We use cookies to make your experience of our website better. Some of these are set by third party Google Analytics to help us analyse website traffic. To comply with privacy regulations, we require your consent to set these cookies. If you continue to use the site without selecting an option we will assume you are happy for us to use cookies.

Forget-Me-Now: Impact Of The Right To Be Forgotten

Forget-Me-Now: Impact Of The Right To Be Forgotten

In May 2014, the Court of Justice of the European Union (CJEU) delivered their ruling in a landmark case brought against Google, establishing the right to be forgotten.  Towards the end of 2014, much-awaited clarification as to what this decision means for search engines, data protection authorities and the public was issued, indicating the impact of the right to be forgotten will be felt going forward into 2015.

The Case

The significant rulings made by the CJEU in May were:

  • Google is a “data controller” able to significantly impact EU citizens’ rights to privacy and protection of personal data;
  • such individual rights override the public interest in having access to information, unless there are particular reasons (such as an individual’s role in public life) to justify public access to personal data; and
  • generally, search results should be removed if they are inadequate, irrelevant (or no longer relevant) or excessive in light of the time elapsed since initial publication.

Google’s Reaction

Despite being openly critical of the CJEU’s approach in this case, Google has implemented measures to show compliance with the ruling.

By the end of May 2014, Google had published an online form for making requests for search results to be removed and had appointed an internal team to handle requests.  Google now publishes statistics on requests in a transparency report, which is updated on a regular basis.  At the time of writing, these figures show that Google has received over 195,000 requests, resulting in the removal of over 700,000 URLs from Google’s search engine.

EU Reaction

In the wake of criticism, particularly from press organisations, that the judgement inhibits freedom of expression and rights to information, the European Commission has been quick to defend the CJEU.  They have clarified that the right to be forgotten relates only to the removal of links against a search for a particular individual’s name, and does not involve the permanent deletion of links which should still be available against other searches.  This means that, for example, an online news article may be removed from a search result of an individual’s name, but would still be available on the news agency’s own website or from a Google search of a different name or topic mentioned in the article.

Latest Developments

In November 2014, the Article 29 Working Party, which comprises all of the heads of the data protection authorities in each EU member state, published guidelines on handling complaints relating to the right to be forgotten and made the following key points about how search engines should effect removals:

  • if the decision is made that a link should be removed, then it should be removed from all of the search engines’ domains, not just national or EU domains (so links should be removed from search results on “google.com” as well as “google.co.uk”);
  • search engines do not have to inform publishers that their links have been de-listed, but may wish to contact the publisher as part of their decision-making process;
  • individuals have the right to make a request by any adequate means, which means they do not have to use a prescribed form provided by the search engine; and
  • if the search engine decides against granting a request, they should provide sufficient explanation for this to the requestor.  They should also inform the requestor that they can appeal to their local data protection authority or to court.

Going forward

For the time being, the right to be forgotten is only enforceable against search engines.  However, the proposed new EU Regulation on Data Protection, expected to be finalised in 2015 / 2016, seeks to extend the current right to erasure by effectively implementing a right to be forgotten enforceable against any data controller.

The UK Information Commissioner’s Office has indicated they have yet to receive many complaints about right to be forgotten requests, but that they are expecting the number of complaints to increase during 2015.

If you have any queries about the right to be forgotten or data protection compliance, please feel free to contact myself, Helena Brown or Ross McKenzie.

Joanne Snedden