On February 6, 2015, the Advisory Council to Google on the Right to be Forgotten published its final report summarizing its advice to Google regarding the implementation of the ECJ’s Costeja v. Google case.

Following the ECJ’s ruling in Costeja v. Google in May 2014, Google organized an advisory council of eight independent experts and two Google executives in order to draw up guidelines on how it should implement the so-called “right to be forgotten”. From September to November 2014, the Advisory Council held seven consultations in Europe.

Our Brussels colleague Patrick Van Eecke, Partner and Co-Chair of DLA Piper’s Global Data Protection, Privacy and Security practice, was invited by the Advisory Council to discuss issues at the intersection of the right to information and the right to privacy. Patrick was cited in the report as stating: “It’s not Google who should decide whether or not to remove a link from the search results. I think it should be an independent arbitration body consisting of a pool of a few hundred panelists,” referring to the current practice for domain name resolution.

In its report, the Advisory Council identified four primary criteria that should be used in evaluating delisting requests from data subjects: 

  • The data subject’s role in public life;
  • The nature of the information;
  • The source of the information; and
  • The time lapse.

Overall, these criteria recall those laid down by the Article 29 Working Party (“WP29?) in its guidelines of November 26, 2014 (see here and here for other blog posts on this topic), although the WP29 may disagree with some of them. For instance, the Advisory Council advised that “religious and philosophical discourse is strongly in the public interest, including opinions and discussions of other people’s religious and philosophical beliefs, and should rarely be delisted“, whereas the WP29 considers that deletion of “sensitive data” should bias toward an individual’s strong privacy interest. But notwithstanding a few differences in the approaches, the two sets of guidelines should be complementary and help search engines improve their de-listing procedures. 

However, the Google Advisory Council report confirms the clash on key procedural elements, including whether to notify webmasters of a delisting, and the geographic scope for delisting.

As regards the first issue, although the WP29 recognizes that in some complex cases, “search engines may want to contact the original editor (…) in order to obtain additional information“, it nevertheless rejects the idea that webmasters should be notified of a delisting, as there is no legal basis for such notice and it could impair individuals’ right to privacy. On the contrary, the Advisory Council advises that “as a good practice, the search engine should notify the publishers to the extent allowed by law“, as a way to take into consideration potential harm to online publishers’ freedom of expression and improve the decision making process by gathering additional information.

With respect to the second issue, whereas the WP29 considers that “in any case de-listing should also be effective on all relevant domains, including .com“, the Advisory Council concludes that “removal from nationally directed versions of Google’s search services is the appropriate means to implement the ruling“, arguing notably that adopting the position of the WP29 may contradict solutions espoused by courts in other parts of the world. Moreover, the Advisory Council mitigates the WP29's concerns by indicating that only 5% of internet users use search engines in a different language/country. It is interesting to note that only one expert, Sabine Leutheusser-Schnarrenberger, German MP, dissented on that issue, backing the WP29's approach.

Eventually, it will be for the courts to settle the debate, even though this might take a while as for the moment very few people are actually going to court. According to Peter Fleischer, Google’s Global Privacy Counsel, less than 1% of the individuals whose removal request is denied bring the matter to the local data protection authority’s attention, and even less seek judicial recourse. In France, Belgium and in Spain, national judges have already decided a few cases, but no general conclusion may be drawn on the territorial effect of a delisting decision (see here and here for other blog posts on this topic).