Interpreting 'right to be forgotten'--will guidelines help?
This article was first published on Lexis®PSL IP & IT on 17 December 2014.
IP & IT analysis: How well are search engines handling delisting requests? Hazel Grant, head of the privacy and information law team and Nuria Pastor, senior associate specialising in privacy law at Fieldfisher, discuss the Article 29 Working Party's response to the Google 'right to be forgotten' (RTBF) case and its subsequent guidance for operators and individuals.
Data protection rights affirmed by new EU guidelines, LNB News 28/11/2014 126
Data subjects will be able to request internet search engines, under certain conditions, to delist links appear-ing in the search results based on a person's name. Guidelines have been adopted by European data protection authorities (DPAs) following a judgment in the Court of Justice of European Union (CJEU) on 13 May 2014. The guidelines contain the interpretation of the ruling, along with the criteria to be used by the DPAs when addressing complaints.
What were the key findings of the CJEU in the milestone Google judgment?
The CJEU ruling--Google Spain SL and another company v Agencia Espanola de proteccion de Datos (AEPD) and another: C-131/12  All ER (D) 124 (May)--is groundbreaking for three main reasons:
It recognised that search engines are 'controllers' of the personal data.
It establishes that an individual has the RTBF under the Data Protection Directive 95/46/EC (the Directive).
It holds that the personal data processing operations carried out by a US entity, which has an establishment in an EU member state, may be considered to be carried out in the 'context of the activities' of that establishment (so, effectively, within that European establishment).
Since then, what steps have Google and other search engines taken to address the points raised in the ruling?
Search engines have received requests to erase personal data from their search results (delisting requests). Some of them have also published guidance and FAQ documents on this matter on their websites and have put procedures in place in order to facilitate the submission of such requests.
Google, Microsoft and Yahoo have engaged in conversations with DPAs in recent months. From the DPAs' viewpoint, the purpose of these discussions has been to ensure a uniform implementation of the precedent set by the ruling.
In this context, in July 2014 (barely two months after the publication of the ruling) these search engines were requested by DPAs to provide detailed answers to 26 questions about the way in which they deal with delisting requests.
What were the key areas of concern raised in relation to the implementation of the ruling?
The ruling has been highly controversial--especially because of the tension between the individuals' right to privacy and other rights at stake such as the freedom of expression and information, and the right to conduct a business.
There is concern that search engines will become not just gateways to information on the web, but also in some circumstances the censors preventing access to information based on objections received.
The European Commission published a fact-sheet where it recommends a 'sober' reading of the ruling and argues some of the concerns that have arisen are 'exaggerated or simply unfounded'. The Working Party's recent opinion WP225 (the Opinion) also emphasises that the impact on the freedom of expression of original publishers and users will be 'very limited'.
Even though the precedent set out by the ruling only applies to name-based searches in general search engines, the ruling has, technically, brought forward the general implementation of the RTBF by finding this right exists under the Directive.
The interpretation of the Directive, arts 12(b) (right of erasure), 14(a) (right to object) in the ruling is broad and, arguably, it was influenced by the regulation of the RTBF in the draft General Data Protection Regulation. Given that the Regulation has not been approved and that controllers are subject to European member states' data protection laws that transpose the Directive, the ruling raises legal uncertainty in practice for controllers (especially those that are not search engines) that receive RTBF requests.
Another criticism has been that the ruling is flawed when considering that the personal data had become unnecessary for the purposes of the processing, as it fails to focus on the purposes sought by Google (the controller of the personal data listed in the search results).
To what extent do the recent guidelines published by the Working Party on the implementation of the ruling address those concerns?
The Opinion is in line with the ruling but it further elaborates on certain legal and practical aspects of it and offers, as a result, an invaluable insight on the European regulator's vision on the future of the RTBF.
The Opinion provides specific guidance on the practical aspects of how delisting requests should be dealt with by search engines and submitted by individuals. For example, it recommends that individuals are allowed to deal with the local establishment of the search engine if they wish and also that they cannot be required to use certain on-line forms set out by the search engines. Both search engines and individuals should have, as a result of the Opinion, a clearer understanding about the way in which the precedent of the ruling will be implemented in practice.
Do the guidelines provide any clarity on what is meant by the 'public interest' in the context of delisting?
The ruling provides some limited guidance on the public interest exception and the circumstances under which the individual's 'role in public life' will stop them from being able to request that search results about them are delisted. It also highlights the difficulty in defining this group of people (ie those with a role in public life). The Opinion clarifies that having a role in public life should be interpreted more broadly than being a 'public figure'. The latter are defined as those whose public functions/commitments have a degree of media exposure. A public life role can extend to those in regulated professions, public officials, business people, etc. Reference is made to recent German case law on this matter.
Does the Working Party's interpretation of the judgment (as extending the delisting to .com domains) go beyond the scope of the ruling, or is that the logical and necessary implication?
Arguably, extending the delisting to .com domains is in line with the ruling's interpretation of the rules on the territorial application of the Directive. In the ruling, Google Inc's processing operations are found to be subject to Spanish law because its search engine activities are considered to take place within its Spanish establishment. Therefore, the requirement to implement delisting decisions to the .com domain is not totally unexpected.
In practice, this means US-based businesses cannot shield themselves from EU data protection law simply by structuring their service so it operates from the US if they have EU sales offices.
What do the guidelines say about the information that should be provided with a request? While the guidance is non-binding, is it likely to discourage non-EU data subjects/(notorious) public figures from submitting unfocused requests?
The Opinion advises that individuals 'must sufficiently explain the reasons why they request delisting, identify the specific URLs and indicate whether they fulfill a role in public life, or not'.
This may have an impact in the way in which search engines design their application forms and, on occasions, it might discourage individuals from submitting unfocused requests. That said, individuals are already required to provide certain level of detail in some of existing application forms of some search engines and thousands of requests have been submitted to date.
What should solicitors acting for data subjects (seeking to make requests on the basis of the RTBF ruling) advise their clients?
The Opinion provides guidance on the criteria that will be applied by DPAs and this is likely to influence the way in which search engines deal with individuals' requests. An assessment should be carried out on the basis of these criteria in order to consider the likely outcome in each case.
Where does this leave Google's practice of posting a notice at the bottom of search results for individuals' names informing users that some information may have been removed?
The Opinion argues it is OK to provide such notices if they are generic.
Even though the Opinion provides guidance only, search engines should be advised to take the Opinion into account when designing their internal delisting procedures. Search engines should also be advised to ensure compliance with relevant local European data protection laws.
The Opinion also acknowledges that search engines may find it practical to put in place centralised procedures to deal with such requests. Search engines should take advantage of this possibility and try to assign one point of contact with EU DPAs that addresses DPAs' requests in a centralised way.
Was the initial flurry of delisting requests a one-off or do you expect requests to continue at a similar rate going forward?
Requests are likely to continue to be submitted but they might decrease in numbers, especially if search engines publish their delisting criteria, as suggested by the Working Party in the Opinion. RTBF requests will also continue to be submitted to non-search engines controllers and is likely to increase as the approval process of the draft Data Protection Regulation progresses.
Interviewed by Anne Bruce.