SEARCH ENGINES IN COLOMBIA: LEGAL REVIEW AND STUDY OF THE MUEBLES CAQUETA VS. GOOGLE INC CASE

Purpose – Considering the relevance of personal data protection, this article focuses on the identification of the criteria used by Colombian Courts regarding the rights to access, modification and erasure personal data within the context of information made available through search engines. This framework will expose the different cases ruled by the Colombian Constitutional Court as it attempts to highlight which were the criteria used by the courts that brought them to rule that search engines are mere intermediaries between the content makers and data subjects. Finally, this study aims to contribute not only to the data protection legal literature in Colombia, but also, to improve the possibilities to effectively implement user ́s rights of online search engines in Colombia. Methodology –In order to achieve the purpose of this research project, the following methodological strategies will be employed: (i) Legal-analytical study, by way of reviewing the Colombian regulatory framework in order to map out main rules regarding the fundamental rights to access, modification and erasure of personal data, and determining which ones are the aspects hindering the effective implementation of the rights; (ii) Legal-theoretical study, where it reviews the issues identified by legal scholars as hampering the implementation of data protection rights in general; (iii) Legal-empirical study that aims to raise awareness regarding the incidence of the activities carried out by search engines in the life of data subjects. Findings – The Colombian Constitutional Court has seen search engines as mere intermediaries, meaning they do not have to rectify, correct, eliminate or complete the information listed in the results they provide. This approach demands that the Judiciary enforces the existence of a right to request the erasure of links and the need of procedures provided by them to do it effectively without erasing or altering the content of the website. This delisting process should not be arbitrary based on conditions that allow data subjects to ask the erasure of links associated with their names. In the European Union, the conditions to get those results delisted are inadequacy, irrelevance, or excessiveness in Sarah Osma holds a law degree from Universidad Externado de Colombia (2014) and a Master of Laws in Law and Technology from Tilburg University (2015). Currently she works at the Data Protection Authority of Colombia and is lecturer of internet liabilities, intellectual property and data protection at Universidad Externado de Colombia. E-mail: sarah.osma.peralta@gmail.com. 2 Search Engines in Colombia: Legal Review and Study of the Muebles... (p. 1-13) PERALTA, S. O. Search Engines in Colombia: Legal Review and Study of the Muebles Caqueta vs. Google Inc Case. The Law, State and Telecommunications Review, Brasilia, v. 12, no. 2, p. 42-54, October 2020. relation to the processing purposes. The current position of the Constitutional Court about the search engines role and their responsibilities has not protected the user’s fundamental rights to privacy, reputation, and honor. Therefore, a more committed study on behalf of the Court is required. Practical Implications – In the Muebles Caquetá Case, the Court must point out the importance of the activities carried out by online search engines, and force them to face the implications of being a “controller” of the processing of personal data that takes place within their services. I suggest that the Court itself should draft clear delisting guidelines considering the opinions of a group of impartial experts, civil society representatives and the local Data Protection Authority. Originality – Considering the implications posed by personal data and data mining, this article identifies the legal and regulatory framework surrounding those activities and in way contribute to create a data protection culture in Latin America, raise awareness regarding the incidence of search engines in the life of data rights holders, identify possible disconnections between the existent regulatory framework for personal data rights, and facilitate the cooperation between Courts and stakeholders of the telecommunication and media sectors, based on the common goal of fulfilling the public interests of ensuring data protection rights.


INTRODUCTION
The accepted papers will be tentatively published in the next issue of this journal. We wish to give the journal a consistent, high-quality appearance. We therefore ask that authors follow some basic guidelines. In essence, you should format your paper exactly like this document. The easiest way to use this template is to download it from the journal website and replace the content with your own material. The template file contains specially formatted styles (e.g., Normal, Heading, Footer, Abstract, Subtle Emphasis, and Intense Emphasis) that will reduce the work in formatting your final submission.
Nowadays, due to the abundance of digital data storage and accessible online information, we face a situation that can be described as "forgetting by choice" and moved to "remembering by default" (KORENHOF, 2014); where remembering has become the norm, while forgetting is the exception.
With this new scenario, the distinction between the concept of the right to erasure and the right to be forgotten must be clear: The right to erasure is related to the control that data subjects have over their personal data and can be enforced through rights such as the right to access and to delete (ANDRADE, 2014), while the right to be forgotten, is related to past convictions and the possibility to have a new start (AMBROSE, 2014 The right under discussion in this paper is the right of every data subject to delete the information that they consider irrelevant about themselves (BERNAL, 2014), which has come to the forefront due to all types of data becoming available given the existence and popularity of search engines. We can see it applied to consumer credit scoring and criminal records, even when said information was originally stored in specific data bases and meant to be consulted for specific purposes and by specific institutions only.
As was set out by Koops (2011), the right to be forgotten can be invoked by the data subjects against those individuals that process data about their past, once the unwanted information is made public. Therefore, the deletion of outdated and irrelevant data is crucial since "people must be able to shape their own lives, and therefore should not be fixed in the perception of others by their past". Individuals must have certainty that data controllers will delete their data after it served its purpose.
Given the decision held by the Colombian Constitutional Court to declare null the ruling that created a set of obligations for online search engines in Colombia as expressed in T-063A/17. It is compulsory to address the key elements of this regulation in order to stablish the responsibilities of search engines regarding personal information and the right to erasure personal data.
In order to clarify the landscape of the responsibilities for search engines, we will explain what those are and what is their role in relation to the rights of access, modification and erasure of personal data, since online search engine operators play a crucial role in the dissemination of information, which implies a series of obligations in the field of data protection that have to be met in order to process personal data. This Article will focus on the role of search engines according to the Colombian Constitutional Court after the Muebles Caquetá vs. Google Inc. Case.

SEARCH ENGINES
The following paragraphs have the objective of explaining what is a search engine and what are the methods they use to collect, organize and make available information, in order to point out and to highlight which are the legal implications of their activities.
What is an online search engine? And how do they work?
The following paragraphs have the objective of explaining what is a search engine and what are the methods they use to collect, organize and make available information, in order to point out and to highlight which are the legal implications of their activities. The early 1990's marked the beginning of a mechanism that we use now on a daily basis called search engines, which emerged as tools for indexing files that were available on the web and made part of databases. These devices operated with a method of storing and retrieving files online (GASSER, 2006). In 1995 the first full text crawler-based search engine appeared, the socalled WebCrawler, that used algorithms based only on keywords and text to classify websites and select them with the criteria of context and relevance (GASSER, 2006).
As stated by Sergey Brin and Lawrence Page, creators of Google, the difference between them and the other competitors was that their Navigator had more precision in terms of the number of relevant documents and commercial services (BRIN; PAGE, 1997). Another element that contributed to Google's success was the introduction of PageRanks, a feature that facilitates the use of link structures for filtering data using an algorithm that "can compute up to 26 million web pages in few hours on a medium size workstation" (BRIN; PAGE, 1997).

Crawling, Indexing & Query
Crawling is the process of navigation over the millions of results available on the web made by the search engine with the use of a crawler or robot that determines which sites should indexed after it reads and analyses the content 1 . The process starts with a selection of URLs that is under constant improvement, once the crawler detects new related URLs it adds them to previous ones and that way refines the information contained in the index 2 .
Once the crawling processes is completed, the robots compile in an index all the information and their IP addresses, including tags to identify the information, this step allows the search engine to make quick examinations after the user introduced his query. After the search engine receives the query, a series of programs look for results based on algorithms that weigh unknown factors to select the most relevant pages, which later on will appear ranked in a list of results (EVANS, 2007).
To sum up, an online search engine is a program that allows internet users to search information on the web by following links and those links are determined by an algorithm 3 . Algorithms are programs that decide the pages that are going to be selected as part of the search engine's index because of their relevance and quality to finally be displayed as results.

Search Engines in Colombia: Legal Review
As part of the Colombian Data Protection Regulation, we find that the rights to intimacy, reputation and data protection are fundamental rights established in Art. 15 of the Colombian Constitution as well as in the Law no. 1266/2008 that regulates the collection, use and transfer of personal information regarding unfulfilled credit obligations and banking services.
Subsequently Colombia adopted the Law no. 1581/2012, which is the general personal data protection regulation and implements the constitutional right to access, to rectify and to update personal information contained in databases. The scope of implementation of this Law includes every personal data processing carried out in Colombia. This regulation clarified concepts regarding personal data and qualified the consent that must be given to data processors in order to collect personal data and carry out the data processing.
The following paragraphs will: address the case law about search engines in Colombia; offer a comment aiming to raise awareness regarding the incidence of the activities carried out by search engines in the life of data subjects and, contribute to increase personal data awareness especially from the user's perspective.
In the ruling No. T-277 from 2015, the plaintiff was referred to as Gloria in all the proceedings. Gloria was a travel agent and was identified as a member of human trafficking gang on an article titled "Empresa de Trata de Blancas", published by El Tiempo Newspaper 5 .
Gloria requested to El Tiempo newspaper the erasure of all the entries available on Google.com that mentioned her as the presumed author of punishable conducts related to human trafficking, arguing that those criminal proceedings had been fully resolved as was confirmed by a non-guilty sentence. The newspaper denied the request of deleting the article from Google.com and affirmed that the newspaper did not have any kind of control over the online search engine 6 .
Google Colombia Ltd. alleged that it should not be a part of the case since the company is not a branch of Google Inc. and stated that in case there was a conviction against Google Inc.; Google Colombia Ltd. would not be able to fulfill it since it does not have control over the shares of the parent company. The company also explained that its activities are related to the indexation of articles available on the Internet, in that light, in this case the only responsible for the content of the publication was the newspaper. The Court concluded that in order to protect the plaintiff´s fundamental rights, the newspaper had to limit the online access to the article titled "Empresa de Trata de Blancas" 7 by using tools such as "robots.txt" and "metatags". The Court also stated that even though this remedy limits the newspaper freedom of expression, granted by Article 16 of the Colombian Constitution, this measure was not as burdensome for newspaper as the obligation to erase content from the Internet 8 .
From this constitutional review, it is concluded that the Constitutional Court assess search engines in the following terms: (a) As mere intermediaries, they cannot be held responsible for the information listed in the results. (b) Based on the protection of the net neutrality principle, the court held that deleting information from the Internet is restricted and reserved to exceptional situations and therefore, in order to protect the plaintiff's fundamental rights, the Court opted for other remedies. (c) The remedies the Court opted for are the use of tools such as "robots.txt" and "metatags¨, which entail obligations only for the media outlets that created the infringing content.
The foregoing study, leads to the conclusion that according to the interpretation made by the Colombian Constitutional Court, search engines are mere intermediaries therefore, given the interference search engines have on data subjects, delisting policies or guidelines are required so that search engines can acknowledge and manage users' inquiries.
This absence of procedures make evident as will be addressed in the next part of the study, that search engines must be seen as data processors and data controllers in order to have obligations regarding users' rights to access, erasure and modification of their personal data.

Facts
Google Inc. is a multinational corporation that provides a wide variety of services and operates all over the world. The company was founded in 1998 and has its headquarters in the United States. One of its businesses is the service of Mr. WFC is the owner of "Muebles Caquetá" a furniture store. He filed a "tutela" against Google Inc. and Google Colombia Ltda, seeking the protection of his fundamental rights to privacy, reputation and honor, which he considered were violated as a result of an anonymous publication on an internet blog hosted in the blogger platform, owned by the company Google Inc. The blog post stated that the company and its owner were unlawful to their customers.
On January 30, 2014, a user of the online platform anonymously published a blog under the title "Do not buy at furniture Caquetá! Scammers!". According to the plaintiff´s libel claim, the blog contained the following statements about his company, which he considered to be false: "As it says in the image, Muebles Caquetá, which is run by the swindler WF, swindles people through several means. They request the full payment in advance and after you hand it over they disappear with your money.
[…] Please share this message to prevent more people from being scammed. If you were the victim of the scammer WF and his company Muebles Caquetá, report them in the links bellow and in the comments of this blog." This case started with several complaints filed by WF to Google's servers, as the proprietary company of Blogger.com. The complaint was based on Mr.WF allegations stating that the content of this blog wrongfully affected him, his family and his business financially and personally. In addition, Mr. WF pointed out the fact that the blog post was anonymous therefore it rendered pretty much impossible for him to identify the author or the source of the blog in order to request him the removal of the false allegations contained in the post at issue.
The claims made by Mr. WF were denied by Google Inc. because, according to Google's policies, the content was not inappropriate nor was unlawful and for these reasons, the company informed him that the only way Google would remove the blog from their service was through a judicial order demanding the removal.
As a result, Mr. WF filed a complaint before the Constitutional Court in order to protect his fundamental rights to privacy, reputation and honor, seeking the removal of the post at issue from internet.
The Constitutional Court notified Google Inc. and the Ministry of Information Technology and Communications (MINTiC) about the Tutela and included them as a party in the case. In its response, Google Inc. clarified that Google Inc. and Google Colombia Ltd. were two separate legal entities, with different seats and different businesses. On its side, Google Colombia Ltd. Furthermore, its legal representative stated that Google Colombia Ltd. was in charge exclusively for the sale, distribution, marketing and development of products and services of hardware related to Internet and advertising space generated on the website www.google.com. Therefore, in light of the above, the company affirmed that they did not have standing in such proceeding 10 using the same argument provided by the company in the Costeja Case held at the European Union in 2014 11 .
On August 2016, the Constitutional Court rejected Mr. WF´s claims because neither Google Inc. nor Google Colombia Ltd. were responsible for the infringement of Mr. WF´s fundamental rights to privacy, reputation and honor since said companies were not responsible of rectifying, correcting, eliminating or completing the information uploaded by the platform users. In summary, for the Constitutional Court, the companies were not directly liable for the information or the contents shared by the users of www.blogger.com 12 .
As part of the mechanism for reviewing the previous ruling, the Constitutional Court answered the following question: Does the company Google Inc. violate the plaintiff's fundamental rights to privacy, reputation and honor when it refuses to remove from the Internet an anonymous blog which storages content claiming a fraud carried out by the plaintiff, arguing that this claim does not violate its content policy?
The Court confirmed that when an internet user entered the words "Muebles Caquetá" on Google's search engine, the search results consisted of links to the blogger entry under the title "Do not buy at furniture Caquetá! Scammers!". The Court also emphasized that publishing information through Internet tools and online platforms such as blogs, can not only have a high impact, but also transcend the private sphere of the individual and put him in a defenseless position, even more if whoever created the defamatory, slanderous or degrading content did it anonymously 13 .
The Court noted that although Google Inc. is not responsible for the publication, the company does own "Blogger.com", the online platform where the defamatory content against the plaintiff and his company was published. Therefore, the Court commented on the power held by Google Inc. over Blogger.com, which includes the power of deleting blogs, when the company considers there is a violation of its content policy 14 .
The Court also concluded that the defamatory, disproportionate and slanderous statements made on the aforementioned blog, affected the applicant´s dignity and honor as a person and his fundamental rights to privacy, reputation and honor.
As to the territorial element of the case, the Court found that Google Colombia Ltd. was in fact a separate legal entity from Google Inc. However, as a subsidiary of Google Inc. located in the Colombian territory, it has to be considered an "establishment" of the parent company, according to the certificate of existence and legal representation of Google Colombia Ltda 15 .
Therefore, even the parent company had to comply with the Colombian regulations regarding consumer's rights 16 .

Core of the Decision
The Court ruled that: (a) Google Colombia Ltd. must carry out all the necessary activities to make sure that Google Inc. withdraws the content identified in the plaintiff´s claims. (b) Google Colombia Ltd. must send a report to the Constitutional Court within the month after the decision was served.
The Constitutional Court concluded that, as the owner of the online platform www.blogger.com, Google Inc. had to delete the online address within a month after the ruling notification, since the content of the blog entry anonymously attributes the plaintiff with the commission of fraud and other expressions that considered slander against him and his company.
Finally, the Court encouraged the MINTiC to create a national regulation aiming to protect internet users' rights from abusive, defamatory, dishonorable, slanderous and insulting publications. In the same vein, ordered that the Ministry should provide legal counselling to the victims of this type of abusive publications facing the online platforms where the slanderous contents were published.

Appeal before the Colombian Supreme Court
Google Inc., Google Colombia Ltd. and the MINTiC appealed the Constitutional Court decision described above. instructions given by the ruling ignored competence norms. According to the Ministry, this instruction was against framework laws and the Constitution since the Ministry does not have powers to issue regulation regarding internet consumer´s rights.
As to Google Inc. and Google Colombia Ltd. both companies requested the previous ruling to be declared null, arguing that there were several procedural defects that violated the principle of due process and stated that this ruling made a sudden change in the Court´s case law on the subject. As explained above every case law in Colombia considered search engines as mere intermediaries.
The companies also argued that the ruling contained inconsistencies between the arguments made by the Court and the decision as well as the unduly implementation of networks and telecommunications regulation to internet companies such as Google Inc. and Google Colombia Ltd.
As to the remedies granted to the plaintiff, the companies argued that the actions imposed by the Court were unjustified and disproportionate; the companies stated that said remedies showed that the Court arbitrarily avoided the analysis of matters with constitutional relevance.
On May 2018, the Supreme Court declared: a) The Court avoided the study of matters with constitutional relevance; b) declared the nullity of the judgement held by the Constitutional Court and c) ordered that given the importance of the matter such decision shall be replaced with a final sentence issued by the Full Court.

CONCLUSIONS AND RECOMMENDATIONS
To sum up, the new ruling that will replace the decision No. T-063A will clarify how Colombians are going to exercise their rights to access, modification and erasure of their personal data. Furthermore, the Court should establish guidelines regarding personal data and state who is in charge of the obligation to determine whether personal data considered irrelevant o no longer relevant. This will not be an easy task yet is mandatory for the current state of affairs.
It must be said that this task will represent a challenge even for traditional authorities in the field of communication, such as newspapers editors and data protection authorities 17 . Furthermore, when journalistic rules are not applicable since the purpose behind news publishing is the protection of historic events and this ruling is about all the personal data available on the internet.
One of the biggest challenges brought up by this case, is therefore to develop jurisprudence and new cases in order to achieve a more stable interpretation of what must be understood as irrelevant and no longer relevant information. As well as who has the obligation to erase or limit the access to said content, is it going to be the source of information or the search engine, moreover when there are cases in which the original source of the information is undetermined as in the Muebles Caquetá case.
Considering that, the Colombian Constitutional Court has seen search engines as mere intermediaries, meaning they do not have to rectify, correct, eliminate or complete the information listed in the results they provide. It must be noted that their relevance makes clear the existence of a right to request the erasure of links (POSNER, 2014) and the necessity of procedures provided by them to do it effectively without erasing or altering the content of the website.
This highly needed delisting process should not be arbitrary (ZITTRAIN, 2014), by consequence, the creation of conditions that allow data subjects to ask the erasure of links associated with their names is required. In the European Union the conditions to get those results delisted are: inadequacy, irrelevance, or excessiveness in relation to the processing purposes.
With the Muebles Caquetá Case, the Court must point out the importance of the activities carried out by online search engines, and force them to face the implications of being a "controller" of the processing of personal data that takes place within their services. If the Court acknowledges that search engines are not mere intermediaries, these very important servers will have to face responsibilities for providing a service that has several privacy implications, like processing of personal data and making personal data available to the public through a list of results.
For all the above reasons, it can be said that the current position of the Constitutional Court about the search engines role and their responsibilities has not protected the user's fundamental rights to privacy, reputation and honor. Therefore, a more committed study on behalf of the Court is required.
In that light, I suggest that the Court itself should draft clear delisting guidelines considering the opinions of a group of impartial experts, civil society representatives and the local Data Protection Authority 18 . These guidelines will give the basis for the decision to delist based on privacy law and regulations. Nevertheless, the decision to keep or erase a link should be made by the search engine 19 .
The decisions made by the search engines regarding the erasure requests must be "informed", meaning that search engines must inform sufficiently data subjects about the considerations behind the delisting request and explain why the criteria is applicable or not, having provided the above analysis, search engines must also craft an additional procedure to oppose a decision to delist considering the due process principle. Therefore, there must be an opposition procedure to the resolution made by the search engine on the erasure request, considering that data subjects must have the opportunity to be heard and to respond to a decision regarding their rights, in this case their right to erasure.
We must reaffirm that in order to strike a balance of all the interests involved, the development of this procedure is mandatory, even more if we realize that it would benefit all the parties involved, including the search engines because this is the easiest way to establish and implement lawful guidelines for an erasure procedure they should carry out.
Finally, it must be said that once the search engine carried out the opposition procedure, data subjects always have available constitutional and legal actions before the Courts and the local Data Protection Authority.