By David Smith, Deputy Commissioner and Director of Data Protection.
It’s almost 18 months since the EU Court of Justice ruling on search results, and while it’s an appropriate time to reflect on the immediate effects of the judgment, there’s no doubt that for many these effects will have been something of an anti-climax.
The sky has not fallen in. No books have been burned. Serious criminals aren’t free to rewrite their own histories. And the internet has not stopped working.
Indeed, perhaps the first thing to reflect on is that we haven’t seen the avalanche of cases coming to us that some predicted. We’re receiving a fairly consistent 25-45 cases coming to us each month, of which 60% are eligible for an ICO decision. The rest typically don’t involve personal data being processed (eg the search was not against an individual’s name) or fall outside our UK jurisdiction.
And it seems appropriate to nip the ‘criminals rewriting history’ myth in the bud early too. Around a third of the cases we’ve considered have related to criminal convictions in some way. The fact that search results referred to minor, historic convictions was a relevant factor in a quarter of the cases where we’ve ordered Google to take down results. And the fact that results referred to serious or recent convictions was a relevant factor in 34% of the cases where we’ve agreed with Google’s decision not to take them down. It’s not necessarily our role to defend the judgment, but those figures, taken in the context of how few actual cases they refer to, do not seem alarming.
Of course, past criminality isn’t the only reason people have looked to use this ruling, and cases typically involve consideration of several of the criteria we’ve published as being central to our decisions.
More often than not, the process ends with us agreeing with Google’s decision. That is most commonly because we consider that the information was factually accurate.
We’ve disagreed with Google’s decision in around a third of the cases we’ve ruled on. The most common factor in those decisions has been that the passage of time means the information is no longer relevant.
While implementation of the ruling is still an evolving area of law, I’m sure many in the data protection community will be reassured to see well-established ‘DPA phrases’ in the criteria we consider. The fact remains that this was a new judgment based on existing law, and our approach remains very much rooted in our extensive experience of regulating compliance under that law. And where the judgment breaks new ground, we’re adapting quickly and working with European partners to ensure consistency.
Enforcement is a good example of this. In August we issued our first enforcement notice in this area, ordering Google to remove nine search results brought up by entering an individual’s name. Google has so far responded constructively, and the links are no longer visible on the European versions of their search engine. However we consider that they should go a step further, and make the links no longer visible to anyone directly accessing any Google search services from within the UK (this would include someone sat a desk in Newcastle, but using google.com). This is a proper and proportionate reflection of what the EU Court of Justice ruling means in practice, and so we’ve clarified the original enforcement notice, with the original text remaining the same but with a new section added spelling out exactly what we expect of Google. The company now has a month to make the changes or appeal against the clarified notice.
Last updated 02/11/2015 15:00
|As well as providing Data Protection leadership across the ICO, David Smith has direct responsibility for oversight of its Strategic Liaison Division which develops and manages the ICO’s relations with its key stakeholders.|