Following the ruling of the Court of Justice of the European Union (CJEU) in the Google Spain case, Google organised a series of public hearings to inform the public about its implementation of “the right to be forgotten” . Last week, the EU’s Article 29 Data Protection Working Party issued its guidelines on how the ruling should be implemented. Here, Jef Ausloos and Brendan Van Alsenoy of the Interdisciplinary Centre for Law and ICT at KU Leuven summarise the main points of the Working Party’s guidance.
Proper framing
The Article 29 Working Party, which consists of all the data protection authorities in the EU, begins by reaffirming the existence of a “right to be delisted”, casting aside the terminologically problematic “right to be forgotten”. Moreover, search engines are not being forced to proactively evaluate “all the information they process, but only when they have to respond to data subjects’ requests”. Such requests are subject to certain conditions and relate to the delisting of specific name-based search results only. Exercising this right also does not affect the source pages to which search engines refer. The original content remains available online and accessible through other search terms. Finally, the Working Party emphasises the limited scope of this right, as well as the need to strike a fair balance between the rights and interests at stake.
Striking the balance
The crux of the Working Party’s guidelines concerns the fair balance between individuals’ privacy and the public’s ability to access information. Unlike the CJEU, the Working Party does refer specifically to the public’s right to receive information (article 11, EU Charter of Fundamental Rights), which acts as a counter-weight to the right to privacy and data protection. The Guidelines contain 13 criteria to inform the evaluation of delisting requests. The list is non-exhaustive, and none of the criteria alone are deal breakers. These 13 criteria can be loosely grouped as follows:
- « Public » vs. « non-public » figures. Drawing from the case law of the European Court of Human Rights, the Working Party explains that “public figures” are individuals who, “due to their functions/commitments, have a degree of media exposure”. To determine whether information should be accessible following a name search, one should evaluate whether “the public having access to the particular information – made available through a search on the data subject’s name – would protect them against improper public or professional conduct”.
- Nature of the Information: The Guidelines contemplate a distinction between information relating to an individual’s private life versus his/her professional life. Depending on the circumstances (nature of work, still engaged in this activity), de- listing of information relating to professional life may be more or less appropriate. Out-dated information, having become inaccurate, should generally be delisted. Similarly, personal data that qualifies as ‘sensitive data’ under the Directive (article 8) should more readily be delisted. When the information relates to a criminal offence, the balance will depend on the severity and lapse of time (though much will depend on the relevant national approach).
- Impact on the individual: Even though the CJEU specified that individuals are not required to demonstrate harm, doing so still constitutes a strong factor in favour of delisting. For example, delisting is particularly appropriate if there is a heightened risk of identity theft or stalking. However, delisting is also appropriate for search results referring to trivial or foolish misdemeanours which are no longer – or have never been – subject of public debate. When the information constitutes hate speech or slander, the data subject will generally be referred to the police and/or court.
- Information published with consent. To date, Google has been inclined to refuse delisting requests for information published with the consent of the individual concerned. The Working Party notes, however, that individuals may not always be in a position to effectively revoke their consent. It considers that the de-listing of a search results may be particularly appropriate in cases where the individual is unable to obtain remedy at the source.
- Purpose of the original publisher. The motivation and purposes of the original publisher should also be taken into account. Even though publication and indexation are separate activities, when information is published for journalistic purposes, this should be a factor in the balance made by the search engine. The same applies for situations where there is a legal obligation to publish information.
Practical implementation
Striking the balance is only part of the equation. In its guidance document, the Working Party also weighs in on a number of practical issues, several of which have already been the topic of debate.
Transparency
Ever since Google launched its online “removal” form, calls for transparency have been resonating with increasing intensity. But too much of a good thing can be detrimental. The Working Party encourages search engines to be transparent, but to do so only in aggregate form. For example, search engines are encouraged to publish statistics about their handling of removal requests. Search engines should not, however, inform their users about the removal of results in specific instances (e.g., by only informing them that “some results have been removed” in cases where hyperlinks were actually delisted). This is quite understandable, as the adverse impact of such removal notices might be greater than the underlying content itself.
Publisher notification
During the Advisory Council hearings, publisher notification was repeatedly put forth as a way to help safeguard access to information. A notified publisher would be able, at least in theory, to submit arguments as to why a search engine provider should reconsider a decision to delist. The Working Party, however, takes issue with search engines who “routinely” or “as a matter of general practice” notify webmasters of successful removal requests. At the same time, the Working Party does recognize that it may be legitimate to contact the original publisher prior to deciding a request, but only when it is necessary to obtain a proper understanding about the circumstances of a “particularly difficult” case.
Global protection
Perhaps the most contentious element of the Working Party’s guidance concerns the territorial effect of the CJEU ruling. It states flat out that search engines must implement the ruling “on all relevant domains, including .com”. It also rejects the argument that limiting implementation to national domains is sufficient because users only tend to access search engines via those national domains. Instead, the ruling should be implemented in such a way that it guarantees “effective and complete” protection of data subjects’ rights and that EU law “cannot easily be circumvented”. Interestingly, the Working Party did not consider the possible use of geographic location tools (which could serve to tailor results independently of the domain used). While we cannot categorically exclude that such an approach would satisfy the Working Party, its language suggests that only a global implementation of the CJEU ruling will be deemed sufficient.
Outlook
The guidelines developed by the Article 29 Working Party are not legally binding as such. They do, however, act as a strong predictor of how national data protection authorities will evaluate complaints brought against recalcitrant search engines.
The long-term impact of the CJEU ruling remains uncertain. In principle, the ruling itself only envisages search engines. The Working Party has made clear however, that this “does not mean that the ruling cannot be applied to other intermediaries”. Concerns that the CJEU ruling might have “spill over” effects towards other actors (such as social networking platforms or micro-blogging sites) are therefore not without basis. For now, it looks as if the Working Party is only contemplating intermediaries who are able to establish “relatively complete profiles” with “serious impact” on the individuals concerned. Time will tell how this approach will eventually wind up shaping the accessibility of personal data online.
This article gives the views of the authors, and does not represent the position of the LSE Media Policy Project blog, nor of the London School of Economics.