A Right To Be Forgotten for Hosting Services?

European courts are beginning to sort through one of the most important follow-up questions to last spring’s “Right To Be Forgotten” ruling in Google v. Costeja: what does the case mean for hosting services? The answer matters for the Twitters, Facebooks and YouTubes of the world – not to mention European hosting services like DailyMotion, local political discussion forums, and blogs or newspapers with user comment sections. And it matters to Internet users, because the way the “Right To Be Forgotten” plays out for these services will have a very real effect on our ability to speak freely and find information online. Courts should protect users’ rights by declining to apply Costeja to hosting services.

Although the Costeja ruling from the Court of Justice of the European Union involved what is popularly called the “Right to Be Forgotten,” it actually established a relatively narrow and concrete right: to stop particular links from appearing in Google’s web search results when users query for a person by name. The CJEU did not go into the philosophical quagmire suggested by the “Right To Be Forgotten” moniker; and it did not address removal rights against platforms that host information posted by users. But of course the same people who want to limit what can be found about them in search results will likely care about sites hosting blog posts or video with the same information. So cases asking hosts to also take down information are inevitable. (In full disclosure, I worked on this issue for web search in my previous role at Google.)

One recent Spanish ruling wrangled with this question and reached the right outcome, declining to extend Costeja to require removal of a user’s blog posts from Google’s Blogger service. Plaintiff and the Spanish Data Protection Agency had argued that the hosting platform must remove users’ blog posts, following the loose new standards established for search engines in Costeja. The Appeals court disagreed – for now, at least. As Miquel Peguera explains in his post about the case, the Court grounded its decision in Data Protection law, holding that Blogger – unlike Google’s web search engine – did not act as the data controller for content posted by third parties. Because the court’s analysis stopped there, it didn’t reach thorny questions about what it would mean for users’ speech and information rights if Internet hosts had to follow Costeja.

A Recipe for Deleting Users’ Lawful Speech

Compelling hosts to follow Costeja would make it dangerously easy to silence amateur journalists, video-makers, bloggers and others who rely on hosting platforms to reach an audience. Notice-and-takedown systems already create a risk of over-removal by Internet platforms adopting an “if in doubt, take it down” standard – appeasing the person who demands content removal is easy; leaving content up is risky; analyzing the law to make the right call is expensive. Combine this existing dynamic with Costeja’s new and notoriously hard-to-understand removal guidance, and you have a recipe for easy removal of legal content.

An intermediary operating under Costeja is in a whole new world compared to the known system of notice and takedown for hosting platforms under Europe’s E-Commerce Directive. A conventional removal claim – say, for copyright infringement or defamation – can be assessed in light of well-developed national law, including defenses and exceptions developed by courts or legislatures to protect free expression rights. Getting the “right” answer can still be a bit of a crapshoot – a tech company is a poor stand-in for a national court in assessing complex claims – but at least there is law to follow. 

By contrast, Costeja’s removal guidance is conveyed in a few short phrases. The CJEU tells us that content should be removed if it is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing” by the intermediary. (Par. 94) But the content should be left up if, “for particular reasons, such as the role played by the data subject in public life … the interference with his fundamental rights is justified by the preponderant interest of the general public” in accessing the content. (Par. 99) European legal experts disagree wildly on what this means in practice; it is unrealistic to expect operators of a broad array of hosting platforms to do any better when faced with difficult real-world removal requests. Courts, like the one that heard the Blogger case in Spain, will be wise not to add hosting companies to the list of entities compelled to stand in judgment over Internet users’ speech under this untested standard.

Removing Content at Its Source

Another important free expression angle arises from the very different roles played by search engines and hosts in disseminating information online. Removing content from search results is a form of de-indexing. Removing from a host is, effectively, deletion.

Removing web search results makes information harder to find online. That matters a lot if the information concerns the criminal convictions of your babysitter or the malfeasance of your mayor – most users who don’t find out about those in search results will look no further. But at least the information is still out there. People who really want to know can hope to track it down. This seems to have been the CJEU’s goal – to add friction to the system, or as Viktor Mayer-Schönberger says, to create a speed bump on the road to other people’s personal information.

Applied to Internet hosts, though, Costeja wouldn’t put a speed bump in the road – it would be more like a concrete barricade. User-created content that exists on only one site would, once removed, become effectively impossible to find online. In the not uncommon case where an Internet host holds the creator’s only copy, the content could be gone for good. (Of course, sometimes this kind of removal at the hosting source is exactly what courts or legislators intend – the U.S. DMCA and E.U. ECommerce Directive both include removals from hosting sites. But those removals depend on well-established underlying law, and can include procedural protections to correct erroneous removals.) Costeja removals from hosted sites would apply the broad standard the court crafted for “speed bump” removals to a whole different class of removals: the ones that can silence speakers completely.

As careful readers of Costeja know, the opinion itself supports the idea that it was never intended to reach hosts. For one thing, the Court explicitly says that Google’s search removal obligation sometimes exists even when the underlying indexed site has the right to publish the content. So a motivated and well-lawyered hosting service that received a content removal request under Costeja could point to a lot of reasons not to comply. But Internet users who rely on hosting platforms to express themselves and learn new information deserve better protection than that. They deserve a bright-line rule from European courts that Costeja does not apply to hosting services at all.