The Article 29 Working Party published new Guidelines on the
Right to be Forgotten on 26 November 2014. This is the latest
chapter in the story which began with the Google Spain case.
In that case, the Court of Justice of the EU (CJEU) decided that EU
data protection law already provides individuals with a right to
have a relevant or outdated information about them de-listed from
appearing in search results.
Here are the key points:
Aim of Guidelines: To guide DPAs on how
to implement the CJEU judgment in Google Spain. The
Guidelines also contain a list of common criteria which DPAs can
apply in handling complaints, but the criteria should be seen as a
"flexible working tool". No single criterion is
determinative and the list is non-exhaustive! So individual
decisions and assessments will be very much
Search Engines: The Guidelines confirm
that search engines act as controllers (as per the Court
ruling). The "mischief" is that processing by a
search engine could allow you to generate a detailed profile of an
individual. This probably means that individual publishers
should be treated as lower risk.
Privacy takes Priority: The rights of
the individual, as a general rule, will prevail over commercial
interests of the search engine and freedom of expression.
This is the most controversial aspect of the ruling.
People "in Public Life": DPAs
will consider the role played by the data subject in public
life. They are less likely to be able to rely on the right to
be forgotten. Interestingly, people in public life could
include politicians, senior public officials, business people and
members of regulated professions.
Process: Individuals should be able to
exercise their rights using any adequate means (online procedures
and electronic forums should not be mandatory). This could
cause practical difficulties in responding to the volume of
Extra-territorial scope: The CJEU ruling
says that a non-EU company can be deemed to be
"established" in the EU by virtue of its
subsidiaries. This could have much wider implications than
intended. Have another look at your group structure to ensure
you are not caught. For search engines, the .com domains will
also have to comply, although DPAs will tend to focus on claims by
EU citizens or residents.
The Search Engines have to de-list all source
content? No; they only need to de-list in relation
to searches made by the name of the individual.
Can Search Engines tell users that content has been
de-listed? No; unless notices or statements are made
in a consistent way (i.e. permanent general statements on search
Can Search Engines tell web publishers about proposed
de-listing? In general: No. Only exception will be
the "particularly difficult cases" where it is necessary
to get a fuller understanding of the circumstances to decide
whether to de-list. So if you publish content that is then
de-listed, you won't necessarily be told about the
The Guidelines include a template set of criteria. Search
engines are encouraged to publish their own de-listing criteria and
make more detailed statistics available.
Optimistically, the Guidelines say that the decision as to
whether de-list particular search results will, in essence, be
"a routine assessment" as whether the processing of
personal data complies with the data protection principles.
Needless to say, it is going to be a bit more complicated than
Dentons is a global firm driven to provide you with the
competitive edge in an increasingly complex and interconnected
marketplace. We were formed by the March 2013 combination of
international law firm Salans LLP, Canadian law firm Fraser Milner
Casgrain LLP (FMC) and international law firm SNR Denton.
Dentons is built on the solid foundations of three highly
regarded law firms. Each built its outstanding reputation and
valued clientele by responding to the local, regional and national
needs of a broad spectrum of clients of all sizes –
individuals; entrepreneurs; small businesses and start-ups; local,
regional and national governments and government agencies; and
mid-sized and larger private and public corporations, including
international and global entities.
Now clients benefit from more than 2,500 lawyers and
professionals in 79 locations in 52 countries across Africa, Asia
Pacific, Canada, Central Asia, Europe, the Middle East, Russia and
the CIS, the UK and the US who are committed to challenging the
status quo to offer creative, actionable business and legal
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances. Specific Questions relating to
this article should be addressed directly to the author.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).