Do you have a right to request search engines to remove your personal data, i.e. Right to be Forgotten?

Internet has a long-term memory. Have you ever thought about your “right to be forgotten”, which means, can you delete your personal data from the web? Though the question sounds simple, and in India, perhaps, never-heard-of, the issue has generated never-ending debate worldwide.

In May 2014, European Court of Justice (“ECJ”) ruled in Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, C-131/12. In this case, a Spanish national lodged a complaint with Spanish Data Protection Agency that when an internet user enters his name in the search engine of the Google, the list of results displays links to two pages of La Vanguardia’s newspaper, which contain an announcement for a real-estate auction being organised following attachment proceedings for the recovery of social security debts owed by the Complainant from 16 years ago. The truth was that the attachment proceedings concerning him had been fully resolved long time back and reference to them was entirely irrelevant at the time of complaint,

The Complainant, therefore, requested that La Vanguardia be required either to remove or alter the those two pages or to use appropriate tools so as to protect the data. He also requested that Google Spain or Google Inc. be required to remove or conceal his personal data so that it should no longer appear in the search results or any of the links to La Vanguardia.

As against La Vanguardia, the AEPD rejected the complaint on the ground that the information in was lawfully published by it. However, as against Google Spain and Google Inc., it upheld the complaint. Thereupon, Google Spain and Google Inc. brought two actions before the National High Court of Spain, claiming that the AEPD’s decision should be annulled. Thereafter, the Spanish court referred the matter to the European Court of Justice (ECJ).

Major Observations of ECJ:

• By searching automatically, constantly and systematically for information published on the internet, the operator of a search
  engine ‘collects’ data within the meaning of the EU Directive. The operator, within the framework of its indexing programmes, then ‘retrieves’, ‘records’ and ‘organises’ the data in question, which eventually gets ‘stored’ on its servers and thereafter the same is ‘disclosed’ or ‘made available’ to its users in the form of lists of results. ECJ held that these operations must be classified as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data.
• The operator of the search engine is the ‘controller’ in respect of that processing, within the meaning of the directive, given that it is the operator which determines the purposes and means of the processing.
• Inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive’s requirements.
• Such operators are, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name.  Therefore, following a request made by the data subject, if it is found that the inclusion of  those links in the list is, at the this point in time,  incompatible with the directive, the links and information in the list of results must be erased. The Court also observed that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed. Therefore, the question to be examined is whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that is the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made. Thus, a fair balance should be sought in particular between that interest and the data subject’s fundamental rights, in particular the right to privacy and the right to protection of personal data. However, no interference with such data can be justified merely on the ground of economic interest which the operator of the search engine may have in the data processing.
• Pursuant to this judgment, Google has taken progressive steps towards complying with the European Union’s new “Right To Be Forgotten”. It has created a new form allowing those in the EU to request take down of URLs they dislike. However, as of today, this feature/form is available only for one of the 28 European Union countries and four non-EU countries, viz. Iceland, Liechtenstein, Norway and Switzerland.

This was a landmark ruling which came as a big surprise and was heavily criticized by free-speech advocates in the U.S., who considered the judgment as pro-censorship ruling, putting search engines in a difficult position as an arbiter of what people have a right to know. In this regard, Lila Tretikov, Executive Director of the Wikimedia Foundation in her blog post commented- The ruling “is undermining the world’s ability to freely access accurate and verifiable records about individuals and events.” However, the privacy activists later explained that the reaction was overblown as results would only be removed from individual name searches, not from all of Google’s search results. (This means, a user can simply change their preferences to use the unfiltered U.S. version where they can still have access to such data).

At present, a new draft Regulation on Data Protection is in the offing by the European Parliament which is keen on introducing a wider and more explicit ‘right to be forgotten’. On the other hand, the loudest criticism is coming from Wikipedia which has received notices requesting at least 50 of its links to be deleted from the website.

Author: Vivek Verma

Image from here

Important Links

• Full Text of the Judgment
• Explanation Posted by Google on its website
• Read More
• Wikipedia’s Criticism of the Judgment
• Figures on ‘right to be forgotten’ requests received by Google