How to exercise your right to be forgotten?
- Lynn Pype
- search engine , search results , request to remove URLs , individual’s role in public life , delisting of results
As a result of the ruling Google Spain and Google Inc. v. Spain of 13 May 2014, the European
Court of Justice held that Google (and search engines in general) should remove search results, on
the request of an individual. Google has complied with the ruling and has implemented a request
Through the use of a standard form, an individual can make an official request to have specific URLs removed that include their name.
Google is responsible for deciding whether the URLs should be removed from the search results. In its decision, Google will take different criteria into account such as the individual’s role in public life, the nature of the information, the source of the information and the time of publication.
If Google would reject a request, an individual can lodge a complaint before the national privacy authority or before a local court.
Google also appointed an advisory council, who acted as independent experts to advise Google on
how to follow to ruling and how to perform the balancing act between an individual’s right to
privacy and the public’s interest in access to information.
The advisory council exists of 8 specialists in the field of data protection. The Advisory council states that all members have volunteered to participate and that they were not paid by Google to do so. They did not sign a nondisclosure agreement, nor are they in a contractual relationship with Google.
The advisory council rendered a report on 6 February 2015 in which they gave various recommendations on the criteria for assessing delisting requests, as well as on the procedural elements that should be in place.
They identified four primary criteria on which they advised Google to evaluate requests from individuals.
The GDPR, that enters into force on 25 May 2018, provides a specific legal ground to invoke the
right to be forgotten or the right to erasure.
Pursuant to Article 17 of the GDPR the individual has the right to obtain from the controller the erasure of personal data without undue delay. The controller shall have the obligation to erase the personal data under certain circumstances. For instance, when personal data is no longer necessary in relation to the purpose for which they where collected, or of the data subject has withdrawn his consent, the right to be erased can be applied.
If personal data has been made public, the controller has to take reasonable steps, including technical measures, to inform controllers, which are processing the data, that the data subject has requested the erasure.
However the GDPR provides a few exceptions. The controller will for example not have to erase the data of the processing is necessary for exercising the right of freedom of expression and information, for compliance with legal obligations, for reasons of public interest in the area of public health, for achieving purposes in the public interest, scientific or historical research of for the establishment, exercise or defence of legal claims.
If the request is granted, Google will delist the URLs in question from the search results.
The content itself will of course not be removed. Google will not contact the webmasters, nor will it take any other action. It is up the individual to take further steps if he wants the actual content to be removed as well.
At first the URLs were only removed on the result list on the local Google domains, such as Google.be or Google.fr. The other Google domains, and in particular the Google.com remained unaltered.
As pointed out in a previous article, the exercise of the right to be forgotten was rather ineffective since the unwanted results could easily be found on other Google websites.
Hence, the French Data Protection authority (CNIL) demanded that Google removed the URLs on a global scale. After a bit of hesitation, Google suggested to delist the results on all Google domains within the country of the individual. This means that the removal of certain results is still geographically determined. If the request of a Belgian individual is granted, the URLs will not be visible on any Google website accessed from Belgium, but outside Belgium they could still appear.
However, the CNIL was not satisfied with Google’s proposal and ordered that the URLs should be removed from the results, irrespective of the location of the individual. The CNIL has fined Google with the amount 100.000 Euro.
Removal from national domains of Google’s search engine within the EU is the appropriate means to implement the ruling of the ECJ
In this regard is should be noted that the advisory council paid attention to the geographic
scope for the delisting and it came to the conclusion that removal from national domains of
Google’s search engine within the EU is the appropriate means to implement the ruling of the ECJ.
There is some doubt whether the demands of the CNIL will be upheld. Although the current situation still makes it possible to circumvent the right to be forgotten, it remains a question whether the CNIL can order that Google to change its search results outside of France.
In May 2016 Google lodged an appeal against the decision of the CNIL. The court has not rendered its judgment yet.
Since the launch of the official request process in 2014, Google received 568.881 requests, to
remove 1.727.251 URLs. According to its own statistics, Google removes approximately 43,2% of the
URLs in question.
If you would want to exercise your right to be forgotten, we can assess whether or not a request would be successful and we can guide and assist you in this process.
Do not hesitate should you have further questions on this topic.