As we previously reported, the Court of Justice of the European Union held in May that two provisions of Directive 95/46 encompass a “right to be forgotten” requiring search engine operators to remove web pages published by third parties from the search results for a person’s name upon that person’s request even if the information was lawfully published on the indexed webpage. On November 26, the European Union’s Article 29 Data Protection Working Party (“WP29”) released guidelines on the implementation of that right to be forgotten.
In the guidelines (and accompanying press release), the WP29 reiterates the Court of Justice’s finding that search engines need only delete links from search results based on a person’s name. Search results based on other search terms are unaffected by the right to be forgotten.
Because users do not necessarily use the national domain of their search engine (e.g., google.es for Spain), the WP29 maintains that search engines must remove contested links from “all relevant domains, including .com.” But while the WP29 states that “everyone has a right to data protection,” data protection authorities will only focus on enforcing this right “where there is a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident of an EU Member State.”