By David Smith, Deputy Commissioner and Director of Data Protection.
It’s now 11 weeks since I last wrote about the Court of Justice of the European Union judgment in the Costeja case.
The publicity given to the judgment has certainly raised awareness of people’s data protection rights, and we understand that several thousand search results and URLs have already been taken down, showing that the judgment is starting to have an effect. Whilst a small number of often borderline cases have generated negative media headlines, even Google has recognised that the removal of links from search results can have a real benefit.
In this early phase it is important for the search engines, firstly, to give members of the public the opportunity to ‘tell their story’ in terms of explaining why a search result is problematic and, secondly, to give people a reasonable explanation when they refuse a take-down request. This is important in terms of transparency but will also ensure that we have all the information we need to adjudicate on complaints.
So far we’ve not seen many complaints to the ICO, but we expect the numbers to increase. We’re about to update our website with advice on when an individual should complain to us, what they need to tell us and how, in some cases, they might be better off pursuing their complaint with the original publisher and not just the search engine. When we handle a complaint we won’t require a search result to be taken down just because someone requests this. In most cases we won’t be able to progress the complaint unless we have a reasonable explanation of why a particular search result is having a negative effect on the individual’s right to privacy. We need this if we are to properly assess where the balance lies between protection of the individual’s privacy and the interest of internet users. We will also consider, on a case by case basis, whether it is helpful to advise the complainant to contact the original publisher to have content taken down, bearing in mind the special protection given under data protection law to journalism, literature and art
The next period is going to be challenging in terms of the volume of complaints we may receive and the complexity of some of the issues we’ll be dealing with. However, we will draw as much as possible on our existing data protection and freedom of information expertise. We will act in a way that defends individuals’ privacy rights whilst recognising the special role search engines play in facilitating public access to information.
As the judgment applies across the EU, it’s also important there’s a consistent approach by the European data protection authorities. We’ve been working closely with the Article 29 Working Party that brings us together with our counterparts, notably meeting with the main search engines, and we expect to see principles for dealing with take-down requests published in the autumn.
Domestically, we’ve seen a certain amount of confusion over what the judgment actually said. The big change was that it said search engines are data controllers and so have to play by the data protection rules. We think this is something to be welcomed. What hasn’t changed is that we are still dealing with familiar data protection issues: whether personal data is inaccurate, excessive, out of date etc, and balancing personal privacy and the public’s interest in access to information. This ruling hasn’t moved the goalposts in that respect.
It’s particularly important to understand that the judgment was only concerned with the privacy impact of the search results themselves, not with the published content they link to. News stories suggesting a negative effect on the press and on the right to freedom of expression have sometimes been misinformed. Journalism, literature and art enjoy special protection under data protection law, something which search engines do not, as the judgment confirmed.
One aspect of the Costeja judgment that is proving controversial is the question of whether search engines should notify publishers when they take down a search result linking to their content. We can certainly see an argument for informing publishers that a link to their content has been taken down. However, in some cases, informing the publisher has led to the complained about information being republished, while in other cases results that are taken down will link to content that is far from legitimate – for example to hate sites of various sorts. In cases like that we can see why informing the content publisher could exacerbate an already difficult situation and could in itself have a very detrimental effect on the complainant’s privacy. We take the view that, like many data protection questions, this can only really be decided on a case by case basis.
Finally, we were disappointed by the recent report of the House of Lords European Union Committee on the ‘right to be forgotten’. We agree with the Committee that the expression ‘right to be forgotten’ is misleading but criticism of the judgment as unworkable is misplaced, as the initial stages of its implementation have already shown. We explained our views to the Committee at the start of July (though we were surprised to see Google’s own briefing for the Committee was provided in private), and Christopher Graham has now written to members of the Committee offering to keep them informed of developments.
Last updated 07/08/2014 15:00
|As well as providing Data Protection leadership across the ICO, David Smith has direct responsibility for oversight of its Strategic Liaison Division which develops and manages the ICO’s relations with its key stakeholders.|