The Article 29 Working Party (“Working Party”) – the collection of EU Member States’ national data protection authorities (“DPAs”) – has issued its much awaited guidance on how DPAs should implement the Court of Justice of the European Union’s (“CJEU”) Google Spain judgment.
The CJEU’s judgment recognised a right of individuals to be ‘forgotten’ on search engines. EU citizens and residents were empowered, in certain circumstances, to request that links returned against their names by search engines be de-listed.
While the judgment has proven to be ground-breaking, search engines and citizens had been grappling to understand the exact extent of the right to be forgotten. The publication of the Working Party’s guidelines aims to set down the parameters of this newly enunciated right.
First Europe, then the World
Likely to be the most talked about aspect of the Working Party’s recommendations is its statement that search engines should not limit de-listing to EU domains only. Up to now, search engines had defended de-listing content from national search domains (e.g. google.ie as opposed to google.com) on the grounds that users tend to access search engines via these national portals.
The Working Party states that such a course of action, “cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects” as set out in the CJEU’s ruling. The Working Party wants any de-listing undertaken by a search engine on a national domain to happen on all “relevant” domains, including .com.
If implemented, the Working Party’s recommendations could well lead to results returned globally being modified on foot of EU data protection law. This is likely to set up a jurisdictional conflict, particularly between EU privacy law and US free speech rights.
Silence is golden
Another notable aspect of the Working Party’s recommendations is its instruction that search engines should stop contacting third party publishers to let them know that an individual has requested that content on such publishers’ sites be de-listed. The Working Party is categorical in its assertion that, “there is no legal basis for such routine communication under EU data protection law.” However, the Working Party’s guidance does not explain why such notifications are covered by EU data protection law, nor does it address the fact that its position essentially amounts to a restriction on a search engine’s right to communicate with website publishers, thus engaging free speech guarantees under EU law
Additionally, the Working Party advises search engines not to create tailored notifications for users advising them that search results have been modified following the submission of a de-listing request. In circumstances where search engines wish to give users some notification, a generic banner should be placed above or below search results. The Working Party states that the identity of the de-listing data subject should not be ascertainable from the information contained in this banner.
The recommendations go into greater practical detail on the criteria that search engines should use to decide whether a de-listing request is accepted or rejected. Some of these criteria include whether:
- the data subject plays a role in public life – politicians, senior public officials, business people and members of regulated professions can usually be considered to fulfil a role in public life. Citing the decision of the European Court of Human Rights in Hanover v Germany, the Working Party states that, “as a rule of thumb, if applicants are public figures and the information in question does not constitute genuinely private information, there will be a stronger argument against de-listing search results related to them”;
- the data is accurate – the newly created right to be forgotten protects individuals from inaccurate, inadequate and/or incomplete information. It offers individuals the right to have opinions of others de-listed from their search results. While some links may constitute a personal campaign against the data subject, the Working Party specifically states that, “this does not necessarily mean that DPAs will consider it necessary to have the relevant search result delisted”;
- the original content was published in the context of journalism – while this is a persuasive argument to refuse a de-listing request, this criterion alone is not enough to justify such a decision. The Working Party acknowledges that the CJEU’s ruling clearly distinguishes between the legal basis for publication by media and the legal basis for search engines to return results;
- the data subject is suffering prejudice on account of the search results complained of – there is no obligation for a data subject to demonstrate prejudice in order to request de-listing but where prejudice can be established, it is a strong factor the search engine should consider in favour of de-listing; or
- the data can be considered sensitive or sufficient to put the data subject at risk – if the complained-of links include information regarding the data subject’s religious, political beliefs etc. or put them at risk of identity theft or stalking, the Working Party directs DPAs to consider the de-listing of search results as appropriate.
A new dawn
Echoing the views of the CJEU, the Working Party states that, “the rights of the data subject prevail as a general rule, over the economic interest of the search engine…”. Data subjects’ rights also “generally prevail over the rights of internet users” who may wish to access personal information via a search against the data subject’s name online. The Google Spain decision is arguably the most important European internet law case of recent years. This initial guidance suggests that EU DPAs intend to robustly enforce this judgment.