EU Data Protection Authorities: Guidelines for Global Implementation of "Right to be Forgotten"

On 26 November 2014, the European data protection authorities assembled in the Article 29 Working Party (WP29) have adopted guidelines on the implementation of the judgment of the Court of Justice of European Union (CJEU) of 13 May 2014 in Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (C-131/12), CRi 2014, p. 77 with remarks from US perspective by Spelman/Towle, p. 85, and remarks from an Irish perspective by Tobin, p. 87. These Guidelines contain the common interpretation of the ruling as well as the common criteria to be used by the data protection authorities when addressing complaints. The Guidelines request effective implementation of the CJEU's judgment on a global scale including all relevant ".com" domains which makes it all the more interesting to realise how such "right to be forgotten" constitutes a challenge to free speech rights recognized by the Constitution of the United States(see Brown, "The Right to be Forgotten: U.S. Rulings on Free Speech Won’t Let Google Forget", CRi 6/2014, pp. 161).

Background

The CJEU's judgment in Google Spain SL and Google Inc. v AEPD and Mario Costeja González (C-131/12) sets a milestone for EU data protection in respect of search engines and, more generally, in the online world. It grants the possibility to data subjects to request to search engines, under certain conditions, the de-listing of links appearing in the search results based on a person’s name.

WP29 Guidelines

• Applicability of Data Protection Directive to Search Engines

The WP29 guidelines recall that the CJEU ruling confirmed the applicability of Directive 95/46/EC to a search engine insofar as the processing of personal data is carried out in the context of the activities of a subsidiary on the territory of a Member State, set up to promote and sell advertising space on its search engine in this Member State with the aim of making that service profitable.

• Scope of "Right to be Forgotten"

The CJEU's judgment expressly states that the right only affects the results obtained from searches made on the basis of a person’s name and does not require deletion of the link from the indexes of the search engine altogether. That is, the original information will still be accessible using other search terms, or by direct access to the source.

• Effective Implementation: National EU-Domains as well as All Relevant ".com"-Domains

The WP29 considers that in order to give full effect to the data subject’s rights as defined in the Court’s ruling, de-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. In that sense, limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant .com domains.

• Eligibility to "Right to be Forgotten"

Under EU law, everyone has a right to data protection. In practice, DPAs will focus on claims where there is a clear link between the data subject and the EU, for instance where the data subject is a citizen or resident of an EU Member State.

• List of Common Criteria for Harmonised Handling of Complaints Against Search Engine's De-Listing Refusal

The guidelines also contain the list of common criteria which the data protection authorities will apply to handle the complaints filed with their national offices following refusals of de-listing by search engines. The list contains 13 main criteria and should be seen as a flexible working tool to help DPAs during the decision-making processes. Criteria will be applied on a case by case basis and in accordance with the relevant national legislations.

No single criterion is, in itself, determinative. Each of them has to be read in the light of the principles established by the CJEU and in particular in the light of the “the interest of the general public in having access to [the] information”.

(ga)

Article 29 Data Protection Working Party, "Guidelines on the implementation of the Court of Justice of the European Union judgment on Google Spain and inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/121", WP 225, adopted on 26 November 2014

Article 29 Data Protection Working Party, "Adoption of guidelines on the implementation of the CJEU's judgement on the 'right to be forgotten'", Press Release of 26 November 2014

EU-Commission, "Mythbuster: The Court of Justice of the EU and the 'Right to be Forgotten'", Factsheet of 18 September 2014

Article 29 Data Protection Working Party, "Ffollow-up to the ruling of the Court of Justice of the EU of 13 May 2014 on the 'right to be forgotten'", Press Release of 18 September 2014

Article 29 Data Protection Working Party, "European DPAs meet with search engines on the 'right to be forgotten'”, Press Release of 25 July 2014

Article 29 Data Protection Working Party, "First exchange of views about the consequences of the 'Costeja' ruling of 13 May 2014 of the CJEU", Press Release of 6 June 2014

Article 29 Data Protection Working Party, "Ruling of the CJEU of 13 May 2014 in the framework of a dispute between Google and the Spanish Data Protection Authority", Press Release of 23 May 2014