Guidelines on data removal following Google Spain

Hugh Grant’s bumbling character in Notting Hill once insisted that bad news was only relevant for a day. But unlike newsprint, online news can last forever. In the age of round-the-clock internet activity, individuals now find that personal data are stored indefinitely and can be regenerated simply with a name search at the touch of a button.

It was against this background that the Google Spain case was decided.¹ The Court of Justice of the European Union ruled that Google is a “data controller” and “processes” personal data for the purposes of the Data Protection Directive (95/46/EC). So operators of search engines should not retain personal data for longer than necessary for the processing purposes, and this in effect gives data subjects a so-called “right to be forgotten”.

In light of the importance of the ruling, the Article 29 Data Protection Working Party has issued Guidelines on its impact and application in practice.² The Guidelines first set out how data protection authorities will interpret and implement the ruling.  They then list common criteria for the authorities’ handling of data subject complaints following refusals by search-engine operators to de-list personal data from search results.

Background

In Google Spain, the CJEU held that a search engine operator has a duty to act within the boundaries of data protection legislation in any relevant jurisdiction of a Member State. This means that a data subject can ask Google to remove search results revealing personal data that are “inadequate, irrelevant, no longer necessary or excessive in relation to the purposes for which it was processed”.  Further, the CJEU found that a search engine operator has no defence in claiming that it would be financially harmful to its business to remove the links, given that “in the light of the potential seriousness of [the] interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing”.

Guidelines

The Guidelines are divided into:

• Part I: Interpretation of the CJEU judgment; and
• Part II: List of common criteria for handling of complaints by European data protection authorities.

Part I – Interpretation of the CJEU judgment

In Part I, the Working Party explains that, in the CJEU’s judgment, search engine operators’ processing of data subjects’ personal data will have a significant effect on the “fundamental rights to privacy and to the protection of personal data”: the publication of links enables an internet user to have unlimited access to reports and information which, when collated, could give the user the opportunity to have a much broader knowledge of the person than would ordinarily be available, but for the existence of the historic links.

So, the Working Party explains, data subjects have the right to request the removal of these links given the “universal diffusion and accessibility of that information” provided by search engines, which could have a “disproportionate impact on privacy”. The judgment made clear that the rights of the data subject prevail over the economic interest of the search engine and over the rights of the internet users under Article 11 of the European Charter of Fundamental Rights. The Working Party recognises, however, the need for a balance between the various and conflicting rights, and stresses that the treatment of an individual’s data may depend on the nature and sensitivity of the data processed and on the level of public interest in having access to it.

When interpreting the judgment, the Working Party draws on the important distinction in the access to the right to be forgotten for private and public individuals. It appears that data subjects who are in the public spotlight may be less entitled to benefit from the de-linking entitlement granted to others as a result of Google Spain. The Working Party advises that “results should not be de-listed if the interest of the public in having access to that information prevails”, but emphasises that even if a link is de-listed from the search engine, the content remains in place on the original website and it can be searchable using keywords other than the data subject’s name.

The Working Party takes a hard line on the practice of notifying web-users that not all results are shown as a result of a de-linking request and states that in order to implement the judgment properly, it can only be acceptable to display such a notice if the identity of the data subject requesting the de-listing remains unclear. The Working Party suggests that, with this in mind, it is advisable that the search engine simply carries a general statement permanently inserted on all of the search engine’s webpages. The Working Party adds that there is no ground in Article 7 of the Directive to communicate with or to inform the websites hosting the original content that their webpage cannot be accessed via a search of the data subject’s name, commenting that “such a communication has no legal basis under EU data protection law”.

Finally, and importantly, the Working Party explains that the de-linking process cannot be territorially restricted, as that would be seen to circumvent EU law and “would not satisfactorily guarantee the rights of data subjects according to the judgment”. Accordingly, any efforts by Google to exempt Google.com from the procedure cannot be sanctioned.

Part II – Common criteria for handling of complaints

The Working Party explains that where a search engine operator refuses a data subject’s de-listing request, that individual may bring the matter before the relevant data protection authorities (DPAs) so that they can carry out the necessary checks and take a decision in accordance with their power under the relevant national law.

The Working Party notes that the European DPAs have established a list of 13 “flexible” and non-determinative common criteria, namely:

1. whether the search result relates to an individual, and whether the search result appears as a result of a name search;
2. whether the data subject plays a role in public life or is a public figure;
3. whether the data subject is a minor;
4. the accuracy of the data;
5. whether the data are relevant and not excessive;
6. the sensitivity of the data;
7. whether the data are up to date or being made available for longer than necessary for the purpose of processing;
8. any disproportionate impact on the subject;
9. whether the links put the subject at risk;
10. the original context of publication;
11. whether the original content was published for journalistic purposes;
12. whether the data publisher has legal power or obligation  to make the data publicly available; and
13. whether the data relate to a criminal offence.

These are to be used on a case-by-case basis by each DPA to evaluate whether the operator has complied with national data protection law in refusing to de-list links, and some of those criteria are considered further below.

Whether the data subject plays a role in public life or is a public figure

The CJEU considered that those playing a role in public life may not benefit from the right to be de‑listed from a search engine’s results. Accordingly, the Working Party gives some guidance on what is meant by “a role in public life”. While noting that it is “not possible” to give a certain definition of such a role, the Working Party gives examples such as “politicians, senior public officials, business-people and members of the (regulated) professions”. The Working Party suggests that the yardstick against which to measure this requirement is whether the public would be protected against “improper public or professional conduct” as result of having access to this information.

The Working Party has equal difficulty in defining “public figures”. The Working Party explains that this relates to “individuals who, due to their functions/commitments, have a degree of media exposure”. Drawing on the European Court of Human Rights’ decision in Von Hannover v Germany (No. 2),³ the Working Party recognises that although some information is “genuinely private”, “if applicants are public figures and the information in question does not constitute genuinely private information there will be a stronger argument against de-listing search results relating to them”.

Accuracy of the data

The Working Party suggests that de-linking complaints will be dealt with differently where a search result provides links to an opinion about the data subject, as opposed to one that appears to contain factual information. The Working Party explains that a DPA is more likely to de-list a search result where an “inaccurate, inadequate or misleading impression of an individual” is given as a result of an inaccuracy as to a purportedly verified matter of fact, rather than as a matter of opinion.

Whether the data are relevant and not excessive

The Working Party measures the relevance of data against the interest of the general public in having access to the information. Further, depending on the facts of the life, older data might be considered to be less relevant than more recent data. The Working Party then sets out three factors to help establish the relevance of the data:

1. whether the data relate to the working life of the data subject (a focus on the professional life of the subject rather than the private life being more acceptable);
2. whether the search result links to information that allegedly constitutes hate speech/slander/libel or similar offences in the area of expression against the data subject (in which case the DPA will refer the data subject to the police and/or to court); and
3. whether the data reflect an individual’s personal opinion rather than verified fact (DPAs being more likely to consider de-listing for inaccurate claims of verified fact).

Whether the data are up to date

The DPAs will aim to de-list data that are “not reasonably current” and that are now out-of-date.

The original context of publication

The Working Party makes clear that if a data subject withdraws consent to the publication, the processing activity must cease. Further, if the data subject consented to the original publication but then cannot revoke consent and a de-listing request is refused by a search engine operator, the DPAs will generally consider that de-listing is appropriate.

Comment

The Guidelines note the separate responsibility of the search engine operator in compiling links to the original content publishers. This places a greater onus on an operator to recognise that, in making the data so readily and easily available, the impact on individuals is heightened, and it is not enough that the original publisher considered the implications of publication when first publishing the information.

The Working Party has commented that “in practice, the impact of the de-listing on individuals’ rights to freedom of expression and access to information will prove to be very limited”. This remains to be seen, but it is reasonable that an individual should have the opportunity to have personal data de-listed from appearing in search results under the individual’s name when the data become inadequate, irrelevant, no longer necessary or excessive. Undoubtedly search engines enable easy access to vast amounts of information, which is, more often than not, a good thing. But it can also have negative implications for an individual.  There is arguably no such thing as an online archive: information remains as accessible via search engines on day 1,000 as it was on day 1, and the CJEU and the Working Party have attempted to redress the balance.

Gideon Benaim, Partner, Michael Simkins LLP

Jessica Welch, Trainee Solicitor, Michael Simkins LLP