We solve your legal problems. Read our legal advice guides & instruct the best lawyer for you.
There has been increasing concern regarding the volume of information stored on the internet and the type of data referenced in search engines, particularly when it relates to information of a personal nature. These concerns culminated in a landmark case at the Court of Justice of the European Union in May 2014, resulting in the recognition of a ‘right to be forgotten’.
The right to be forgotten helps ordinary people to remove information about themselves from the internet, provided the informations meets the necessary criteria laid down in the rules. The onus is on search engines such as Google, Bing and Yahoo to remove the data. While some see the ruling as a triumph in the protection of people’s personal data, others believe the decision is tantamount to censorship, depending which side of the debate is listened to.
The right to be forgotten is part of a wider attempt from within the European Union (EU) to place a limit on the information that is available on the internet, in an attempt to safeguard the privacy rights of individuals living within the EU. It is a component of the European Data Protection Directive that was adopted in 1995. The European Commission has also introduced a draft regulation that will develop the right to be forgotten more broadly within EU law, and will supersede the directive.
The right to be forgotten arose as a result of a case decision made by the Court of Justice of the European Union (CJEU). A Spanish citizen, Mr Gonzalez, complained against a local newspaper, Google Inc and its subsidiary, Google Spain, that information available from Google’s search engine was causing him difficulties. Information was displayed on Google’s search engine about his home being repossessed some ten years earlier, owing to financial difficulties that had now been settled for some time. Mr Gonzalez argued that the availability of this information was damaging his reputation, and breaching data protection regulations. He argued that Google should remove this information from its search results.
Google disagreed with Mr Gonzalez that they should remove the information relating to him, and defended their position on three grounds:
The CJEU looked at the arguments made by Google and also looked at the terms of the data protection directive, and gave what has been described by many as a very ambitious ruling. To decide whether Google’s arguments were in line with European laws, it had to consider three things:
The court rejected Google’s argument that it was exempt from EU law and the terms of the data protection directive. It said that Google Spain was a subsidiary body of Google Inc, and because activities were being organised in Spain, it was subject to both Spanish and European law.
To answer this question, the court paid special attention to the European rules. The court had to find out two things:
Google was deemed to be a controller of personal data.
The court took into account the fundamental rights laid down in European law, for example, freedom of expression, but it was very clear in its decision. The court said if it did not hold Google responsible in this case – and, by extension, search engines more generally – then it would violate a fundamental right in the right to privacy. The court said that individuals would have the right to ask search engines to remove links available on their search engines that contained personal information about them. The court also said that the right to be forgotten was subject to limitations. Primarily, only information that is inaccurate, inadequate, irrelevant or excessive for the purpose of processing information could be removed. Furthermore, the court held that this right was not absolute, and would have to be balanced alongside other fundamental rights, for example, the right to freedom of expression. The court made very clear that this would have to be dealt with on a case-by-case basis.
If someone finds information about themselves on a search engine then they can approach the search engine and ask for it to be removed from the search results (under the current rules, information will not be erased from the internet, but it will not appear in the search results generated by the search engine).
However, as mentioned above, the information must fall within one of the categories laid down by the CJEU before it will be removed from search results. It will not always be immediately apparent whether information should be withdrawn from a search engine index of results, even if inaccuracy or irrelevance is demonstrated. Search engines will, as the ECJ said, have to look at the matter carefully.
The situation can become slightly more complicated if the individual requesting information to be withdrawn from search results is prominent in the public eye. Politicians, actors and those whose lives are very ‘public’ may struggle to have information removed. Moreover, the European authorities (particularly the European Commission) have made it very clear that the right to be forgotten does not grant individuals a right to have information about them removed from history.
The right to be forgotten can sound quite strange, and many might wonder why anyone would want to be forgotten. The reality is that many people would like certain aspects of their lives that have found their way onto the internet (for example through newspapers, social media or video logs) to be removed from public view and forgotten about.
A number of different groups of people would find the right to be forgotten quite useful.
When considering the suitability of candidates, many employers conduct general searches on search engines for evidence of someone’s good or bad character.
Search results may not always be in the prospective employee’s favour. For example, a person may have had some ‘fun times’ at university that have been documented on the internet. This is unlikely to be the image a job candidate would want to show a future employer, and so they may attempt to have this kind of information ‘forgotten’.
People working in the public sphere, for example, politicians, try to portray a professional and trustworthy image. While it is hoped that the details available online about them are a true representation, often, historical comments from their less experienced days tend to resurface. This can cause irreparable damage to a career.
This is not the type of information politicians would like voters to judge them on, which is why it may, in their opinion, be removed from view.
Serious crimes are often heavily reported on. Punishments allocated to parties who are found guilty of these crimes are also often reported on. It is not uncommon to read a newspaper article or an online article detailing an individual who has been convicted for a crime, and the accompanying punishment.
While crimes may have been committed many years ago, related articles published online will continue to exist. If a person’s name is typed into a search engine then this may be all that is required to bring up the details of their past. People who bear convictions would obviously prefer that this information is not available to the public.
The decision of the judges of the CJEU to recognise the existence of a right to be forgotten has received a mixed response in the UK.
Everything mentioned, so far, is based around the terms of the European Data Protection Directive, which is broadly speaking a piece of European law. The ruling of the CJEU, however, provided more substance on what the terms of the directive and any implementing national legislation of EU member states must do, to be in line with European law.
Search engine operators, including the likes of Yahoo, Microsoft and Google, that operate in the UK and Europe did not welcome the ruling. It meant that, to avoid breaching European law, they would have to operate a procedure where individuals could contact them about a particular piece of information available on their search engines. Provided that the individual met with certain criteria then the search engine would need to remove that information from its search results.
Many operators have now designed a procedure for answering right to be forgotten claims from people who would prefer certain pieces of information not to be available in search results. However, search engine operators have voiced concern over the number of requests they receive and the time required to process each one on a case-by-case basis.
Political circles in the UK also voiced concerns over the ruling of the CJEU. Following the judgement, the House of Lords Home Affairs, Health and Education EU Sub-Committee criticised the ruling as ‘unworkable’. The committee was critical of the idea of search engines as commercial bodies, deciding on what information should be removed from search results on the internet. The committee also stated that it believed that information which is obtained lawfully and is accurate should not be removed from search results simply because individuals would rather it was not in the public eye. The committee has called for the European Data Protection Regulation, due to come into force in 2015, not to define search engines as controllers of information, removing their responsibility to deal with requests for the removal of information.
Ultimately, the ruling has been followed, despite concerns from multiple parties. The UK Information Commissioner defended the ruling of the CJEU on the issue of the right to be forgotten but called for clarity on what was actually being discussed. He, amongst others, has stated that information may be removed from search engine results, but the information will still exist on the internet – it simply will not show up on a search. Many in the UK and the EU have attempted to remind parties that the so-called right to be forgotten will not amount to a deletion from history.
It was mentioned earlier that the right to be forgotten is being developed in a new regulation that is due to come into force in 2015. The draft European Data Protection Regulation detailed a ‘right to be forgotten and erasure’, however, following the concerns voiced over the right to be forgotten, it now provides for a more general ‘right of erasure’, which requires that controllers of information – which still includes search engines – on request from an individual, remove personal information that is held by them from their index or bank of information. However, this removal of information will only be granted if the availability of this information contravenes the rights and freedoms of individuals recognised by the EU.
Many have expressed concerns that this piece of legislation will contravene freedom of expression, and allow for what some may deem to be important information to simply disappear. Despite these and other concerns, the alterations made to the substance of the draft regulation have been fairly minimal. The regulation represents a very apt example of the constant struggle to balance the right to freedom of expression and the availability of information on the one hand, and an individual’s right to privacy on the other.
Nothing in this guide is intended to constitute legal advice and you are strongly advised to seek independent advice on matters that affect you.
