Bursting the Bubble

New EU Guidelines on the Right to be Forgotten

11 December 2014 | by

The Article 29 Working Party published new Guidelines on the Right to be Forgotten on 26 November 2014.  Earlier this year the Court of Justice of the EU (CJEU) ruled in the ‘Google case’. In this instance, the CJEU decided that EU data protection law already gives individuals the right to have relevant or outdated information about them de-listed from search results.

Here are the key points of the Guidelines:

Public interest balance

Data Protection Authorities (DPAs) will consider the role played by the data subject in public life.  They are less likely to be able to rely on the right to be forgotten as the Guidelines note that “The interest of the public will be significantly greater if the data subject plays a role in public life” and that “If the interest of the public overrides the rights of the data subject, de-listing will not be appropriate”. People in public life could include politicians, senior public officials, business people and members of regulated professions. Wikipedia founder Jimmy Wales has expressed his criticism on the ruling, calling it ‘censorship of knowledge’.

Territorial effect of a de-listing decision

The extra-territorial scope, which sets out that any removal of links, must apply to all web domains that European citizens can access, not just the regional ones like .fr or .co.uk. Up to now, Google has been implementing the ruling only on sub-domains, arguing that .com is not much used in Europe and therefore it is not relevant to the ruling. EU regulators argue that this can weaken the data protection right of citizens as shown in a recent decision of a French court. In this case, the court fined Google France €1,000 per day when it restricted the effect of a takedown request of a French lawyer to the google.fr domain.

Search engines cannot tell web users that content has been de-listed. E.g.:

The guidelines note that this practice “is based on no legal requirement under data protection rules”, and that it “would only be acceptable if the information is presented in such a way that users cannot, in any case, conclude that one particular individual has asked for the removal of results concerning him or her”. So, Google must either not post these notices at all, or post them universally under all name searches in order to avoid citizens being able to conclude a particular individual has made a de-listing request.

Additionally, search engines ‘should not as a general practice’ inform webmasters when pages have been de-listed, as has been Google’s practice until now. However, the search engines are allowed to contact the webmasters prior to making a decision “in particularly difficult cases, when it is necessary to get a fuller understanding about the circumstances of the case”.

13 criteria

If a search engine rejects a de-listing request from a web user, it must give an explanation for its decision. Data subjects have the right to ask their local DPA to judge whether that decision was in line with data protection law. The guidelines contain a list of 13 common criteria which the DPA’s will apply to handle the complaints filed and to help them to make more consistent decisions.

Lastly, the Guidelines note that the decision whether search results will be de-listed will be “a routine assessment” deciding whether the search engine’s processing of personal data complies with data protection principles. It goes without saying that it is going to be a bit more complicated than that!

What do you think?