Hacker News Reader

Comment by holstvoogd | Hacker News Reader

What everybody here seems to miss, is that the right to be forgotten is aimed at you right to ask a company to delete all personal data they have on you.

The question then is, how does this apply to search engines/indexers? I don't think it necessarily should, however since 'indexers' are not a recognized role in data processing laws, it takes some case law to figure these things out properly.

By the letter of the law, if something about me is indexed by google, they are processing my personal data and I have the right to ask them to stop doing that and delete it. Realistically though, this can lead to abuse by public people same as the DCMA does for companies.

So, still some work to be done. But I am glad that I have a legal way to force for instance a marketing deparment to stop harassing me with spam mail/calls. In practice, the threat of making a official request is often enough to motivate them ;)

View on HN

Seems like a transitive bit of reasoning might be a useful law here.

If I post a photo to facebook with "public" settings, then later want to delete it, facebook should do so. If an indexer like google has indexed it, then they should delete it too. Profile photos are an instance.

If I am the subject of a public interest news story, then I don't think I can ask them to forget me, so maybe in that case I can't ask google to forget me either?

I could then ask google to forget something if and only if I could ask the underlying content publisher to forget it.

This is mostly how things already work under EU rules. Neither the original "right to be forgotten" established by a significant court case, which in fact did relate to systems like search engines, nor the subsequent "right to erasure" under the GDPR creates an unrestricted power for data subjects to require all data about them to be deleted regardless of circumstances. For example, you can't take out a bank loan and then force the bank to erase all records of it.

There is at least one significant deviation from your "transitive" reasoning, though, in that while EU law might not extend to an original source that is providing misleading/harmful data about someone but is based elsewhere, it can still affect those providing indirect access to that data who are within the scope of EU law.

I think what this case is saying is that Google only has to "forget" that thing in the EU. It's free to keep that information on its servers in Asia and the US for instance. In fact, we can imagine actual legal situations in places like Singapore or the US where that data has to remain available. So I think this just clarifies that it doesn't have to work for every server everywhere in the world.

Suppose that you are the subject of a public interest story, where you randomly witch-hunted as, let's say, a 'pedo guy'.

Suppose that once the dust settles, the facts turn out to be entirely in your favor, and a the publications that ran hit pieces against you quietly issue retractions.

What will happen when I search Google for '6gvONxR4sf7o'? Maybe because you are interviewing to work for me?

I'm going to be bombarded with three pages of search results that loudly proclaim you to be a criminal, a moral degenerate, and possibly even a horse thief.

Is it in the public interest for incorrect information about you to be an incredibly prominent part of your public record?

(Bonus points: You can run a lucrative business by poisoning someone's search results, by, say, including their name and alleged wrong-doings in a 'mugshot database', and then demanding that the target pay you money to get removed from this 'mugshot database'... Should search engines be allowed to play their part in this form of extortion?)

I don't really find arguments like yours persuasive. Why should there be such a wide, sweeping law for something that's so obviously a corner case? It's not like there are millions of people being publicly "witch-hunted" every year… What's the everyday use case for this? Getting off of marketing mailing lists?

Why should there be laws against mass-murder? Hardly anyone does that.

But that's just the thing: I don't recall there being laws specifically against "mass murder". It'd just be multiple counts of murder. I could be wrong though.

It's not a corner case. It happens all the time.

Also, 'mugshot indexes' that extort money from you are a big business. Search engines should not be cooperating with, and profiting off that racket.

I agree with you, but think it might be an orthogonal question. I'm saying we could resolve the indexer question transitively. You're talking about the content question, where I agree you should be able to set the record straight. That one's a can of worms, so I tried to sidestep it.

>If I post a photo to facebook with "public" settings, then later want to delete it, facebook should do so. If an indexer like google has indexed it, then they should delete it too. Profile photos are an instance.

I'm not sure I agree with that. It's certainly valid for them to retain a snapshot of that time with the profile photo available. Or are you suggesting they are expected to alter/modify snapshots (or log data) to cater to after-the-fact decisions?

The whole point of the right to be forgotten is that they do not retain those snapshots.

Then I think the "right to be forgotten" is utter bullshit. It's isn't and shouldn't be a right.

The right to be forgotten is a bad idea.

At best, it might be reasonable to pursue a right to demand amendment.

You post a photo to facebook. You accidentally have the wrong sharing settings, which you notice too late. Should there be no ability to change your mind? We're operating in this "once it's online, it's out of your control" but that's a new kind of thing, and it's shitty.

> We're operating in this "once it's online, it's out of your control" but that's a new kind of thing, and it's shitty.

It's new? I think it's always been like that since the dawn of the internet (and before if you substitute "online" for "published"). The idea that you should have a right to force other entities to forget public information that they saw is what seems to be new.

> You accidentally have the wrong sharing settings, which you notice too late. Should there be no ability to change your mind?

Well, it's like accidentally telling someone a secret and then wishing there was legislature to force them to forget what you told them (assuming we have a technology for human memory deletion).

the problem ist, that if google wants to "forget" your data, they need to save two things.

- the data they need to "forget" - the request for forgetting the data

google is just an index over sites, if they do NOT want to remove things, google will index it forever.

thus thats why I hate the "right to be forgotten" law. it uses the wrong approach. it targets google, which does not provide the data. unfortunatly most often people want to silence news outlets which do not NEED to remove the data. so its extremly complicated.

I dislike both and I think the law should remove data from the web if it targets people and is relatively old (discussable). This would eliminate the problem completly AND all search engines would need to stop it. Or better implement a banned.txt or something that news outlets/sites need to implement if they are targeted, so that even archives can remove the data. all in all the law is pretty stupid in its current state. because it does not fix the problem it just duck tapes it.

As far as I can tell the only logical reason is political. It would be far less popular to force news organizations, which might be influential and local, to delete data than forcing an unpopular foreign corporation to do it.

The real problem is that it's fairly easy to get random websites to delete info about you. It really is. I contacted maybe 30 websites in the last year or so and all deleted/or hidden my information promptly without any questions.

Getting it THEN deleted from google/bing/and friends is freaking annoying. They act like they're some superimportant holders of knowledge, and require all kind of identification, personal information, ID document copies, whatever, just to even listen to you.

There's outdated link removal console for both search engines, but it only works if websites are implemented certain way, to properly return 404 error on no longer existing pages. Some websites will redirect non-existing urls to home page, and good luck getting anything removed from search engines then. They will refuse, because the page still exists. They will not even check that the page has changed.

>They act like they're some superimportant holders of knowledge, and require all kind of identification, personal information, ID document copies, whatever, just to even listen to you.

Google's real issue isn't that they have some deep ideological conviction to free speech. This isn't 1998-2008 Google anymore, all the "free speech" libertarians have either left the company or retired rich.

Their real issue is that a zero marginal cost business, like a search engine, is starting to have some costs now. Their opposition to these types of laws is about preserving their high margin, infinitely scalable business model. That may have been the primary motivator in the early years of Google as well, the ideology may have just been grafted on later.

Yeah, it's really easy to prove you have a valid request on the internet, if the real people are processing your request. When I assumed some website would liked more verification that I actually owned the domain before asking for removal, I just put the text into a file hosted on the domain, and there was no problem.

But that requires having people process your request and having un-structured request medium, like accepting e-mails on some preferred address.

And it looks like google liks to avoid having an unstructured input from random plebes, presumably to avoid expensive human labor.

Related factoid: a commonly accepted approach to GDPR compliance for those who have backups (that are retained for longer than the GDPR grace period) is to store enough information about the request to delete someone's data so that during the restore procedure the data can be deleted again.

> The question then is, how does this apply to search engines/indexers?

The bigger issue I think is that Google is already enjoying such position of deciding who and what is visible in the indexes. This is about giving similar option to the person whose data is indexed.

Reply on news.ycombinator.com