Sophos News

Google slip reveals why people exercise their “right to be forgotten”

When the European Court of Justice (ECJ) ordered Google to remove links to two web pages last year, in a ruling that kicked off the “right to be forgotten,” I’m sure I was not alone in thinking that the main beneficiaries would be criminals, politicians and other high-profile figures.

Indeed, shortly after Google introduced its right to be forgotten request form, we heard how it received thousands of applications, with many coming from those who wished to bury the news of their past misdemeanours.

More than one year later, however, it appears that the profile of those making such requests is quite different to what I initially expected.

According to the Guardian, which says it uncovered new data hidden away in the source code of Google’s own transparency report, more than 95% of the close to 220,000 removal requests it has received are from members of the general public looking to remove links to their personal and private information.

The Guardian discovered the data, which Google has never released publicly, during an analysis of archived versions of Google’s reports. The underlying source code, now removed, gave a breakdown of the types of requests Google had received, along with the countries from which they were issued.

The Guardian says there were 218,320 link removal requests (covering a total of 1,030,182 URLs) between 29 May 2014 and 23 March 2015. Of those requests, 46% (101,461) were granted, with 99,569 involving “private or personal information.”

The remaining 1,892 successful removal requests, which represent less than 1% of the total made, related to four other distinct groups, identified by Google as “serious crime” (728 successful removal requests), “public figure” (454 removed), “political” (534 removed) and “child protection” (176 removed).

Interestingly, Google’s own transparency report shows how citizens of some nations are keener than others to bury their pasts. The French, for instance, requested the removal of 198,255 URLs during the period in question, representing almost a fifth of all such requests across the whole of Europe.

By way of contrast, UK nationals requested the removal of 139,230 URLs – around 13.5% of Europe’s total.

Curiously, British citizens ultimately proved more successful in having their removal requests granted, achieving a success rate of 62.5% versus the 52.3% enjoyed by French applicants.

The Guardian also discovered that the proportion of requests for removal of personal information versus crime-related links is broadly similar across most of Europe, except in Italy – where the share of serious crime stories (11.9%) requested for removal was over four times more than the UK (2.7%) and almost twenty times higher than in France (0.6%).

In a statement, Google confirmed the validity of the data discovered by the Guardian, saying:

We've always aimed to be as transparent as possible about our right to be forgotten decisions.

The data the Guardian found in our Transparency Report's source code does of course come from Google, but it was part of a test to figure out how we could best categorise requests.

We discontinued that test in March because the data was not reliable enough for publication. We are however currently working on ways to improve our transparency reporting.

Despite the Guardian’s discoveries, which I believe show the majority of requests are being made in the spirit the ruling was designed to foster, the right to be forgotten ruling remains controversial.

The Daily Mail reports how it has led to the removal of a number of links about stories “from drug abuse to incest, murder and spying.”

The online newspaper suggests criminals are using family members mentioned in articles to submit the removal requests in order to get around terms that state those who have been convicted of serious crimes “do not have the right to be forgotten.”

By way of example, the Mail said a story about a paedophile who kidnapped an 11-year old girl with learning difficulties before abusing and murdering her had been removed from search results.

Two other stories that had been “forgotten” by Google involved a teenager who had received a light sentence, despite being responsible for 40% of all the crime in his town; and an article about Josef Fritzl, who had held his own daughter in captivity for almost a quarter of a century while continually raping and abusing her.

Some nations, such as France, have ordered Google to expand its removal of links to include its search sites both inside and outside of the European Union.

Meanwhile, specialised sites such as hiddenfromgoogle.com (the domain has now expired) sprang up to list pages Google had removed from its search results under the ruling, and the BBC recently set up a list of its own news articles that had been “forgotten” by Google.

The legitimacy of the right to be forgotten has by no means been settled, and recently a privacy group filed a complaint against Google in the US seeking the right to be forgotten for Americans as well.

We asked readers of Naked Security to take a poll and comment on whether the right to be forgotten should be extended to everyone as a privacy right, or restricted out of respect for free expression.

It seems Naked Security readers lean in favour of privacy: as of Wednesday (15 July), 57% of respondents said the right to be forgotten should be extended to everyone, with 20% saying no one should be able to remove links in search engines.

The remaining 23% of our poll takers said the right to be forgotten should be reserved for special cases such as when the information is no longer relevant, which is in line with the ECJ’s ruling.


Image of pencil eraser courtesy of Shutterstock.