ECJ May Limit “Right to be Forgotten” Before It Becomes a Tool for International Censors

A recent non-binding opinion from an European Court of Justice advocate general recommends limiting the extraterritorial effect of the E.U.’s right to be forgotten in an effort to establish precedent that could serve as a counter to future actions by other countries.  While not specifically stated in the opinion, it appears that this opinion has an eye towards the ramifications that the right to be forgotten might have in the hands of more authoritarian countries. In this way, the E.U. is chosing to have its own version of the internet rather than face the possibility of having a version that has been sanitized by dictators.

On January 10, 2019, Advocate General Maciej Szpunar recommended that Europe’s “right to be forgotten” not include a right to compel the deindexing of search results outside the E.U.  The case in question arose from a notice from the French data protection authority, CNIL, to Google in 2015. CNIL demanded that Google make deindexing requests from French citizens applicable to all of Google’s country-specific search engines, globally. However, Google refused to comply, instead continuing the its practice of deindexing only results within the E.U.  Google also proposed to implement an additional process it labeled “geo-blocking,” by which Google would make certain search results unavailable on all of its domains if the user’s IP address placed that user within the E.U.  CNIL found this additional mechanism to be insufficient and took its case to the ECJ.

Google, along with third parties filing briefs including Wikimedia Foundation Inc., the Foundation for Freedom of the Press and Reporters Committee for Freedom of the Press, argued that CNIL’s proposed ruling would create a dangerous precedent that could invite other countries outside the E.U., including authoritarian regimes, to also mandate global implementation orders of deindexing requests, resulting in censorship.

Attorney General Szpunar agreed, drawing a line between application of deindexing requests to domains within the E.U. and extraterritorial domains.  He stated that searches originating outside the E.U. should not suffer from E.U. deindexing requests.  Further, he agreed that the embrace of a right to global deindexing would be a dangerous green light for other countries to adopt deindexing laws, which could ultimately result with an interference of the right to free expression within E.U. and throughout the world.

Attorney General Szpunar also made clear that the effect of a deindexing request would remain quite strong within the E.U.  A.G. Szpunar was quite clear that Google would still be required to take any measure at its disposal, including all technically possible controls, to ensure a complete deindexing within E.U. territory, specifically including geoblocking.

This new opinion from the E.U. is similar to the position taken by Canada’s Privacy Commissioner with respect to its nascent right to be forgotten. Canada is currently considering whether its privacy law, PIPEDA, contains a right to request deindexing as written.  While it is not clear if the decision of that case will include an analysis of extraterritorial deindexing, the Office of the Privacy Commissioner has separately recommended that search engines be required only to deindex search results from Canadian domains (e.g., google.ca) as well as employ geoblocking.

Of course, none of these steps is certain to deter authoritarian regimes from ordering Google or other search engines to globally deindex results about their citizens, potentially including public figures. The January 10, 2019 opinion seems to acknowledge that fact, seeking only to prevent the sending of a signal to other countries that global deindexing requests are permissible.  Accordingly, it remains to be seen whether the right to be forgotten will become a weapon of misinformation online.

How is the E.U.-U.S. Privacy Shield Being Enforced? The Second Annual Review Report Provides A Guide

Near the end of last year, the European Commission published its Report on the second annual review of the functioning of the E.U.-U.S. Privacy Shield, which took place in October 2018. Annual reviews are mandated by the Adequacy Decision for Privacy Shield in order to allow the Commission to monitor compliance with the framework.

In light of the European Parliament’s Resolution on July 5, 2018, concluding that Privacy Shield was not providing an adequate level of protection for the data of individuals in the E.U. and recommending suspension of the program, the outcome of the annual review was not assured. However, the Commission found that data protection under Privacy Shield remained adequate, and it indicated that the certification and oversight processes had been improved.

Beyond this good news for companies relying upon Privacy Shield, the Report also provided an outline of the ways in which the Department of Commerce and Federal Trade Commission are enforcing compliance with Privacy Shield.  The mechanisms employed by DoC over the last year include quarterly reviews of certain non-participating companies, random spot checks of participating companies, participant “sweeps,” monitoring of privacy news articles, and internet searches to locate for companies misrepresenting participation. This new insight should guide companies seeking to maintain Privacy Shield certification and avoid additional regulatory scrutiny.

Quarterly Reviews

The DoC has undertaken quarterly reviews of companies believed to be more likely to make false claims about Privacy Shield participation. These higher-risk companies include those that began the certification process but did not complete it or that failed to complete the annual recertification process. The DoC reviews the websites of companies in these categories to ensure that there is no reference to Privacy Shield. The DoC has already made at least one referral to the FTC concerning one of these higher-risk companies, which resulted in an enforcement action last year.  To comply, companies should ensure that their certification has been approved prior to placing any reference to Privacy Shield on their website and, if electing not to complete recertification, ensure references to the program are scrubbed from privacy notices and other webpages.

Spot Checks

Second, the Report referenced random spot-checks, which the DoC had performed on approximately 100 of the nearly 4,000 organizations certified under Privacy Shield as of October 2018. A spot check includes a review of the company’s privacy notice to ensure that it is available and remains in compliance with Privacy Shield requirements.  The DoC also attempts to reach the company’s designated point of contact to ensure that person is available and responsive to complaints and access requests.  Finally, the DoC takes steps to ensure that the company’s designated Independent Recourse Mechanism (“IRM”) is available to handle complaints.

As spot checks are random, there is no way for a company to anticipate when or if one might arise.  Accordingly, the only way for a company to be prepared is to ensure its internal privacy policies account for the possibility of changes to privacy personnel and privacy notices with an eye towards remaining in compliance with Privacy Shield at all times.  The DoC specifically recommended appointing multiple points of contact to ensure communications are received.  Additionally, periodic follow up with a chosen IRM to ensure availability is advisable.

Sweeps

The DoC also noted that it has begun sweeps of participant websites, looking for broken links to privacy notices. Little additional information about these sweeps was provided, but it appears that they are intended to have a broader reach but shallower focus than the spot checks.

Perhaps of greater import, the FTC has also implemented its own, completely different “sweep” program to monitor compliance with Privacy Shield with a significantly higher burden on participants. During the annual review, the FTC reported that it had recently begun conducting issuing administrative subpoenas to participants to request information on Privacy Shield compliance.  The FTC gave examples of how it might focus future subpoena sweeps, such as sending the subpoenas to Privacy Shield companies within a certain industry. However, it provided no specific information on how the subpoena sweeps had been conducted to date. The Commission Staff Working Document, which was released along with the Report, noted that the FTC’s use of these subpoena sweeps could be quite broad in the future as “a reasonable suspicion of non-compliance is not a prerequisite to send a subpoena.”

News Articles

The DoC has designated an employee to monitor news articles and other public reports for Privacy Shield violations.  Where the DoC finds “credible evidence or reasonable belief” that Privacy Shield compliance could be impacted based upon the new article, it will undertake further compliance investigation and issue a Compliance Questionnaire.  Accordingly, companies providing notice of a data breach should anticipate additional scrutiny of their Privacy Shield compliance in addition to the other expected ramifications.

Internet Searches

Finally, the DoC has implemented a system for searching the internet using common phrases used to indicate participation in Privacy Shield, ensuring that those phrases are only used by certified participants. These searches are not performed on any firm schedule, but the DoC has plans to expand their use in 2019. In particular, DoC is developing a Privacy Shield logo to be placed on participating companies’ websites, and it intends to use image searching to similarly ensure the logo is not being used improperly.

Final Thoughts

Of course, while further compliance and enforcement attention from the DoC is never desirable, the Report also made clear that companies out of compliance will be given an opportunity to correct a problem before they are subject to penalty.  Likewise, even where the DoC has referred a case to the FTC, most companies come into compliance before an enforcement action is started.  Of the more than 100 referrals to the FTC since the beginning of the program, only 8 have resulted in enforcement actions. Accordingly, while maintaining compliance at all times is important, having a system to respond to DoC notifications and correct violations it has raised is indispensable for companies participating in Privacy Shield.