Who Knew Google Was a Credit Reporting Agency?

You thought that Google was just a search engine.  It turns out that Google is also a credit reporting agency.  The octopus has a 9th tentacle.  Didn't see that coming. (I guess that makes it a Googlepus...) That's the implication of the European Court of Justice's ruling ordering Google to take down links to the advertisements to a foreclosure sale from 16 years ago.  

The commentary on the ECJ's Google ruling has focused on the ECJ classifying Google as a data processor, but I think the credit reporting part of the decision may be just as significant. The ruling looks a lot less radical when understood from the credit reporting perspective, although it remains a problematic ruling because it is not limited to such a context.  

Here's the background.  In 2010, a Mr. Costeja González, a Spanish national, filed a complaint against a Spanish newspaper and Google for violating his privacy rights under the EU Data Privacy Directive (Directive 95/46) and its Spanish implementation, particularly his "right to be forgotten".  González's complain was that when he ran a google search of his name, he would obtain links to the newspaper's pages advertising his home in a 1998 foreclosure sale.  

The major focus of the commentary on the ECJ's ruling has focused on the issue of whether Google is engaged in "processing of...data" and a "controller" of the personal data in contained in the web pages it indexes.  The ECJ held that search engines are in fact data processors and control the data they index. That part of the ruling alone puts search engines within the scope of the Data Privacy Directive.  But unless the data in question is personal data that a EU citizen has a "right to have forgotten," then it doesn't matter much.  And this is an issue about credit reporting.  

The ECJ held that the 1998 foreclosure sale advertisment was prejudicial to González and that his fundamental rights to data proction and privacy overrode "the legitimate interests of the operator of the search engine and the general interest in freedom of information."  (ECJ opinion ¶ 91). The ECJ's opinion contained virtually no analysis weighing the harm to González to the interest of Google or the public. The closest thing there was to factual analysis was the emphasis that the foreclosure had occured 16 years prior. (ECJ opinion ¶ 98).  Accordingly, it is hard to know exactly what the ECJ was thinking--perhaps the ECJ thought it was self-evident that the harm outweighed the benefit.  The lack of analysis makes it particularly hard for parties to figure out how to apply the standard announced by the ruling on a going-forward basis.  

I think the ECJ ruling can be understood as creating a sort of floor for credit reporting in the EU. The EU lacks a uniform law governing credit reporting.  Instead, credit reporting, and indeed, the entire European consumer finance system, remains on a national level. (There's an EU Credit Agreements Directive, 08/46, but it doesn't deal with credit reporting.)  Any sort of integrated EU credit reporting wouldn't be very workable unless national legal and consumer financing systems were better integrated or else, credit files of, say Danes and Italians, would be apples and oranges. For all of European economic integration, household finance remains completely unintegrated. (If you think it'd be hard to reconcile state foreclosure laws nationally in the US, one can only imagine how difficult that would be in Europe.)  What the ECJ has essentially done in the Google case (intentionally or not) is to create a de facto rule that credit information that is 16 years old cannot be retained in a credit file, much less on the Internet.  

This sort of a rule limiting the publication of stale credit information isn't such a strange idea.  In the United States, the Fair Credit Reporting Act restricts how long certain items can remain on a credit report:  7 years for most negative information, and 10 years for a bankruptcy.  In other words, the US already has a type of "right to be forgotten" when it comes to credit histories.  

The legislative history of the FCRA doesn't shed a lot of light on why 7 years or 10 years, etc., much less why the different cutoffs.  Why is bankruptcy worse than a civil judgment or foreclosure? (Interesting factoid:  in the 1970s, a young Congressman named Christopher Dodd fought unsuccessfully to get 10 years down to 7 .)  And why should a judgment stay on a credit report for 7 years?  Is there anything magical about 7 years as opposed to 6 or 8 years, say?  The selection of 7 years is fairly arbitrary.  

Currently, at least, credit scores appear to be primarily driven by the last couple of years of credit history, making an event 7 years ago seem like ancient history.  On the other hand, nothing prevents a creditor from considering such events or even older events if it learns of them in some other way (such as asking a borrower on a loan application).  The FCRA  prohibition only covers the reporting, not the consideration of such stale data. 

To date, no one has applied this US credit history "right to be forgotten" to Internet search engines, but it isn't totally clear why they would be exempt.  The FCRA restriction applies to "consumer reports" from "consumer reporting agencies".  A "consumer report" is defined as "any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for...[consumer] credit or insurance....employment purposes... or [licensing or business transactions initiated by the consumer]."  Arguably a link on a search engine fits this statutory definition.  

As for the term “consumer reporting agency”, it is "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."  It's harder to fit Google into this definition given that Google's revenue does not come from its search users, but from advertisers and those paying for priority of their links.  Still, the "monetary fees" are not required by the terms of the statute to come from the users of the credit reports...

All of which is to say that one could conceivably argue that Google is subject to the FCRA in the United States and would have to eliminate any links to bankruptcies, foreclosures, judgments, etc. that were older than the FCRA expiry dates.  At the very least, the idea of having an expiry date on credit information isn't novel, although the idea that this applies not just to credit reporting agencies, but also to Internet search engines is a novel application, but not one that is wholly inconsistent with the (pre-Internet) drafting of the FCRA.  

Coming back to the ECJ decision, the   with the ECJ ruling is that it is a standard, not a rule. The FCRA creates a bright line:  information can be a credit report for 7 or 10 years, but not a day more. The ECJ just said that there has to be a finding that "the information in question in that list [of search results] causes prejudice to the data subject...[unless] for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having ... access to the information in question."  

This is a totally unworkable standard.  The ECJ has essentially put the burden on search engines like Google to figure out in the first instance how old credit information has to be before it is stale.  I don't know how Google is supposed to do this.  And this isn't an issue narrowly limited to credit information.  It covers any personal information.  How on earth is Google or any other search engine supposed to determine whether there is a public interest that outweighs the private interest? Consider information that could conceivably affect a variety of parties:  a person's marital history.  If someone was divorced 10 years ago, is that still relevant?  For underwriting (one could imagine divorce affecting credit)?  For potential future relationships?  Or how about a person's past criminal record?  For how long is a misdemeanor conviction relevant to, say employers or potential friends and partners or otherwise professionally?  Can information that was not relevant spring back to relevance, say when someone decides to run for political office?  I don't know how Google--or any other party deemed a "data processor" can be realistically expected to make such assessments. 

 

Comments

[Google Skeptic]

Are you essentially saying that the ECJ should have given an objective list of things that the SEs have to take down, such as:

1) mugshot extortion site links
2) expunged criminal records
3) accusations proven defamatory in court (see, e.g., the Bettina Wulf autosuggest case)

Does FCRA work that way, or was it subject to follow-on judicial interpretation?

[quixote]

I get tired of the "It's unworkable" argument. It's a matter of principle that private individuals have control over their own information. (Yes, I know there are a million and a half edge cases to think about. But let's think about the core of the thing first.)

On the other hand is a search engine which can track your every click for years (and is making billions of dollars doing it). But keeping track of the information they hold for any purpose except their profit is "unworkable."

BS. If someone has a multi-billion dollar empire founded on ripping people off -- the Mafia for instance -- we don't just give up because we were asleep at the switch while they grew big.