Global Sourcing Views on Right to Be Forgotten, Big Data and Global Sourcing This article was originally published in Bloomberg BNA’s Privacy Law Watch on August 22, 2014. by Brooke L. Daniels
In a landmark ruling, the European past few months, there has been an Court of Justice—the European opportunity to see the scale of the Union’s top court—held that data impact of the right to be forgotten. subjects in the EU have the right to compel Google Inc. and other Since the decision, Google has Internet search engines to remove responded to upwards of 91,000 search results linking to websites requests from individuals to remove containing personal information links from its European search results. Brooke L. Daniels about them. There is an undeniable cost to Google Global Sourcing in responding to these requests. First, +1.202.663.8618 Bloomberg BNA Privacy & Security Google must dedicate personnel to [email protected] Law Report Senior Legal Editor receiving and responding to requests, Donald G. Aplin posed a series which means either re-allocating Brooke Daniels is counsel in Pillsbury’s of questions to Brooke L. Daniels, resources or hiring new ones. Second, Global Sourcing practice and is located in counsel at Pillsbury Winthrop in addition to the cost of personnel the Washington, DC office. She focuses on Shaw Pittman LLP, in Washington, resources, Google has to maintain complex global sourcing transactions and about the effect of the ruling on and bear of the cost of tools needed to software licensing on behalf of Fortune 500 search engines in a world of big track the information and remove it international corporate clients, including data analytics and the possible from its search results. transactions for operating and infrastructure, repercussions for companies telecommunication, offshore application engaged in global sourcing activities. So I suppose whether or not development and maintenance and business Daniels works in the firm’s Global this is an unfair burden is a process services. Sourcing Practice. matter of perspective, but it is undeniably onerous. Do you believe that the European Court of Justice’s May right to be Is the balancing test set by the ECJ forgotten ruling presents an unfair ruling between individual privacy implementation burden on Google and rights and the right of the public to other search engines in terms of the see information a reasonable one for resources they must expend to respond search engines to implement, and to data subject removal demands? are you hopeful that the Article 29 Working Party will—after if finishes its The analysis of the decision is still consultation with the affected search in its nascent stage, but data related engine companies (144 PRA, 7/28/14)— to the impact of the decision, as be able to craft guidance on how to reported by Google itself, have address that balancing test? started to become available. Over the
Pillsbury Winthrop Shaw Pittman LLP www.pillsburylaw.com Global Sourcing
While the ECJ recognizes a the de-identification process used by chance that the right to be forgotten compelling individual interest and data collectors. will be established in the U.S. one that is not entirely unique (for example, prior events causing poor Even if the requested information is The fact that the EU has adopted a credit scores in the U.S. are eventually removed, what happens if the same much more protectionist stance on expunged over time), the standard information can be inferred through individual data while the U.S. appears set by the ECJ is a subjective one the analysis of big data? Where does unwilling to walk down the same that is open to interpretation by the Google’s responsibility to scrub the path serves to highlight some of the search engine. information end? There don’t seem to difficulties that we face in establishing be clear answers to these questions. a global privacy framework. That The ECJ held that individuals have fact combined with the increasing the right to require search engines The version of the proposed EU data global footprint of companies with to remove personal information protection regulation approved by the operations and consumers located about them if the information is European Parliament in March (49 in multiple countries will continue “inaccurate, inadequate, irrelevant or PRA, 3/13/14) includes the right to be to cause friction and ambiguity with excessive.” Such a standard means forgotten principle recast as a right to respect to compliance. that (1) since the standard for removal erasure. If that principle remains in a is subjective (e.g., how does one final version of the regulation to replace The U.K. government has said it opposes determine whether the information the EU Data Protection Directive (95/46/ the right to be forgotten principle (132 is “inaccurate, inadequate, irrelevant EC), do you think it will eliminate the PRA, 7/10/14), and a House of Lords or excessive?”), Google itself has to possibility that the EU will find any subcommittee issued a report, which be the arbiter of the requests, and (2) other country without the principle called the principle “unworkable” (147 Google is responsible for reporting on to have adequate privacy protections PRA, 7/31/14). Do you think the U.K. view its own compliance with this ruling. or otherwise undercut international represents something that has a chance privacy harmonization efforts? of emerging as a consensus view in Given the subjective nature of the EU or of perhaps moderating the the ECJ’s ruling, any institution Issues like the right to be forgotten proposed data protection regulation? will have a challenge in providing (or its evolutionary kin, the right to guidance to the private sector and erasure) highlight the difficulties The U.K. subcommittee report monitoring compliance. that are facing countries in creating a certainly left no doubt on its views global privacy framework. of the right to be forgotten principle. In a world where big data analytics Calling the principle unworkable that are able to capture and compare A May report released by the White and recommending that the U.K. disparate pieces of data increasingly House, which was focused on the government fight to ensure that the make the anonymization of data less future of big data, recommended EU data protection regulation does effective, is a right to be forgotten even that the “United States should not include any type of right to be possible regardless of what search lead international conversations forgotten principle makes it clear that engines may do to de-link information? on Big Data that reaffirms the not everyone is ready to embrace the Administration’s commitment to amplification of individual rights with The question of whether data can interoperable global privacy frame- respect to data. ever truly be erased or anonymized works” (85 PRA, 5/2/14). is one that has been plaguing big data As the impact of the ECJ’s ruling analytics almost since its inception. How will the right to be forgotten begins to ripple through Google’s Certain entities like the Federal Trade factor into establishing a global operations, a clearer picture of the Commission have been very vocal in privacy framework? Neither Congress implications of the ECJ’s ruling expressing concerns about the ability nor the U.S. courts have shown much begins to appear. to “re-identify” data with individuals of an appetite for adopting a stance even after such data has gone through similar to the ECJ, so there is little
Pillsbury Winthrop Shaw Pittman LLP Views on Right to Be Forgotten, Big Data and Global Sourcing
The EU’s justice commissioner Although a client’s data are often However, as I mentioned earlier, the recently said that the impact of the accessed by service providers, most standard is a subjective one, and even decision is distorted, but as more infrastructure outsourcing service if an individual’s request patently creditable and vocal opponents providers do not function as a “search falls out of the ECJ’s guidelines, the emerge the EU may have to consider engine” or provide other types client will still need to respond to moderating the breadth of the right to customer facing service. The answer the individual and implement a be forgotten (160 PRA, 8/19/14). might be slightly different for certain process with the service provider in types of business process outsourcing order to remove such data. That also Since your practice includes a (BPO) service providers. For example, means that the cost of removing data, strong focus on global sourcing and a database marketing outsourcing including the technical tools and the information technology work, I’m provider typically uses a client’s resources, will need to be factored interested in how you think the right customer records in order to enrich into the charges for such services. to be forgotten court ruling or the those records with data obtained proposed regulation’s right to erasure from other sources and to conduct may impact how multinationals marketing exercises on behalf of the approach their international sourcing client. Is it possible that an individual and IT efforts? might seek to have that data removed from the customer records? Yes, it is Fortunately, for infrastructure possible, although it seems a stretch outsourcing service providers the that such data would be categorized right to forgotten should not have an in a manner that would meet the enormous impact. ECJ’s standard for removal.
Reproduced with permission from Privacy Law Watch, 163 [pra-bul], 8/22/2014. Copyright 2014 by The Bureau of National Affairs, Inc. (800-372-1033)
www.pillsburylaw.com Pillsbury Winthrop Shaw Pittman LLP