It’s difficult to put the genie back in the bottle

The EU court’s Google ruling will sound good to those who want old photos and articles deleted, but reality will be more complex

It’s a rare person who doesn’t have something about themselves they would like taken off the internet, whether it’s trivial (that picture from the office party) or grave (that news article about those people you killed).

So on the face of it, a new ruling from the European Union’s (EU’s) court of justice upholding the “right to be forgotten” looks like good news. As the debate around privacy, identity, and ephemerality has raged around the Snowden disclosures for the past year, the idea of putting the genie back in the bottle, and making old photos, articles and notes hard to find once more, will be for many an appealing one.

But behind the lustre lies a much more difficult situation. The EU court’s ruling relates to a long-running dispute around a 1998 newspaper article relating to the repossession of a Spanish man’s home. The court ruled that the newspaper had acted in the public interest in reporting the news, but that Google’s offering a link to the article in search results represented an infringement of his privacy — and so the search giant should delete the result.

The court didn’t establish an absolute right to vanish: “a fair balance” should be sought between the public’s right to access given information and the “data subject’s” right to privacy and data protection.

This creates a real quagmire for any company offering up information online: After how long does a bankruptcy ruling become something that should be private? Is that different if the subject is a celebrity or a politician? What if they offered the information voluntarily (or sold their story) in the first place? How about drug use, or prostitution, or murder? What if a person stands for public office a few years after having their search records scrubbed?

If nothing else, deciding such issues on a case-by-case basis will require huge teams of compliance staff in every tech company (and probably most media companies), and will tie up courts on the limits of each provision for years to come.

This is before we even get close to the trickier issues. Google was found to be subject to the EU court’s decision because it has an established operation in Spain, within the union. This was despite the data being held and search results processed elsewhere. Most major tech giants are based in the US — which thanks to the first amendment, is very unlikely to require companies to restrict search results (ie what they can “publish”) due to overseas privacy requirements.

The results could become exceedingly strange: will people searching from the US be able to see the “private” data of EU citizens, while natives of those countries cannot? Or will companies with no EU footprint be able to serve up results, but those with sales offices in EU countries be required to censor them?

Privacy is rightly recognised as an important right. The permanence of the internet is a concern to many, especially given the level of surveillance and intrusion on the network. In the meantime, social networks and activity are shifting from the permanent — Facebook — to the transient — Snapchat — showing that technology and culture are already starting to fix the permanence problem. That’s a much better way: Privacy is great, but it needs baking in from the start. Trying to clumsily reverse-engineer it into the system through law is an act of hubris.