ICO serves first 'right to be forgotten' enforcement notice on Google

The Information Commissioner's Office (the ICO) has served an enforcement notice on Google Inc requiring it to delist nine specific search engine results within 35 days.  This is understood to be the first formal enforcement notice served by the UK regulator on the US online giant in relation to a 'right to be forgotten' request.

The anonymous complainant originally requested that Google filter certain results returned on a search for his name under the 'right to be forgotten' principle established in the case of Google Spain SL, Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez (Case C-131/12).  In this case the European Court of Justice held that Google is a 'data controller' for the purpose of EU data protection legislation (incorporated into English law as the Data Protection Act 1998) and has an obligation to filter its search results where the results against a search for a person's name are "inadequate, irrelevant, no longer relevant or excessive” and there is not a preponderant public interest.  Of wider application, the categorisation of Google as a 'data controller' meant that it has to comply with the provision of the Data Protection Act 1998 and the 'Data Protection Principles'.

The complainant's original request concerned the indexing of webpages referring to a nine-year old minor criminal conviction, which was 'spent' under the Rehabilitation of Offenders Act 1974.  Google agreed to filter links to the webpages from its search results (against a search for the individual's name), agreeing that they were no longer relevant and were having a negative impact on the individual's privacy.   However, Google also notified the publishers of the webpages.  This in turn lead to a number of websites running stories on the removal of the links themselves.  These webpages identified the complainant, referred to the original spent conviction and the filtered pages.  The complainant therefore made a second request to Google that these links be removed (as against a search of their name).  Google refused to remove the new links on the basis that the filtering of search engine links was a separate story in itself and a matter of public interest.

In ruling against Google the ICO held that whilst it agreed that the removal of search engine links was a matter of public interest in itself, the identity of the complainant was not.  It was not necessary, or indeed proportionate or fair, for links to the personal data to be produced against a search of the complainant's name.  By returning these webpages against a search for the individual's name Google was causing the complainant to suffer unwarranted damages and distress.  The ICO found that this was a breach of the Data Protection Principles/Data Protection Act 1998.

Google may, if it wishes, seek to appeal the ICO's decision to the First Tier Tribunal.  Unless the decision is overturned Google must filter the results within 35 days.  Failure to comply with an enforcement notice is a criminal offence under section 47 of the Data Protection Act 1998.

A copy of the ICO's press release can be found here.

A copy of the ICO's enforcement notice can be found here.