The European Union approaches the one-year anniversary of the Court of Justice's landmark decision recognizing a right to be forgotten. The newfound right gives people in the EU the right to have search engines remove links to articles generated from a search of their names if the articles contain personal information that is "inadequate, irrelevant or no longer relevant." The decision was a victory for the European concept of privacy. Yet, a year later, the EU is still experiencing a lot of handwringing.
The brunt of concern centers on Google. For all intents and purposes, Google is the judge and the jury for the privacy requests people make to Google. People can appeal Google's decisions to the national data protection authorities and the national courts in the EU. But recent statistics from appeals in Ireland suggests that very few of Google's decisions are ever appealed. Google wields immense power for each request it receives, not only on the merits of the case, but also the scope of relief, which Google has thus far limited to European versions of its site--much to the consternation of EU privacy regulators, who believe the relief should extend to Google.com.
The critics of Google raise a valid question: why is Google deciding how the right to be forgotten should be applied? But the answer is not difficult to find. Google is the judge of these privacy requests because that's what the EU asked for. The EU let the decision-making power fall squarely on Google.
Of course, delegating--or outsourcing--such power to a for-profit corporation raises serious concerns about democratic accountability. We've seen this type of privatization problem in other contexts, ranging from the running of prisons to the provision of social services. Copyright owners have power to request websites to take down allegedly infringing material. In the first week of April 2015, Google received over one million copyright notices a day. For most of these takedown requests, Google is the only judge to decide whether the material can remain online or not.
So why do governments allow corporations to make these important decisions? In some cases, there is no viable alternative. No country in the world has enough courts to handle a million copyright lawsuits a day. The same concern applies to the right to be forgotten. According to a 2010 EU Report, many of the national data protection authorities in the EU do not have sufficient staff and resources to carry out their responsibilities. Hard to imagine these already strapped agencies could handle the over 224,000 requests related to 813,000 links to webpages that Google received and decided in just nine months.
Max Weber recognized that "public" and "private" entities in the modern state are no different in terms of their bureaucratic organization, which he saw as the most efficient manner of organization in the administration of tasks. Google is, in effect, a private administrative agency. The choice then becomes which agency, whether public or private, can best handle the task?
The choice seems clear. In terms of analytics, resources, and ability to create and manage an online processing system, Google is probably better than any government agency could ever be. Within just two weeks of the Court of Justice decision, Google hired more staff, designed an online claims system in 25 languages, and started receiving and reviewing privacy requests from people in all EU members. Google's site also includes a transparency report that updates, in real time, the number and outcomes of all privacy requests Google has decided. Could a government agency match Google's seamless and speedy launch? Doubtful.
Of course, delegation to Google doesn't mean that the EU should abdicate its role in providing oversight. But, by all measures, the EU hasn't. Google is being closely scrutinized every step of the way. The EU's recent antitrust charges against Google for unrelated issues will only heighten the scrutiny. Google has conceded there may be a legitimate need for a right to be forgotten and that it is trying to view the issue from a more European perspective.
This exchange between European and American perspectives is healthy. So is the heated public debate over the wisdom of the right that has ensued in Europe, the United States, and elsewhere. How to strike the right balance between online privacy and the public's right to know is a difficult question, but also a fundamental one that every democratic society must answer. Google, whose mission is to provide access to information, no doubt can learn from the European understanding of privacy, but so too the EU regulators can learn from the American understanding of free speech. The right balance on the Internet is not likely to be reached by a regional approach--EU, U.S., or other approach--that ignores the externalities it imposes on the rest of the world.