Google ‘committed’ to transparency on user access to personal data

Google has said offering transparency about legal and policy-related access requests for its users’ data “is something we are really committed to” and its transparency report is “a beginning and not an end” to how much it hopes to reveal.

Addressing an event on legal and technical views on privacy hosted by NUI Maynooth, Google senior privacy counsel William Malcolm also said the company was still evolving its approach to the "right to be forgotten" ruling by the European Court of Justice last year.

The landmark decision resulted from a case taken by a Spaniard who wanted Google to remove search result links¨ – but not the actual content – for outdated information about a personal bankruptcy.

The ruling established a limited “right to be forgotten” for EU citizens under which they can request search engine links to incorrect or outdated information be removed. Microsoft’s Bing search service also processes such requests.

“Right from the start, we recognised this was a landmark case,” Mr Malcolm said. Google started receiving requests immediately after the ruling and hurried to work out a system for taking and processing requests, all of which is done manually.

The company has assessed more than one million individual URLs since the ECJ decision, he said. In making removal decisions, the company was “in a bit of a role of being an adjudicator”. But Mr Malcolm said that overall, Google felt public records should remain public, and that there was a public interest in political speech.

“Our approach will not be static. It will continue to change over time,” he said. Google was committed to “thoughtful collaboration” and discussion as it works to comply with such EU regulations.

Speaking on the same panel, TCD associate professor of law Eoin O'Dell noted "the huge and increasingly private power of huge and increasingly powerful intermediaries" on the internet, such as Google and "common carriers" providing internet services.

Legal remedies against such entities were hard to achieve because regulators have limited resources, as do individuals, and competition only functions to a limited extent to curtail such power.

NUI Galway law lecturer Ronan Kennedy and information systems lecturer Michael Lang said that effectively implementing a right to be forgotten was technically difficult because "computers were not intended to forget." Developers needed to be designing IT systems to enable better data management in coming years.