Europe's 'Right to Be Forgotten' Is Flawed, Research Finds

Two years ago, the European Court of Justice embraced the "right to be forgotten," establishing new, tougher privacy protections for EU citizens. The major impact of that right, so far, has been the elimination of unwanted results from Google and other search results.

But the right to be forgotten isn't exactly absolute, researchers at New York University have found. With just a few clicks, Europe's privacy rules can be easily elided. And that could mean new legal woes for American tech companies.

The Internet Doesn't Forget

The names of roughly one-third of the individuals who've sought to have search results removed can be found with just a few clicks, the researchers found. The team, which included experts from NYU and the Federal University of Minas Gerais in Brazil, looked at so-called "forgotten content," information that had been delisted from search results. Their results have not been presented publicly, but were reported by The New York Times on Friday.

In many cases, it would not be difficult for a third party, such as an investigator, to find who requested information to be removed from search results and to rediscover information that was removed. Further, requesting removal often results in slightly higher visibility on Google and Twitter, the researchers found.

"This poses a threat to whether the 'right to be forgotten' can be maintained in the long term," according to Keith Ross, the researcher who led the project. "If a hacker can easily find 30 or 40 percent of people's names from delisted articles, what is the point?" he told the Times.

Increasing Pressure on Google

The research could put increased pressure on Google and other American tech companies. Google has been in a long-running legal battle with the EU over the reach of the right to be forgotten.

Last year, France's data protection authority ruled that Google must remove search results not just on their European domains, but globally. The company has so far refused to do so, agreeing only to delist results on Google.com for searches performed from within the EU. The dispute will likely end up in European courts in the near future.

But even internally "forgotten" information isn't hard to find. The researchers were able to discover removed information simply by cross referencing the names of petitioners with article headlines on Google.co.uk, the search engine's British domain. If a link didn't show, it was likely to have been removed as a result of that request.

"Someone with an undergraduate computer science degree would be able to do what we did," Ross told the Times. "It would be relatively straightforward to find the delisted links and republish people's names online."

Related Resources:

• Google Appeals French 'Right to Be Forgotten' Order (The Wall Street Journal)
• EU Court Ends US Safe Harbor, Makes Private Data Transfer Harder (FindLaw's Technologist)
• Data Privacy Negotiations With E.U. Fail, Legal Action Next? (FindLaw's Technologist)
• European Union Circling the Antitrust Wagons Around Google? (FindLaw's Technologist)