2_1_DiscoverGermany_August2014_Issue17:Scan Magazine 1
31/7/14
14:31
Page 46
Discover Germany | Business | Solicitor Column
Forget Me (Not) TEXT & PHOTO: GREGOR KLEINKNECHT
In a landmark ruling handed down in May, the highest court of the European Union determined that private individuals can benefit from a limited ‘right to be forgotten’, which allows them to request the removal of links to websites and other material on the web that turns in internet searches for their own name. In equal measures the judgement has been heralded as a victory for personal privacy law and criticised as a danger to freedom of expression. The underlying premise, namely, that search engine providers are subject to European data protection laws, must be welcome on all accounts. Whichever way you look at it, the decision requires Internet search providers to implement some changes to their procedures, indexing and technical infrastructure. But how real is its impact? The case involved Google Spain and a Spanish individual who complained that a Google search for his own name brought up links to web pages from a newspaper which were more than ten years old and concerned court proceedings that had been fully resolved and were no longer relevant. In its decision, the court analysed the activities and obligations of search engine providers in detail in the context of European data protection law and concluded that they are obliged to remove data from search results that is ‘inadequate, irrelevant, no longer relevant or excessive’ in relation to the purposes of the processing or the amount of time that has elapsed since the initial processing of the data. Takedown requests must be made in the first instance directly to each individual search engine provider, which is then tasked with examining the merits of the individual request. In response to the ruling, Google promptly published an online form enabling users to request the removal of search results for their names and was inundated almost equally quickly with over 40,000 take-
46 | Issue 17 | August 2014
down requests. From the end of June, Google reportedly began processing requests and implementing removals on a case-by-case basis, having set up a dedicated ‘removals team’. Other search engine providers, such as Yahoo and Bing, are in the process of developing similar solutions. As revolutionary as the nascent digital ‘right to be forgotten’sounds, it is not an absolute right and has significant limitations. An individual making a takedown request will need to establish that the relevant data protection rules in his jurisdiction (in the case of England, the data protection principles set out in the Data Protection Act 1998) have been breached through the unlawful processing of his data by a search engine provider; many of the relevant rules are vague and open to interpretation. It is clear, however, that individuals will not be able to request the removal of all links to personal information just because they cause embarrassment or are deemed undesirable (often with the benefit of hindsight). Although it is still too early to tell how selectively search engine operators will treat takedown requests, early indications from Google are that each request will be individually assessed and that each complainant's privacy rights will be carefully balanced against any public interest in the information. Furthermore, Google has only been required to remove search results from its European websites; links to the same information can therefore still be accessed simply by using one of Google's other international or US sites, even after a European takedown request has been implemented. Also, the underlying website to which a search result links, and which published the information originally, will of course still be accessible (for example, the newspaper website carrying the original news report). Individuals wishing to make a request for the removal of a link can currently access Google's form online. The form itself is relatively simple, requiring the name and con-
tact details of the person making the request, as well as proof of identity, the URLs for each link that should be removed, and an explanation as to why the URL is ‘irrelevant, outdated or otherwise inappropriate’. The challenge for individuals making takedown requests will be, first, that a request must be made and justified for each individual URL and to each individual search engine provider; secondly, to show that the search result and content fall within the parameters of the relevant data protection rules and the guidance provided by the court ruling; and, thirdly, to provide a coherent explanation as to why the search engine provider is legally obliged to remove the link. If the removal of relevant links cannot be achieved through a request to the search engine provider, individuals have the option of taking their complaint to the national data protection authority or the courts. Given the administrative burden of achieving a comprehensive removal of links and the ease with which undesirable search results can still be obtained, even after a takedown request has been implemented, many may decide not to bother and will instead simply wait for undesirable search results to be pushed down the list with the passage of time through the normal process of search engine algorithms.
Gregor Kleinknecht LLM MCIArb is a German Rechtsanwalt and English solicitor, and a partner at Hunters Solicitors, a leading law firm in Lincoln’s Inn. Hunters Solicitors, 9 New Square, Lincoln’s Inn, London WC2A 3QN, E-mail: gjk@hunters-solicitors.co.uk www.hunters-solicitors.co.uk