The Right to be Forgotten - Part Two

In May 2014, the Court of Justice of the European Union (CJEU) ruled that search engines, such as Google, assumed the function of a controller and set out the right of data subjects to request the erasure of personal data that is ‘inadequate, irrelevant or no longer relevant’. 

Search Engine Delisting Process

As a result of the CJEU ruling and the changing regulatory landscape set in motion by the General Data Protection Regulation (“GDPR”), Google has implemented a request process whereby people wishing to exercise their right to be forgotten can lodge the following procedure:
i.    A complaint through an online form is lodged;
ii.    Google investigates the case based on specific criteria;
iii.    If Google rejects the request, the individual can lodge a complaint before a local court or competent authority such as the Data Protection and Information Commissioner in Malta. 
iv.    If the complaint is acceded to, the search engine result containing the individual’s name or other personal data is removed from the specific search engine results.

The four criteria set out by Google to assess a request

1. The individual’s role in public life
It is more likely that the request will be granted for an individual with no distinct role in public life, than for ones with a clear role in public life.  

2. The nature of the information. 
If the type of information relates to an individual’s strong private interest, such as personal finances, private contact or identification, it will be more inclined to be erased. Information that is related to public interest, such as political discourse or criminal activity is not.

3. The source of the information
This criterion is dependent on the credibility of the source of information. 

4. The time of the publication 
If the information was published at a time where the individual had a more prominent role in public life but it has subsequently changed, this criterion will have more weight.  

 
The Effects of Delisting Data on a Search Engine

If the request is accepted, search engine operators will delist the URLs in dispute from the search results. Therefore such data is no longer searchable. However, the content may still appear on the website where the personal data originates from. It is up to the individual who is lodging the request to take action to ensure such content is erased. 

It is also important to bear in mind that the right to be forgotten is not an absolute right that is acceded to upon the data subject requesting it. At first instance, it appears to be within the search engine operator’s discretion to decide whether to accede to the individual’s request based on a case-by-case assessment. 

In certain cases, assessing a request against the above criterion and preparing a strong submission case to the search engine operator can determine the outcome of whether a complaint is acceded to or not.  

The GDPR

There is no doubt that the entry into force of the GDPR in May 2018 will bolster the right to be forgotten. The regulation makes it amply clear that this right will apply to all data held by controllers established in the EU, or those processing personal data on subjects located in the EU, and subject to certain exceptions, all data controllers must comply with requests for the erasure of any data.

The exceptions to this rule are rather rigid and relate to considerations such as overriding legitimate grounds for processing or legal obligations to retain data (such as statutory retention periods provided by law). Additionally, the GDPR will also introduce the right of rectification, whereby data subjects will be able to request that any inaccuracy or incompleteness relating to data held about them by controllers, be rectified and amended. 

The GDPR will accentuate the rights of data subjects as well as the obligations incumbent upon controllers and processors of data throughout the EU, and will provide a clearer and more robust system of data protection, with data subjects and their privacy at the heart of its considerations.