Who: CJEU, Information Commissioner’s Office (ICO), the Article 29 Data Protection Working Party (Working Party) and Justice Minister Simon Hughes
When: May – June 2014
Where: Europe
Law stated as at: 3 July 2014
What happened:
The so-called “right to be forgotten” first broke cover in proposals to reform EU data protection law published by the European Commission in early 2012 and now, thirty months on, still being negotiated.
But, as the CJEU ruled in May 2014 in the case of Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (C-131-12), such a right is already available under existing EU data protection laws.
Individuals have a right, the CJEU said, to petition search engines to remove from their search results links to content which was legitimately published but which has since become “inadequate, irrelevant or no longer relevant” (the so-called “right to be forgotten”). The disputed case which led to the ruling concerned a Spanish national seeking to remove links to debt-recovery proceedings against him dating from 1998.
The full impact of the ruling has started to be felt in recent weeks as Google begins complying with some of the estimated 50,000 deletion requests (and counting) it has received. The decision’s continued waves have prompted both the ICO and the Working Party to issue statements in respect of it, with UK Coalition Government Justice Minister Simon Hughes making his government’s position very clear at a recent Parliamentary committee hearing.
ICO Comment
The ICO has endorsed the CJEU’s finding that search engines are data controllers and accepted ICO’s enforcement role in the event that a search engine fails to adequately respond to a deletion request.
However the ICO is taking a pragmatic approach and allowing search engines time to put processes in place to consider requests.
Thereafter it will focus on those cases which are “linked to clear evidence of damage and distress to individuals”.
The ICO has cautioned that the implications of the case should be kept in proportion, and that it does not equate to an absolute right for links to be removed. Companies operating and advertising online are also reminded that s32 Data Protection Act 1998 provides an exemption for the publication of journalistic, literary or artistic material in certain circumstances.
Working Party Comment
The Working Party (which brings together representatives from national data protection authorities, the European Data Protection Supervisor and the European Commission) has welcomed the CJEU’s decision as a crucial “milestone for EU data protection […] in the online world”.
At its June plenary the Working Party committed to identifying guidelines in order to establish a common approach for EU data protection authorities on implementing the ruling. In the meantime it has encouraged all search engines to voluntarily put in place user-friendly tools to enable individuals to exercise their right to request deletion and has welcomed Google’s development of a form which enables individuals to do so.
Justice Minister Simon Hughes takes a different position
In contrast, in his evidence to a House of Lords Committee looking at up and coming EU data protection reforms, Coalition Government Justice Minister Simon Hughes was dismissive of the CJEU decision and of the right to be forgotten generally.
He felt it was technically unenforceable and would lead to thousands of misconceived complaints. He complimented Google on their “co-operative” approach in the aftermath of the CJEU decision but felt it was “difficult and uncomfortable” for them.
The UK Government did not want the law to develop in the way implied by the CJEU judgment, he said, and did not agree with the equivalent wording in the current draft General Data Protection Regulation.
Why this matters:
Although the current “right to be forgotten” focus is on Google and the obligations of search engines, despite Minister Hughes’ trenchant criticisms, advertisers and companies operating in the online environment would be well-advised to take note of the CJEU’s decision, and the Working Party and the ICO’s comments in respect of it. Whilst it remains unclear how the ruling will impact on which results will be blocked, companies will need to bear in mind that relying on the continued availability of search links may not be possible.
At present a request for the deletion of the link will not automatically impose an obligation for the disputed content itself to be deleted from the host website. Nevertheless the ruling is a timely reminder of the onward march of the European privacy agenda and the need for companies to keep abreast of developments so as not to fall foul of data protection and privacy laws.
However as the fall-out from the CJEU decision continues, one senses that Simon Hughes’ strong concerns will be shared by others and as a result there has to be a serious question whether, longer term, the right to be forgotten will survive the EU data protection reform process now that its practical ramifications are becoming clear.
Click on the links to read the ICO statement and the Working Party press release.
