The Information Commissioner’s Office ( “ICO”), the UK regulator for data protection, has published a brief response to the recent Court of Justice of the European Union decision in Case C-131/12 (Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González.
The response, entitled ‘Four things we’ve learned from the EU Google judgement’ confirms that:
- Search engines may have to remove some search results, although search engine providers will need to time to make arrangements for this and, importantly, the ICO will allow them a reasonable period before ruling on any complaints.
- The judgment demonstrates that the European Union’s (“EU”) data protection regime, while still in need of reform (which is ongoing and is due to come into effect in late 2016/early 2017), is still capable of being adapted and applied to modern data protection issues.
- This does not create an absolute right to be forgotten, and there may be competing interests or exceptions which allow requests for the removal of personal data from search engine results to be refused.
- The judgment only marks start of the matter, and it will have to be interpreted and applied by search engine providers and data protection authorities.
The ICO’s response to the judgment is brief, however the response also confirms that the ICO intends to discuss the implications of the judgment with the Article 29 Working Party (“A29WP”), the EU’s independent data advisory body which includes representatives from each Member State’s national data protection authority, so as to ‘ensure a consistent approach is taken across Europe’.
It is unlikely the ICO will provide any substantial guidance on the matter until the A29WP has reached some consensus on how the judgment should be interpreted and applied. Following the A29WP’s meeting next month we would, in due course, expect both the A29WP and the ICO to publish further comments or guidance on the case and its practical implications for users and providers of Internet search engines.