Four things we’ve learned from the EU Google judgment

By David Smith, Deputy Commissioner and Director of Data Protection.

*UPDATE, 05/06/14: Google has now published a form allowing people to apply to have search results linked to their name removed. The Article 29 Working Party, which brings together data protection authorities from across Europe, has also now commented on the judgment.

ico-blog-search-bThe Court of Justice of the European Union grabbed headlines last week when it ruled in favour of a man who wanted Google to remove information about him from its search results. Here, we reflect on what we’ve learned from that judgment.

We’ve also produced a brief overview of what we see as the main points of the judgment.

Let’s imagine an Adam Brown puts his name into a search engine. The list of results includes a link to a webpage that contains personal information about him. This judgment ruled that if the way that information is being used doesn’t fit with European data protection law, for instance if it is inadequate, irrelevant or outdated, then Adam can request that the link is removed from future search results. The search provider will have to comply unless there is an overriding public interest.

He’ll need to contact the search company to remove links from search results, and if the search provider refuses the request, he can contact the ICO.

This judgment was only made last week, and the companies will need some time to work out how they’re going to handle this. We won’t be ruling on any complaints until the search providers have had a reasonable time to put their systems in place and start considering requests. After that, we’ll be focusing on concerns linked to clear evidence of damage and distress to individuals.

2. There’s life in the data protection law yet

This is a judgment that we welcome. It sets out a framework to hold data controllers operating online search engines to account for the personal data they process. It also backs our view that search engines are subject to data protection law, clarifying an area that was previously uncertain.

It’s worth noting that the judgment does all this under the existing European Data Protection Directive. Some critics have previously suggested the law is no longer fit for purpose – and indeed we’d still back calls for it to be updated – but this ruling shows the existing directive can still be relevant when discussing modern data protection issues.

There are some who are seeking to draw out much wider implications of the judgment for freedom of expression in general.  It is important to keep the implications in proportion and recognise that there is no absolute right to have links removed. Also, the original publication and the search engine are considered separately: the public record of a newspaper may not be deleted even if the link to it from a search website is removed.

We recognise that there will be difficult judgments to make on whether links should be removed. It is also important to remember that the exemption for journalism, art and literature under section 32 of the Data Protection Act can be applied by media organisations, bloggers and other publishers of information, depending on the circumstances.

What this is not, then, is a full or absolute ‘right to be forgotten’. As we previously indicated in our analysis of the draft European Data Protection Regulation, such a right would be a valuable tool in enabling individuals to have stronger rights in terms of controlling the dissemination of information about them. But our concern remains how this can be achieved in practice and how to set reasonable expectations for the public about how such a right can operate. The right to be forgotten can help reduce privacy intrusion but we have to be realistic about how difficult it can be to completely remove all traces of personal information online.

4. This is the beginning, not the end

The judgment might mark the end of a lengthy legal process, but it marks the beginning in terms of how a decision in Luxembourg affects the man in the street here in the UK.

Although compliance with the judgment is primarily a matter for the search engines, there is now a key responsibility for the data protection authorities, including the ICO, to interpret and apply this judgment to concerns raised with us. We believe the judgment provides space to strike a balance between the right to privacy and the public’s right to know, recognising the role search engines play in facilitating access to information in today’s society. Guidance will be needed from data protection authorities to ensure search providers take the right approach.

We will be discussing this issue with our fellow European Data Protection Authorities in the Article 29 Working Party at the start of next month, to ensure a consistent approach is taken across Europe. Once we have done that we will be speaking to the main search providers established in the UK.

In the meantime, we expect search providers to start the process of considering what solutions are needed to deal with requests to remove links. We recognise that the challenge is logistical and technical. Any solutions should enable appropriate consideration to be given to each case, and should reflect a judgment that upholds the data protection rights of individuals.

Last updated 20/05/2014 16:30

David SmithAs well as providing Data Protection leadership across the ICO, David Smith has direct responsibility for oversight of its Strategic Liaison Division which develops and manages the ICO’s relations with its key stakeholders.
This entry was posted in David Smith and tagged , , , , , , , , , , , . Bookmark the permalink.

15 Responses to Four things we’ve learned from the EU Google judgment

  1. Pingback: Four things we’ve learned from the EU Google judgment - IT Policy

  2. Pingback: UK reacts to Google 'right to be forgotten' ruling | Geovanny Poveda Home Page

  3. Pingback: UK reacts to ‘right to be forgotten’ | Headline News Today

  4. Pingback: UK reacts to ‘right to be forgotten’ : One Caribbean Radio | The Global Mix

  5. Pingback: XpressVids.Info | UK reacts to ‘right to be forgotten’

  6. Mike Henson says:

    This is the most rediculous piece of legislation I’ve yet seen. It just goes to show that governments and other meddlers are trying, in vain, to control something that they don’t understand. If you want something taken down from the internet you take it up with the webmaster of the site, the owner (if different) and if all else fails, the hosting company.
    Does anyone really think that this is going to work. Whos is going to police the hundreds of search engines that exist throughout the world. See

  7. Pingback: Warren Fyfe | UK reacts to ‘right to be forgotten’

  8. Pingback: UK reacts to ‘right to be forgotten’

  9. Pingback: UK reacts to ‘right to be forgotten’ | Efstathios Karanikolaidis

  10. Pingback: UK reacts to Google ‘right to be forgotten’ ruling – BBC News | GreatNewsUpdate

  11. Pingback: UK reacts to ‘right to be forgotten’ | News Leech

  12. Pingback: UK reacts to ‘right to be forgotten’ |

  13. John Leach says:

    Quick reactions calling this decision “ridiculous” or “a new form of censorship” do not help. There are some good points made by the ECoJ but there is also much to be discussed and challenged. For example, the ECoJ talks about finding a fair balance between the rights of the individual and the interests of the public but does not seem to find a fair balance between the responsibilities of the search engine operator and those of the publisher. Even with publishers having been granted a limited exemption under Section 32 of the DPA, they still have responsibilities. Their inability to make their materials more readily available without the assistance of search engines should not let them off the hook.

    • Mike Henson says:

      The search engines are like libraries, they hold all the information and their index shows you where to find it. The library is not responsible for whats printed in the book so why is the search engine. If someone wants something removed they should contact the owner of the website.

      • John Leach says:

        I agree, they should. But the ECoJ decision is based on two points. The first is that search engines do significant processing that adds significant interference to an individual’s rights over and above the prior publication of the constituent parts. The second is that publishers who publish for journalistic purposes are exempt from most of the provisions of European Data Protection legislation, including the requirements to ensure accuracy, completeness, and currency. For this reason, the ECoJ could not require the publisher to remove outdated data either in place of or before the search engine operator has to remove links. If the publisher is not required to remove outdated data, there is no protection for the individual in telling them they have to address their request to the publisher.

Leave a Reply