With a number of high-profile claims against Google in the offing, practitioners and individuals alike are hopeful for guidance on the interplay between the application of the ‘right to be forgotten’ principle and the forthcoming introduction of the General Data Protection Regulation (GDPR). Iain Wilson, managing partner of Brett Wilson LLP, considers the issues at hand.
The Prime Minister has indicated that the Law Commission will review legislation “to ensure that the criminal law, which was drafted long before the creation of social media platforms, is appropriate to meet the challenges posed by this new technology”. A new “social media code of practice”, providing guidelines for content and conduct and how companies report abuse is also proposed.
It is now just over two years since the Court of Justice of the European Union first ruled that Google was a data processor and that the principles of EU Directive 95/46/EC (‘the Data Protection Directive’), and the various national legislation that implement them, applied to its search results. The specific right to have search results which are in breach of data protection principles removed or ‘de-listed’ was coined the ‘right to be forgotten’ (see the judgement and our blog piece from May 2014). From June 2014, Google implemented a system whereby people, or their legal representatives, could make requests for removal of specified results retrieved on searches of their name, and Google would consider whether the search results complained of were, in its view, likely to be compliant with the data protection principles. Where they acceded to a request, the search results would be delisted from searches made for that person on Google’s European domains e.g. Google.co.uk, Google.fr, Google.de etc. In November 2014, an EU Working Party set up under Article 29 of Directive 95/46/EC published guidelines which suggested this approach by Google was insufficient as it did not ‘guarantee the effective and complete protection of [data protection] rights’ and that the law could be ‘easily circumvented’ by the use of non-EU domains, including, most significantly, Google.com. Google nevertheless declined to widen the scope of its delisting.At the same time, various individuals across the EU lodged complaints about Google with their respective data regulators. Such complainants included people whose requests had been acceded to by Google, but whom were unhappy that the scope of the filtering did not extend to non-EU domains. On 21 May 2015, the French regulator, Commission Nationale de l’Informatique et des Libertés (‘CNIL‘), issued an enforcement notice against Google requiring it to extend delisting to all its domains within 15 days. Google requested time to consider its position, and, having unsuccessfully sought to have the notice rescinded, ultimately failed to comply. CNIL therefore issued proceedings against Google, and a hearing was listed before its Restricted Committee. In October 2015, the UK regulator, the Information Commissioner’s Office (‘ICO’) followed suit, amending an existing enforcement notice against Google to include a request that search results be delisted from all versions of Google directly accessible from within the UK (note this demand was worded more narrowly than that made by CNIL). Google appealed against the enforcement notice, and therefore the matter was listed for a hearing before the Information Tribunal.
Google has succumbed to pressure from European data regulators and announced a wider system of delisting where it agrees to remove search engine results under the so-called “right to be forgotten” principle.
Brett Wilson LLP partner Iain Wilson features in the latest edition of the UK’s biggest student newspaper The Tab in an article by Bob Palmer on how the internet can turn against you. A copy of the article can be found here.
The Deputy Information Commissioner, David Smith, has indicated that the Information Commissioner’s Office (ICO) may take legal action against Google over its handling of ‘right to be forgotten’ requests. The Article 29 Working Party has also criticised Google for notifying media outlets when URLs from their sites are going to be filtered and for failing to filter URLs from all of its search engines including www.google.com.
Brett Wilson LLP partner Iain Wilson has been interviewed by the New York Times about the fallout from the decision in the ECJ case of Google Spain SL, Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez and the response of reputation management companies