Ministry of Transport, Information Technology and Communications

Internet : http://www.coe.int/cm
Recommendation CM/Rec(2012)3 of the Committee of Ministers to member States on the protection of human rights with regard to search engines
(Adopted by the Committee of Ministers on 4 April 2012 at the 1139th meeting of the Ministers’ Deputies)
Search engines play a pivotal role in the information society
1. Search engines enable a worldwide public to seek, receive and impart information and ideas and other content in particular to acquire knowledge, engage in debate and participate in democratic processes.
2. Recommendation CM/Rec(2007)16 of the Committee of Ministers to member States on measures to promote the public service value of the Internet emphasises the importance of access to information on the Internet and stresses that the Internet and other information and communication technologies (ICTs) have high public service value in that they serve to promote the effective exercise and enjoyment of human rights and fundamental freedoms for all who use them. The Committee of Ministers is convinced of the importance of search engines for rendering content on the Internet accessible and the World Wide Web useful for the public and therefore considers it essential that search engines be allowed to freely crawl and index the information that is openly available on the Web and intended for mass outreach.
3. Suitable regulatory frameworks, compliant with human rights requirements, should be able to give adequate responses to legitimate concerns in relation to referencing by search engines of content created by others. Further consideration is necessary as to the extent and the modalities of application of national legislation, including on copyright, to search engines as well as related legal remedies.
Human rights and fundamental freedoms can be threatened by the operation of search engines
4. The action of search engines can affect freedom of expression and, given their role in facilitating access to information, can bear even more on the right to seek, receive and impart information; similarly, their action has an impact on the right to private life and the protection of personal data. Such challenges may stem, inter alia from the design of algorithms, de-indexing and/or partial treatment or biased results, market concentration and lack of transparency about both the selection process and ranking of results.
5. The impact on private life may result from the pervasiveness of search engines or their ability to penetrate and index content which, although in the public space, was not intended for mass communication (or mass communication in aggregate), and from data processing generally and data retention periods. Moreover, search engines generate new kinds of personal data, such as individual search histories and behaviour profiles.
6. There is a need to protect and promote access, diversity, impartial treatment, security and transparency in the context of search engines. Media literacy and the development of skills that enable users to have informed access to the greatest possible variety of information, content and services should be promoted having regard to Recommendation CM/Rec(2011)7 on a new notion of media.
2
7. The Committee of Ministers therefore, under the terms of Article 15.b of the Statute of the Council of Europe, recommends that member States, in consultation with private sector actors and civil society, develop and promote coherent strategies to protect freedom of expression, access to information and other human rights and fundamental freedoms in relation to search engines in line with the Convention for the Protection of Human Rights and Fundamental Freedoms (ETS No. 5, hereinafter referred to as the “Convention”), especially Article 8 (Right to respect for private and family life) and Article 10 (Freedom of expression) and with the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108, hereafter referred to as “Convention No. 108”), in particular by engaging with search engine providers to carry out the following actions:
– enhance transparency regarding the way in which access to information is provided, in order to ensure access to, and pluralism and diversity of, information and services, in particular the criteria according to which search results are selected, ranked or removed;
– review search ranking and indexing of content which, although in the public space, is not intended for mass communication (or for mass communication in aggregate). This could include listing content sufficiently low in search results so as to strike a balance between the accessibility of the content in question and the intentions or wishes of its producer (for example having different accessibility levels to content which is published seeking broad dissemination as compared to content which is merely available in a public space). Default settings should be conceived taking account of this objective;
– enhance transparency in the collection of personal data and the legitimate purposes for which they are being processed;
– enable users to access easily, and, where appropriate, to correct or delete their personal data processed by search engine providers;
– develop tools to minimise the collection and processing of personal data, including enforcing limited retention periods, adequate irreversible anonymisation, as well as tools for the deletion of data;
– ensure accessibility to their services to people with disabilities, thereby enhancing their integration and full participation in society.
8. In addition, member States should:
– ensure that suitable legal safeguards are in place when access to users’ personal data is granted to any public or private entity, thus securing the full enjoyment of the rights and freedoms enshrined in the Convention;
– encourage search engine providers to discard search results only in accordance with Article 10, paragraph 2, of the Convention. In this event, the user should be informed as to the origin of the request to discard the results subject to respect for the right to private life and protection of personal data;
– promote media literacy with regard to the functioning of search engines, in particular on the processes of selecting, ranking and prioritising of search results and on the implications of the use of search engines on users’ right to private life and the protection of their personal data;
– consider offering users a choice of search engines, in particular with regard to search outputs based on public value criteria;
– promote transparent self- and co-regulatory mechanisms for search engines, in particular with regard to the accessibility of content declared illegal by a court or competent authority, as well as of harmful content, bearing in mind the Council of Europe’s standards on freedom of expression and due process rights;
3
– take measures with regard to search engines in line with the objectives set out in the appendix to this recommendation;
– bring this recommendation and its appendix to the attention of all relevant public authorities and private actors.
Appendix to Recommendation CM/Rec(2012)3
I. Helping the public make informed choices when using search engines
Context and challenges
1. Search engines play a crucial role as one of the first points of contact on the Internet in exercising the right to seek and access information, opinions, facts and ideas, as well as other content, including entertainment. Such access to information is essential to building one’s personal opinion and participating in social, political, cultural and economic life. Search engines are also an important portal for citizens’ access to mass media, including electronic newspapers and audiovisual media services.
2. There is some concern that users tend to use a very limited number of dominant search engines. This may raise questions regarding the access to and diversity of the sources of information, especially if one considers that the ranking of information by search engines is not exhaustive or neutral. In this regard, certain types of content or services may be unduly favoured.
3. The process of searching for information is strongly influenced by the way that information is arranged; this includes the selection and ranking of search results and, as applicable, the de-indexing of content. Most search engines provide very little or only general information about these matters, in particular regarding the criteria used to qualify a given result as the “best” answer to a particular query.
Action
4. While recognising that full disclosure of business models and methods or business-related decisions may not be appropriate because algorithms are highly relevant for competition and that related information might also result in increased vulnerability of search engine services (for example in the form of search manipulation), member States, in co-operation with the private sector and civil society, should:
– encourage search engine providers to enhance transparency as regards general criteria and processes applied to the selection and ranking of results. This should include information about search bias, such as in presenting results based on apparent geographic location or on earlier searches;
– encourage search engine providers to clearly differentiate between search results and any form of commercial communication, advertisement or sponsored output, including “own content” offers;
– promote research on the dynamic market for search engines, to address issues including the public value dimension of search engine services, the increasing concentration of the search engine market and the risk of abuse, manipulation and restriction of search results.
4
II. Right to private life and to the protection of personal data
Context and challenges
5. Search engines process large amounts of personal data on the search behaviour of individuals, varying from cookies and IP addresses to individual search histories, as highlighted by a number of relevant texts already adopted at both European and international levels.1
6. An individual’s search history contains a footprint which may reveal the person’s beliefs, interests, relations or intentions. Individual search histories may also disclose sensitive data (revealing racial origin, political opinions or religious or other beliefs, or data concerning health, sexual life or relating to criminal convictions) that warrant special protection under Article 6 of Convention No. 108.
7. The processing of personal data by search engines acquires an additional dimension due to the proliferation of audiovisual data (digital images, audio and video content) and the increasing popularity of mobile Internet access. Specialised search engines that allow users to find information on individuals, location-based services, the inclusion of user-generated images into general-purpose search indexes and increasingly accurate face-recognition technologies are some of the developments that raise concerns about the future impact of search engines on fundamental rights such as the right to private life, and its potential bearing on the exercise of freedom of expression or the right to seek, receive and impart information of one’s choice.
8. By combining different kinds of information on an individual, search engines create an image of a person that does not necessarily correspond to reality or to the image that a person would want to give of her- or himself. The combination of search results creates a much higher risk for that person than if all the data related to her on the Internet remained separate. Even long-forgotten personal data can resurface as a result of the operation of search engines. As an element of media literacy, users should be informed about their right to remove incorrect or excessive personal data from original web pages, with due respect for the right to freedom of expression. Search engines should promptly respond to users’ requests to delete their personal data from (extracts of) copies of web pages that search engine providers may still store (in their “cache” or as “snippets”) after the original content has been deleted.
9. Overall, it is vital to ensure compliance with applicable privacy and data protection principles, starting with Article 8 of the Convention and Article 9 of Convention No. 108, that foresee strict conditions to ensure that individuals are protected from unlawful interference in their private life and abusive processing of their personal data.
Action
10. Member States (through the designated authorities) should enforce compliance with the applicable data protection principles, in particular by engaging with search engine providers to carry out the following actions:
– ensure that the collection of personal data by search engine providers is minimised. No user’s IP address should be stored when it is not necessary for the pursuit of a legitimate purpose and when the same results can be achieved by sampling or surveying, or by anonymising personal data. Innovative approaches promoting anonymous searches should also be encouraged;
– ensure that retention periods are not longer than strictly necessary for the legitimate and specified purposes of the processing. Search engine providers should be in a position to justify with demonstrable reasons the collection and the retention of personal data. Information in this connection should be made publicly available and easily accessible;
1 Article 29 Working Party Opinion 1/2008 (adopted on 4 April 2008) on data protection issues related to search engines; the 28th International Data Protection and Privacy Commissioners’ Conference Resolution on Privacy Protection and Search Engines (London, 2-3 November 2006).
5
– ensure that search engine providers apply the most appropriate security measures to protect personal data against unlawful access by third parties and that appropriate data breach notification schemes are in place. Measures should include “end-to-end” encryption of the communication between the user and the search engine provider;
– ensure that individuals are informed with regard to the processing of their personal data and the exercise of their rights, in an intelligible form, using clear and plain language, adapted to the data subject. Search engines should clearly inform users up front of all intended uses of their data (emphasising that the initial purpose of such processing is to better respond to their search requests) and respect the user’s right with regard to their personal data. They should inform individuals if their personal data has been compromised;
– ensure that the cross-correlation of data originating from different services/platforms belonging to the search engine provider is performed only if unambiguous consent has been granted by the user for that specific service. The same applies to user profile enrichment exercises as also stated in Recommendation CM/Rec(2010)13 on the protection of individuals with regard to automatic processing of personal data in the context of profiling.
11. In addition, member States should:
– encourage search engine providers further to develop tools that allow users to gain access to, and to correct and delete, data related to themselves that have been collected in the course of the use of services, including any profile created, for example for direct marketing purposes;
– ensure that requests from law-enforcement authorities to search engine providers for users’ data are based on appropriate legal and judicial procedures, and that transparent mechanisms of co-operation are in place. This should include strong legal safeguards and the observance of due process requirements before individuals’ data and search records are disclosed to public authorities or private parties. The above-mentioned procedures should not represent an undue burden for the providers in question.
III. Filtering and de-indexing
Context and challenges
12. A prerequisite for the existence of effective search engines is the freedom to crawl and index the information available on the Web. The filtering and blocking of Internet content by search engine providers entails the risk of violation of freedom of expression guaranteed by Article 10 of the Convention in respect to the rights of providers and users to distribute and access information.
13. Search engine providers should not be obliged to monitor their networks and services proactively in order to detect possibly illegal content, nor should they conduct any ex ante filtering or blocking activity, unless mandated by court order or by a competent authority. However, there may be legitimate requests to remove specific sources from their index, for example in cases where other rights outweigh the right to freedom of expression and information; the right to information cannot be understood as extending the access to content beyond the intention of the person who exercises her or his freedom of expression.
14. In many countries, search engine providers de-index or filter specific websites at the request of public authorities or private parties in order to comply with legal obligations or at their own initiative (for example in cases not related to the content of websites, but to technical dangers such as malware). Any such de-indexing or filtering should be transparent, narrowly tailored and reviewed regularly subject to compliance with due process requirements.
6
Action
15. Member States should:
– ensure that any law, policy or individual request on de-indexing or filtering is enacted with full respect for relevant legal provisions, the right to freedom of expression and the right to seek, receive and impart information. The principles of due process and access to independent and accountable redress mechanisms should also be respected in this context.
16. In addition, member States should work with search engine providers so that they:
– ensure that any necessary filtering or blocking is transparent to the user. The blocking of all search results for certain keywords should not be included or promoted in self- and co-regulatory frameworks for search engines. Self- and co-regulatory regimes should not hinder individuals’ freedom of expression and right to seek, receive and impart information, ideas and content through any media. As regards the content that has been defined in a democratic process as harmful for certain categories of users, member States should avoid general de-indexation which renders such content inaccessible to other categories of users. In many cases, encouraging search engines to offer adequate voluntary individual filter mechanisms may suffice to protect those groups;
– explore the possibility of allowing de-indexation of content which, while in the public domain, was not intended for mass communication (or mass communication in aggregate).
IV. Self- and co-regulation
Context and challenges
17. Self-regulatory initiatives by search engine providers aiming at protecting individuals’ fundamental rights should be welcomed. It is important to recall that all self- and co-regulation may amount to interference with the rights of others and should therefore be transparent, independent, accountable and effective, in line with Article 10 of the Convention. A productive interaction between different stakeholders, such as State actors, private actors and civil society, can significantly contribute to the setting up of standards protecting human rights.
18. Member States should:
– take actions to promote the protection of individuals’ fundamental rights meeting the Convention’s standards, in particular the right to due process, the right to freedom of expression and the right to private life, through the development of co-regulation with search engine providers, when such measures are found appropriate;
– encourage the industry to develop self-regulatory codes of conduct guaranteeing the protection of individuals’ fundamental rights, in the due respect of the Convention, in particular the right to due process, the right to freedom of expression and the right to privacy.
V. Media literacy
Context and challenges
19. Users should be informed and educated about the functioning of different search engines (search engine literacy) in order to make informed choices about the sources of information provided, in particular that a high ranking search does not necessarily reflect the importance, relevance or trustworthiness of the source. As search engines play an increasingly important role with regard to the accessibility of media and information online, media and information literacy strategies should be adapted accordingly. Users should be made aware of the implications of the use of search engines, both with regard to personalised search results, as well as to the impact on their image and reputation of combined search results about them, and of the available tools to exercise their rights.
7
Action
20. Member States should:
– take appropriate steps to include the topic of search engine literacy in their national media literacy strategies;
– take appropriate actions to enable users to be aware of and to manage their online identity, in particular with respect to the impact that search results can have on their image and reputation and to the effective tools to exercise their rights.