Citizens erased? – search engines and the right to be forgotten

  • Posted

Increasingly, we live our lives ‘online’, creating digital footprints as we explore and create content. But how indelible are those footprints and what are the implications for our personal privacy?

On 24 September 2019, the Court of Justice of the European Union (CJEU) made two landmark rulings that clarify the limits on an individual’s right to be forgotten.

First, in Google (Territorial scope of de-referencing), the Court ruled that, while you have the right to instruct the operator of a search engine, such as Google, remove links to pages that contain your personal information from searches in certain conditions, this right does not extend to searches made from outside of the EU. The Court’s reasoning was that the GDPR was formulated to maintain a balance within the EU between the right to be forgotten and the right to freedom of expression. However, the GDPR was not written to take into account conditions in countries outside of the EU, and the CJEU was concerned that extending the scope of the Regulations could see them being used by oppressive regimes to “forget” dissenting opinions or evidence of corruption. As a consequence of the ruling, personal information can still be accessed by people outside of the EU, or from anywhere by anybody using Virtual Private Network (VPN) software, even if someone successfully applies to Google to have their personal information forgotten.

Second, in GC and Others (De-referencing of sensitive data), the Court reaffirmed their previous decision in Google Spain and Google that search engines definitely count as data controllers and so can be asked to forget individual’s data. However, the Court ruled that requests to be forgotten can be refused in some situations. This would apply if the operator believes that the right to freedom of expression of the publisher and the interest of the general public in having the information outweigh the right to privacy of the person whose personal information it is, even if that information is especially sensitive. Regarding information about criminal proceedings involving individuals, the Court ruled that, even if the operator refuses to forget the information, they must list updates to the proceedings in order of most recent first. This is to ensure that the overall picture the search gives is of the current legal position.

While the impact of both decisions on individuals within the EU might be contentious, it is undeniable that they are significant victories for Google and other search engine operators. The decisions reduce the operational burden for search engine operators to comply with the law while providing clarification on the degree of allowed discretion that they have in dealing with requests to be forgotten. Taken together, the two rulings place the ball firmly in the court of the search engine operator to decide whether the balance of right to be forgotten and right to freedom of expression tips one way or the other.

If you host personal information on your website, including news stories, telephone numbers, or pictures of individuals; have had your request to be forgotten refused by a search engine operator; or have any other concerns regarding the GDPR either from an individual or business perspective, please contact us.