FIVE BLOCKS SPECIAL REPORT 5/7/2019 ECJ Ruling: Google & the Right to Be Forgotten Overview: Europe’s Court of Justice ruled in May 2014 that users have the right to influence what information is available about them online. As such, search engines – such as Google – must accept requests to remove unfavorable search results under certain conditions. Key Facts : The ruling is only for search results that are ‘inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed.’ It only applies to individuals. This ruling does not address undesired content about business entities. Google can say no. Requests for removal can be denied if the results are deemed to be in the public interest. In this case, the request is pushed back to local government agencies to make a binding determination. The content persists online. Approved requests on Google will result in removal of the link(s) from all of Google's EU based domains (e.g. google.de, google.fr), but the content lives on other Google (google.com) or non-Google search engines with no presence in the EU. vs. Sources: Official ECJ Press Release , Financial Times 5/30/14 Forbes 6/06/14 , Search Engine Land 6/10/14

FIVE BLOCKS SPECIAL REPORT 5/7/2019 ECJ Ruling: Google & the Right to Be Forgotten Implementation: Removal has already begun. As of June 26, 2014 Google started removing results on its European sites based on requests received. Flagged results. Google has begun putting a takedown notice on all results pages for non-celebrity name searches in the EU: When you search for a name, you may see a notice that says that results may have been modified in accordance with data protection law in Europe. We’re showing this notice in Europe when a user searches for most names, not just pages that have been affected by a removal. Google FAQ Sources: Wall Street Journal 6/26/14 The Guardian 6/8/14 , Wall Street Journal 6/9/14 Search Engine Land 7/1/14

FIVE BLOCKS SPECIAL REPORT 5/7/2019 ECJ Ruling: Google & the Right to Be Forgotten Additional Considerations: Requests may volley back to courts. When Google denies a request, the applicant can appeal to their local data protection agency for another review. The agency’s verdict on the case is presumably binding. EU vs US & Asia. With this ruling only effective in Europe, implementation could lead to noticeably different search results in parts of the world. Legal implications. This ruling has sparked much discussion on the implications for international privacy laws (both existing and new) and their enforcement. Makes clear that Google’s search results are fully subject to European data privacy laws, which are more comprehensive than just the right to be forgotten. Now more difficult for search companies to take advantage of differences in privacy law enforcement across the countries of the EU. Cases similar to the one that prompted the ECJ ruling are making their way through courts in Canada and Japan; which may ultimately lead Google to having a global policy. Advisory Committee. Google has formed an advisory group (separate from the removal request review team) tasked with developing recommendations about the greater implications of the ruling. The committee includes privacy experts, regulators, academics and company executives. Sources: Forbes 6/06/14 , Search Engine Land 5/30/14 The Guardian 6/08/14 , Wall Street Journal 5/30/14 (A) Washington Post 5/14/14 , Wall Street Journal 5/30/14 (B) Hong Kong's Privacy Commissioner's Blog 6/26/14

FIVE BLOCKS SPECIAL REPORT 5/7/2019 ECJ Ruling: Google & the Right to Be Forgotten: By the Numbers As of May 19: 41,000+ takedown requests Germany Spain UK Italy France 40% 3% 14% 2% 13% Source: Financial Times 5/30/14 Takedown requests are related to… 31% 20% 12% Arrests/ convictions for violent/ serious crimes Fraud/ scam Child pornography

FIVE BLOCKS SPECIAL REPORT 5/7/2019 ECJ Ruling: Google & the Right to Be Forgotten Looking ahead: Impact on online reputation. It is too early to say whether this is an effective way for executives to influence their online reputation as it appears in Europe. Personal action steps. At this stage it makes sense to see how these requests are handled before deciding what to do next. International implications. Based on this ruling, Google is only mandated to address removal requests from the EU. It remains to be seen whether other countries will follow with similar rulings. Sources: Forbes 6/06/14 The Guardian 6/08/14 Official Google Form

Open Questions What is the territorial scope of application of the ruling? How does the ruling impact the processing of special categories of data by search engines? How should links be handled should they become relevant again in the future (e.g. in the event of repeated conduct)? What criteria should be used regarding the balance with the public’s right to access of information? What is the scope of application of the ruling when it comes to social media and news search engines run by media companies? David A. Goldman davidg@fiveblocks.com Source: Lexology 6/15/14