The Right to Be Forgotten – Insights From Germany

The Court of Justice of the European Union (CJEU) and the General Data Protection Regulation (GDPR) have set the basic framework for the right to be forgotten. Recent case law from Germany offers an insight into its application on the ground.

The right to be forgotten as initially created in the Google Spain case (C-131/12) and now further developed in art. 17 GDPR provides data subjects with the right to have their personal data erased by a data processing controller (most prominently search engines) under specific circumstances. For search engines, though, balancing the diverging rights and interests of publishers and data subjects is in many cases next to impossible.

This column outlines how German courts deal with this factual dilemma and what obligations they impose on search engine operators under the right to be forgotten.

1. The Fundaments

The right to be forgotten as codified in art. 17 GDPR provides that data subjects shall have the right to obtain erasure of their personal data without undue delay in a set of cases, in particular, if:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (art. 17 (1) (a) GDPR) or
• the personal data have been unlawfully processed (art. 17 (1) (d) GDPR).

The first case group refers to fact patterns such as the one decided in the Google Spain case: A search for the applicant’s name led to two sixteen-year-old newspaper announcements that made public “a real-estate auction connected with attachment proceedings for the recovery of social security debts”. The CJEU stated that such sensitive information could only be deemed necessary for search indexing if the public interest in such information outweighs the data subject’s privacy interests (for example because the data subject is a prominent person).

The second case group (unlawful processing) serves as a catch-all clause for any data processing not covered by any provision in the GDPR, or compliant member state law that allows for the specific data processing in question. Despite its misleading wording (“have been […] processed”), art. 17 (1) (d) GDPR must be read in a way that it refers to the current lawfulness of the processing, not of its past lawfulness.

The most important provisions proving a legal basis for data processing are art. 6 art. 6 (1) GDPR and (for categories of sensitive data) art. 9 (2) GDPR. The press can be exempted from these limitations by member state law (art. 85 GDPR). The German states have implemented such exemptions in their press acts but have not made any express references therein to search engine operators. Their data processing, in the form of search engine indexing, can nevertheless be exempted from the right to be forgotten if such processing is (inter alia) necessary for exercising the right of freedom of expression and information (art. 17 (3) (a) GDPR).

2. Application in Germany

After the CJEU’s Google Spain decision, it remained unclear whether search engine operators should have an obligation to conduct complex balancing exercises when freedom of press or speech was involved. As the CJEU’s decision only dealt with a public announcement made in a newspaper, articles that contained a mixture of facts and opinions still could be treated differently. In early 2018, the German Supreme Court (“GSC”) had to deal with such a case (VI ZR 489/16).

The plaintiff helped to create an internet forum for a third party. Members of another internet forum found out about his identity and started spreading rumors that he was responsible for the conduct of the forum’s users which to them constituted “stalking”. The plaintiff, together with the other forum members, was addressed as “ass-kisser”, “serious criminals”, “criminal villains”, “terrorists”, “gang,” “stalker,” and “criminal stalker household.”

The GSC denied any obligation of Google operator Alphabet to deindex related search results. Alphabet itself did not act as an offender under German tort law -concerning the plaintiff’s personality rights – as it neither published the incriminated content itself nor did it from a reasonable user’s perspective appropriate this content merely by indexing.

For liability under German tort law, therefore, only the figure of an “indirect offender” remained available. Such a status requires the violation of a duty of care, in particular, a duty to scrutinize content. The GSC showed remarkable constraint in imposing such an obligation on search engine operators: Due to the specific characteristics of the search engine business, it cannot reasonably be expected that they proactively scrutinize all content they intend to index.

The GSC emphasizes that search engine operators also do not have the means to contact all the individual publishers when they receive a complaint about specific indexing and give them an opportunity to react to the complaint. Deindexing search result entries without such opportunities would likely result in overblocking as in many cases they would not be feasible. The deindexing would further not only affect specific critical passages but the whole linked content.

Accordingly, the GSC limited the duty for search engine operators to only react to rights violations they are specifically made aware of and that are patent and recognizable at first glance. In these cases, the court regarded making the complaint available to the publisher unnecessary. In cases in which freedom of speech is at stake, though, this line can be difficult to draw as the German Constitutional Court requires a complex balancing of the opposing rights taking into consideration inter alia the context of the speech and a link to a factual discussion. Therefore, German tort law may only in exceptional cases impose an obligation to deindex results referring to critical speech. In the case at hand, the GSC refrained from imposing this duty as the criticism against the plaintiff was still linked to his role in setting up the internet forum and the conduct of its members. The court took further into account that in the forums concerned members usually were using a rather “rough” tone.

So what about the CJEU’s right to be forgotten? The GSC referred to its arguments under tort law when it reviewed a parallel claim under pre-GDPR data protection law. The necessary balancing between the plaintiff’s right of informational self-determination (art. 8 (1) ECHR, art. 7, 8 CFR) on the one side and the search engine operator’s and its users right to freely communicate (art. 10 (1) ECHR, art. 11 CFR) had to take into consideration the specifics of operating a search engine and led the court to the very same considerations and results as under German tort law.

The GSC’s decision was still made under the old data protection law. Its relevance though remains, as German High Courts have applied its reasoning to art. 17 GDPR. A decision by the Frankfurt High Court (16 U 193/17, appeal permitted) dealt with a case in which the plaintiff sought to deindex five URLs that referred to news articles which stated that he had given up his role as CEO due to personal health reasons and underwent rehabilitation. Even such vague description invokes the strict processing limitations of art. 9 (1) GDPR as it contains sensitive health data.

Although it remained questionable whether there is currently a legal basis for search engines to process sensitive information (presumably the member states ought to create one under art. 85 GDPR – a question currently pending at the CJEU, C-136/17), the court ruled that the plaintiff has, in any case, no claim for deindexing. His health information was used in the context of press articles, and the public had a considerable interest in knowing about the circumstances under which as a CEO he left the company in question. The data processing was accordingly found to be justified under art. 17 (3) (a) GDPR. Interestingly, the court did not put much weight on the fact that the news articles were over four years old. Not only was this considered to be a relatively short time span, but the court found that the CJEU’s strict view on the loss of public interest over time, making deindexing rather the norm than the exception, has not been reflected in the GDPR’s provisions and did not relate to press articles with a mix of facts and opinion.

A recent decision by the Dresden High Court (4 W1149/18) confirms these principles. In that case, the appellant aimed to have deindexed search results that referred to a blogger’s article. The article accused the appellant of threatening other entrepreneurs to denounce their business practices if he was not paid. The article particularly stated: “One thing you have to give the two gentlemen credit for is that they know everything about fraud, extortion, coercion, insult and character assassination”.

The court dismissed the appeal by concluding that there was no obvious violation of the applicant’s rights. As the sharp language in the blog article was still linked to a factual criticism of the appellant’s business, the determination whether it was still covered by freedom of speech was only possible by carrying out a balancing of interests and rights, a task that in the case at hand was not possible for the appellee search engine operator.

Summing up, the current content that search engine operators are obliged to take down under German tort law and art. 17 (1) GDPR, include severe and patent rights violations: child pornography, calls for violence against persons, obvious confusion of persons, existence of an enforceable judgement against the publisher, decrease of any information interest by lapse of time (this rather vague criterion was established in the CJEU’s Google Spain decision), hate speech or mere slander without any factual foundation.

3. Conclusion

The right to be forgotten is often discussed in the news and academia as a prominent and innovative example of modern data protection. Its actual impact, though, has remained more limited than its large presence in the public discourse may suggest. Recent decisions by German courts illustrate the difficulties a search engine operator would have to face if the right to be forgotten was applied on a broader basis: it would have to conduct a balancing of interests on an often-unclear foundation. As publishers are likely not identifiable in many cases, it will often be impossible for the search engine operator to get a complete picture of the underlying factual situation, which could lead to significant overblocking.

As search engines provide a service necessary for the functioning of the internet as we know it, the constraint German courts have shown when it comes to imposing obligations on operators is well founded. For removing open and severe violations of personality rights from the very easily accessible search engine listings, the right to be forgotten nevertheless remains a valuable addition to the European data protection framework.

—