The Right to be Forgotten- an Israeli Perspective, Lior Shahar
Since the GDPR (General Data Protection Regulation) replaced Directive 94/46/ec in May 2018 as the main regulation tool dealing with the protection of processing of personal data, it has raised many questions regarding how to address the rights of data subjects outside of the EU.[1] Thanks to the Territorial scope of the GDPR, it applies, under certain conditions, to data subjects outside of the EU.[2] Therefore, GDPR compliance and regulation is becoming a major part of the legal landscape outside of the EU as well. In this Blog-post I will review one of the rights given to EU citizens by the GDPR – the right to be forgotten, and its status in Israel in the pre-GDPR era, considering the effect the GDPR might have on the legal landscape in Israel.
The right to be forgotten: the Costeja case and the GDPR
In 1998, a Spanish newspaper published two announcements in its printed edition regarding an auction of properties, which were being held by the government, due to social security debts. The Spanish Ministry of Labor and Social Affairs ordered this publication with a purpose to attract as many bidders as possible. A version of the printed edition was later made available on the newspaper website. The announcements also included the debt holders’ names, amongst which was Mario Costeja Gonzalez.[3]
On March 5th, 2010 Mr. Costeja lodged a complaint with the Spanish Data Protection Agency, asking that both the newspaper would be required to remove the notices and that Google Spain or Google Inc. would be required to remove links to the pages leading to the search results by typing Mr. Costeja’s name.[4] Google argued, that any request seeking the removal of information must be addressed to the publisher of the web page concerned because it is he who takes the responsibility for making the information public, and who is in a position to appraise the lawfulness of that publication.[5] The Audiencia Nacional joined the actions and stayed the proceedings pending a preliminary ruling from the CJEU (Court of Justice of The European Union) on several questions regarding the interpretation of the Data Protection Directive.[6].
The CJEU ruling held that the Directive enables the data subject to request that links to web pages be removed from such a list of results, on the grounds that he is entitled to have the information appearing on those pages relating to him personally to be "forgotten" after a certain time. The Court held that if it is found, following a request by the data subject, that the inclusion of those links in the list is at such point in time, incompatible with the Directive, therefore the links and information in the list of results must be erased.[7]
Using a broad interpretation for the right to erasure, provided to data subjects by article 12 of the Directive 94/46/ec, the court established that Google was responsible for infringing Mr. Costeja's privacy with respect to the processing of personal data[8] — which requires protection under Article 1(1) of the Directive in making the information available.[9]
The Costeja case was an important milestone in the development of the right to be forgotten in the EU. Today, courts do not need to use elaborate interpretation in order to enforce the right to be forgotten, as it is now part of the EU's formal legislation, in the GDPR.[10]
The legal perspective on the right to be forgotten: Israel
In Israel, unlike the EU, the right to be forgotten is not a formal part of the legislation. In recent years the legislator has addressed it in several bills, which would have constituted significant developments in Israeli privacy law had they been passed.[11] Unfortunately, none of these bills have been passed by the Knesset (the Israeli parliament).
In a bill from 2017, the emphasis was placed on the right of a person to be forgotten from search engines while referencing to the ruling in the Costeja case as the catalyst to the legislative bill.[12] The bill, serving as an amendment Privacy Protection Law suggested that accepting a request for removal by the court is possible only after the court has considered the proper balance between the public interest that the information will be accessible to the general public and the particular infringement of a specific person's privacy. If the particular infringement outweighs the interest of the public, the court has the authority, according to the bill, to order the removal of said information from search engine.[13]
, Yet as pointed out above, the bill was not passed, and the right to be forgotten has yet to become part of Israeli legislation. A similar bill was published during November 2019,[14] yet no progress has been made since then – something that can be attributed in part to the complicated political reality in Israel in the last year.
Today, The Privacy Protection Law merely recognizes the right of a data subject to request the rectification of its personal data if it is found to be incorrect, incoherent or outdated. That being said, Israeli courts have addressed the right to be forgotten in different contexts, which I will discuss in the text below.
Israeli case law
In Israel, there were only a few cases where the right to be forgotten was mentioned, let alone discussed. An interesting case is that of HPS Business Information Ltd. v. Courts Administration,[15] where the courts administration conditioned the access to its verdict database by posing an obligation on the user to refrain from creating an "open index" – meaning, indexing the information in the database. An open index allows typing key-words into a search engine to reach a certain website. The purpose of the Israeli Courts Administration was to prevent possible infringement of the right of privacy of litigants, caused by search results which contained the names of the litigants. This condition made it very difficult for the operators of the website "Takdin-Lite"[16] to attract potential customers.[17]
The Court rejected the claim made by the Courts Administration that an accessible judgment in a digital legal database (for which a subscription had to be paid) provided proper anonymity, while finding it by using a free search engine may not do so.[18] The Court went one step further stating that the right to be forgotten was not part of Israeli Law.[19] As a result, this ruling weakens the right to be forgotten in the Israeli legal system.
Nonetheless, this was not true for the case of Savir vs. Noy. The case involved an Israeli lawyer (Ami Savir) who represented the Israeli Bar Association in disciplinary proceedings. Savir argued that typing his name in Google's search engine led to faulty results. The search results led to a webpage which displayed a distorted picture - that Savir was convicted in disciplinary proceedings, whereas, in act, he was the legal representative of the Bar Association in the said proceedings.[20]
Savir contacted the web page operator and Google, requesting the removal of the incorrect data, but was refused. Following that, Savir filed a lawsuit against the web page operator (Mr. Noy) and Google, in demand for compensation for defamation and damage to his reputation. The Court refused his claim of defamation and damage to his reputation against Google but accepted the claims against the web page operator on the grounds that Google had no responsibility for the content on a page belonging to a third-party and was merely a pipeline for information.[21] His claims were accordingly dismissed. Savir appealed the decision. On appeal, the District Court held that Google is in fact responsible for the incorrect publication.
However, this ruling might have a limited effect on the scope of the right to be forgotten in Israel. The court held that Google is responsible for the removal of the data only in cases where a third party that generated the defamatory content (in that case – the web page operator) did not cooperate or refuses the request of removal; and when there is certainty that the data is incorrect. The court further stated that if there is any doubt about the correctness of the data, Google may claim that only by judicial order it will actively interfere with the content displayed on its website.[22]
Conclusion
On the one hand, the GDPR imposes responsibility on the controller, which in many cases are the operators of search engines, such as Google; through them information can circulate at a much greater pace than on a website. On the other hand, one might argue that the burden to verify every piece of information by the operators of search engines is far too heavy, and that we should not impose such a responsibility on the operators. Israeli courts have yet to recognize an independent right to be forgotten. In Savir's case, the court relied on Defamation Law to "enforce" the right to be forgotten,[23] yet one can think of certain publication on a web page may not be defamatory, yet the data subject may require this data to be forgotten, as described in the Costeja case mentioned above. Evidently, we will have to wait for the Knesset to decide on the matter. Considering former bills and Israeli case law, it will be interesting to see how the right to be forgotten ultimately will be addressed and developed in Israel, in view of the GDPR legislation and its effect on foreign regulation outside the EU.
[1]. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [OJ 2016 L 119/1], at §1.
[2] Id, at §3.
[3] Court of Justice of the European Union Press Release No. 70/14 (13.05.14); https://curia.europa.eu/jcms/upload/docs/application/pdf/2014-05/cp140070en.pdf.
[4] Case C-131/12 Google Spain SL, Google Inc. VS Agencia Espanola de Proteccion de Datos (AEPD), Mario Costeja Gonzalez [13.05.14] ECR, at §15.
[5] Id. at §63.
[6] Id.at §20.
[7] Id. at §94.
[8] ‘Processing’ is defined under § 4 of the GDPR as: "means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".
[9]Google Spain SL, Google Inc. VS Agencia Espanola de Proteccion de Datos, Mario Costeja Gonzalez, at §94; Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [OJ 1995 L 281/31], at §12.
[10] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [OJ 2016 L 119/1], at §17.
[11]The Privacy Protection Law, 5741-1981.
[12] Privacy Protection Law Bill Proposal (Amendment: the Right to be Forgotten), 5777-2017.
[13] Id. At 2.
[14] Privacy Protection Law Bill Proposal (Amendment: the Right to be Forgotten), 5780-2019.
[15] 5780/14 HaShavim H.P.S B Business Information Ltd.VS Coutrs Administration (12.11.2015).
[16] "Takdin-Lite" is a website which uses as a database for all the different rulings given by the courts in Israel, and the access to it is only through payment. "Takdin-Lite" grants access to a single ruling without a subscription for 26 nis.
[17] HaShavim H.P.S B Business Information Ltd.VS Coutrs Administration, at §21 of Justice Rubistein's verdict.
[18] Id. at §43 of Justice Rubistein's verdict.
[19] Id. at §15 of Justice Rubistein's verdict
[20] 49918-05-12 Adv. Ami Savir VS. Shaul Bar Noy, Google Inc. (23.09.14), at §5-6.
[21] Id. at §76.
[22] 44711-11-14 Adv. Ami Savir VS. Shaul Bar Noy, Google Inc. (12.11.2015), at §16.
[23] The Defamation law 5725-1965.
