In an age where “you are what Google says you are,” search engines play a crucial role in facilitating access to information in today’s society. This is why the decision from the Court of Justice of the European Union (CJEU) dated 13 May is of particular importance.
The CJEU Decision ruled that EU citizens have a "right to be forgotten" online and may require search engines to remove search results linking to content published on third-party sites. The Article 29 Data Protection Working Party has now published guidelines on how the EU data protection authorities intend to implement the "right to be forgotten" pursuant to the CJEU decision.
The guidelines clarified several points addressed by the CJEU decision.
The Working Party reaaffirmed that:
- “Data subjects have the right to request and, if the conditions laid down by Articles 12 and 14 of Directive 95/46/EC are met, to obtain the de-listing of links to web pages published by third parties containing information relating to them from the list of results displayed following a search made on the basis of a person’s name.”
- Although the CJEU decision specifically addressed the issue of search engines, the Working Party stressed that the ruling may also be applicable to other similar situations involving a data controller and that individuals may seek to exercise the same rights whenever the conditions established in the CJEU decision are met.
- Any impact on freedom of expression and access to information should be “very limited” because a balancing exercise would need to be performed between the opposing rights and interests, in particular, on the one hand, the interests of the data subject along with his or her right to privacy, and on the other hand, the commercial interests of Google and more importantly the public’s interest in accessing information:
A balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public will be significantly greater if the data subject plays a role in public life. […] The impact of the exercise of individuals’ rights on the freedom of expression of original publishers and users will generally be very limited. Search engines must take the interest of the public into account in having access to the information in their assessment of the circumstances surrounding each request. Results should not be de-listed if the interest of the public in having access to that information prevails. But even when a particular search result is de-listed, the content on the source website is still available and the information may still be accessible through a search engine using other search terms.
- Individuals seeking the de-listing of information are not obliged to contact the original website in order to exercise their rights towards the search engines.
- Likewise, search engines should not inform the webmasters of the pages being de-listed from the search results. However, the Working Party strongly encourages search engines to provide the de-listing criteria they use and to make more detailed statistics available.
- The individual’s right only affects the results obtained from searches made on the basis of his or her name, but the original information may still be accessible on the search engine using other search terms or otherwise by simply accessing the original website.
- In relation to the entitlement to request the de-listing of information, the guidelines appear to narrow down the application of the CJEU decision, which held the general principle that, under EU law, everyone has a right to data protection. The guidelines state that the EU data protection authorities will instead focus on claims where there is a clear link between the data subject and the EU, for instance, where the data subject is a citizen or resident in the EU.
- On the territorial effect of de-listing decisions, the guidelines noted that in order to give full effect to the individual’s rights in accordance with the CJEU decision, “limiting the de-listing to EU domains … cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant .com domains."
- The Working Party stated that there is no legal requirement under data protection rules to inform users of search engines that the list of results to their search queries is not complete due to the application of EU data protection rules. The guidelines go even further by stating that such practice would only be acceptable if the information is presented in such a way that users cannot, in any case, conclude that an individual has asked for de-listing of results. In other words, such notices should be avoided or otherwise be very general in order to avoid users being able to infer a particular person has made a de-listing request. The purpose is to avoid a "Streisand effect" and unintentionally draw attention on the information.
- The guidelines also establish a list of 13 main criteria that EU data protection authorities will use during their decision-making process to evaluate whether data protection law has been complied with, bearing in mind that no single criterion is determinative. Criteria will be applied on a case-by-case basis, in particular in the light of “the interest of the general public in having access to (the) information." The criteria are the following:
- Does the search result relate to an individual and does the search result come up against a search on the data subject’s name?
- Does the data subject play a role in public life? Is the data subject a public figure?
- Is the data subject a minor?
- Is the data accurate?
- Is the data relevant and not excessive? (i) Does the data relate to the working life of the data subject? (ii) Does the search result link to information which allegedly constitutes hate speech/slander/libel or similar offences in the area of expression against the complainant? (iii) Is it clear that the data reflect an individual’s personal opinion or does it appear to be verified fact?
- Is the information sensitive, within the meaning of Article 8 of the Directive 95/46/EC?
- Is the data up to date? Is the data being made available for longer than is necessary for the purpose of the processing?
- Is the data processing causing prejudice to the data subject? Does the data have a disproportionately negative privacy impact on the data subject?
- Does the search result link to information that puts the data subject at risk?
- In what context was the information published? (i) Was the content voluntarily made public by the data subject? (ii) Was the content intended to be made public? Could the data subject have reasonably known that the content would be made public?
- Was the original content published in the context of journalistic purposes?
- Does the publisher of the data have a legal power—or a legal obligation—to make the personal data publicly available?
- Does the data relate to a criminal offence?