This paper considers the shape that a “right to be forgotten” is taking in the online world, in the aftermath of the Google Spain decision, in which the Court of Justice of the European Union found (against Google) that European data subjects had the right to request that search engines de-index webpages that feature in searches on their names.
The judgment, and Google’s response, raises a series of questions that are addressed in this paper. In particular, the judgment affects the nature of the balance between free speech and privacy on the Internet. Google’s presentation of its search as a neutral reflection of the state of the Web (and for that reason, a valuable resource for Web users) was found wanting by the court, and indeed Google itself has often adjusted its PageRank algorithm to improve its output by excluding, for example, spam, link farms and child pornography. Such methods cannot be transparent, since they would then be gamed by the spammers, and so Google has to present as a corporate “black box.” Yet it is a big step to devolve issues of privacy and freedom to an opaque process — even if it is accepted that a private sector actor can legitimately make decisions in this area.
The final section of the paper considers whether individuals might manage their personal data with flexible architectures that could act as points of contact for those wishing to use the data. In such a technological ecosystem, many issues could be addressed within a system that respected the autonomy of the data subject in providing limited abilities to control self-presentation. However, this remains a thought experiment at this stage — such technologies, though technologically feasible, are not yet the subject of great demand or takeup from consumers, while the state of current regulation means that business models favour sidelining data subjects from decisions made about the use of their data.
