On 13 May 2014, the Court of Justice of the European Union (the "ECJ") issued a landmark judgment (See VBB on Belgian Business Law, Volume 2014, No. 5, p. 6, available at www.vbb.com) granting the possibility for a data subject to request from search engines such as Google the de-listing of links appearing in the search results based on this data subject's name. This judgment is supposed to create a balance between the relevant privacy rights of an individual and the interest of the public in having access to particular information.
On 26 November 2014, the Article 29 Data Protection Working Party (the "Working Party"), an independent European advisory body on data protection and privacy comprised of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor and the European Commission, adopted guidelines on the implementation of this judgment (the "Guidelines").
The Guidelines, first, recall that the ECJ's judgment has made it clear that search engine operators process personal data and therefore qualify as data controllers within the meaning of Article 2 of the Data Protection Directive 95/46. The Guidelines also demonstrate that every person has a right to protection of his personal data and that individuals are not obliged to contact the original website in order to exercise their rights of de-listing towards the search engines.
Second, the Guidelines note that the right to seek the de-listing only affects the results obtained from searches made on the basis of a person's name and does not require the deletion of the link from the indexes of the search engine altogether. The original information will therefore always be accessible using other search terms, or by direct access to the source.
Third, the Working Party considers that in order to give full effect to the data subject's rights and guarantee the territorial effect of de-listing decisions, those decisions have to be implemented on all relevant domains of the search engine, including the ".com" domain.
Fourth, the Guidelines clarify that the practice of informing the users of search engines that the list of results to their queries is not complete as a consequence of the implementation of the ECJ's judgment is not based on a requirement under data protection rules. The Guidelines specify that such a practice is only acceptable "if the information is presented in such a way that users cannot, in any case, conclude that one particular individual has asked for de-listing of results concerning him or her".
Finally, the Guidelines contain a list of 13 common criteria which the data protection authorities can apply in handling complaints filed by data subjects whose request for de-listing was denied. Those criteria should be applied on a case by case basis and in accordance with applicable national legislation.
The Guidelines can be consulted here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
