At 3:20 a.m. on August 24, 2014, the strongest earthquake in a quarter-century rocked the San Francisco Bay Area, causing damage widely estimated at between $300 million and $1 billion.
The quake spared Silicon Valley and other areas farther south, where many of the world’s biggest tech companies–including Twitter, Google, Facebook, Apple, and Yahoo!–are based. Yet proximity means that the region is subject to the same tectonic perils, which is likewise true of a dangerous rift in the increasingly volatile digital information landscape: In both cases, disruption in one region points to potential trouble elsewhere, even if the effects are not immediately felt.
The most pressing danger facing California’s tech companies involves shockwaves from the rupture of doctrinal tensions between two legal Western philosophies that have long been under pressure.
The first, a distinctly American notion of free speech and privacy that tends to sacrifice the latter to the former, is all but unique in the world, providing unmatched protection for news and other information in the public interest. This can lead to uncomfortable results in which speech of questionable merit remains untouchable by the state. Born of the American colonists’ experiences with occupying British forces, the underlying philosophy is that in a so-called “marketplace of ideas,” good ideas will prevail. These principles are applied so broadly that U.S. courts have held that search engine results are a form of free speech.
By contrast, European courts and lawmakers tend to take a more ad hoc approach that sometimes sacrifices newsworthy information to individual privacy. This approach also has its rationale: “The privacy protections we see reflected in modern European law are a response to the Gestapo and the Stasi,” Fred H. Cate, a law professor at Indiana University’s Maurer School of law, told The New York Times in 2010.
Two cases decided in 2014–Riley v. California, decided by the U.S. Supreme Court, and Google Spain v. AEPD and Mario Costeja González, decided by the Court of Justice of the European Union–illustrate the schism between these two philosophies. Each case also represents a break from traditional ways of viewing these complex issues. Taken together, they create uncertainty about the delicate balance of free expression, privacy, and the power of states to surveil and censor journalists and the platforms they use.
Riley suggests that the U.S. has finally broken from its reluctance to protect digital data from unwarranted seizure; at the same time, U.S. free expression principles remain intact. The EU, by contrast, is moving toward allowing governments to quash newsworthy speech in the name of individual privacy, a trend that González accelerates. Should the European trajectory toward censorship continue, it will limit tech companies’ ability to host newsworthy information, with potential consequences for press freedom around the world.
*****
Down on his luck in 1998, Mario Costeja González likely never imagined that he would send one of the richest companies in the world scrambling to scrub the fact of his misfortunes from its corner of the public Internet nearly a generation later.
González began his quest against Google in earnest in 2009, when he learned that a search for his name on the website brought up an old advertisement announcing the repossession of his home to pay a tax debt. González, who told the Guardian that he had long since put his money troubles behind him, felt it unfair that the 36-word advertisement could still be found so easily, and set out to have it buried.
Applying the European Union’s Data Protection Directive, the Spanish Data Protection Agency (AEPD) rejected González’s claim against the newspaper in which the advertisement had been placed but upheld it in regard to Google. Faced with removing the links to the otherwise lawful article, Google Spain and Google Inc. appealed, and the issues ultimately found their way before the European Court of Justice (ECJ), the highest court in the EU. The court ruled for González and, in doing so, created the so-called right to be forgotten.
In an age in which so much personal information can be found online, it is easy to see how a “right to be forgotten” might seem seductive. Worldwide, the ability to control what can be learned about one’s self is a topic of widespread public concern. A May 2014 report of a study led by researchers at the Oxford Internet Institute found that two-thirds of global Internet users believe that organizations, companies, and agencies ask for too much personal information online. In the U.S., attitudes are even starker. For example, 91 percent of respondents to a November 2014 Pew Research Center poll of U.S. consumers said that they agreed or strongly agreed that consumers have lost control over how information is collected and used by companies.
The abuse of private information can be especially dangerous for journalists. All too often, journalists are subjected to harassment–and worse–facilitated by information gleaned from the Internet. Sometimes these harms are the result of online research, such as when, in January 2013, The New York Times reported that reporters and editors from The Journal News, in suburban New York, had their home addresses posted online after publishing a story about gun ownership in the state, causing some staffers to temporarily move into hotels. At other times, malevolent actors may end up abusing information in their possession, such as in November 2014, when BuzzFeed reported that a top executive at the car-sharing company Uber had tracked a journalist’s movements without her permission; that same month, the outlet reported that while at a dinner in Manhattan, Uber’s senior vice president for business had suggested looking into the private lives of journalists.
Although there is legitimate cause for concern about the collection, security, private misuse, and public disclosure of individuals’ data, the right to be forgotten is not a cure, and it represents what many see as a dangerous precedent. The rule that González established holds that search engines can be required to erase links to content upon request by an individual. The breadth of the ruling cannot be overstated: It allows an individual to demand that data be removed from a site’s servers, even if the content is truthful and lawfully published and causes the person no prejudice.
As CPJ has previously written, the ruling largely ignores free expression values that are vital to online journalism. It also represents a radical break from the carefully constructed legal philosophies underscoring privacy, which is already a newer and much more volatile right than the free expression values with which it often collides.
The right to be forgotten is also unworkable, a notion that has been expressed by British Justice Minister Simon Hughes, the country’s House of Lords, the European Network and Information Security Agency, and others. Although EU Commissioner for Justice Viviane Reding has optimistically claimed, “It is possible to handle the copyright question, so it should also be possible to handle the takedown requests on personal data questions,” according to the Guardian,this analysis is flawed. Notice and takedown requests–in which a website or other platform can escape liability by removing content that allegedly infringes on a copyright–are frequently abused, often to the detriment of journalists. Reding’s statement is also untrue: Copyright protections are much more clear-cut than the near-limitless scope of the right to be forgotten. As EU Advocate General Niilo Jääskinen argued in a formal recommendation not to adopt a broad right to be forgotten, submitted to the ECJ in 2013, “‘notice and take down procedures,’ if required by the Court, are likely either to lead to the automatic withdrawal of links to any objected contents or to an unmanageable number of requests handled by the most popular and important Internet search engine service providers.”
Although Google is not the only target for the right to be forgotten, the company was an obvious choice. Google.com is the most visited website in the world, according to the traffic-ranking site Alexa.com. The company has a greater audience share than Netflix, Facebook, and Twitter combined, according to the research firm Deepfield. Its servers index 30 trillion Web pages every month. Google’s search algorithm is a closely held trade secret, and a profitable one: The company is one of the world’s richest, reporting a revenue stream totaling more than $115,000 per minute.
For many, the tech behemoth stands for American hegemony, yet it is also an example of the kind of ingenuity that at once thrives on, and grants unprecedented access to, information. The huge amounts of information on which Google and other tech companies thrive can play a key role in supporting the future of journalism. However, the right to be forgotten threatens the ability of journalists, and the companies building the platforms they use, to put information to its most productive ends.
More fundamentally, the right to be forgotten corrupts history, as CPJ noted shortly after the ruling by the ECJ. “The right to access history is important,” World Wide Web founder Tim Berners-Lee told the LeWeb conference in Paris in December 2014, according to CNET. “It’s our society. We build it. We can define the rules about how to use data … that’s much better than trying to pretend a thing never happened.”
That sentiment is shared by Eduardo Bertoni, director of the Center for Studies on Freedom of Expression at the Palermo University School of Law in Argentina and the former Special Rapporteur for Freedom of Expression of the Inter-American Commission of Human Rights at the Organization of American States. Calling the right to be forgotten an “insult to Latin American history,” Bertoni wrote in a blog post for Huff Post Tech, “[R]ather than promoting this type of erasure, we have spent the past few decades in search of the truth regarding what occurred during the dark years of the military dictatorships.” Among other horrors, the abuses that occurred under these dictatorships include the censorship, murder, and disappearance of journalists–crimes that in some cases are only now coming to light. And, as Wikipedia founder Jimmy Wales told journalists in London, in August 2014, according to The Washington Post, “I would never, ever use any kind of legal process like this to try and suppress the truth. I think it’s deeply immoral.”
Though less than a year old, the nascent right to be forgotten is sparking controversy from South Korea to South Africa, Canada, and Chile. Efforts to expand the ruling are already under way, and the threat of copycat laws looms. In addition to generating enormous uncertainty about the future of free expression, as well as the right to receive information, the ECJ has forced difficult jurisdictional issues to the fore, possibly prematurely. And because the right to be forgotten allows individuals to censor truthful information, the harm caused by the decision is limited not just to the ability of individual journalists to publish what they choose but also to the interconnected and freewheeling nature of the Internet itself, leading Google co-founder Larry Page to warn, “We’re not going to see the kind of innovation we’ve seen” as regulations such as the right to be forgotten take hold.
If the González case is exceptional, the norms from which it so radically departs bear examining.
Samuel Warren and Louis Brandeis first articulated “the right to privacy” as a concept in Western legal philosophy in an eponymous 1890 Harvard Law Review article that is as famous as it was prescient. The article remains deeply influential, showing up in U.S. legislation, U.S. Supreme Court case law, and contemporary debates about new technologies. Even EU Advocate General Niilo Jääskinen’s recommendation that the ECJ reject the right to be forgotten began with a discussion of the article’s influence.
As Warren and Brandeis imagined it, the right to privacy consisted of a “right to be let alone,” which differs from the contemporary right to be forgotten. Derived primarily from common-law judicial decisions in cases between private parties but also deeply embedded in the American 4th Amendment’s prohibitions on unreasonable searches and seizures, the right to privacy is meant to protect an individual’s ability to set reasonable boundaries for one’s life before publication or other intrusion. That said, the right is far from absolute. Because of the importance of protecting the free exchange of ideas, news, and culture, the right to privacy is tightly cabined by free expression principles.
For this reason, an individual would be unlikely to win a lawsuit alleging invasion of privacy after thrusting themselves into the public light, or a case in which newsworthy facts were reported, or if information was reported from public proceedings or documents. And, as with most matters, a potential plaintiff would have to show that he or she was harmed in some way. By contrast, these limitations on liability for speech are largely absent from the right to be forgotten.
Although the essay “The Right to Privacy”remains powerful, it is also true that the U.S. Supreme Court tends to be dilatory in taking up matters of digital privacy. Cautious about ruling too broadly, for years the court has clumsily attempted to apply real-world analogies to newly developed technological issues. But, as Chief Justice John Roberts remarked in the unanimous opinion in Riley,to say that a search of all data on a cell phone is “materially indistinguishable” from a physical container “is like saying a ride on horseback is materially indistinguishable from a flight to the moon.”
The pithiness of Roberts’ observation belies the significance of an extraordinary doctrinal shift. Riley makes real a concept first recognized nearly a half-century ago: that “… the Fourth Amendment [to the U.S. Constitution] protects people, not places.” In Katz v. United States,the Supreme Court struck down a warrantless wiretap used to convict a Los Angeles man who was running an illegal gambling operation. In so doing, the court created a legal test that looks to an individual’s “reasonable expectation of privacy,” which in turn hinges upon cultural and factual context.
The facts of Riley are similarly routine, and they are inconsonant with the effect the case may have on journalists’ privacy. In Riley,the Supreme Court held that a long-standing doctrine allowing police to search arrestees as a matter of course should not extend to the electronic devices they carry. Writing for the court, Chief Justice Roberts noted, “A phone not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form–unless the phone is.”
Just as the actions of a bookie in L.A. ultimately meant that journalists in the U.S. are unlikely to see their telephones wiretapped (even if the same cannot be said of other forms of surveillance), Riley is a boon for journalists who have struggled to protect their privacy and that of their sources in the post-Snowden era. “The fact [is] that everybody’s digital media device in their pocket is a potential source of newsgathering,” Stanford Law School professor and Supreme Court litigation clinic co-director Jeffrey Fisher told CPJ. Fisher, who argued Riley at the Supreme Court, said that privacy and speech are often complementary values, noting that news and information “flow in a more uninhibited way if people aren’t subject to confiscation and search of whatever’s on their device.”
Riley has other far-reaching implications. “When it comes to individual privacy,” Fisher told CPJ, “whether it be collection of phone records, whether it be cell site information being compared to the old-time use of beepers or other tracking devices, the third-party disclosure doctrine–all of those things that have developed in a certain form in the analog world now need to be rethought in the digital world.”
Hanni Fakhoury, a staff attorney with the Electronic Frontier Foundation, agrees. “Old cases involving older technologies don’t necessarily apply the same way to new technologies,” Fakhoury told CPJ in October 2014. “Now you have to assess the technology for what it’s revealing; you can’t just blindly apply old precedent.”
Riley‘s reaffirmation that both privacy and technology are socially beneficial has powerful implications. As companies begin to push back against government pressure and implement encryption by default, journalists end up having to spend less time figuring out technology and more time doing their jobs, as CPJ staff technologist Tom Lowenthal explains elsewhere in these pages.
Although both Riley and the right to be forgotten relate to the protection of privacy, they approach the problem in very different ways. The right to be forgotten forces tech companies to delete potentially newsworthy information after it has been reported–even if it isn’t particularly negative; Riley focuses on the power of the government to seize, search–and thus censor–in the first instance.
“I don’t think it’s an accident that the leading American opinions are cases that involve the state, because our constitution speaks to state power,” Fisher told CPJ. “Both as a cultural matter and a constitutional matter, the focus of American privacy law tends to be more on state actors rather than private parties or corporations … Europeans, I think, see a threat to privacy perhaps to some degree coming from different sources, or with different force from different sources.”
Though well intentioned, the right to be forgotten carries significant dangers for online journalism and has caused some commentators to question the extent to which U.S. tech companies should engage with Europe. Writing in Computerworld in December 2014, journalist Mike Elgan argued that Google should pull out of Europe entirely, “just as it did China.” In fact, European regulators are attempting to expand the right to be forgotten to the rest of the globe.
Brandeis, coauthor of “The Right to Privacy,” later became a justice of the U.S. Supreme Court. In the first wiretapping case to reach the nation’s high court, later overruled by Katz, Brandeis offered a foreshadowing of how journalists should view the “right to be forgotten.” When the court’s majority put its imprimatur on warrantless wiretapping, Brandeis wrote in dissent, “Experience should teach us to be most on our guard to protect liberty when the government’s purposes are beneficent … The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding.”
Geoffrey King is CPJ’s San Francisco-based Internet advocacy coordinator, working to protect the digital rights of journalists worldwide. He is a constitutional lawyer who also teaches courses on digital privacy law and on the intersection of media and social change at the University of California, Berkeley.