To view any of the ICO Enforcement Notices discussed below, please click here.

Google Inc - On 18 August 2015 the ICO issued Google Inc (Google) with an enforcement notice concerning breaches of the first and third data protection principles of the DPA.

The ICO ordered Google to remove from the list of results, links to websites, following a search made on the complainant's name. This is the first formal action by the ICO taken against Google as a result of the ECJ decision inGoogle Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González.

Although Google had removed some links, it had refused to remove a link to an article about Google's decision whether to delist the search results or not.  Google argued that this search link was still relevant and in the public interest. As it formed part of a recent news story, it was a matter of public importance.

The ICO concluded that Google had contravened the first and third data protection principles on the basis that:

  1. the article was not in the public interest or where making the information available would protect the public from improper or unprofessional conduct;
  2. the personal data is sensitive personal data as it consists of information relating to the commission of an offence, the proceedings for that offence and the sentence of the court in those proceedings; and

the conviction was not current - it related to a conviction almost 10 years old.

What action could be taken to manage risks that may arise from this development?

None - for interest.