Taking on a tech giant like Google requires preparation and hard evidence, particularly when the target for legal challenge is the jewel in its crown – the Google search engine. A recent ruling made against Google shows European nations are taking preparation seriously and CIPIL Deputy Director Dr David Erdos has been assisting them through his research into the company’s notification practices when deindexing material under the 'right to be forgotten'.
Dr Erdos’ work analysing how Google’s practices undermined an individual’s right to deindexing was cited in submissions the Swedish Data Protection Authority made to the Swedish Administrative Court. This sought to ensure that Google was prevented from continuing with its nonconfidential disclosures to websites.
On Monday, 23 November this court upheld the regulator including in its imposition of a SEK50 million fine (approximately €5M) on Google for its previous practices. It gave Google eight weeks to change its ways.
Google’s deindexing webform was additionally found to be misleading and incomplete and, partly as a result of this design but also due to the narrow manner in which it analysed the data received, it was also found to have failed to act promptly to deindex all relevant material in one of the specific cases put before the court. The latter violations, however, attracted a smaller penalty than that suggested by the data regulator of just SEK2M.
Dr Erdos, said: "It’s great to have my work used by the Swedish Data Protection Authority in its claim that unsafeguarded webmaster notification is incompatible with de-indexing rights under GDPR and also that Google must take greater care and responsibility when responding to right to be forgotten claims.
At the moment Google alerts webmasters to the fact it is de-indexing material, going so far as to supply the URL of the page without any confidentiality guarantees. These disclosures readily identify individuals who can consequently find this material republished precisely at the time when Google itself has found that they have a right to benefit from greater obscurity.
Such practices can exert a wider chilling effect on de-indexing as those who have every right to claim this may fear that in doing so their actions could lead to greater rather than lesser publicity of what can often be old, yet impactful, personal data – the precise opposite of what the de-indexing right is designed to achieve."
Google’s practices have come under increased scrutiny following the landmark case Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González.
Dr Erdos’ research article on this topic was published in the September 2020 edition of Computer Law and Security Review and the working paper can be seen on SSRN’s eLibrary. A series of slides detailing its main arguments can be found on SlideShare. He has also penned a wider submission on the regulation of search engine indexing for the European Data Protection Board which can be viewed on the Board’s website.
This article originally appeared on the Trinity Hall website and is reproduced here in modified form.
Main image: Culture of Shock (Truthout.org)