The Right to be Forgotten
2 November 2022
The right of a data subject to request the deletion of their personal data by a data controller has become commonly as “The Right to be Forgotten”. It is a judicially-created principle which was first carved out of the Data Protection Directive 95/46 in the seminal case of Google Spain,[1] and is available under particular circumstances. While the right in theory exists against any data controller, it has been most commonly used in applications against Google to have personal data removed from the search engine results which it provides.
Since Google Spain, the right has been placed on a legislative footing by Article 17 of GDPR, and Section 92 of the Data Protection Act 2018. It should be noted that it is often considered in conjunction with the related “right to rectification”, which allows a data subject to require that inaccurate data about them be rectified by the controller.
While these are two separate rights under the GDPR – rectification comes under Article 16, while erasure comes under Article 17 – it is perhaps unfortunate that they have been conflated into the one section in the 2018 Act. For this reason, an application under Section 92 may be incorrectly referred to as a “Right to be Forgotten” application, when in reality what is sought is a rectification order.
The nature of the right
The Right to be Forgotten, under provides for a data subject’s right to seek erasure of personal data when it meets any of the six criteria listed in Article 17(1).
1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the data subject withdraws consent on which the processing is based;
3. the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
4. the personal data have been unlawfully processed;
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
6. the personal data have been collected in relation to the offer of information society services.
The most common bases for seeking erasure are that the information is no longer necessary or relevant, and that the grounds for its continued existence are outweighed by the personal rights of the data subject.
It should be stressed at the outset that the term ‘forgotten’ can be misleading, suggesting as it does that all traces of the data to which the applicant objects are expunged from the internet, and no longer available to users. This is incorrect, for a variety of reasons:
1. As suggested above, the vast majority of ‘Right to be Forgotten’ applications are made against Google. Even if an applicant is successful in having search engine results delisted by Google, however, this does not mean that the underlying article is removed from the internet as well. In order to achieve that, a separate application would have to be brought against the primary publisher.
2. Even if an application against a search engine provider is successful, this only results in the links that are returned following the inputting of the applicant’s own name as a search term being removed. It does not result in all links to the particular publication being removed. If the link, for example, concerned court proceedings, inputting the name of a different party to those proceedings would still return a link to the website page that the applicant sought to have delisted.
3. The right does not generally extend to internal search engines on websites, on the basis that such searches will not establish a complete profile of the affected individual and the results will not have a serious impact on them.
4. As recently confirmed by the CJEU in Google v CNIL,[2] search engine operators have no obligation to remove information from search engines accessible outside of the EEA.
The origin of the right
In Google Spain, a Spanish lawyer, Mario Costeja Gonzalez, lodged a complaint with the Spanish Data Protection Authority. In 1988 Mr Gonzalez had been the subject of attachment proceedings, when real estate property he owned was auctioned off in satisfaction of a social security debt. When Mr Gonzalez’s name was entered into Google’s search engine, links to two newspaper reports, which covered the proceedings, were presented to users. Some 12 years later, he requested that the articles which appeared in La Vanguardia newspaper’s online archive be removed, and also that Google be obliged to remove any links that referred to the proceedings, on the basis that the attachment proceedings concerning him had been fully resolved for a number of years and that any reference to them was now irrelevant.
While the Data Protection Authority rejected the complaint in respect of the newspaper archive, it upheld the complaint pertaining to the search engine results. It ordered Google to adopt the necessary measures to remove personal data relating to Mr González from its index, and to prevent access to the data in the future. When Google appealed the decision, the national court referred questions to the CJEU, which resulted in the oft-quoted decision.
In response to the central question as to whether a data subject has the right to seek the erasure of the search engine results, the CJEU stressed the significance of internet search engines in terms of data protection rights, the influential role they possess in the moulding of public opinion, and the greater prominence they often give to the dissemination of information than the web page which publishes it in the first place.[3]
The Court concluded that deletion of the search engine results could be performed independently of a deletion of the underlying article to which it links, and could be ordered even in circumstances where the underlying article was lawfully published.’[4]
Following the decision in Google Spain, the Article 29 Working Party produced a set of guidelines as assistance to domestic courts as to what factors should be considered when assessing a delisting request.[5] They include:
1) the degree to which the data subject is a public figure;
2) whether the data subject is an adult or a child;
3) whether the data relates to the data subject’s working or private life;
4) does the data contain special categories of personal data;
5) is the data published for journalistic purposes;
6) does the data relate to a criminal offence?
Case law on de-listing
There is only one superior court decision in this jurisdiction which has considered the Right to be Forgotten principles from Google Spain, and it is questionable whether it should even have done so. The High Court judgment in Savage v Data Protection Commissioner & Anor,[6] concerned an application by Mark Savage, who had run as a candidate in the North County Dublin local elections in 2014, in relation to a result produced when his name was entered into Google’s search engine. A snippet in the result read “Mark Savage, North County Dublin’s homophobic candidate,” which referred to the title of a discussion thread on reddit.com.
Given the fact that the application sought the rectification of inaccurate data, it is unclear why both the Circuit and High Courts dealt at length with the Google Spain decision, which concerned only an order for the removal of data whose accuracy was not being challenged. While the High Court acknowledged that the appeal was against a decision of the Circuit Court which ordered that inaccurate data be edited by Google, its suggestion that to ‘mandate a search engine company to place parenthesis around a URL heading would oblige it to engage in an editing process which is certainly not envisaged in the Google Spain decision” is a questionable one.[7]
The reason such editing was not envisaged by the CJEU in Google Spain is because it was not required to consider it. The applicant in that case had requested that accurate data be removed, not that inaccurate data be edited, so to consider Google Spainas authority for the proposition that Google cannot be asked to edit its search engine results does not appear to be correct.
Of greater relevance is the decision of the English High Court in NT1 & NT2 v Google,[8] delivered just two months after the decision in Savage, in which the Court provided very useful guidance in relation to the parameters within which future applications of this type may be conducted. The substantive focus of the English case was on the degree to which the continued publication of accurate data had become irrelevant due to the passage of time, and constituted a disproportionate infringement on the claimants’ right to privacy – essentially the same focus as the Google Spain judgment.
The joined cases concerned similar delisting applications against Google’s search engine facility in respect of two, otherwise unconnected plaintiffs, both of whom sought the removal of details relating to their historical criminal convictions, which were presented when their names were entered into Google’s search engine. In the late 1990s NT1 was convicted of criminal conspiracy to defraud the Inland Revenue through false accounting in relation to sums which ran into millions of pounds, for which he received a four-year custodial sentence. NT2’s offences were more minor, and he was sentenced in the early 2000s to six months imprisonment (though he was released on licence after six weeks) for authorising a firm to conduct computer hacking and phone tapping to find out who was engaged in hostile activity against his company.
In refusing NT1’s application, but upholding that of NT2, the Court focussed on NT1’s lack of remorse for, or even acknowledgment of, his criminal wrongdoing. The court linked his lack of contrition, and his continued refusal to admit his crimes, with an evaluation of the degree to which the continued publicising of his criminal history by Google should be considered relevant. In NT2’s case, however, the court placed emphasis on his acceptance of wrongdoing and his remorse when giving evidence, which were factored into an assessment of whether the data processed by Google was still relevant.
The decision of the CJEU in Google LLC v CNIL[9] concerned a discreet aspect of the Right to be Forgotten, namely whether a search engine operator is required to deploy delisting to all of its domain names, irrespective of the place from where the search is conducted. Without suggesting that this form of blocking was undesirable, the court observed that a worldwide delisting order would be problematic, as numerous jurisdictions outside the EU do not recognise the right to delisting, or have a different approach to that right.[10]
The CJEU held it was ‘in no way apparent’ that the EU legislature intended that the scope of delisting orders would apply worldwide by extending it to the national versions of its search engine that do not correspond to the Member States.[11] The CJEU did, however, state that as well as delisting the data pertaining to the data subject from the search engines of EU Member States, Google should take measures to ‘seriously discourage’ internet users in the Member States from being able to access the links which are still available on search engines worldwide.
Applications to Google
It is important to note that applications pursuant to the Right to be Forgotten do not necessarily require court proceedings to be instituted. The first port of call should be the search engine itself, usually Google, which has a dedicated procedure to deal with requests to have search engine results delisted, available here. A complaint may also be lodged with the Data Protection Commission, but the Commission advises individuals to contact Google first, and only contact them if Google rejects the delisting request.
If required, the Commission follows the procedure provided for by section 109 of the Data Protection Act 2018. If it fails to broker an amicable solution between the data subject and Google, it may take one of the actions provided for under section 109((5)(f), which includes the imposition of an enforcement notice on the search engine provider to delist the material.
As of 30 October 2022, the total number of delisting applications made to Google since the Google Spain decision is 1,337,230, relating to 5,204,268 different URLs. In Ireland alone, the number of requests stands at 11,541. As a result of these requests, just under 50% of the requested URLs had been delisted. It is notable that 90% of the requests related to material pertaining to private individuals.[12]
Google’s policy states that it assesses applications in a manner consistent with the Article 29 Working Party Guidelines referred to above. Google’s website provides examples of the type of complaints it receives, and the decisions which it arrived at. In relation to the length of time that it considers is required to have elapsed before it will consider a search engine result to be no longer relevant, it is notable that a decision was made in respect of links to news articles concerning an Irish person who had his personal injuries proceedings dismissed on the basis that social media posts revealed him to have misled the court. Despite the serious nature of allegation, Google considered the fact that the incident took place approximately 10 years previously to mean that sufficient time had elapsed to warrant deletion of the links.
Google has also recently expanded the type of information which can be the subject of a Right to be Forgotten application beyond the traditional issues of material which is prejudicial or no longer relevant. Users are now able to request the deletion of links to web pages which list their phone number, address or potential identifiers, on the basis that such information may hint at confidential log-in credentials and thereby pose a risk for identity theft.
Google does not, however, comment on individual decisions that it arrives at in relation to delisting requests, and was the subject of some commentary in November 2021 when it was revealed that it had acceded to requests from members of businessman Sean Quinn’s family to have numerous links to newspaper articles removed. These articles concerned elements of the Quinns’ private lives, such as the cost of the cake at the wedding of a family member, but also concerned their business dealings with IBRC in respect of the latter’s attempts to enforce personal guarantees against family members.[13]
Potential fines for failure to delist
A decision of the Belgian Data Protection Authority in July 2020 is of interest, as an illustration of the potential risk that Google runs in refusing a delisting request by a user. The anonymised applicant, who played a role in public life, had sought the delisting of 12 links which suggested they had ties to a particular political party and, more importantly, provided links to a complaint of harassment which had been made against them 10 years previously, but which had not been upheld. Google had refused to delist any of the links, and the data subject brought a complaint to the Belgian DPA.
The Litigation Chamber of the Belgian DPA agreed with Google that the links did not reveal any political opinions of the applicant, and as such could not be considered to amount to the processing of special categories of personal data. The Chamber also noted the applicant’s role in public life, which meant that a higher threshold applied before the right to erasure could prevail.
Notwithstanding this, the Chamber confirmed that Google should have agreed to the delisting of four of the links in respect of the harassment allegations on the basis that they were obsolete and no longer necessary. It noted that the articles to which the links were provided were approximately 10 years old, were based on unproven allegations, and that the continued publicising of the allegations could have harmful repercussions in the data subject’s professional and private life. The Chamber imposed a fine of €600,000 on Google.
Conclusion
There is currently little by way of reported decisions in the area of the Right to be Forgotten. This is perhaps a reflection of that fact that many of the complaints are resolved at first instance by Google, and those which are not and are subsequently referred to the Data Protection Commission are currently subject to a considerable backlog.
It is perhaps regrettable that Google, in particular, are not more transparent in relation to their decision-making process when it comes to assessing delisting requests. This is particularly true when an application for delisting is consented to, and the public’s right to receive information may be impaired by the removal of important search results.
With many news media now adopting a “digital first” policy, it is likely that in future all news reports will be indexed by a search engine, leading to an ever-increasing number of applications by data subjects who object to the publicising of material which they would prefer, for one reason or another, to be less conspicuous.
As the law currently stands, whether such material is publicised is largely a decision for the technology giants to make themselves. Given the significant, and ever-growing importance that such search engines play in respect of the public’s fundamental right to freedom of expression, which often comes into conflict with an individual’s right to privacy and their reputation, greater clarity in respect of contours of the Right to be Forgotten is desirable.
[1] Case C-131/12 Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González EU:C:2014:317.
[2] Case C-507/17 Google LLC v CNIL.
[3] Case C-131/12 Google Spain, at para 87.
[4] Case C-131/12 Google Spain, at para 88.
[5] https://ec.europa.eu/newsroom/article29/items
[6] Savage v Data Protection Commissioner and Google Ireland Limited [2018] IEHC 122.
[7] Savage v Data Protection Commissioner and Google Ireland Limited [2018] IEHC 122, at para 39.
[8] NT1 & NT2 v Google LLC [2018] EWHC 799 (QB).
[9] Case C-507/17 Google LLC v CNIL (decision of the Grand Chamber, 24 September 2019).
[10] Case C-507/17 Google LLC v CNIL, at para 59.
[11] Case C-507/17 Google LLC v CNIL, at para 62.
[12] https://transparencyreport.google.com/eu-privacy/overview
[13] The Irish Times alone claims that links to 74 individual articles were delisted – https://www.irishtimes.com/news/ireland/irish-news/google-delists-74-irish-times-items-about-sean-quinn-and-his-family-1.4723940