How to exercise your right to be forgotten?

1.  Implementation of the Ruling of the European Court of Justice

As a result of the ruling Google Spain and Google Inc. v. Spain of 13 May 2014, the European Court of Justice held that Google (and search engines in general) should remove search results, on the request of an individual. Google has complied with the ruling and has implemented a request process.

Through the use of a standard form, an individual can make an official request to have specific URLs removed that include their name.

Google is responsible for deciding whether the URLs should be removed from the search results. In its decision, Google will take different criteria into account such as the individual’s role in public life, the nature of the information, the source of the information and the time of publication.

If Google would reject a request, an individual can lodge a complaint before the national privacy authority or before a local court.

2. The advisory council to Google on the right to be forgotten

Google also appointed an advisory council, who acted as independent experts to advise Google on how to follow to ruling and how to perform the balancing act between an individual’s right to privacy and the public’s interest in access to information.

The advisory council exists of 8 specialists in the field of data protection. The Advisory council states that all members have volunteered to participate and that they were not paid by Google to do so. They did not sign a nondisclosure agreement, nor are they in a contractual relationship with Google.

The advisory council rendered a report on 6 February 2015 in which they gave various recommendations on the criteria for assessing delisting requests, as well as on the procedural elements that should be in place.

They identified four primary criteria on which they advised Google to evaluate requests from individuals.   

• One of the main criteria is the individual’s role in public life.It is more likely that a request will be granted for an individual with no discernable role in public life than for individuals with a clear role in public life. Whether an individual with a limited or context-specific role in public life can lodge a successful delisting request, the content of the information will be decisive.

• Another criterion is the nature of the information.The advisory council listed types of information that will more likely bias towards an individual’s strong privacy interest. This is information related to personal finances, private contact or identification, information revealing ethnic origin or religious beliefs. The advisory council adds that information appearing in an image or video form can heighten an individual’s privacy interests.On the other hand there is also information that is more bias towards a public interest, such as information relevant to political discourse, information relating to public health and consumer protection or information related to criminal activity.

• A third criterion is the source of the information. The advisory council states that if the source is a journalistic entity, there will be a greater public interest in accessing the information.

• The fourth and last criterion is the time of publication of the information. This criterion has more weight if the individual’s role in public life is limited or has changed.

3.  The right to be forgotten provided by the General Data Protection Regulation (GDPR)

The GDPR, that enters into force on 25 May 2018, provides a specific legal ground to invoke the right to be forgotten or the right to erasure. 

Pursuant to Article 17 of the GDPR the individual has the right to obtain from the controller the erasure of personal data without undue delay. The controller shall have the obligation to erase the personal data under certain circumstances. For instance, when personal data is no longer necessary in relation to the purpose for which they where collected, or of the data subject has withdrawn his consent, the right to be erased can be applied. 

If personal data has been made public, the controller has to take reasonable steps, including technical measures, to inform controllers, which are processing the data, that the data subject has requested the erasure. 

However the GDPR provides a few exceptions. The controller will for example not have to erase the data of the processing is necessary for exercising the right of freedom of expression and information, for compliance with legal obligations, for reasons of public interest in the area of public health, for achieving purposes in the public interest, scientific or historical research of for the establishment, exercise or defence of legal claims. 

4.  Actual delisting of the results

If the request is granted, Google will delist the URLs in question from the search results.

The content itself will of course not be removed. Google will not contact the webmasters, nor will it take any other action. It is up the individual to take further steps if he wants the actual content to be removed as well.

At first the URLs were only removed on the result list on the local Google domains, such as Google.be or Google.fr. The other Google domains, and in particular the Google.com remained unaltered.

As pointed out in a previous article, the exercise of the right to be forgotten was rather ineffective since the unwanted results could easily be found on other Google websites.

Hence, the French Data Protection authority (CNIL) demanded that Google removed the URLs on a global scale. After a bit of hesitation, Google suggested to delist the results on all Google domains within the country of the individual. This means that the removal of certain results is still geographically determined. If the request of a Belgian individual is granted, the URLs will not be visible on any Google website accessed from Belgium, but outside Belgium they could still appear.

However, the CNIL was not satisfied with Google’s proposal and ordered that the URLs should be removed from the results, irrespective of the location of the individual. The CNIL has fined Google with the amount 100.000 Euro.

Removal from national domains of Google’s search engine within the EU is the appropriate means to implement the ruling of the ECJ

In this regard is should be noted that the advisory council paid attention to the geographic scope for the delisting and it came to the conclusion that removal from national domains of Google’s search engine within the EU is the appropriate means to implement the ruling of the ECJ.

There is some doubt whether the demands of the CNIL will be upheld. Although the current situation still makes it possible to circumvent the right to be forgotten, it remains a question whether the CNIL can order that Google to change its search results outside of France.

In May 2016 Google lodged an appeal against the decision of the CNIL. The court has not rendered its judgment yet.

5.  Conclusion

Since the launch of the official request process in 2014, Google received 568.881 requests, to remove 1.727.251 URLs. According to its own statistics, Google removes approximately 43,2% of the URLs in question.

If you would want to exercise your right to be forgotten, we can assess whether or not a request would be successful and we can guide and assist you in this process. 

Do not hesitate should you have further questions on this topic.