Business Cloud News
Google recently added a form that allows users to request their personal data be deleted or de-indexed, but making private companies solely responsible for deciding the validity of such claims opens up a can of worms

Google recently added a form that allows users to request their personal data be deleted or de-indexed, but making private companies solely responsible for deciding the validity of such claims opens up a huge can of worms

Web giant Google announced the launch of a form that will allow internet users to request their names be removed from search results using its platform in response to recent a ruling by the Court of Justice of the European Union. But some privacy advocates say making companies like Google solely responsible for deciding on the validity of said claims leaves the system open to abuse and unfair bias.

The decision to offer users the request form stems from a recent court ruling, based on the 1995 Data Protection Directive, related to a Spanish man that requested a link to an old newspaper article about the repossession of his house be removed from Google’s index and search results.

The company said it would assess each request on a case-by-case basis, and aim to apply a “public interest” principle that would attempt to ensure abusive requests would be denied, like if a politician attempted to suppress a scandal for instance.

“We will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information,” the company said.

“We will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information—for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials.”

The cloud giant said it is still mulling how to implement removal requests under the impending EU data protection law, but will finalize its approach “as soon as possible.”

But the move also comes with risks since it puts the search giant in charge of determining what search results are “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed.”

European Digital Rights executive director Joe McNamee told Business Cloud News that the courts provide very little guidance with regards to the criteria justifying de-indexing or deletion.

“News reports have vastly overestimated Google’s obligation with respect to this ruling,” he explained, adding that Google regularly suppresses certain avenues for finding content based on requests from governments, companies and citizens based in part on relevant stipulations for data deletion contained in the 1995 Data Protection directive.

“It means that if I ask them to refrain from storing my name, all Google has to do is remove my personal information from the page that is in their cache, which allows them to find that page, perhaps more easily than in a case where others are looking for any other characteristic  contained within that page,” he said.

“But they’re going to struggle when it comes to determining what a reasonable request would be; that is vastly more complex.”

McNamee said that the EU Court should establish more detailed obligations regarding what a valid request would look like under the law because the alternative would unfairly bias Google’s discretion in the matter. The company has previously come under pressure from both state and non-state actors to de-index websites outside of any request based in law.

He said local data protection authorities should be included in the decision-making process.

“It shouldn’t be Google’s sole task to determine what a reasonable request is,” he said.

“If the court had said there needs to be an open, transparent process by which Google decides on these cases that would be another matter, but that’s not what happened. What the court shouldn’t do but has done is leave companies and their customers to work it out for themselves.”

@BizCloud
News