The Article 29 Working Party (encompassing the various EU data protection authorities) has published its long-awaited guidance on how the controversial “right to be forgotten” ruling of the Court of Justice of the European Union (CJEU) will be implemented.
In May this year, the CJEU ruled that Google and other search engines were “data controllers”, and therefore had to comply with European data protection laws. In particular, it ruled that in certain circumstances individuals can require search engines to “de-list” the results of a search in an individual’s name.
This hugely significant ruling has generated much press attention and Google has reportedly been inundated with de-listing requests, with 145,000 individuals making requests between May and October.
In interpreting the CJEU’s decision, this latest guidance makes it clear that:
- Search engines may not limit compliance with de-listing requests to their EU domain names (e.g. google.co.uk). The removal of links must also cover .com domains. Google has so far only been removing links from its EU websites;
- Search engines may only inform users that certain search results have been deleted from search results where doing so would not lead the users to realise that a particular individual had made a de-listing request. To date, Google has been placing a brief explanation at the bottom of the page where results have been de-listed;
- Whilst everyone has a right to protection, data protection authorities will focus on claims where there is a clear link between the individual making a request and the EU (e.g. where they are an EU citizen); and
- Ultimately, the decision as to whether or not to de-list search results will be made as a result of a balancing exercise between an individual’s right to privacy and the right of the public to have access to the information in question. Where the information relates to a public figure, the balance is likely to weigh more heavily in favour of the public’s right of access. There is no absolute “right to be forgotten”.
In addition to interpreting the CJEU’s judgment, the guidance also sets out some of the factors and common criteria that data protection authorities will take account of when determining whether or not to have search results de-listed. This includes: the accuracy of the information, the date of the original publication, the age of the individual, and a consideration of what amounts to a “public figure”.
This guidance will be scrutinised closely by both the search engines who will attempt to implement it in the first instance, and by individuals seeking to remove search results related to them. Further more detailed responses to the judgment are likely to follow in time from each country’s own data protection authorities, but in the meantime this serves as a useful initial guide to the implementation of the judgment.