Data Privacy and Dignitary Privacy: Google Spain, the Right to Be Forgotten, and the Construction of the Public Sphere

In 2014, the decision of the European Court of Justice in Google Spain SL v. Agencia Espanola de Proteccion de Datos (“Google Spain”) set off a firestorm by holding that the fair information practices set forth in EU Directive 95/46/EC, which is probably the most influential data privacy text in the world, require that Google remove from search results links to websites that contain true information. Google Spain held that the Directive gives persons a “right to be forgotten.” As a result of Google Spain, Google has processed 703,910 requests to remove 1,948,737 URLs from its search engine, and some 43.2% of these URLs have been erased from searches made under the name of the person requesting removal. The world-wide influence of Google Spain is likely to become even greater when the EU promulgates it General Data Protection Regulation (“GDPR”) in 2018. At stake in Google Spain were both privacy values and freedom of expression values. Google Spain inadequately analyzes both. With regard to the latter, Google Spain fails to recognize that the circulation of texts of common interest among strangers makes possible the emergence of a “public” capable of forming “public opinion.” The creation of public opinion is essential for democratic self-governance and is a central purpose for protecting freedom of expression. As the rise of American newspapers in the 19th and 20th Century demonstrates, the press underwrites the public sphere by creating a structure of communication that is responsive to public curiosity and that is independent of the content of any particular news story. Google sustains the virtual public sphere by creating an analogous structure of communication. Even though Google is not itself an “author,” it should nevertheless have been accorded the same legal status as traditional press. With regard to privacy values, EU law, like the law of many nations, recognizes two distinct forms of privacy. The first is data privacy, which is protected by Article 8 of the Charter of Fundamental Rights of the European Union. Data privacy is safeguarded by fair information practices designed to ensure (among other things) that personal data is used only for the specified purposes for which it has been legally gathered. Data privacy operates according to an instrumental logic, and it applies whenever personal information is processed. Its object is ensure that persons retain “control” over their personal data. Google Spain interprets the Directive to give persons a right to have their personal data “forgotten” or erased whenever it is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine.” It is not necessary to show that the processing of such data will cause harm. In contrast to data privacy, Article 7 of the Charter of Fundamental Rights of the European Union is entitled “Respect for Family and Private Life.” Article 7 is to be understood analogously to the interpretations of Article 8 of the European Convention by the European Court of Human Rights. Article 7 of the Charter accordingly protects the dignity of persons by controlling inappropriate communications that threaten to degrade, humiliate or mortify them. The privacy at issue in Article 7 follows a normative logic that prevents harms to personality caused by violations of civility rules. Article 7 enshrines the same privacy values as those safeguarded by the American tort of public disclosure of private facts. It protects what we may call “dignitary privacy.” Throughout the world, courts protect dignitary privacy by balancing the harm a communication may cause to the integrity of a person against the importance the communication may have to the public discourse necessary for democratic self-government. The instrumental logic of data privacy is inapplicable to public discourse, which is why both the Directive and GDPR contain derogations for journalistic activities. The communicative action characteristic of the public sphere is made up of intersubjective dialogue, which is antithetical both to the instrumental rationality of data privacy and to its aspiration to ensure individual control of personal information. It was therefore a mistake for Google Spain to apply the fair information practices of the Directive to the Google search engine. But the Google Spain opinion also invokes Article 7, and in the end the opinion creates doctrinal rules that are roughly reminiscent of those used to protect dignitary privacy. The Google Spain opinion is thus deeply confused about the kind of privacy it wishes to protect. It is impossible to ascertain whether the decision seeks to protect data privacy or dignitary privacy. Google Spain is ultimately pushed in the direction of dignitary privacy because it is well understood how the requirements of dignitary privacy may be reconciled with the requirements of public discourse. Although the normative logic of dignitary privacy may be in tension with freedom of expression, it is not, like the instrumental logic of data privacy, incompatible with freedom of expression. Insofar as freedom of expression is valued because it fosters democratic self-government, public discourse cannot serve as an effective instrument of self-governance without a modicum of civility. Yet the Google Spain decision recognizes dignitary privacy only in a rudimentary and unsatisfactory way. It inadequately theorizes both the harms potentially caused by Google links, and the contributions made by such links to public discourse. If it had more clearly focused on the requirements of dignitary privacy, moreover, Google Spain could not so sharply have distinguished Google from the underlying websites to which Google links refer. Google Spain would not have been able blithely to outsource the enforcement of the right to be forgotten to a private corporation like Google.