Original URL: https://www.theregister.com/2014/06/17/for_mon_how_google_plans_to_torpedo_your_privacy_rights/
Slippery Google greases up, aims to squirm out of EU privacy grasp
Will the huge advertising firm manage to spin its way free of the law?
Posted in Legal, 17th June 2014 10:59 GMT
Special Report Google is wriggling desperately to escape new European privacy rules that could force it to take some responsibility for what information it republishes in response to a given search – in particular a search of someone's name.
The European Parliament voted in favour of data protection reforms in March, which the EU's press office proudly proclaimed was "irreversible". But they may not be cemented in place if Google gets its way. The process is still open to amendments – and there's one amendment in particular that the Californian advertising giant would urgently like to add.
This involves removing the right of ordinary citizens to ask for irrelevant data that isn't in the public interest to be deleted from search engines. Google may find its long history of arrogance and disdain in dealing with European authorities a handicap here, no matter the amount of friendly commentary it manages to plant in the Anglophone media regarding the issue.
Last month the European Court of Justice ruled that Google was subject to European data protection laws – and must therefore take account of an individual's fundamental right to "a private life" – expressed in Article 8. The Court carefully explained that this was not some absolute "right to be forgotten", but had to be balanced against the public interest to know. The links to be removed would have to be old and irrelevant, and magnified by the search engine's reputational power into something unfair.
Sources suggest that Google will wait until an independent council of European data protection bods complete a review of the reforms - they met last week - before making its move. This process is called the Article 29 Working Party.
Why does Google care? It's a telling question. The gigantic advertising company can begin bouncing link-removal requests from citizens to the Information Commissioner's Office right away. Then Google can - if it's as serious as it claims to be about preserving its search results - appeal each and every ruling made by the ICO in favour of complainants. The multi-stage legal procedure takes around 18 months. So by around 2017 we could have a decent track record from which to decide whether a tweak to data protection legislation in Europe actually needs to be made.
But Google doesn't want that. It wants to be completely exempt from the law, and it wants to be so as soon as possible. The ads giant has launched a broad-based PR campaign pushing to "change the law", creating a false impression that it's being asked to make difficult decisions in vast numbers (in fact courts ultimately decide, not Google), and that the situation is burdensome for it (when in fact it can bounce all the complaints to the data protection registrar, and wait for the legal system to do all the work).
Google has announced a hand-picked team of five "advisors" with which it would consult on this matter. One of them, Wikipedia co-founder Jimmy Wales (who now lives in the UK), appeared on TV recently to give a highly misleading interpretation of the ECJ ruling - one which flatly contradicted the text handed down by the court. Sadly, he did so without challenge from the BBC host, Andrew Marr, who introduced him as "one of the internet's undisputed legends" and "founder of the era-defining encyclopaedia, Wikipedia".
In fact, the CJEU ruling states that the decision will indeed be left to the courts and judges. In plain English, the Court explained:
The Court points out that the data subject may address such a request directly to the operator of the search engine (the controller) which must then duly examine its merits. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly ...
Wales was dissembling when he claims Google is being forced to make ethical interpretations typically made by judges.
Academics are also helping to lobby for Google's desired change in the law. In an interview with us, another of Google's five Advisors on the issue, Professor Luciani Floridi, also called for changes to the law. But he declined to suggest what kind of change that might be.
"To be honest I do not know why Google has taken the steps it has taken to putting that form online and organising that advisory committee," Florini told us. But everything pointed to a legal change.
"Some improvements could be made," Floridi told us. "The current legislation we have is a bit strained."
How, exactly?
"I'd really rather not comment."
We now have two of the five advisors Google appointed pressing for a change in the law - and long before 2017, when lawmakers could consider a Europe-wide change in the law on the basis of real evidence.
'A digital superstate that can navigate its floating kingdom undisturbed by nation-states and their laws'
Google has assembled a SOPA-style "populist" campaign designed to persuade bureaucrats and the media that the ECJ's privacy ruling is unworkable - before it's had a chance to work.
Google's strategy appears to be similar to Microsoft's in times past, when it was ordered by a US judge to demonstrate a version of Windows with Internet Explorer "disentangled". It turned up with a modified, "disentangled" copy of Windows that wouldn't boot. It was saying: "See, if we comply with your crazy order, you stupid judge - everything breaks."
The Process
The question is - will Google succeed? Here's how the new data protection changes are working their way through the EU machinery.
The EU views "a strong EU General Data Protection framework" as "essential for the completion of the Digital Single Market", a goal it wants to declare in 2015. So it's updating these regulations: Directive 95/46, which established how Freedom of Information and data privacy work in Europe. The UK adopted this in 1998.
The new framework was announced two years ago, in January 2012. This can be read in detail in here and here.
The EU parliament approved them with a plenary vote in March this year - meaning they're set in stone - almost. The final step is adoption by the Council of Ministers. On Friday the Council met in Luxembourg to discuss data protection.
American companies are hardly flavour of the month in Brussels following the Snowden revelations. Google is trying to fend off a full investigation into how it treats third party businesses in its search results, and over its grip on the digital market. Google's privacy rap sheet illustrates the range of data protection concerns. And that was all acquired before it bought home-monitoring outfit NEST.
In April, Mathias Döpfner, the boss of Axel Springer, described Google as "a kind of superstate that can navigate its floating kingdom undisturbed by any and all nation-states and their laws". (Here in pdf).
That makes it all the more likely that American companies will have to conform to Pillar Two of the Commission's Proposal:
Pillar Two: Non-European companies will have to stick to European data protection law if they operate on the European market ...
At this stage, could an amendment be tabled that defies the Commission, the Parliament, and the CJEU - one that simply excludes Google from European Law?
In theory, yes - but given the context, this is unlikely, thinks Serena Tierney Head of Intellectual Property at commercial law firm Bircham Dyson Bell.
"It could, but I don't think it would. The Court makes it clear that this decision is to strike a balance two fundamental rights: privacy and freedom of expression."
The Germans in particular feel so strongly about privacy, that such a move would be an affront. Google can dream of a world without laws to inhabit its behaviour. It's not going to get a world without Germans.
Last week the Article 29 Working Party met and issued a strongly worded statement.
It vowed to investigate if Google refused to abide by the CJEU ruling, promising to develop "a coordinated response to complaints of data subjects if search engines do not erase their content whose removal has been requested.
It added all search engines are "to put in place user-friendly and pedagogical tools for the exercise by their users of their right to request the deletion of the search results links containing information relating to them. More generally, search engines should ensure compliance with the opinion of the WP29 on data protection issues related to search engines (WP148)".
Google has flooded Brussels with lobbyists, but this may not be an adequate response to regulators on a continent growing weary of what is more and more perceived as US arrogance. Sources familiar with the Article 29 Working Party tell us that after it wrote to Google in 2012 reminding it that its privacy policy broke EU law, Google failed to reply.
That imperial indifference to different cultural practices is coming back to haunt Google. ®