Since the introduction of GDPR we’ve seen a significant upturn in requests from private as well as commercial clients to have prejudicial data removed from online search engines like Google. But this ‘right to be forgotten’ has its limitations – highlighted recently by The Court of Justice of the European Union (the ECJ). In a significant victory for Google, the ECJ agreed with the internet corporation that it is not required to remove links to personal data outside the EU.
WHAT IS THE RIGHT TO BE FORGOTTEN?
GDPR bolsters the way individuals can manage how their personal data is stored and processed. We’ve explained previously the key aspects of the right to be forgotten (or ‘erasure’) and how we here at Nath Solicitors in London help clients enforce that right under GDPR.
With its specific right of erasure, GDPR is a powerful tool for individuals and businesses. It greatly increases their ability to manage their reputation when there is no compelling reason for an organisation to hold personal data about them.
As far back as 2014 the ECJ concluded in the Google Spain case that Google was performing the role of a data controller in operating its search engine. Consequently Google was subject to the data protection principles of the EU. That landmark decision meant Google was required to remove or delist search results that were in breach of the EU Data Protection principles. For instance, in cases where a search for an individual’s name results in webpages that contain unlawful information about the individual (for example unfair, inaccurate or out dated webpages). What became known as the right to be forgotten was, as we’ve mentioned, subsequently codified in the GDPR as ‘the right to erasure’.
CONSEQUENCES OF GOOGLE SPAIN
Following the Google Spain decision, Europeans began requesting links to pages containing sensitive personal information about them be removed. We saw these requests increase following the introduction of GDPR and further obligations on controllers in 2018. Google was inundated with requests to remove information. Reports suggest Google has processed almost 850,000 requests from individuals asking for links to 3.3 million websites to be taken down.
The right to erasure process is relatively straightforward: Members of the public are empowered to make a request to any organisation “verbally or in writing” to remove data and the organisation has one month to respond. Companies then have a range of considerations to weigh up to decide whether they are compelled to comply or not.
GOOGLE, THE ECJ AND THE RIGHT TO BE FORGOTTEN
But there was a loophole for the search engines: In cases where Google or another operator agrees to delist search results, the results complained of are blocked only on Google’s EU domains and all versions of Google when the search is made from the complainant’s country. This means that the offending information remains available on all other versions of Google. In practical terms searches for the complainant’s name in the USA, Japan, Africa and other non-EU jurisdictions around the world will reveal the offending information. As a result, many complaints have been made by individuals to their local data protection regulators about Google’s refusal to remove the offending content worldwide.
Due to the large volume of complaints, in May 2015 the Commission Nationale de l’informatique et des libertés (CNIL), the French data regulator, sent an enforcement notice to Google, requiring that all delisting of French residents apply to all of Google’s versions and domains worldwide.
In response to this, Google introduced a system whereby they would use IP addresses to determine the location from which a search is made in relation to the offending content and restrict access to the delisted links on all versions of Google when accessed from the country from which the delisting was requested.
The CNIL regarded this change as inadequate and imposed a fine of €100,000.00 on Google for refusing to comply with their request to remove delisted content on all their domains.
Google appealed on the grounds that to impose such a global obligation would interfere with the right to freedom of expression worldwide.
BALANCING THE RIGHT TO ERASURE WITH OTHER RIGHTS
The ECJ ruled in Google’s favour and accepted that although delisting on a global level would protect the complainer’s interest in line with EU GDPR, not all countries outside the EU have the same Data Protection laws. Moreover, the court stated that the right to protection of personal data must be balanced against other fundamental rights as required by the Human Rights Act 1998 under the principle of proportionality.
As a result of this decision, there is now no obligation under EU law for Google or any other search engine to delist content on all of its domains. This means that while individuals can exercise their right to be forgotten – they can only do so in the EU where their interests lie and not outside of the EU.
CONTACT OUR DATA PROTECTION SOLICITORS LONDON
If you wish to discuss the right to be forgotten and the removal of defamatory content about you online, please contact Nath Solicitors on 44 (0) 203 670 5540 or contact the firm online.
