The right to be forgotten owes its origin to a judgment delivered by the Court of Justice of the European Union (CJEU) in May this year against Google Spain after a Spaniard searched for references to himself on Google’s search engine and found a link reporting that his house was being auctioned for failing to pay an old debt.
The landmark ruling sets a milestone for EU data protection in the online world. It granted data subjects the right to request search engines to remove links appearing in search results based on a person’s name, under certain conditions. That ruling, however, left in doubt the extent of the search engines’ obligations as data controllers and uncertainties on the criteria to be used in determining what links must be delisted.
Owing to the significance of this ruling and the discord in its implementation, Article 29 Data Protection Working Party has been working hard to formulate guidelines to achieve a uniform interpretation of the right to be forgotten by local data protection authorities.
The guidelines provide a summary of the more important aspects of the CJEU ruling and its implementation. The Working Party reaffirms the existence of the right to ask to be deleted by search engines, moving away from the “right to be forgotten” referred to in the court’s judgment, although the latter term has now gained a degree of popularity. The guidelines do not address the issue of search engines alone but have a wider application to cover other similar situations involving a data controller.
The guidelines encapsulate European efforts to force search engines to apply the ruling to search results outside Europe. Indeed, on the territorial effect of delisting, the Working Party confirms the view that any removal of links must be done across all domains owned by the search engine in order to give full effect to the individual’s rights.
Limiting the delisting to EU domains – like google.com.mt in Malta or google.co.uk in the UK as opposed to google.com – has the effect of weakening data protection rights as it allows individuals to access such information by using a non-European search domain from within the EU.
The Working Party places particular emphasis on the need to balance individuals’ privacy and the public’s ability to access information. Data protection must be balanced with other fundamental rights, such as freedom of expression and the need to ensure public security. When other interests come into play, such as the economic interest of the search engine, the rights of the data subject prevail as a general rule.
If a search engine refuses to accept a delisting request from a data subject, the guidelines provide the framework for handling of complaints referred to local data protection authorities. The relevant search engine must provide its reasons for refusing to delist. Such a refusal will then be assessed against a list of non-exhaustive criteria that the guidelines lay down to determine whether such a refusal was in line with data protection laws.
One important criterion to be used is to assess whether the information relates to a public figure or a person who plays a role in public life, or a private person. The Working Party explains that public figures are individuals who have a degree of media exposure due to their functions or commitments, such as politicians, senior public officials, business-people and members of the regulated professions.
Another criterion is the nature of the information. Independently of whether a person is public or private, the guidelines protect information about public figures that is genuinely private, such as information about their health or family members. The accuracy of data is also relevant. Search results that contain factual inform-ation that is inaccurate or outdated are generally to be delisted. Sensitive data, concerning a person’s sexuality or religious beliefs, are more likely to be the subject of delisting.
When the data relate to a criminal offence, the Working Party makes the determination dependent on the severity of the offence and lapse of time. Delisting from search engines is more likely to be considered in relation to minor offences that happened a long time ago than in relation to more serious offences that happened recently.
The concept of the best interests of the child is high on the Working Party’s agenda. As a general rule, if a data subject is legally under age at the time of the publication of the information, delisting requests are more favourably met.
The 13 criteria laid down in the guidelines constitute a working tool to help data protection authorities during their decision-making processes. Although not binding, the guidelines set a standard that local data protection authorities will follow when deciding on complaints brought by citizens against recalcitrant search engines.
jgrech@demarcoassociates.com
Josette Grech is adviser on EU law at Guido de Marco & Associates.