Exercising the right to be forgotten

Black Hole

Author Alain R

Source Wikipedia

Creative Commons Licence

Jane Lambert

In Right to be forgotten: a Transatlantic Dialogue 1 Aug 2015 NIPC Law I discussed the judgment in C‑131/12 Google Spain SL and Another v Agencia Española de Protección de Datos (AEPD) ex parte Costeja 36 BHRC 589, [2014] 3 CMLR 50, [2014] EMLR 27, EU:C:2014:317, ECLI:EU:C:2014:317, [2014] All ER (EC) 717, [2014] 3 WLR 659, [2014] ECDR 16, [2014] 2 All ER (Comm) 301, [2014] EUECJ C-131/12, [2014] 1 QB 1022, [2014] QB 1022 and Google's response to it. Yesterday I wrote about Judge Behrens's decision in Dawson-Damer and Others v Taylor Wessing LLP and Others [2015] EWHC 2366 (Ch) (6 Aug 2015) in Wilmslow versus the Bahamas: Dawson-Damer and Others v Taylor Wessing and Others 13 Aug 2015. Although Dawson-Damer was not a right to be forgotten case, it casts some light on how rights arising under the 1998 Act would be enforced.

What is the right to be forgotten?

As I observed in Right to be forgotten: a Transatlantic Dialogue the "right to be forgotten" amounts to nothing more than that search engine operators are "data controllers" and that statutes such as the Data Protection Act 1998 which implement the Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data  OJ L 281 , 23/11/1995 P. 31 - 50) apply as much to them as they do to anyone else. Personal data are to be processed in accordance with certain "data protection principles" which are set out in Schedule 1. S.10 of the Act provides a right of action to prevent processing likely to cause damage or distress. S.13 provides a right to compensation for any damage resulting from non-compliance with the Act.  S.14 provides a right to rectification, blocking, erasure and destruction of personal data.

Applying the Data Protection Principles

Probably the most relevant data protection principle in right to be forgotten cases is the fourth:

"Personal data shall be accurate and, where necessary, kept up to date."

It was the generation of links to a newspaper advertisement of an auction of property that had been confiscated from Mr Costeja to pay his social security debts many years earlier that had prompted him to complain to the Spanish data protection authority. The advertisement gave an out of data impression of Mr Costeja's creditworthiness. Google was not responsible for uploading the advertisement to the internet but it was responsible for referring searchers to it.  The only way the impression could be corrected was by excluding the URL to the advertisement from the search results.

The Notice

S.10 (1) requires a data subject to serve a notice in writing on a data controller requiring him "to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject." Google, Bing and Yahoo have all provided simple on-line forms requesting the removal of specified URLs from search results. Google's form is here.

Responding to the Request

A data controller is not bound to comply with a notice under s.10 (1). S,10 (3) requires him only to respond within 21 days of receiving a notice under subsection (1) (“the data subject notice”) by giving the individual who gave the data subject notice a written notice—

"(a) stating that he has complied or intends to comply with the data subject notice, or
(b) stating his reasons for regarding the data subject notice as to any extent unjustified and the extent (if any) to which he has complied or intends to comply with it."

In its FAQ Google explains how it deals with requests to remove references to URLs:

"In evaluating a request, we will look at whether the results include outdated or inaccurate information about the person. We’ll also weigh whether or not there’s a public interest in the information remaining in our search results—for example, if it relates to financial scams, professional malpractice, criminal convictions or your public conduct as a government official (elected or unelected).

Our removals team has to look at each page individually and base decisions on the limited context provided by the requestor and the information on the webpage. Is it a news story? Does it relate to a criminal charge that resulted in a later conviction or was dismissed? In order to demonstrate the scope of removal requests, we have included a section for request summaries on the Transparency Report."

As of today, Google has received 295,716 requests relating to 1,073,454 URLs. 36,891 requests in relation to 143,960 URLs were from the UK alone (see the Transparency Report).

Outcomes

Across the European Economic Area (EU plus EFTA) as a whole Google has removed 41.3 % of the requested URLs from its search reports and refused to do so in respect of 58.7%. In respect of requests from the UK Google has removed 37.5% of the requested URLs and refused in the case of 62.5%. Examples of requests that Google has allowed are as follows:

"A man asked that we remove a link to a news summary of a local magistrate’s decisions that included the man’s guilty verdict. Under the UK Rehabilitation of Offenders Act, this conviction has been spent. We have removed the page from search results for his name."

"A victim of rape asked us to remove a link to a newspaper article about the crime. We have removed the page from search results for the individual’s name."

On the other hand the following have not been removed:

"A couple who was accused of business fraud asked us to remove articles about the crime. We did not remove the pages from search results."

"A high ranking public official asked us to remove recent articles discussing a decades-old criminal conviction. We did not remove the articles from search results."

Challenging a Search Engine Operator's Decision

One of Google's FAQ is "What happens if an individual disagrees with your decision?" Its answer is:

"If we decide not to remove a URL from our search results, an individual may request that a local data protection authority review our decision."

There is no machinery under the Data Protection Act 1998 for the Information Commissioner to review a decision by a search engine operator not to delete a URL from a search report though there is nothing to prevent him from serving an enforcement notice under s.40 (1) upon a complaint from a data subject if he is satisfied that the operator has a data controller has contravened or is contravening any of the data protection principles. The main problem with referring a complaint to the Information Commissioner is that there are only so many complaints that the ICO can investigate.

The alternative is to bring proceedings for an order under s.10, compensation under s.13 or rectification, blocking, erasure and destruction of personal data in the High Court or County Court in England, Wales and Northern Ireland or the Court of Session or Sheriff's Court in Scotland.

It should be noted that while s.13 (1) confers an entitlement to compensation if an individual suffers damage by reason of any contravention by a data controller of any of the requirements of this Act s.10 (4) and s.14 (1) give the court a discretion as to whether or not to make an order compelling compliance with a notice under s.10 (1) or requiring the rectification, blocking, erasure and destruction of data.  Judge Behrens was not prepared to exercise a similar discretion in a subject access request under s.7 (9) in Dawson-Damer.

Further Information

If you want to discuss this article, the so-called "right to be forgotten" or data protection further, feel free to call me on 020 7404 5252 during office hours or use my contact form.