Following the ruling of the Court of Justice of the European Union (CJEU) in the Google Gonzalez case on 13 May 2014 ‘right to be forgotten’, the EU’s Article 29 Data Protection Working Party published its guidelines on the implementation of the ruling.
Article 29, released in November 2014, relates “right to be forgotten” search results to Google.com, potentially widening the ruling from European sub-domains such as Google.co.uk. So far, Google, the search engine giant, has been implementing the ruling only in sub-domains.
However, Article 29 recommends that: ‘De-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented.’
The main concerns voiced in Article 29 relate to the Court’s decision to apply the ruling only to Google’s European sites – searches to google.co.uk can bring different results to those of google.com. According to article, ‘Limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient mean to satisfactorily guarantee the rights of data subjects according to the ruling.’
‘De-listing should also be effective on all relevant domains, including .com.’
In the guidance, the European regulators advise that European Data Protection Authorities (DPAs) should focus on ‘claims where there is a clear link between the data subject and the EU’, suggesting that the ‘data subject’ is a European citizen or member.
Article 29 also clarifies the importance of maintaining a balance between private rights and public interest:
‘A balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public will be significantly greater if the data subject plays a role in public life.’ Article 29, p.2
However, the guidance continues to make clear that when the public interest overrides the rights of the data subject, de-listing will be rejected.
In addition, individuals are not obliged to go directly to the original website to exercise their rights towards de-listing. Search engines are qualified as data controllers, so the requests for de-listing do not necessarily have to go via the original website. In some circumstances, search engines can go to the original editor in order to obtain additional information about the de-listing request. However, search engines are not obliged to inform the editor of the website about any de-listing in their pages.
In addition to the interpretation of the CJEU judgment, the new guidance also presents a list of common criteria that European data protection authorities will take account for the handling of complaints for de-listing. This list includes: the data accuracy; the data relevance; the importance of data in public life; the date of the original publication; the age of the individual, and the context in which the data was published.
Since launching the right to be forgotten ruling in May 2014, over 200,000 requests have been received for over 730,000 links according to Google. The company has removed more than 360,000 links – which amounts to over 60 per cent of the requested removals across Europe.
‘The Article 29 Working Party strongly encourages the search engines to provide the de-listing criteria they use, and to make more detailed statistics available’, according to the new guidance.
Hopefully, Article 29 guidelines will encourage individuals and their lawyers to think more carefully before sending out unfocused right to be forgotten requests for de-listing.
Please don’t hesitate to contact me for a confidential discussion, or if you need more details and guidance about The Article 29 Working Party.