the European Union (CJEU) delivered its judgment (the Judgment) on the interpretation of the right to erasure (right to be forgotten) under Article 17 of the EU General Data Protection Regulation 2016/679 (GDPR), and the rights of access and objection under Articles 12 and 14 of the EU Directive 95/46/EC (the Directive), in light of fundamental rights to privacy, protection of personal data, and freedom of expression and information under Articles 7, 8, and 11 of the Charter of Fundamental Rights of the European Union (the Charter). The case establishes that the burden of proof is on the person requesting de-referencing to show manifest inaccuracy of information, but this does not require them to seek a judicial remedy against the website publisher before requesting de-referencing. Although the search engine operator is obliged to carry out checks to confirm the merits of the request, it has no obligation to investigate the facts and probe further with the website publisher. However, it must de-reference where relevant and sufficient evidence is submitted to show manifest inaccuracy, and it must display a warning where it is made aware of judicial proceedings.

The right to de-referencing ‘manifestly inaccurate’ information: TU, RE v Google

ABSTRACT On 8 December 2022, the Court of Justice of the European Union (CJEU) issued a judgment in case TU, RE v Google (C-460/20) as a step forward in shaping the right to de-referencing. After an overview of the previous CJEU’s case-law on the right to de-referencing, the present note gives insights into the findings of the CJEU regarding both the de-referencing of allegedly inaccurate content by the search engine operators, and the de-referencing of photographs displayed in the form of thumbnails. Regarding the dereferencing of online content, the CJEU held that such dereferencing must be granted when the data subject proves a manifest inaccuracy without the need for a judicial decision. As for the dereferencing of thumbnails, their informative value should be taken into account regardless of the original context of their publication.

‘The Right to Be Forgotten’ and the Sui Generis Controller in the Context of CJEU Jurisprudence and the GDPR

The Google Spain judgment established a search engine as a sui generis controller and the related ‘right to be forgotten’ (right to delisting) under data protection legislation, despite the controversies surrounding it primarily on account of the logic of the search engine operator’s functioning and its consequent inability to comply with certain basic data protection requirements. Resulting interpretations, ie the contouring of data protection legislation under CJEU case law (the Google Spain and the GC and Others judgment), are examined in this paper in detail in relation to the currently applicable GDPR provisions, which allows conclusions to be drawn on the substance of the (sui generis) delisting right, the legal standing of data subjects, the assessment of delisting requests, and the related role and responsibilities of search engine operators. While neither removal from the source web page is required nor can delisting be denied exclusively on the basis of the publisher’s right to freedom of information and expression, analysis shows several manifestations of inherent interweavement with concerns of freedom of information and expression, which at the same time intrinsically oppose data protection and privacy rights. The issue is further challenged by a lack of harmonisation in the area of reconciling privacy and data protection rights with the freedom of expression and information. The last section of the paper discusses the rationale behind the recently established duty of adjusting, ie rearranging, search results in certain cases where delisting requests were denied, the implications for the operators, and the future outlook. Keywords: right to be forgotten, GDPR, GC and Others v CNIL, sensitive data, legitimate interest, substantial public interest, freedom of information, adjusting search results.   This work is licensed under the Creative Commons Attribution − Non-Commercial − No Derivatives 4.0 International License.   Suggested citation: N Gumzej, ‘“The Right to Be Forgotten” and the Sui Generis Controller in the Context of CJEU Jurisprudence and the GDPR’ (2021) 17 CYELP 127.

Problems and trends of the information security systems in some countries of the Asian region

The article is devoted to the theoretical and legal analysis of information security systems in some countries of the Asian region. It is proposed to consider the information protection system as a set of interrelated elements and their interactions aimed at preventing and countering threats in the information sphere, as well as developing and improving the system itself. The system-structural approach allowed the author to highlight the following elements of the information security system: objects, subjects, scope, functions, conditions and directions of the system, principles and legal framework. The main trend in the field of information security of these countries is the strengthening of state regulation of their cyberspace. In particular, the legislation of these countries strictly regulates the rights, duties and responsibilities of the owners of information resources on the Internet, news aggregators, instant messengers and search engine operators.

Google LLC v. Commission nationale de l'informatique et des libertés (CNIL)

InGoogle LLC v. Commission nationale de l'informatique et des libertés (CNIL), the Court of Justice of the European Union (CJEU or Court) held that the EU law only requires valid “right to be forgotten” de-referencing requests to be carried out by a search engine operator on search engine versions accessible in EU member states, as opposed to all versions of its search engine worldwide. While the ruling has been perceived as a “win” for Google and other interveners, such as Microsoft and the Wikimedia Foundation, who argued against worldwide de-referencing, the Court also made clear that that while the EU law does not currently require worldwide de-referencing, “it also does not prohibit such a practice” (para. 72). As a result, the CJEU found that an order by a national supervisory or judicial authority of an EU member state requiring worldwide de-referencing in accordance with its own national data protection laws would not be inconsistent with EU law where the data subject's right to privacy is adequately balanced against the right to freedom of information. By leaving the door to extraterritorial de-referencing wide open, the CJEU continues to pursue its post-Snowden hard-line stance on data privacy in a manner that is likely to transform the data privacy landscape.

Google v. CNIL and the Right to Be Forgotten: A Judgment of Solomon

The EUCJ ruling on Case C-507/17 provides further clarity on the territorial scope of the right to be forgotten. The court interprets that the EU law does not require a search engine operator to attend the right to de-referencing on all the versions of its search engine globally, but only on those corresponding to all the Member States, but at the same time it also clarifies that a supervisory or judicial authority of a Member State remains competent to, after weighing up the legally protected interests, order (where appropriate) that the de-referencing is carried out on all versions of the relevant search engine. A decision that likely does not please either the search engines or the data subjects, and which drops a certain dose of uncertainty on the system. GDPR, right to be forgotten, right to de-referencing, search engines, territorial scope

Google LLC v. Commission Nationale de l’informatique et des Libertés (CNIL)

In Google LLC v. CNIL, the Court of Justice of the European Union (CJEU or Court) held that the EU law only requires valid “right to be forgotten” “de-referencing” requests to be carried out by a search engine operator on search engine versions accessible in EU Member States, as opposed to all versions of its search engine worldwide. The ruling has been perceived as a “win” for Google and other interveners, such as Microsoft and the Wikimedia Foundation, who argued against worldwide de-referencing; while the Court has been praised for its restraint in finding that the current EU law on the “right to be forgotten” only applies within the EU. However, the CJEU went further and recognized the EU Parliament’s ability to extend the GDPR to apply extraterritorially and Member States’ ability to apply national de-referencing laws beyond their borders. Moreover, the CJEU appears to have reached these conclusions at the expense of the GDPR’s aims to harmonize the data protection framework across the EU. The decision allows Member States to decide individually the territorial scope of de-referencing obligations, thus creating the potential for different results based on where the requester resides. By creating the potential for national data protection authorities to apply stronger protections than those afforded by the GDPR, this decision could be seen as another brick in the “data privacy wall” which the CJEU has built to protect EU citizens. This note thus argues that Google LLC v. CNIL’s significance can only be understood by situating it in the broader context of CJEU’s recent data privacy decisions, which reveals the continued forcefulness of the CJEU’s stance on data protection after Snowden and Cambridge Analytica scandal.

WORK IN PROGRESS: THE EUROPEAN "RIGHT TO BE FORGOTTEN" – LEGAL AND TECHNICAL CHALLENGES OF SEARCH ENGINES COMPLYING THE RIGHT TO ERASURE

The new European right to be forgotten (Art. 17 of the European General Data Protection Regulation (GDPR) grants EU citizens the right to demand the erasure of their personal data from anyone who processes their personal data. To enforce this right to erasure may be a problem for many of those data processors. On the one hand, they need to examine any claim to remove search results. On the other hand, they have to balance conflicting rights in order to prevent over-blocking and the accusation of censorship.
 The paper examines the criteria which are potentially involved in the decision-making process of search engines when it comes to the right to erasure. We present an approach helping search engine operators and individuals to assess and decide whether search results may have to be deleted or not. Our goal is to make this process more transparent and consistent, providing more legal certainty for both the search engine operator and the person concerned by the search result in question. As a result, we develop a model to estimate the chances of success to delete a particular search result for a given person. This is a work in progress.

GC et al v CNIL: Balancing the Right to Be Forgotten with the Freedom of Information, the Duties of a Search Engine Operator (C‑136/17 GC et al v CNIL)

Case C‑136/17 GC, AF, BH, ED v Commission nationale de l’informatique et des libertes (CNIL), Judgement of the Court of Justice of the European Union (Grand Chamber) of 24 September 2019 Search engine operators are confirmed to be controllers with regard to the processing necessary to create the search result list and the structured overview present under each result. In their quality as controllers, search engine operators are subject to the prohibition and exceptions concerning sensitive data as per Article 8 of Directive 95/46/EC and 9 of the GDPR, since no specific derogation exists. However, the extent of their obligations as controllers is peculiar in the case of sensitive data and is limited to assessments following the request of the data subjects, due to the nature of the technology involved which would make an a priori evaluation impossible. In complying with the right to be forgotten, search engine operators must carry out a balancing of the right to personal data protection with the freedom of expression and information. In this regard, the importance of the role of search engines in making information available is stressed. Furthermore, the right of the general public to research is deemed to be not only limited to current information but also to the past, although in this case the search engine operator should evaluate whether, due to the time passing, the information concerning offences and criminal convictions no longer reflect reality and the web pages reporting outdated information should either be de-listed or listed only after those pages reporting more updated circumstances. Articles 8 and 9 of the Data Protection Directive; Articles 9, 10 and 17 of the General Data Protection Regulation; Articles 7, 8 and 11 of the EU Charter of Fundamental Rights; Articles 8 and 10 of the ECHR

Setting Borders to Forgetfulness: AG Suggests Limiting the Scope of the Search Engine Operators’ Obligation to Dereference Personal Data

Opinion of Advocate General Szpunar, Case C-507/17 Google LLC v Commission nationale de l’informatique et des libertés (CNIL), 10 January 2019 1. A search engine operator is not required to implement a request for dereferencing of personal data on all domain name extensions of its service. 2. However, a search engine operator must take any measure available in order to ensure full and effective dereferencing. This includes notably resort to geo-blocking, preventing access from users supposedly located in an EU Member State irrespective of the domain name extension of the search engine they use. Articles 12(b) and 14(a) of Directive 1995/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L 281/31.

GC and Others v CNIL on the Responsibility of Search Engine Operators for Referring to Sensitive Data: The End of ‘Right to be Forgotten’ Balancing?

GC and Others v CNIL on the Responsibility of Search Engine Operators for Referring to Sensitive Data: The End of ‘Right to be Forgotten’ Balancing?

Az internetes keresőmotor működtetőjének az adatvédelmi szabályok betartásáért való felelősségének a terjedelme a harmadik fél által közzétett weboldalakra mutató keresési eredmények tekintetében

By its judgment of 13 May 2014 in the Google Spain and Google case the Court set out that, under the EU data protection directive, an internet search engine operator is responsible for the processing that it carries out on personal data which appear on web pages published by third parties. Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.By two judgments of 24 September 2019 in two French cases over Google, the Court added new elements to its case-law on the internet search engine operator’s responsibility for protecting personal data. On the one hand, the Court ruled that the personal scope of the prohibition, which, under EU law on the protection of personal data, applies as a general rule to processing certain categories of sensitive personal data, also encompasses the operators of search engines. Moreover, the Court pointed out that, in the context of a request for de-referencing regarding sensitive data, a balance must be struck between the fundamental rights of the person requesting the de-referencing and those of internet users potentially interested in that information.On the other hand, as to the territorial scope of the internet search engine operator’s responsibility at issue, the Court set out that the operator is not required to carry out a de-referencing on all versions of its search engine. It is, however, required to carry out that de-referencing on the versions which specifically target the general public of any of the EU member states, and to discourage internet users from gaining access, from one of the member states, to de-referenced links appearing on versions of that search engine outside the EU.

Global identity management for individuals? The right to be forgotten and issues of extraterrioriality

The Google Spain ruling of the Court of Justice of the European Union has received much attention (and criticism) both in Europe and the other side of the Atlantic. In this paper I present the decision, focusing on it novel elements and the issues of extraterritoriality. I analyse the problems of extraterritoriality as a function of jurisdiction relying on the presence or absence of links to the EU through the location of establishment, equipment or the target of business activity. Next, I discuss the arguments promoting and rejecting the global application of Rtbf by search engine operators. Finally, I consider extraterritoriality as a practical problem, the solutions offered by scholarship and national courts, as well as their effect on corporations.

Factors influencing search engine usage behavior

We analyzed the effect of individual factors, contextual factors, and perception of search engine advertising on users' search engine usage behavior. The sample comprised 404 Chinese who used search engines in the context of their paid employment. Results showed that (a) perceived search skills and perceived search engine reliance significantly and positively impacted users' general search engine usage, (b) perceived advertising clutter reduced the beneficial effects of perceived search skills on users' general search engine usage, (c) users with higher perceived search engine reliance preferred search engines to other online search methods, and (d) prior negative experience reduced the positive link between perceived search engine reliance and users' specific search engine usage. Our findings suggest that search engine designers and operators should focus on individual and contextual factors influencing search engine usage behavior, and should consider users' perception of advertising on search engine programs.

An exploration into the information-seeking behaviours of engineers and scientists

This article considers findings from Master’s research that investigated the information-seeking behaviours of engineers and scientists in the workplace. The objectives of this research were to establish where engineers and scientists look for information, consider their search preferences and determine the understanding they have of online search engine operation. There is limited current research in these areas looking at engineers and scientists in the workplace. The research was undertaken using a mixed methods research methodology. A survey was conducted with engineers and scientists working in the UK, using an online questionnaire and interviews to obtain quantitative and qualitative data. Due to the small sample size (115: 58 engineers, 57 scientists) this research does not make generalisations about the wider population. The research showed both similarities and differences between engineers’ and scientists’ information-seeking behaviours. The most popular resources used by both engineers and scientists were online search engines, specialist databases and scholar search engines; and the most used sources were from within their own organisation (colleagues and documents). Electronic versions of sources were preferred over print because of their searchability; however, when an item was found it was often printed out to read. Although the main focus of this research was not information literacy it is suggested that there are significant gaps in the understanding of search engine functionality by both engineers and scientists, even though it is the most heavily used resource for information seeking. Whilst this research does not make generalisations about the wider engineer and scientist populations, potential implications for information professionals working with these groups are considered.

Effects of regulatory focus and user perception on search engine advertising avoidance

We examined the effects of promotion and prevention types of regulatory focus and the 3 user perception factors of perceived goal impediment, perceived advertising clutter, and prior negative experience, on search engine advertising (SEA) avoidance. The participants comprised 348 in-service users of the Chinese search engine, Baidu. We found that regulatory focus, perceived goal impediment, perceived advertising clutter, and prior negative experience had a significantly positive effect on SEA avoidance. Moreover, each user perception factor fully mediated the relationship between regulatory focus and SEA avoidance. We also revealed 1 personality antecedent (regulatory focus) of SEA avoidance and examined how it functions. Our findings suggest that advertisers and search engine operators should differentiate between promotion-focused and prevention-focused users, and pay attention to the perceived experience of each user type.

Right to Be Forgotten: Much Ado About Nothing

In the information society, the role of private sector entities in gathering information for and about users has long been a most critical issue. Therefore, intermediaries have become a main focus of privacy regulations, especially in jurisdictions with a strong tradition of privacy protection such as Europe. In a landmark case, the ECJ ruled that an internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties. The recognition by the European Union of a so called “right to be forgotten” (RTBF) has ignited disgruntled reactions from civil society and legal scholars, especially in the United States. Meanwhile, proposals for the adoption of a similar right have appeared in several jurisdictions, including Brazil, Japan, Korea, and Russia. Supposedly, the right to be forgotten would endanger freedom of expression (FoE) and access to information. Apparently, factoids — defined by the Oxford Dictionary as “an item of unreliable information that is reported and repeated so often that it becomes accepted as fact” — dominated the recent debate surrounding the right to be forgotten. This paper will discuss and debunk these factoids, review data protection legislation in Europe, and explore the legal and policy implications of the newly emerging right to be forgotten. Finally, the idea that extra-territorial application of the RTBF might unleash a kraken that can break down the Internet will be contextualized within the present political scenario. The extra-territorial application of the RTBF follows in the footsteps of a global move towards data protectionism against the de facto market dominance of US Internet conglomerates. Global blocking governed by a nationality principle — as suggested by CNiL and other EU institutions — would put at rest these protectionist concerns.

The Right to Be Forgotten in the European Union and Russia: Comparison and Criticism

In July, 2015, the Russian President signed Law No. 264-FZ which grants to Russian citizens the right to request delisting of search results which link to inaccurate or irrelevant information about them (“the right to be forgotten”). According to its drafters, the law is expected to adapt Russian law to the European practice. This article recounts the decision of the Court of Justice of the European Union in Google Spain v. AEPD and Mario Costeja Gonzalez, the case which inspired Law No. 264-FZ, and analyses commonalities and differences between the judgment of the Court of Justice and Law No. 264-FZ.The decision in Google Spain v. AEPD and Mario Costeja Gonzalez was decided with reference to the principles contained in the data protection legislation. Guided by these principles, the Court of Justice of the European Union sought to strike a balance between the individual’s right to privacy and right of the public to access the information. As a consequence, search engine operators in the European Union are not obliged to remove search results if there is the preponderant interest of the general public in having access to the information in question. In contrast, Law No. 264-FZ is not based on data protection principles and introduced the sui generis right to request delisting of search results. The law contains a number of differences from the decision in Google Spain v. AEPD and Mario Costeja Gonzalez. Most critically, Law No. 264-FZ fails to give due consideration to the public’s right to access information and does not contain a similar general exception from delisting of search results.