We commented on the ‘right to be forgotten’ judgment in Google Spain SL, Google Inc. v Agencia Española de Protección de Datos in May earlier this year (see our commentary on that ruling here). The ruling granted data subjects the right to request search engines to remove links appearing in search results based on a person’s name, under certain conditions. Since the judgment, the Article 29 Working Party (“the Working Party”) has been working to establish a common framework for local data protection authorities to approach complaints surrounding the removal of search results. Our commentary on their progress, published in October, is available here.
Last week, the Working Party published its much-anticipated guidelines encompassing its interpretation of the CJEU ruling. The guidelines also incorporate criteria it expects local data protection authorities to adopt when considering complaints surrounding take down requests. Although the Working Party has no strict enforcement powers, the guidelines will undoubtedly carry substantial weight.
Notably, the Working Party has specified that de-listing decisions must be implemented in such a manner which guarantees the protection of the rights of data subjects. The Working Party commented that “limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling”. Practically speaking, this means de-listing from .com domains as well as EU domains.
The guidelines themselves are available here, and contain a list of 13 criteria, described as a “flexible working tool” by the Working Party, which the data protection authorities will apply on a case by case basis to handle complaints following the refusal to de-list by search engines. Amongst others, the criteria include whether the data is accurate and puts the data subject at risk of prejudice or has a disproportionately negative impact on the privacy of the data subject. However, the guidelines stress that “no single criterion is, in itself, determinative”.
The guidelines give rise to a number of issues, leading us to ask, has the application of the CJEU judgment gone too far, or is a global approach the only means of effectively safeguarding data subjects’ rights? Further, how will the search engines and local regulators receive and enforce the guidelines? The responses to such questions will no doubt await us in 2015.