By David Smith, Deputy Commissioner and Director of Data Protection.
The Court of Justice of the European Union grabbed headlines last week when it ruled in favour of a man who wanted Google to remove information about him from its search results. Here, we reflect on what we’ve learned from that judgment.
We’ve also produced a brief overview of what we see as the main points of the judgment.
Let’s imagine an Adam Brown puts his name into a search engine. The list of results includes a link to a webpage that contains personal information about him. This judgment ruled that if the way that information is being used doesn’t fit with European data protection law, for instance if it is inadequate, irrelevant or outdated, then Adam can request that the link is removed from future search results. The search provider will have to comply unless there is an overriding public interest.
He’ll need to contact the search company to remove links from search results, and if the search provider refuses the request, he can contact the ICO.
This judgment was only made last week, and the companies will need some time to work out how they’re going to handle this. We won’t be ruling on any complaints until the search providers have had a reasonable time to put their systems in place and start considering requests. After that, we’ll be focusing on concerns linked to clear evidence of damage and distress to individuals.
This is a judgment that we welcome. It sets out a framework to hold data controllers operating online search engines to account for the personal data they process. It also backs our view that search engines are subject to data protection law, clarifying an area that was previously uncertain.
It’s worth noting that the judgment does all this under the existing European Data Protection Directive. Some critics have previously suggested the law is no longer fit for purpose – and indeed we’d still back calls for it to be updated – but this ruling shows the existing directive can still be relevant when discussing modern data protection issues.
There are some who are seeking to draw out much wider implications of the judgment for freedom of expression in general. It is important to keep the implications in proportion and recognise that there is no absolute right to have links removed. Also, the original publication and the search engine are considered separately: the public record of a newspaper may not be deleted even if the link to it from a search website is removed.
We recognise that there will be difficult judgments to make on whether links should be removed. It is also important to remember that the exemption for journalism, art and literature under section 32 of the Data Protection Act can be applied by media organisations, bloggers and other publishers of information, depending on the circumstances.
What this is not, then, is a full or absolute ‘right to be forgotten’. As we previously indicated in our analysis of the draft European Data Protection Regulation, such a right would be a valuable tool in enabling individuals to have stronger rights in terms of controlling the dissemination of information about them. But our concern remains how this can be achieved in practice and how to set reasonable expectations for the public about how such a right can operate. The right to be forgotten can help reduce privacy intrusion but we have to be realistic about how difficult it can be to completely remove all traces of personal information online.
The judgment might mark the end of a lengthy legal process, but it marks the beginning in terms of how a decision in Luxembourg affects the man in the street here in the UK.
Although compliance with the judgment is primarily a matter for the search engines, there is now a key responsibility for the data protection authorities, including the ICO, to interpret and apply this judgment to concerns raised with us. We believe the judgment provides space to strike a balance between the right to privacy and the public’s right to know, recognising the role search engines play in facilitating access to information in today’s society. Guidance will be needed from data protection authorities to ensure search providers take the right approach.
We will be discussing this issue with our fellow European Data Protection Authorities in the Article 29 Working Party at the start of next month, to ensure a consistent approach is taken across Europe. Once we have done that we will be speaking to the main search providers established in the UK.
In the meantime, we expect search providers to start the process of considering what solutions are needed to deal with requests to remove links. We recognise that the challenge is logistical and technical. Any solutions should enable appropriate consideration to be given to each case, and should reflect a judgment that upholds the data protection rights of individuals.
Last updated 20/05/2014 16:30