Right to Be Forgotten in United Kingdom

The European Court of Justice (ECJ)

The European Court of Justice decision to uphold the Spanish data protection regulator’s initial ruling against Google – who were asked to remove the index and stop any future access to the digitised newspaper article by searching for the individual’s name.

The European Court of Justice did not specifically find that there is a ‘right to be forgotten’ in the Google case, but applied existing provisions in the EU Data Protection Directive, and Article 8 of the European Convention on Human Rights, the right to respect for private and family life.

ICO overview of key points of the Court of Justice of European
Union judgment regarding Google and the removal of search
results

• In operating their search service, Google is processing personal data and is acting as a data controller under the terms of the European Data Protection Directive.
• Google is established in Spain in terms of its search engine service under the terms of the Directive. Spanish data protection law therefore applies to Google.
• Search providers can be required to remove links to web pages that contain personal information published by third parties, from the list of results displayed, following a search on the person’s name, where the processing of the personal data does not comply with the relevant provisions of the Directive.
• A search provider can be required to consider removal regardless of the legal status of the personal information in the third party web pages.
• The Court highlights the significance of interference to personal data rights that can be caused by the availability of the links associated with a name.
• The Court observed that the data subject’s rights also override, as a general rule, the legitimate interest of internet users to access information.
• A balance will have to be struck between these interests. It will depend, in specific cases, on the nature of the information in question and its sensitivity for the individual’s private life. It will also depend on the interest in communicating the information to the public, an interest which may vary, according to the role played by the data subject in public life.
• The Court observed that lawful processing of personal data may, in the course of time, become incompatible with the directive.
• Requests to remove links should be directed to the search provider as data controller. Where the controller does not grant the request, the data subject may bring the matter before the data protection supervisory authority or the courts.

Press Release issued by the Article 29 Data Protection Working Party

“The European data protection authorities assembled in the Article 29 Working
Party (WP29) welcome the ECJ ruling of 13 May 2014 which sets a milestone for EU data protection in respect of search engines and, more generally, in the online world. In particular, it retains a wide interpretation of the notion of “establishment” for determining the applicability of the EU Directive 95/46/EC and national law to search engines. It also
clarifies the concepts of “data processing” and “controller” as regards the processing of personal data by search engines, and recognises a right to be forgotten for individuals, subject to conditions. The WP29 will discuss at its next plenary the operational and legal consequences of this ruling.

This ruling is the response to interlocutory questions submitted in 2012 to the European Court of Justice by a Spanish High Court (Audiencia Nacional) in the framework of a dispute between Google and the Spanish Data Protection Authority (Agencia Espanola de Proteccion de Datos, AEPD), further to a complaint lodged before the latter by a Spanish data subject.

The European Court of Justice was requested to rule on a search engine’s legal qualification as regards processing of personal data through its search engine service, on the applicability of Directive 95/46/EC to the latter, and on the data subject’s right to obtain the deletion of links, in search results, to information infringing his rights to data protection.

In its judgment published on 13 May 2014, the European Court of Justice ruled that search engine providers are data controllers in respect of the processing of personal data carried out by the search engine, since their activity is to automatically index information published online and to provide such information to web users according to a particular order of
preference. This specific activity comes in addition to that of web publishers and search
engines providers could therefore be liable for affecting data subjects’ rights.

The ECJ also confirmed the applicability of Directive 95/46/EC to a search engine – in this specific case, Google – insofar as the processing of personal data is carried out in the context of the activities of a subsidiary on the territory of a Member State, set up to promote and sell advertising space on its search engine in this Member State with the aim of making that service profitable.

On those grounds, the European Court of Justice concluded that web users have the right to directly request from the search engine the deletion of the links to web pages containing information breaching their rights under the Directive, even if the publication of the information on the web pages in question is lawful in itself.

The European Court of Justice nevertheless indicated that the rights to privacy and to the protection of personal data enshrined in the EU Charter of Fundamental Rights, although they override the search engine’s economic interest, are not absolute, and that therefore the right to deletion of information will have to be assessed on a case by case basis depending on the nature of the information in question, on its sensitivity for the data subject and on the interest of the public to have access to that information, considering in particular the role played by the data subject in public life.

A first exchange of views between the EU data protection authorities will take place at the WP29 plenary meeting of 3-4 June 2014 in order to analyse the consequences of the European Court of Justice’s ruling and to identify guidelines in order to build a common approach of EU data protection authorities on the implementation of the ruling.”

Implications to UK Law

According to David Smith, Deputy Commissioner and Director of Data Protection (iconewsblog.wordpress.com/2014/05/20/four-things-weve-learned-from-the-eu-google-judgment/):

“It’s worth noting that the judgment does all this under the existing European Data Protection Directive. Some critics have previously suggested the law is no longer fit for purpose – and indeed we’d still back calls for it to be updated – but this ruling shows the existing directive can still be relevant when discussing modern data protection issues.

There are some who are seeking to draw out much wider implications of the judgment for freedom of expression in general. It is important to keep the implications in proportion and recognise that there is no absolute right to have links removed. Also, the original publication and the search engine are considered separately: the public record of a newspaper may not be deleted even if the link to it from a search website is removed.

We recognise that there will be difficult judgments to make on whether links should be removed. It is also important to remember that the exemption for journalism, art and literature under section 32 of the Data Protection Act can be applied by media organisations, bloggers and other publishers of information, depending on the circumstances.

What this is not, then, is a full or absolute ‘right to be forgotten’. As we previously indicated in our analysis of the draft European Data Protection Regulation, such a right would be a valuable tool in enabling individuals to have stronger rights in terms of controlling the dissemination of information about them. But our concern remains how this can be achieved in practice and how to set reasonable expectations for the public about how such a right can operate. The right to be forgotten can help reduce privacy intrusion but we have to be realistic about how difficult it can be to completely remove all traces of personal information online.

The judgment might mark the end of a lengthy legal process, but it marks the beginning in terms of how a decision in Luxembourg affects the man in the street here in the UK.

Although compliance with the judgment is primarily a matter for the search engines, there is now a key responsibility for the data protection authorities, including the ICO, to interpret and apply this judgment to concerns raised with us. We believe the judgment provides space to strike a balance between the right to privacy and the public’s right to know, recognising the role search engines play in facilitating access to information in today’s society. Guidance will be needed from data protection authorities to ensure search providers take the right approach.”

Implications to UK Law for Web Archiving

According to Helen Hockx-Yu, Head of Web Archiving, The British Library (britishlibrary.typepad.co.uk/webarchive/collections/#sthash.iWXeaPqa.dpuf):

There is at present no formal and general “right to be forgotten” in UK law, on which a person may demand withdrawal of the lawfully archived copy of lawfully published material, on the sole basis that they do not wish it to be available any longer. However, the Data Protection Act 1998 is applied as the legal basis for withdrawing material containing sensitive personal data, which may cause substantial damage or distress to the data subject. Our policy is in line with the Information Commissioner’s Office’s response to the Google ruling, which recommend a focus on “evidence of damage and distress to individuals” when reviewing complaints.

It is important to recognise that the context of the ECJ’s decision is Google’s activities in locating, indexing and making available links to websites containing information about an individual. It is not about the information itself and the court did not consider the blocking or taking down access to the newspaper article.

The purpose of Legal Deposit is to protect and ensure the “right to be remembered” by keeping snapshots of the UK internet as the nation’s digital heritage. Websites archived for Legal Deposit are only accessible within the Legal Deposit Libraries’ reading rooms and the content of the archive is not available for search engines. This significantly reduces the potential damage and impact to individuals and the libraries’ exposure to take-down requests.

Our conclusion is that the Google case does not significantly change our current notice and take-down policy for non-print Legal Deposit material. However, we will review our practice and procedures to reflect the judgement, especially with regard to indexing, cataloguing and resource discovery based on individuals’ names.