Please forget me Google

More than 12,000 people filed requests via Google's "right to be forgotten" online form within one day after the company launched the service. The large number of requests is hardly surprising, given the relative ease, with which Internet users can have undesirable records of their past deleted from the search engine’s results.

You just need to provide your name, the links - each listed individually - you want deleted along with an explanation of why the link should be removed and an electronic copy of your ID, driver’s license or passport, which Google promises it will only keep on record for a maximum of a month.

But if the form is easy to complete, the process following it is a bit more complicated. Some three weeks after the European Court of Justice ruled that EU citizens have a right to request Google to remove private links about them from search results, the Internet giant is still trying to figure out how to follow through on that decision.

A challenging task for Google

It seems the world’s largest search machine is stumped over how to best deal with all the requests. The quick-and-easy right to be forgotten form which looks like any other online registration form and doesn’t appear to offer any guarantees of data security, generated several questions and criticism among users when it was launched.

Initially the form even failed to comply with German regulations regarding the automatic uploading of personal identification. According to German law, non-public offices are not permitted to automatically save a copy of an official personal identification document. So Google was forced to modify that form in Germany after data protection officials criticized the online form.

It is also not clear how long it will take Google to handle the requests and remove the content from the search results. The company has promised to notify the Internet user when a request is being reviewed, but it did not give details on a time frame.

"It isn't easy for us to implement the ruling on the right to be forgotten," Google's Germany spokesman Kay Oberdeck told DW, while noting that this was the first time that the company had to deal with so many requests.

Case by case basis

And it’s not just the shear number of requests posing a problem. What actually falls under a citizen’s “right to forget” and what information belongs in the public domain? The European Court of Justice ruling is not a blank check to erase all uncomfortable records from public memory. Imagine if a politician were to use the request to hide incriminating details before an election. That would be tantamount to censorship. So it is up to Google to review every request before determining which ones will be deleted from its search results.

Many are worried that the ruling leaves too much up to a private company to decide. Google has set up an expert legal advisory board to examine requests and determine when an individual’s right to be forgotten outweighs the public’s right to information. The board is made up of data protection authorities and UN advisors for free speech who are expected to draft guidelines for the company. Former Google chief Eric Schmidt, Wikipedia founder Jimmy Wales and Frank La Rue, UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression are reportedly on the company’s board.

"It's clear that we need to think deeply about the realities of the Internet age and we must find new, innovative ways to improve privacy protections for society as a whole," said Jose Luis Pinar, former director of Spain's data protection authority and member of Google's expert advisory board on the ECJ right to be forgotten ruling.

Decision to delete

If Google approves a request to delete a link, it will be removed from the list of search results - but only in Europe. The content still exists in the Internet and can be called up from anywhere. Google searches outside Europe will also continue to display the undesirable link. The company will also publish a notice on the search page indicating that the list of results has been altered.

Google has announced that in the interest of promoting transparency it will publish information on the dimensions of the right to forget requests. The company plans to include this statistic in the half-yearly transparency reports, which it has compiled each year since 2010.

Local authorities unprepared

So what happens if Google denies an individual - the ruling applies only to EU citizens - a request to delete content? There are essentially two options: take the Internet giant to court in an expensive lawsuit or turn to the national data protection authority.

In Germany, the Hamburg data protection authority is responsible for handling all complaints about Google because that is where the company's headquarters in the country are based. Around 40 percent of the thousands of requests made following the ECJ's right to be forgotten ruling originated in Germany. That means that a small office, which only has a handful of staff, would be responsible for potentially handling thousands of requests.

And even though Johannes Casper, Hamburg's data protection commissioner, has welcomed the right to be forgotten ruling, he is concerned about how his office could end up dealing with thousands of complaints from people whose requests are rejected by Google. After all, before Google’s online form, Germans had submitted more requests to be forgotten than any other country.

The EU ruling applies not only to the market leader Google, but to all other search machines such as Bing or Yahoo. Unlike Google, no other search machine has offered a special process to request removal of a link.