The Right to Be Forgotten or Is It? No. It Is the Right to Erasure of Certain Data

27 March 2015

Author: Olivia O'Kane
Practice Area: Media and Defamation

Background

In 2009 Mario Costeja González carried out a Google search on his own name.  He found home-foreclosure notices dating back to 1998, a time when he was in financial trouble.  Costeja González requested that La Vanguardia, the newspaper who had published the notices, be required either to remove or alter the pages in question so that his personal data no longer appeared or to use certain tools so that the data no longer appeared in the search results and in the search engine links to La Vanguardia.

The case went to the European Court of Justice (“ECJ”) which held, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine collects data within the meaning of the directive. The Court considered that the operator retrieves records and organises the data in question, which it then stores on its servers and discloses to its users in the form of lists of results.

The ECJ held that such operations must be classified as processing even where they exclusively concern material that has already been published in the media. The ECJ held that the operator of the search engine is the ‘controller’ in respect of that processing, given that it determines the purposes and means of the processing. The ECJ observed that the operator of the search engine must ensure that its activity complies with the directive’s requirements. 

In its ruling of 13 May 2014 the ECJ said on the “Right to be Forgotten,” that individuals have the right, in certain circumstances, to ask search engines to remove links with personal information about them.

This applies where for the purposes of the data processing the information is:

(a)  inaccurate;

(b)   inadequate;

(c)   Irrelevant; or

(d)  excessive

A case-by-case assessment is needed considering the type of information, its sensitivity for the individual’s private life and the public interest in having access to that information. 

Significantly the role the person requesting the deletion plays in public life might also be relevant. 

The 1995 Data Protection Directive

The 1995 Directive under Article 12, in principle, already encompasses the “right to be forgotten”.  For instance a person can ask for personal data to be deleted once that data is no longer necessary.  Under the Directive, every data subject has the right to obtain from the data controller, the rectification, erasure or blocking of data whereby the processing of which does not comply with the provisions of the Directive as such data is incomplete or inaccurate.

The Data Protection Regulation

The European Commission has prepared a draft Data Protection Regulation to deal with, amongst other issues ‘the right to be forgotten'

The key points of the Regulation in respect of the right to be forgotten are outlined below:

  1. Under Article 3 of the Regulation, non-European companies, when offering services to European consumers, must apply European rules.
  2. The Commission has proposed reversing the burden of proof so that it is for the company to prove that the data cannot be deleted because it is still needed or relevant.  This would make the right to be forgotten easier to access for individuals.
  3. The Proposed Regulation creates an obligation for a controller who has made the personal data public to take ‘reasonable steps’ to inform third parties of the individual’s request to have the data deleted.  The European Parliament cemented this right by including an obligation on the controller to ensure an erasure of the data.
  4. Data Protection authorities would be able to impose fines of up to 2% of annual worldwide turnover where companies do not respect the right to be forgotten.
  5. There are limitations to the right to be forgotten.  The exercise of freedom of expression, public health and historical, statistical and scientific purposes all form part of the public interest reasons for limiting this right.

Under the Commission’s draft, erasure must be carried out "without delay", subject to limited carve outs which include freedom of expression.  

Article 17 requires controllers to weigh subjects' rights against any competing rights and interests including "the public interest in the availability of the data" when considering such requests.  Whilst it seems to be rational to protect the freedom of speech in this manner, it nevertheless imposes a potentially onerous obligation upon otherwise neutral secondary controllers.

How Do I Get My Information Removed?

To make a request to have personal data removed from Google a straightforward online form can be completed at the link below:

https://support.google.com/legal/contact/lr_eudpa?product=websearch

The form allows an individual or someone representing an individual to put in a request. The form requires submission of a photo ID of the individual the request is for.

The form allows people to list the name and the URLs that they want to be removed from the search results.  An explanation must be provided as to why they want them removed and why each URL is irrelevant, outdated or otherwise inappropriate.

If a removal is approved, the URL will be dropped for searches on the associated name from all the EU-specific versions of Google that the company maintains.  The URL will be dropped out of Google UK, in that person’s home country. But it will also be dropped out of other versions of Google for individual EU countries. The URL would not be dropped from Google.com. Removals will only be done from the EU versions.

Please contact us should you wish to discuss this.

Comment

The EU institutions aim to adopt the Data Protection Regulation by May 2015, meaning it could take effect as soon as 2017. 

Whilst at present the ECJ decision only applies to search engines, it may only be a matter of time before the concept of a "right to be forgotten" or "right to erasure" is applied far more widely under the proposed Regulation. 

On 26 November 2014, the influential Article 29 Working Party issued a press release announcing the agreement and publication of criteriato be followed by local data protection authorities and Member State law implementing theGoogle Spaindecision. 

Article 29 Press Release can be accessed here: http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/20141126_wp29_press_release_ecj_de-listing.pdf

Press Release of ECJ: http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-05/cp140070en.pdf

For more information please contact Olivia O'Kane.

Back