AN UNFORGETTABLE DECISION...
It used to be the case that today's news was tomorrow's fish and chip wrapper. Many a politician or celebrity faced with a scandalous revelation emblazoned over the front page of a daily red top would perhaps have been comforted by the thought that their indiscretions would soon be confined to the waste paper bin. Not so these days when every bit of information that is released into the public domain can be retained on the world wide web.
Whether we want information on a prominent business person, a local restaurant, a famous actor or a new vacuum cleaner, we generally "google it". We can easily find out what Bill from Bognor Regis thought of the B & B he stayed in in Cleethorpes, what Jane from Redditch thought about the latest episode of #eastenders or how a certain Mr Gonzalez from Spain put his house up for auction in 1998 to pay off outstanding debts.
However, things have now changed. Since Mr Gonzalez succeeded in a case brought before the Court of Justice of the European Union (CJEU) he now has the "right to be forgotten" by Google and other search engines. The CJEU found that a search engine (such as Google) "processes" "personal data" and acts as a "data controller" and therefore "data subjects" have the right to deletion and rectification of their personal data by search engines under the EU Data Protection Directive.
Following the CJEU's decision, EU citizens are now able to request that Google and other search engines remove their personal data that is "inadequate, irrelevant or no longer relevant". Google has now set up a service whereby EU citizens can request that their personal data be removed from online search results. The offending article will not be removed from the source site but the relevant personal data will not appear in the search results.
Each request will be considered and the individual's right to privacy will be balanced against the public's right to know and distribute information and the right to freedom of speech. Already the process appears to be an administrative burden for Google with over 250,000 requests for information to be removed having reportedly been made.
The Isle of Man has its own data protection legislation, the Data Protection Act 2002 (the Act) which is based very much on the UK's Data Protection Act 1998 which in turn implements the terms of the EU Data Protection Directive. In 2004, the European Commission declared that the Act offered an adequate level of protection thereby simplifying the transfer of personal data into and out of the Isle of Man.
The Act contains Eight Data Protection Principles:
- personal data shall be processed fairly and lawfully;
- personal data shall only be obtained for a specified and lawful purpose and not further processed in any manner incompatible with that purpose;
- personal data shall be relevant, adequate and not excessive;
- personal data shall be accurate and kept up to date;
- personal data shall not be kept for longer than is necessary;
- personal data shall be processed in accordance with the rights of data subjects under the Act;
- a data controller must take appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and to guard against accidental loss, destruction or damage to personal data;
- personal data shall not be transferred to a country outside the Island unless that country ensures an adequate level of protection for the rights and freedoms of data subjects.
The Isle of Man is not part of the EU and the EU Data Protection Directive does not apply here. However, the Act was drafted to be compliant with the EU Data Protection Directive so a similar decision could well be made here were the Isle of Man courts to be faced with a similar situation. We will therefore watch the arguments surrounding this momentous decision with interest.
No doubt there will be numerous arguments as to what exactly constitutes irrelevant information and defenders of free speech will continue to criticise any form of censorship which may be viewed by them as "the thin end of the wedge". However, as the articles will all remain on the internet and be available to people outside the EU and those who do not use the offending search term, the effectiveness of the ruling could also come under question.
There is no doubt that this judgment is remarkable but it also has to be viewed in light of the political discussions and lobbying over forthcoming legislation in this area. The EU proposed back in 2012 that the current EU Data Protection Directive would be replaced by a Data Protection Regulation. The text of the Regulation adopted by the European Parliament in March 2014 appears to have watered down the "right to be forgotten‟ found in the text originally proposed, replacing it with a more limited "right to erasure‟. It remains to be seen what text will be adopted and whether this case may have an impact, not just for data subjects, but also on the political dialogue and negotiations surrounding the new Regulation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.