Analysis Google's advisory panel on privacy recommends rolling back 160 years of UK common law, say legal experts, with Google itself creating new interpretations of well-established legal principles. The consequence would be that Google usurps the courts' role in guarding individual privacy, which critics say would be like the fox ruling the hen house.
Google appointed the advisory panel following the European Court of Justice's Gonzalez ruling last year, which decreed that Google is not exempt from EU privacy and data protection laws. As a consequence, Google has been "de-listing" search engine results in response to complaints from individuals. The panel made recommendations today.
The most surprising recommendation is that Google, a US corporation, wants to be established as a quasi-legal authority on privacy matters. The most worrying, lawyers tell us, is that the panel confuses well-established principles such as "in the public interest", established here since 1848 – long before the EU existed.
The least surprising revelation is that at least two panel members – Guatamalan labour lawyer Frank La Rue, and Jimmy Wales of Wikipedia – seem have no grasp of the EU law, while none of the panel appear to have read the CJEU Gonzalez ruling itself. That much we already knew from the Advisory Panel's touring "roadshow", which saw La Rue speculate over fundamental rights. (He "doubted" that the "Right to be Forgotten" was an EU Charter Fundamental Right – while any European lawyer could have told him it isn't).
Not all of the "Wise Monkeys" seem to know the European law
Wales has repeatedly complained* that Google is being unfairly treated by being put in a position of being the "ultimate legal authority" by the Gonzalez ruling. The CJEU clearly stated that the courts, not the data controller, are the ultimate legal authority – which means Google doesn't need to agonise over deletions. Or invite an advisory panel to agonise on its behalf, either. It could simply bounce them up to the Information Commissioner's Office.
The Panel's report is written in US English, rather than UK English – a gaffe that will infuriate some Europeans.
Do these experts sound like experts to you?
Not surprisingly, the Google-appointed panel wants to give Google maximum leeway in how it interprets matters. But as Serena Tierney at BDB Law points out, it sounds confused.
The Gonzalez ruling didn't establish a "right to be forgotten", but balanced two fundamental rights, of the European Convention on Human Rights: Article 8 (privacy) and Article 10 (free expression). The court said the rich legal history of each member state would ultimately decide. Each member state has distinctive mores and morals regarding what is permissible speech, and what is an invasion of privacy.
In the UK, the common law on "privacy" is older than most people think. Lawyers often refer today to a landmark confidence case in 1848, brought by Queen Victoria's consort, Prince Albert: Albert vs Strange. In more recent years the ECHR was incorporated into UK law, giving the courts more to do. The courts have made some subtle distinctions here, such as in Naomi Campbell vs Mirror Group Newspapers. Campbell sued the Mirror for publishing a photo of the model leaving a rehab clinic. Her lawyers successfully argued this was a breach of confidence.
"The court ruled that there was a sufficient public interest in her being able to attend drug rehab clinic without feeling they're going to be photographed doing it. It was not sufficient that 'public would be interested'", Tierney explained. In other words, "of interest to the public" and "promotes the interests of the public" are quite different. The test has been applied to all appropriate UK cases since 2004.
Yet Google's advisory panel acts if the distinction had never been made. It wants to make those distinctions itself using Google's Law – a supra-legal legal authority.
On page 9, the Google panel considers the criteria for delisting, and writes:
"In general, this information will hold increased weight of privacy rights in the balancing test against public interest. The exceptions will generally be for individuals who play a role in public life, where there is a public interest in accessing this information about the individual."
Simply being famous makes Google more likely to refuse a privacy request, then. But the courts have already ruled, rejecting the simplistic argument that if you're very famous, you don't have any privacy.
"They're saying that if this is in the public interest, it may otherwise outweigh a strong privacy interest suppressing publication. But if people are gagging to read a story about the sex life of a cheating soccer star - that's not sufficient."
"They're trying to blur concepts central to breach of confidence cases. In doing that they're wrong," thinks Tierney.
Google Panel makes a similar blurring elsewhere. In a notably pious statement, it writes:
"Where content relates to a historical figure or historical events, the public has a particularly strong interest in accessing it online easily via a name-based search, and it will weigh against delisting. "
This also gives it considerable interpretive leeway. Why does it matter?
Several people the panel consulted suggested Google take on a quasi-legal role. The UK's Big Brother Watch said: "We think it would be worthwhile for search engines to consider jointly funding an arbitration board."
(There's already an arbitration board. It's called the UK courts)
The Editor of WiReD Italia recommended another quasi-legal board, based on ICANN's dispute resolution panel, decide.
The Google panel was careful not to recommend any of these – yet – but the appeal must be clear. The CJEU ruled that Google can't evade European privacy law: Google had argued in the case that it isn't really operating in Europe, so it can't be subject to its laws. Google can't easily repeal European privacy law, either. But it can "become the court", which, for Google, is the next best thing – and a major win.
The Panel's full report can be read here. ®
As James O'Brien pointed out to Wales on Newsnight, Jimbo is no disinterested party in the privacy debates as the world's largest publisher of mostly inaccurate information. Once people start to exercise their rights, they'll be coming after Wikipedia: