If you would like to change your password, please contact IT Department.
Following the judgment of the European Court of justice C-131/12, 13th May 2014, an EU individual or an EU resident may ask search engines to remove some results which include their name, where the interests in those results are outweighed by the person’s privacy rights. But what happens with individuals based in non-EU countries, don’t they have a right to their privacy?
It is now clear that the operator of a search engine is a ‘data controller’ within the meaning of the EU Directive and is responsible for the ‘processing of personal data’ as it finds information on the internet, indexes it, stores it temporarily and makes it available to the public in the form of search results linked to other websites. Such processing must be classified regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data.
The Data Controller is under a duty to remove information on data subjects from search engine results, even in cases where the publication on the original pages is lawful. This, as the Court ruled, is in the light of Article 7 (respect for private life) and Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union, proper. An individual has the right to ask for information relating to him personally not to be included in a list of results displayed in a search engine following a search made on the basis of his name.
What comes out of the judgment is that a person has a right to be forgotten. As the ECJ held, an internet search engine operator is responsible for the processing that it carries out of personal data that appear on web pages published by third parties. According to the judgment, if following a search made on the basis of a person’s name, the list of results displays a link to a web page that contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, the removal of that link from the list of the results.
The ECJ further held that the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, and the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities that its activity complies with the Directives requirements.
Google’s reaction to the ECJ ruling:
In an attempt to comply with the new legal framework, Google has established an online procedure which allows those residing in the EU to request a take down of URLs they dislike. The balance of privacy rights of the individual will be balanced with the public interest at stake, in each case and inevitably decline to de-link some of them. This procedure will be made by people rather than algorithms which indicates that it will be more personal.
The form requires that a photo ID of the individual is uploaded. Further for each one URL you request to be taken down the individual must explain why each and every one is irrelevant, outdated, or otherwise inappropriate and of course, are deemed to be reasonable.
There is a queue at the moment and it is uncertain at what point in time the take downs will commence and/or continue and at what pace. Each case will be assessed on a case-by-case basis and people whose request has been rejected will be notified as to why the rejection occurred; such individuals will be able to appeal to their country’s data protection agency. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.
Google has stated that the search engine will not remove URLs out of Google worldwide. Where a removal is approved, such a removal will be dropped for searches on the associated name from all EU- specific versions of Google that the company or individual maintains. The limitation to this is evident; for instance if a request is approved, the URL will be dropped out of Google Co, Google France, Google Germany, Google Spain and other versions of Google for individual EU countries. BUT the URL will NOT be dropped from Google.com and anyone going onto Google.com whether in the EU or in any other part of the world will still see the URLs. Further; it is even possible that those going to specific EU versions outside the EU will still see the URLs. Whether this is really effective and whether Google has actually complied with the ECJ is highly debatable and remains to be seen whether the ECJ will tolerate this.
When Google decides to remove certain results it will portray a little notice at the bottom of the results stating that a complaint had been received and that result(s) have been removed – therefore anyone looking into that person will know that a URL has been removed. Further Google will likely provide a link to another website, chillingEffects.org where people will be able to find out more about what has been removed – informing them that something has happened, simply making it more difficult for them to find out what has happened, but by no means impossible.
Other search engines:
The decision is definitely not confined to Google; all other search engines including Yahoo and Bing will have to comply with the ruling. Yahoo has stated that it is in the process of developing its own solution for Yahoo users in Europe. Bing has also opened up a form where the request can be filed.