Posted by John North, Partner
On 1 September 2016 Withy King LLP merged with Royds LLP. The trading name for the merged firm is Royds Withy King. All content produced prior to this date will remain in the name of the firms pre-merger.
The Latest Update on the Right to be Forgotten
In 1995 the European Union adopted the European Data Protection Directive (“the Directive”) to regulate the processing of personal data. The objective of the Directive is:
1. To protect the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data (Article 1(1)); and
2. To neither restrict nor prohibit the free flow of personal data between Member States (Article 1(2)).
What is the right to be forgotten?
The term ‘right to be forgotten’ is a relatively new concept and was enforced in the case of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González. If an individual requests that web links to pages concerning his or her personal data be removed on the grounds that he or she wishes that information to be ‘forgotten’, and it is proved to be incompatible with the Directive, then those links must be erased.
In 2010 a Spanish citizen lodged a complaint against a Spanish newspaper, Google Spain and Google Inc. with the national Data Protection Agency. An auction notice of the citizen’s repossessed home appeared on Google’s search results. The citizen claimed that this infringed his privacy rights as the proceedings against him had been resolved a number of years back. The gentleman first requested the newspaper to remove or change the pages so the data relating to him would cease to appear and then he requested that Google Spain or Google Inc. be required to remove the data so it would not appear in the search results.
The case was referred to the Court of Justice of the European Union.
On 13th May 2014 the Court ruled that Google processes personal data by collecting, storing and making it available to users (Article 2(b)). It was also held that as the ‘controller’ in respect of the processing of data, Google must ensure that its activities comply with the Directive’s requirements (Article 2(d)) and remove links to web pages published by third parties.
The judges said that:
1. The Directive applies to search engines such as Google;
2. The Directive applies even if Google’s physical server is located in America because Google has a branch or a subsidiary in a Member State which promotes the selling of advertising space offered by the search engine. Google Spain is a subsidiary of Google Inc. in Spain and is therefore an ‘establishment’ within the meaning of the Directive. When non-European companies offer services to European consumers, the European rules apply (Article 3 of the Directive); and
3. Individuals have the right to have data removed when it is inaccurate, irrelevant, excessive or inadequate for the purposes of the data processing (Article 12 of the Directive).
Google was required to delete access to the irrelevant information but the newspaper was not required to change the archive content in the name of data protection. The newspaper simply made the information ubiquitous, therefore respecting the citizen’s privacy.
Google receives more than 250,000 requests for the right to be forgotten and has approved around 40 percent of these.
Proposals for the Data Protection Regulation
The proposal for a Data Protection Regulation will strengthen the principle underlying Article 12 of the Directive which states that a person can ask for personal data to be deleted once that data is no longer necessary.
The commission has proposed reversing the burden of proof so that the company must prove that the data is needed and is still relevant and therefore cannot be deleted. The proposed regulation places an obligation on a controller to take ‘reasonable steps’ to make it know to third parties that the individual wishes for the data to be deleted. The regulation would allow data protection authorities to impose fines of up to 2% of annual worldwide turnover in cases where companies do not respect citizens’ rights.
The right to be forgotten is not absolute and the proposed regulation aims to strike a balance between the right to freedom of expression and the right to protection of personal data.
For example, the BBC has published an updated list of links which details the stories affected by the removals of links since the ruling above was made. The BBC proposes to update this list every month as a contribution to public policy. The BBC seeks to preserve the integrity of the BBC’s online archive and even though pages concerned remain published on BBC online, the removal from Google searches makes the archive less easy to find.