Guidelines on the implementation of the "right to be forgotten"

The Article 29 Data Protection Working Party has adopted the guidelines on the implementation of the Court of Justice of the European Union’s judgment on ‘Google Spain and Google Inc. vs. Agencia Española de Protección de Datos and Mario Costeja González’ C-131/12 which is expected to adopt common criteria to determine whether it is appropriate or not to de-list personal data at the request of the interested party.

On 13 May 2014, the Court of Justice of the European Union (“CJEU“) issued a judgment on ‘Google Spain and Google Inc. vs. Agencia Española de Protección de Datos (“AEPD“) and Mario Costeja González’ C-131/12 (best-known as the Google judgment) which establishes that search engine operators (excluding search engines included in web pages) are data controllers of the personal data they process. Additionally, the CJEU considers that to the extent that a search engine operator has a branch or subsidiary in a Member State, intended to promote and sell advertising spaces, Directive 95/46/EC will be applicable by virtue of the interpretation given to article 4.1(a). 

The direct result of the exercise of the “right to be forgotten” is the obligation of search engine operators to de-list from the search results those links to web pages obtained through searches made on the basis of a person’s name. In any event, there should be a balance between the subjects’ data protection rights and the interests on the processing of and access to the data. As a general rule, the CJEU establishes that the rights of the data subjects must prevail over the economic interest of the search engines and that of internet users to have access to personal information obtained through search engines. However, in some cases such balance may depend on the nature and sensitivity of the data being processed and on the interest of the public in having access to that particular information. 

In view of the aforementioned, which criteria must be considered when assessing rights and conflicting interests for achieving the “right to be forgotten”? On 26 November 2014, the European Data Protection Authorities assembled in the Article 29 Data Protection Working Party and issued the common guidelines to determine whether it was appropriate or not to de-list any personal data obtained from searches made on the basis of a person’s name, once the operator of a search engine had rejected the request. These criteria have to be applied in the light of the principles established by the CJEU and in accordance with the relevant national legislation, taking into consideration that no single criterion is in itself determining and that all of them should be assessed together. 

The document establishes 13 criteria which may be grouped in different categories. In this sense, depending on the nature of the data subject, the exercise of the “right to be forgotten” will not be treated in the same manner if the subject is a simple individual or if he or she is a person that plays a role in public life (among others, politicians or business-people), a public figure or a minor. In any case, the European Data Protection Authorities shall consider that pseudonyms and nicknames are personal data when they allow data subjects to be identified.

The quality and type of the data being processed is another category in which the analysed criteria can be included. Thus, the European Data Protection Authorities will be more likely to consider the appropriateness of de-listing those search results that provide inaccurate information, which could result in receiving an incorrect, inadequate or misleading impression of an individual. Relevance and excessiveness in the processing of and access to personal data is measured on the basis of the data’s age, the impact on the person’s private life (e.g. information not related to working life), any associations with hate speech, slander or libel or similar offences against the data subject and the sensitive or criminal nature of the information. Personal information will be more likely to be de-listed from the search result if it is linked with non-current and out-of-date information.

Other aspects to be considered are the consequences for data subjects as a result of processing and accessing their personal data. In this sense, the prejudice caused to the data subject is a determining factor, in addition to the fact that search results would also allow identity theft or stalking.

The legitimacy to publish personal data on the Internet must be considered to determine if the search results should be de-listed. Therefore, the following issues should be taken into account: if the data subject had consented to the original publication, but could not later revoke this consent, if the publication is based on journalistic purposes or if there is a legal obligation or a legal power to publish such information on the Internet.

In short, the issuance of these guidelines by the Article 29 Data Protection Working Party has shed light on the interpretation of the Google judgment and its application by the European Data Protection Authorities when operators of search engines have rejected the “right to be forgotten” exercised by individuals.