On Wednesday 26 November 2014, the European data protection authorities assembled in the Article 29 Working Party (WP29) adopted guidelines on the implementation of the judgment of the Court of Justice of European Union (CJEU) of 13 May 2014 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (C-131/12), which granted the possibility to data subjects to request to search engines, under certain conditions, the de-listing of links appearing in the search results based on a person’s name .
These guidelines contain the common interpretation of the ruling as well as the common criteria to be used by the data protection authorities when addressing complaints.
The ruling recognises that search engine operators process personal data and qualify as data controllers within the meaning of Article 2 of Directive 95/46/EC .
Under the sentence, WP29 set out that a fair balance between fundamental rights and interests has to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public will be significantly greater if the data subject plays a role in public life.
WP29 pointed out that in practice, the impact of the de-listing on individuals’ rights to freedom of expression and access to information will prove to be very limited. Therefore, when assessing the relevant circumstances, European Data Protection Authorities (hereinafter: DPAs) will systematically take into account the interest of the public in having access to the information. If the interest of the public overrides the rights of the data subject, de-listing will not be appropriate.
The judgment states that the right only affects the results obtained from searches made on the basis of a person’s name and does not require deletion of the link from the indexes of the search engine altogether. Therefore, WP29 highlighted that the original information will still be accessible using other search terms, or by direct access to the publisher’s original source.
The ruling set out that individuals are not obliged to contact the original website in order to exercise their rights towards the search engines. WP29 pointed out that data protection law applies to the activity of a search engine acting as a controller. Therefore, data subjects shall be able to exercise their rights in accordance with the provisions of Directive 95/46/EC and, more specifically, of the national laws that implement it.
Under EU law, everyone has a right to data protection. In practice, for WP29, DPAs will focus on claims where there is a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident of an EU Member State.
In order to give full effect to the data subject’s rights as defined in the Court’s ruling, for WP29, de- listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. In that sense, limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient mean to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, for WP29, this means that in any case de-listing should also be effective on all relevant domains, including .com.
The practice of informing the users of search engines that the list of results to their queries is not complete as a consequence of the application of European data protection is based on no legal requirement under data protection rules. For WP29, such a practice would only be acceptable if the information is presented in such a way that users cannot, in any case, conclude that one particular individual has asked for de-listing of results concerning him or her.
Search engines should not as a general practice inform the webmasters of the pages affected by de-listing of the fact that some web pages cannot be acceded from the search engine in response to a specific name-based query. WP 29 pointed out that there is no legal basis for such routine communication under EU data protection law.
In some cases, search engines may want to contact the original editor in relation to particular request prior to any de-listing decision, in order to obtain additional information for the assessment of the circumstances surrounding that request.
Taking into account the important role that search engines play in the dissemination and accessibility of information posted on the Internet and the legitimate expectations that webmasters may have with regard to the indexing and presentation of information in response to users’ queries, the Article 29 Working Party strongly encouraged the search engines to provide the de-listing criteria they use, and to make more detailed statistics available.