The UK body that regulates data protection, the Information Commissioner’s Office (ICO), has issued an overview of key points in relation to the recent European Court of Justice (ECJ) judgment involving Google and the removal of internet search results to protect individuals’ privacy under the Data Protection Directive (1995/46/EC).
In this instance a case was brought by a Spanish citizen, Mario Costeja González, against Google regarding search results that pointed to a 1998 newspaper article about a social security debt he had incurred. Having failed to convince the newspaper to remove the article he then requested Google to remove all such search engine references under his right to privacy.
The case was brought before the Spanish data commissioner (Agencia Española de Protecteción de Datos – AEPD), which then referred key issues to the ECJ regarding the data processing activities of search engine providers, their status as data controllers, and the existence and scope of a right to be forgotten (C-131/12, 13 May 2014).
The ECJ ruled that amongst other things, search engines are data processers and controllers – despite in Google’s case these activities taking place outside the EU – and that a claimant has a right to have information removed about them when that information is inaccurate, but also even when the information is irrelevant, excessive, out-of-date or kept for longer than necessary.
The ICO’s Deputy Information Commissioner has welcomed the ECJ’s judgment in a blog post entitled Four things we’ve learned from the EU Google judgment, describing it as a framework to hold search engines accountable for the personal data they process and which helps to strike a balance between the right to privacy and the public’s right to know. The ICO emphasises however that the decision does not herald a blanket ‘right to be forgotten’.
Europe’s data privacy protection regulators through the Article 29 Working Party are now seeking to agree a consistent EU-wide approach to the issue, with the ICO making contact with UK-based search providers.
The ICO has indicated that in the meanwhile it will not rule on any complaints received until search providers have had a reasonable time to manage the impact of the ruling. It also states that it will prioritise cases where individuals can clearly show damage or distress arising from search results.
Although the ECJ’s judgment appears to indicate that it may not always be necessary for an individual to show prejudice in order to establish a right to remove information in search results, it seems that in the UK at least, this right may for the time being be less easy to enforce without any evidence of damage or distress.
Since the ECJ’s ruling Google has been receiving a reported 10,000 requests a day via its online removal form.
