Google – Right to be Forgotten

Search engines obliged to remove links to inadequate, irrelevant, no longer relevant, out of date, inaccurate and / or excessive personal data

The Google Spain decision has confirmed that search engine providers must take down or erase information and links if a data subject complains that the personal data therein is inadequate, irrelevant, no longer relevant, out of date, inaccurate and / or excessive. This applies irrespective of whether the personal data was lawfully posted on a third party website and / or the data subject has been prejudiced by the information or link. The only exemptions to this in the UK are the pre-existing exemptions under the Data Protection Act 1998 (“DPA”) and if there is an overriding public interest in the personal data remaining in the public domain. The Information Commissioner’s Office (“ICO”) has suggested that such overriding interest depends “on the nature of the information in question and its sensitivity for the individual’s private life. It will also depend on the interest in communicating the information to the public, an interest which may vary, according to the role played by the data subject in public life”.

The Google Spain decision is seen as a landmark case as it confirms that:

• search engines are not a neutral intermediary – they are data controllers subject to data protection laws; and
• non-EU operators with a small branch or subsidiary in the EU are covered by EU data protection legislation. This may be the main effect of the Google Spain case. Google unsuccessfully argued that as the physical server processing data was located outside Europe, EU data protection rules did not apply to the search engine.

Google have published an online form for disgruntled data subjects to complete if they want links removed. This includes the data subject explaining how the URL “in search results is irrelevant, outdated or other inappropriate”. Google suggest there is a public interest in “information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials” remaining in the public domain.

The ICO has made clear that:

• search engine providers will have a “reasonable time to put their systems in place and start considering requests”;
• if the search engine provider refuses to remove a link, the data subject should contact the ICO to determine if the search engine provider is lawfully maintaining the link;
• it will initially focus on “concerns linked to clear evidence of damage and distress to individuals”. This is significantly narrower than the European Court of Justice (“ECJ”) judgement. The ECJ specifically ruled “that it is not necessary….that the inclusion of the information in question in the list of results causes prejudice to the data subject”; and
• the original newspaper articles will remain in the public domain. It is simply the Google and other search engine links to the articles that are to be erased. This has prompted the ICO to advise that “A ‘right to be forgotten’ will still be difficult in practice….we have to be realistic about how difficult it can be to completely remove all traces of personal information online”.

Nathaniel Lane is a Solicitor in Michelmores’ Technology, Media and Communications Team who has an ISEB Certificate in Data Protection. For further information on this matter or data protection generally, please contact Nathaniel at nathaniel.lane@michelmores.com or on 0207 788 6313.