Over the last nine months, German courts have issued a pair of rulings that seem to be at odds with one another when it comes to the right to be forgotten under the GDPR. The second of these two cases was decided on July 27 in which the Federal Court of Justice stated that the public’s right to information outweighed the right of the plaintiff to have unfavorable information about him removed from the Internet – a ruling that was hailed as a “triumph” for the defendant Google. Yet the German Constitutional Court issued a ruling in November 2019 (in a case with a rather macabre background) that seems to stand diametrically opposed to today’s case and which stated that the plaintiff’s right to be forgotten should prevail in the face of information requires that certain information about him be removed from the Internet.
So what is going on with the German courts and the right to be forgotten? Is there any way for a company to predict what sort of judicial guidance might arise in the near future? Or is there some logic underlying these two rulings that unites them despite what seem to be at first glance a contradiction?
But first, let’s have a look at what the right to be forgotten is – and isn’t.
What is the “Right to be Forgotten”?
The first comprehensive data protection program to cover the whole of the European Union was the Data Protection Directive that took effect in 1995. Under this directive – which required member states to enact legislation to ensure not only that a data subject’s personal data is secure, but also to protect citizens’ fundamental rights as far as his or her data are concerned. It was under this legal framework which preceded the GDPR that the European Court of Justice ruled in 2014 (in “Google Spain”) that search engines such as Google must, under certain circumstances, remove links that pertain to an individual if that person so requests. In that case, a Spanish citizen requested that information about his previous bankruptcy that had been published in a newspaper be removed from Google’s search results. This case is considered a watershed in EU data privacy law since it was the first legal establishment under European human rights law to require data controllers to consider individual requests to remove or extinguish personal information.
The Data Privacy Directive was superseded by the General Data Protection Regulation (GDPR) in 2018, however many data privacy concepts developed under the Directive were carried over into the Regulation. In fact, the GDPR incorporated the individual right to have information removed that the European Court of Justice formulated in 2014 directly into the text of the Regulation. Under Article 17 of the GDPR, an individual can request such removal if, inter alia, the data is no longer needed or if the data subject withdraws his or her consent.
Of course, the right to be forgotten is not absolute, and the GDPR in Article 17(3) allows organizations to decline requests for deletion under the right to be forgotten (sometimes also called the right of erasure) if, for example, such a request would hamper the right of free expression. And it is exactly the tensions inherent in these two assertions that are at the heart of the following two (seemingly bewildering) German cases.
A Murder at Sea, and Der Spiegel’s Long Memory
One of the most recent cases on the right to be forgotten has its grizzly origins in the early 1980s – and not anywhere in Europe but in the Caribbean. (To give some background to this case, I am going to paraphrase from the 2017 book by Nic Compton called Off the Deep End: A History of Madness at Sea.) It was in 1981 on the Canary Islands that two West German men, Paul Termann and Herbert Klein, set off on their boat the Apollonia for the Caribbean with the intent to start a charter business. En route, tensions increased between the two men, with Termann increasingly feeling frozen out of the rest of the crew. A petty argument then exploded into a full rage, with Termann pulling a gun on Klein and telling him he had only 10 minutes to live. When Klein tried to defend himself by hitting Termann over the head with a pump handle, Termann started firing wildly, first killing Klein’s girlfriend and then Klein himself. Although Termann initially claimed that the two victims had fallen overboard in a storm, other crew members informed the German police. Termann was then arrested, put on trial, and sentenced to life in prison, however he was released in 2002.
Understandably the murders and trial made for sensational headlines, and the German weekly Der Spiegel ran at least two articles about the case in 1982 and 1983, both of which mentioned Termann by name. Those articles still appear (at least of this writing) in the magazine’s digital archives in the original German-language versions. For years Termann sought legally to have those archives removed under the right to be forgotten, arguing that perpetual access to records of long-ago crimes hinder his right to freely develop his “personality.”
The first judicial ruling on Termann’s case came in 2012 when a court rejected his claims and stated that his right to privacy was outweighed by both the freedom of the press and the right of the general public to access information. Recall that this ruling preceded both the Google Spain case and the adoption of the GDPR, so that by the time the German Constitutional Court reviewed the case in 2019, the privacy landscape had shifted considerably in favor of individuals, which may have influenced the way the court weighed competing factors.
Why Did the Constitutional Court Side with Termann?
While some of the English-language press coverage of the case tended to highlight the luridness of the initial case, analysis of the court’s reasoning was unfortunately fairly thin when the ruling was announced. Fortunately the press release from the German Constitutional Court itself goes into how they decided as they did (the original German-language version can be found here; a summary of the most pertinent points follows.)
The court first notes that although it is deciding an issue that is within the scope of the all-EU GDPR, member states will apply the GDPR in different ways depending upon the laws that govern each individual nation. In Termann’s case, the German court naturally applied the German Basic Law and its attendant fundamental rights. One of these rights that the German Basic Law guarantees is the right to the “free development of one’s personality,” which the court stated entails the “self-determination of information” about oneself (informationelle Selbstbestimmung) – meaning that an individual has a degree of power over what information may be disseminated about someone. The Constitutional Court ruled that the lower court had incorrectly applied the scope of protection afforded by the Basic Law by emphasizing the public interest in accessing information over the right to control information about oneself that is “stigmatizing” and that risks “social exclusion.” Freedom requires a legal framework that gives people the chance to leave mistakes in the past and to not have previous actions available to the public indefinitely.
If you are going by the English-language press, it seems that the Constitutional Court flatly stated that Termann has the right to be forgotten, and that “his name can be removed from online search results.” Alas, this seems to be a massive oversimplification of what actually happened. The court did not rule that Herr Termann’s right to be forgotten was violated, and that he can now go to Der Spiegel and have the archived articles go away. As seems to happen with regrettable frequency, much of the media reporting missed the mark here, sometimes quite widely.
What the Bundesverfassungsgericht did in fact was to refer the case back to the Federal Court of Justice to re-weigh the competing considerations of freedom of the press with the (newly affirmed) right to have some determination over information about oneself. Courts and other parties need to take each case on its unique facts, given factors such as time elapsed since the event in question and the feasibility of implementing informational safeguards. The Constitutional Court in fact emphasized the importance of press freedom when considering erasure requests that a German press-freedom group, Reporter ohne Grenzen (Reporters Without Borders) welcomed the ruling as it did not place the right to be forgotten over the right to publish and archive matter even if it refers to someone by name.
All of which means we must still await the ultimate outcome of the Termann case….
In my opinion – assuming the Federal Court of Justice rules on this in the next year or so – the most likely outcome is that the right to publish and archive will prevail over Termann’s right to be forgotten. The Constitutional Court had said that the long interval between Termann’s crimes and the present day mean that the public has less of a right to know about these events, yet the power to infringe on Termann’s right to self-determination is still present. Perhaps. A more likely analysis from the court seems to be that the further in the past Termann’s actions were – he was 43 at the time of the murders and is over 80 now – the less likely the harm to him in the present. Moreover, public interest does not vanish with time, even if it pales compared to an ongoing murder trial. Therefore, the right to publish and the right to be informed would most likely outweigh any possible harm (which it is not clear if Termann was able to demonstrate; he had been out of prison for seven years before he even knew about Der Spiegel’s archived articles.) In all likelihood, the linked articles above will continue to be freely available in their original form, and the right to be forgotten will not be implicated here.
How Germany’s Latest Erasure Ruling Fits with the Termann Case
On July 27, 2020, Germany’s other High Court – the Federal Court of Justice – rejected the petition a man who had requested that Google remove links to old news articles in which his name appeared. (In Germany the Court of Justice is the highest court for matters of civil and criminal law, while matters that implicate rights guaranteed in the Basic Law will be heard in the Constitutional Court. If a plaintiff believes the Court of Justice failed to protect his or her fundamental rights, the Constitutional Court can then hear an appeal. This is what happened in the Termann case.)
The news articles in question were from 2011 and described the million-Euro loss that the petitioner’s charitable organization had suffered as well as the poor state of the petitioner’s health. Unlike in Termann’s case where the coverage had appeared in a national magazine, these articles appeared in a regional Frankfurt newspaper, although they too were accessible online. The Federal Court of Justice ruled that while Article 17 of the GDPR grants the plaintiff a right to erasure, this right must be weighed against the public interest to information and the freedom of the press to publish. In this case, the plaintiff’s request must be measured against the time elapsed and the public right to information. In other words, the court held that there is no “automatic” right of erasure, so Google can continue hosting the digital archive with the relevant articles.
So it turns out this case and the Termann case do not actually contradict one another; instead, both rulings state that each request to remove digital archives or links must be weighed against the countervailing rights of the publisher and the public. Since the Constitutional Court did not rule that the right of erasure automatically requires (for example) Google to remove search results, this week’s case is part of the same emerging jurisprudence that seeks a compromise between competing considerations. And so far, it appears that the right to erasure has been consistently subordinated to the wider interests of the press and public.
Where is Article 17 Headed? What Circumstances Will Require Erasure?
Since the GDPR is only a few years old at this point, we are only just now seeing the first cases dealing with erasure. The two German cases mentioned above can only lead one to wonder what exactly would be adequate grounds for erasure to be granted. On the other hand, earlier in July the Belgian Data Protection Authority fined Google 600,000 Euros for failing to comply with an erasure request by a Belgian public official of searchable information about him. Google stated that it did so because it considered the right of the public to access this information to outweigh the interests of the official. Google can still appeal this fine, and it is possible that Belgian courts or the European Court of Justice will take up this matter in future. So while the exact parameters of the right of erasure are still being demarcated in European courts and DPAs, it seems that the broader interests of the press and wider public – which happen to overlap largely with the interests of Google and such – are tipping the scales away from individuals’ desires for erasure.
GermanLegalBlog.com 