The UK’s Information Commissioner’s Office (‘ICO’) has published what appears to be its first public enforcement notice based upon “the right to be forgotten” against Google Inc. The “right to be forgotten” was introduced by the ECJ last year when it held that data subjects have a right to compel search engines to remove results linking to websites containing their personal information, if those results were outdated or irrelevant.
In the current case, Google originally agreed with the data subject’s initial right-to-be forgotten request, namely that its historic criminal conviction was no longer relevant, and removed the link. Unfortunately for the data subject, the removal drew more attention to the story causing new articles to be written, and Google refused to remove the subsequent links on the basis that they were relevant and in the public’s interest.
The ICO considered that the links to the subsequent websites were likely to cause the data subject distress and breach their right to privacy, and ordered Google to remove the links to websites. David Smith, Deputy Commissioner at the ICO, said that while the ICO understands that newspapers will want to write about links being removed, it is unnecessary for such links to be found by searching the data subject’s name. As such, Google has 35 days to remove the offending links or risk further enforcement action.
Organisations that receive such enforcement notices have the right to appeal to the First-tier Tribunal. Indeed, Google has appealed previous (and unrelated) ICO orders with varying success, so it should come as no surprise if it were to do so here. No comment has yet been made by the company, but with Google facing similar claims across Europe, this story may not yet be over.