Data privacy regulators from across the EU met in Brussels last week (16-17 September). The discussions included Google’s application of the right to be forgotten ruling from May this year. The press release issued on Friday tells us that they may have missed an opportunity to clarify what is a complex situation. Whilst the regulators agreed to develop a common ‘tool box’ to ensure a coordinated approach to the handling of complaints, serious issues remain.
The right to be forgotten ruling has led to hundreds of complaints and requests for articles to be removed. Whilst technically the ECJ ruling affects only secondary sources (like search engines) and not primary sources (like newspapers) many complainants have not seen this distinction. For example we have handled cases already from individuals with a history using aggressive lawyers to try and clean up their past for them. There is background to the original ECJ decision here and in our podcasts here and here.
Between the May ruling and 1 September this year, Google has received approximately 120,000 requests affecting 457,000 website addresses. If the requester is unhappy with Google’s response, they are able to complain to their national privacy regulator. Not all of the national regulators have made their complaints figures public but as an example the UK regulator has received 91 complaints and the Irish regulator has received 17 during this time period. It is these complaints which the toolbox will try and ensure are dealt with consistently across the EU. If the tools are made public this could also assist Google and other search engines in making their initial decisions about requests.
Ahead of the meeting, Gerard Lommel, the head of Luxembourg’s data-protection authority stated: “We expect to take a position on such questions the general public is waiting for”. However, on the contrary, key questions have still not been answered, particularly around notification of site owners and application outside of the EU.
Google is currently notifying the owner of the website when their link is removed as a result of a request. This has been queried by some as it may draw more attention to the personal information which is being ‘forgotten’, but there has been no official guidance on the correct way to handle this situation.
Another elephant in the room is the EU regulators power to reach to the US. Currently, if a link is removed it will only be removed from search results within the EU; it will still appear in search results on the US version of the website. Google has stated that less than 5% of traffic on the US site comes from Europe.
Google is holding its own, public talks across Europe to seek advice on the principles that should be applied when making decisions on individual cases. They have convened a panel of experts and are holding talks across Europe to gain public opinion. The final talk will be held in Brussels on 4 November.
The EU Press release is here (opens as a pdf)
Details of the Google discussions are here.
Jonathan Armstrong is a lawyer with Cordery in London where his focus is on compliance issues.
Jonathan Armstrong Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH
Office: +44 (0)207 075 1784