Following the Court of Justice of the European Union decision in the now notorious 'Google Spain' case, Google, and other search engine operators, have set up processes to deal with request by individuals to have URL links removed from search results against the individual’s name. Individuals are entitled to have URL links removed where, in summary, the link has an unwarranted and negative impact on an individual’s privacy – and this is judged by reference to information contained on the website which the link leads to.
One feature of the removal processes adopted by search engine providers is to notify the webmaster whose pages are being removed from the search results. The explanation given by Google for doing this is: “We do this in the interest of transparency. In order to respect the privacy of the individuals who have made the removal requests, we only send the affected URLs, not the requester’s name”. A consequence of these notifications is that the webmasters (often large media organisations) may then publish stories about the removal – and those stories can repeat the information that had led to the conclusion in the first place that the link should be taken down. If that happens, can the individual concerned get the URL links to those new stories removed? An Enforcement Notice just published by the Information Commissioner suggests that the answer to that question is “Yes”.
In the case considered by the Information Commissioner, Google had agreed to a request to remove a link to a website that contained a report about an individual’s minor conviction which had taken place about 10 years ago. Artic les about the removal of the link, and which included details of the original story about the conviction, were then published. The individual concerned asked Google to remove links to these stories, but Google refused. It argued that stories about its removal decisions were of significant public importance and that the information about the individual formed a relevant part of such stories. Google also relied on the journalistic judgements of the media organisations that had published the stories as being of significance in determining where the public interest lay. The individual complained to the Information Commissioner.
The Information Commissioner upheld that complaint and has issued an Enforcement Notice under section 40 of the Data Protection Act 1998 (DPA) requiring Google to remove the search results. In relation to Google’s reasons for not removing the links, what was said in the Notice was: “The Commissioner accepts that the search results in this case relate to journalistic content. Further, the Commissioner does not dispute that journalistic content relating to decisions to delist search results may be newsworthy and in the public interest. However, that interest can be adequately and properly met without a search made on the basis of the complainant’s name providing links to articles which reveal information about the complainant’s spent conviction”.
The Information Commissioner’s decision is not surprising – if he had decided in favour of Google, then in practice the benefits to individuals of getting search links removed would have been severely undermined. But what the decision does do is highlight, in stark terms, an unsatisfactory tension at the heart ofGoogle Spain - which is that at one and the same time it can be lawful (and not in breach of the DPA) for a media organisation to publish an individual’s personal data as part of a story but unlawful (and in breach of the DPA) for a search engine organisation to provide a link to that story, if that link is created as a result of a search against the individual’s name.