07 December 2018 - Article
If your New Year’s resolution was to ensure your reputation is not blighted by outdated or excessive material easily available online, now may be the time to act following recent developments with the ‘right to be forgotten’.
Google Spain – what does it do?
The landmark Google Spain decision caused a sharp intake of breath at Google and other search engines last year. Its impact is to allow individuals to request the delinking by search engines from freely accessible web pages on a search of their name where their personal data is being unlawfully processed. In simple terms, data will be considered to be unlawfully processed when it is:
- ‘Inadequate, irrelevant or excessive in relation to the purpose of the processing’; or
- ‘not kept up to date’; or
- ‘kept for longer than is necessary unless required to be kept for historical, statistical or scientific purposes’.
Google Spain – how does it work?
Taking a deeper breath, Google agreed to comply but only in respect of complaints from those in the EU or with links to the EU, and only in respect of URLs based in European jurisdictions. So notably, it did not impact any .com sites. The US giant managed the mammoth task by creating an online webform through which complainants can request the delinking from offending links. Recent statistics reveal that Google has delinked from around 240,000 URLs in its search results since requests began in 2014.
Google Spain – who does it protect?
While Google may have been voluntarily complying, its procedures and policies were based on a unilateral view of the Google Spain decision. On 24 November 2014, the EU Article 29 Working Party – which represents the data regulatory bodies across Europe – issued its own Guidelines on implementation of the decision. While not legally binding they are likely to be used as guidance by the EU regulators, including by the UK Information Commissioner’s Office, when evaluating individual decisions by Google, brought to it on appeal.
Of note, is that the panel advised search results removal should be expanded beyond European domains like “google.co.uk” to include “google.com” in order to guarantee that “EU law cannot be circumvented”. This coincides with what we have always maintained, that the judgment should apply to any citizens affected, not just EU citizens thereby enabling us to assist the US clients and clients from around the worldwide practice of our global law firm. Our commentary on the effect of the Guidelines can be found here.
Perhaps unsurprisingly, Google isn’t happy. Just this month, its chief legal officer David Drummond responded to the guidance, announcing that the company needed to ‘limit’ the right to be forgotten because it was a ‘European concept’; and that it will be steered by a group of “independent” experts it set up as the Advisory Council which is due to publish its own report shortly.
Google Spain – gazing into the crystal ball
It would be a rash bet to back Google’s Advisory Council not to confirm Google’s own view that it need not delink from .com URLs. But will our UK Information Commissioner’s Office agree…?
What we, at Withers Media & Reputation team, do know is that the Internet ether is not a place for the fainthearted and constant vigilance is required for the protection of privacy and reputation – both of which can be damaged by the reckless publication online of data. We will continue to petition Google in the interests of our domestic, European and international clients, where appropriate and to monitor these developments. If you have any questions about how these recent developments could assist with managing your online reputation, please contact Withers’ Media & Reputation team for guidance.
As we thought, Google’s Advisory Council has confirmed they will seek to ‘limit’ the application of the Article 29 Working Party’s Guidelines to only include EU-URLs in their consideration of right to be forgotten applications. Google continues to argue it is a ‘European concept’ and should be treated as such. It is not clear whether this means they will refuse to delist .com URLs or whether they will take a more reasoned case-by-case approach. Not everyone has been happy with this outcome. The French data protection agency, CNIL (the equivalent of the UK’s ICO), said the company would be disobeying the law if it did not remove links globally and that ‘it is time for [Google] to comply with the European law’. For now, it looks like any challenges to Google’s decision not to remove results from non-EU domains are likely to take place at national level via data protection agencies which in the UK, leaves the ball firmly in the ICO’s court…
Click here to view Google Advisory Council’s final report.