On November 26, 2014, Article 29 Working Party (“WP29”) published the Guidelines for the implementation of the European Court of Justice (“ECJ)’s recent decision in the Costeja case, C-131/12 (“right to be forgotten” decision), holding that data subjects have a right to obtain the de-listing of links appearing in the search results based on a person’s name.
Most importantly, WP29 opines that de-listing decisions must be implemented as to “guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented”. As a consequence, any case de-listing should be effective on all relevant domains, including .com.
The Guidelines consists of three parts: an executive summary, a guide for the interpretation of the ECJ judgment and a list of criteria for appeals from people whose requests to remove information from search results under their name have been turned down by search engines.
From the EXECUTIVE SUMMARY of the Guidelines:
1. Search engines are qualified as data controllers.
2. A fair balance between fundamental rights and interests is sought. “The rights of the data subject prevail, as a general rule, over the economic interest of the search engine and that of internet users to have access to the personal information through the search engine”. However, a balance of the relevant rights and interests has to be made and the outcome may depend on the nature and sensitivity of the processed data and on the interest of the public in having access to that particular information. The interest of the public will be significantly greater if the data subject plays a role in public life”.
3. The impact of the de-listing on individuals’ rights to freedom of expression and access is limited by the interest of the public in having access to the information.
4. No information is deleted from the original source and the original information will still be accessible using other search terms, or by direct access to the publisher’s original source.
5. Data subjects do not have any obligation to contact the original website. Search engines act as a controller and data subject can exercise their right according to EU provisions.
6. Data subjects’ entitlement to request de-listing: “Under EU law, everyone has a right to data protection. In practice, DPAs will focus on claims where there is a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident of an EU Member State.”
7. Territorial effect of a de-listing decision shall not be limited to EU domains, but it should be effective on all relevant domains, including .com
8. Practice of informing the public that “the list of results to their queries is not complete as a consequence of the application of European data protection”? Possible only “if the information is presented in such a way that users cannot, in any case, conclude that one particular individual has asked for de-listing of results concerning him or her.”
9. No communication regarding the de-listing by search engines is required (or allowed) to webmasters whose pages are “affected by de-listing”
In addition the Guidelines:
– give an INTERPRETATION OF ECJ JUDGMENT
– inform on how the DPAs intend to implement the Costeja judgment. They clarified: (a) role of search engines as controllers; (b) data subject exercise of rights; (c) scope of the ruling; (d) duty of communication to third parties; and (e) role of DPAs.
– give a LIST OF COMMON CRITERIA WHICH DPAs WILL USE TO HANDLE COMPLAINTS. While DPAs will decide on a case-by-case basis the complaints following refusals of de-listing by search engines, they will considers the the following factors: 1. Does the search result relate to a natural person – i.e. an individual? And does the search result come up against a search on the data subject’s name? 2. Does the data subject play a role in public life? Is the data subject a public figure? 3. Is the data subject a minor? 4. Is the data accurate? 5. Is the data relevant and not excessive? 6. Is the information sensitive within the meaning of Article 8 of the Directive 95/46/EC? 7. Is the data up to date? Is the data being made available for longer than is necessary for the purpose of the processing? 8. Is the data processing causing prejudice to the data subject? Does the data have a disproportionately negative privacy impact on the data subject? 9. Does the search result link to information that puts the data subject at risk? 10. In what context was the information published? a. Was the content voluntarily made public by the data subject? b. Was the content intended to be made public? Could the data subject have reasonably known that the content would be made public? 11. Was the original content published in the context of journalistic purposes? 12. Does the publisher of the data have a legal power – or a legal obligation – to make the personal data publicly available? 13. Does the data relate to a criminal offence?
Article 29WP Guidelines on the Implementation of the Court of Justice of the European Union Judgment on “Google Spain And Inc V. Agencia Española De Protección De Datos (Aepd) And Mario Costeja González” C-131/12 is available at http://ec.europa….
For information: Francesca Giannoni-Crystal
Follow us on& Like us on