Frederik J. Zuiderveen Borgesius

Google Spain v. González: Did the Court Forget About Freedom of Expression?

In this note we discuss the controversial judgment in Google Spain v. Gonzalez of the Court of Justice of the European Union (CJEU). Our focus is on the judgment’s implications for freedom of expression. First, the facts of the case and the CJEU’s judgment are summarised. We then argue that the CJEU did not give enough attention to the right to freedom of expression. By seeing a search engine operator as a controller regarding the processing of personal data on third party web pages, the CJEU assigns the operator the delicate task of balancing the fundamental rights at stake. However, such an operator may not be the most appropriate party to balance the rights of all involved parties, in particular in cases where such a balance is hard to strike. Furthermore, it is a departure from human rights doctrine that according to the CJEU privacy and data protection rights override, “as a rule”, the public’s right to receive information. In addition, after the judgement it has become unclear whether search engine operators have a legal basis for indexing websites that contain special categories of data. We also discuss steps taken by Google to comply with the judgment.

Informed Consent: We Can Do Better to Defend Privacy

Informed consent as a means to protect privacy is flawed, especially when considering the privacy problems of behavioral targeting. Policymakers should pay more attention to a combined approach that both protects and empowers individuals.

Open Data, Privacy, and Fair Information Principles: Towards a Balancing Framework

Open data are held to contribute to a wide variety of social and political goals, including strengthening transparency, public participation and democratic accountability, promoting economic growth and innovation, and enabling greater public sector efficiency and cost savings. However, releasing government data that contain personal information may threaten privacy and related rights and interests. In this paper we ask how these privacy interests can be respected, without unduly hampering benefits from disclosing public sector information. We propose a balancing framework to help public authorities address this question in different contexts. The framework takes into account different levels of privacy risks for different types of data. It also separates decisions about access and re-use, and highlights a range of different disclosure routes. A circumstance catalogue lists factors that might be considered when assessing whether, under which conditions, and how a dataset can be released. While open data remains an important route for the publication of government information, we conclude that it is not the only route, and there must be clear and robust public interest arguments in order to justify the disclosure of personal information as open data.

Freedom of Expression and ‘Right to Be Forgotten’ Cases in the Netherlands after Google Spain

Since the Google Spain judgment of the Court of Justice of the European Union, Europeans have, under certain conditions, the right to have search results for their name delisted. This paper examines how the Google Spain judgment has been applied in the Netherlands. Since the Google Spain judgment, Dutch courts have decided on two cases regarding delisting requests. In both cases, the Dutch courts considered freedom of expression aspects of delisting more thoroughly than the Court of Justice. However, the effect of the Google Spain judgment on freedom of expression is difficult to assess, as search engine operators decide about most delisting requests without disclosing much about their decisions.

Google and Personal Data Protection

This chapter discusses the interplay between the European personal data protection regime and two specific Google services, Interest-Based Advertising and Google Street View. The chapter assesses first the applicability of the Data Protection Directive, then jurisdictional issues, the principles relating to data quality, whether there is a legitimate purpose for data processing, and lastly the transparency principle in connection with the rights of the data subject. The conclusion is that not all aspects of the services are easy to reconcile with the Directive’s requirements.