On 13 May, the European Court of Justice delivered its eagerly anticipated judgment in Google v AEPD - better know as the case around the "right to know" and the "right to be forgotten".
The judgment stemmed from a request made by a Spanish man, Mario Costeja González, who requested that Google remove links to notices in a newspaper, published in 1998, concerning the repossession of his home.
The notices advised that property belonging to Mr González was to be auctioned due to his outstanding social security debts. Mr Gonzalez subsequently repaid the sums and the auction did not take place. Nonetheless, a search on the applicant's name on the Google search engine still retrieved the advert. While not requiring the newspaper to remove the information concerned from its archive, the Court held that Google must remove hyperlinks to the articles from its index.
The Court determined that an individual's data protection rights "override, as a general rule, the interest of internet users,". This principle was caveated only on the basis that the "balance may ... depend... on the nature of the information in question and its sensitivity to the data subject's private life and on the interest of the public in having that information". According to the Court, the extent of the public interest will vary depending on the role played by the data subject in public life.
What does this mean?
The decision highlights the tension between the "right to know" and the "right to be forgotten". While the latter right may ultimately be enshrined in EU legislation under the new General Data Protection Regulation (due to take effect in 2016), the rights relied upon in Mr Gonzalez's case already exist. Any individual has the right to require a data controller (which the Court construed to include Google) to rectify, erase or block disclosure of data because it is incomplete or inaccurate.
However, there is no suggestion that the information contained in the notice in Mr Gonzalez's case was incomplete or inaccurate or that the newspaper had acted inappropriately in publishing it. Accordingly, on the basis of the Court's decision, and in the absence of guidance as to when information will be deemed "irrelevant or no longer relevant", some may argue that damaging public information becomes private simply by virtue of the passage of time.
The right to be forgotten could also be open to what some may construe as abuse. Already, anecdotal evidence exists of politicians seeking to have links to damaging stories removed from Google search results. There may also be requests for removal of stories where individuals wish to hide embarrassing information about themselves, perhaps prior to applying for a new job, for fear that prospective employers may use a Google search as a character reference.
Recent research shows that 51 per cent of the United Kingdom public have, at some point, entered their name into Google to see what information is held on them. Time will tell whether a "reputation management" industry blossoms, with third party intermediaries making requests of search engines on behalf of individuals seeking to manage their online profiles.
From a technical perspective, given the ease of internet link sharing, links can suddenly go "viral" across various online platforms, including social media. With the same content hosted on numerous services and through different links, how the right can be practically enforced will need further consideration. The somewhat burdensome ruling was, unsurprisingly, lacking in detail concerning practical implementation.
Google may be one of the most well-known search engines, but for those seeking the right to be forgotten, it is far from the only one on the internet with which an individual should be concerned. Therefore, a person seeking removal of links from all online search results may require to make requests of numerous search engines.
Nevertheless, all such search engines will require to resource accordingly across the EU. It remains to be seen whether the less onerous policy of automatic approval of such requests is adopted or whether the private life / public life test is considered in each instance. Any dispute between Google and an individual would, in the UK, likely be elevated to the Information Commissioner for consideration.
The UK has previously sought to opt-out from the "right to be forgotten" provisions of the General Data Protection Regulation, citing the difficulties in putting the provisions into practical effect. Nonetheless, the Criminal Justice and Courts Bill, currently being considered by the UK Parliament, seeks to provide the Attorney General with the power to require the removal of online archive material that might prejudice legal proceedings. The power to jail jurors if they seek to research a defendant's past is also enshrined in the draft legislation. It may be that such moves signal acceptance of the "right to be forgotten" by the UK in certain circumstances.
James McGachie is legal director at law firm DLA Piper
Successful leaders are infusing analytics throughout their organisations to drive smarter decisions, enable faster actions and optimise outcomes
Focus on cost efficiency, simplicity, performance, scalability and future-readiness when architecting your data protection strategy