ICO gives guidance on factors it will consider on receipt of a request to delist search results.
What's the issue?
Last year's controversial CJEU judgment in the Google Spain case determined that search engines are data controllers in respect of their search results; that European data protection law applies to their processing of the data of EU citizens, even where they process the relevant data outside the EU; and that a 'right to be forgotten' online applies to outdated and irrelevant data in search results unless there is a public interest in the data remaining available and even where the search results link to lawfully published content.
Search engines have had to respond quickly and develop their own guidelines to help them make decisions on whether or not to accede to take down requests. If the search engine and applicant disagree, the applicant can complain to the Information Commissioner's Office (ICO) or other relevant data protection authority (DPA) who will then have to make a decision.
What's the development?
The ICO has published a list of criteria to be used by it in deciding whether a particular search result should be delisted. It has said it will consider complaints on a case-by-case basis based on the following criteria which have been developed jointly by the ICO and other European DPAs:
- Does the search result relate to a natural person i.e. an individual and does it come up against a search against the individual's name?
- Does the individual play a role in public life?
- Is the subject of the search result a child?
- Is the data accurate?
- Does the data relate to the individual's working life?
- Does the search result link to information which apparently constitutes hate speech, slander, libel or similarly offensive content targeted at the complainant?
- Is the information sensitive for the purposes of the DPA?
- Is the data up to date? Is it being made available for longer than necessary?
- Is the data processing causing prejudice to the individual and/or having a disproportionately negative impact on the individual's privacy?
- Does the search result link to information that puts the individual at risk?
- On what basis was the information published originally?
- Was the original content published in a journalistic context?
- Does the publisher of the data have a legal power or obligation to make the personal data publicly available?
- Does the data relate to a criminal offence?
The ICO finishes with a reminder that delisting a link will not mean that the published content will become inaccessible.
What does this mean for you?
While the ICO list does not necessarily make the jobs of search engines any easier, it does provide a firm and expanded indication of what needs to be considered on receipt of a take down request and of what regulators will be looking at if they become involved in appeals. These criteria should also be carefully considered by those seeking to get links delisted prior to making a formal request.