Right to be forgotten in Google and other search engines

What is the online right to be forgotten?

This right, under EU law, derives from a May 2014 ruling of the European Court of Justice in a case where a Spanish individual successfully sought removal of Google search results relating to a newspaper article about an auction notice placed on his home some 16 years previously.
Unexpectedly, the European Court decided that individuals had a right to seek removal from Google (and other search engines) of search results on privacy grounds in certain circumstances. That right still applies in the UK after Brexit.

Is it the same as the GDPR “right to erasure”?

The EU data protection law, known as the GDPR (converted into the “UK GDPR” in the UK following Brexit) includes an individual’s “right to erasure”, also known as the “right to be forgotten”, under which you are entitled (subject to certain restrictions) to seek deletion of your personal information by anyone who holds your personal information – i.e., not just search engines. So the GDPR right to erasure is far wider than the 2014 EU court ruling, which still remains relevant for search engines.

Where does it apply?

The search engine right to be forgotten applies to Google and other searches made from within the UK and the EU. So, for example, you can’t use this right to seek removal of search results from say Google.com searches within the the US – though there may still be a case for removal from those search results based on other privacy grounds.

What exactly can search engines be required to “forget” in the UK and EU?

The 2014 EU court decision simply referred to personal information which was “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed”. So, not the clearest definition. However, EU data protection authorities have since issued guidance on the criteria which should be taken into account when assessing such requests plus there have been some court decisions. So, the landscape is now much clearer than it was. The factors include: any public role played by the individual; whether the individual is a child; whether the information relates to private life or is sensitive; the journalistic context etc. So It’s crucial to deal with these criteria when making a request under the right to be forgotten.

Is it necessary to show that material is inaccurate?

While inaccuracy (if proved) is one of the factors which will be taken into account in assessing a right to be forgotten request, it isn’t essential. The right to be forgotten revolves around privacy, unlike say defamation where truth of what is being said is a key factor. For example, in the Google Spain case (see above), the search result accurately reflected the fact that an auction notice had been placed on the complainant’s home. The point was that the information was so old that it was no longer relevant and unfairly impacted on the individual’s privacy.

What about convictions for criminal offences?

In principle, reference to criminal convictions can be removed but it all depends on the circumstances. The older, and more minor, the conviction, the more likely that de-listing will be granted. Other important factors include whether the conviction is “spent” (i.e. covered by the law about rehabilitation of offenders – but this isn’t conclusive), acknowledgment of guilt and remorse, and, for business-related crimes, whether the offender is now operating in the same field or not.

Which search terms are covered?

Generally the right to be forgotten applies only to searches against someone’s exact name e.g., “James Smith”. Although not straightforward, there maybe a case in certain scenarios to argue that the right should apply even if extra qualifying terms are added (e.g., “James Smith Tunbridge Wells”) or if the search engine automatically suggests adds additional incriminating words (e.g., “James Smith conviction”),

Is there a right of appeal?

Yes. If Google or the other search engines reject a right to be forgotten request, there is a right of appeal to your local data protection authority. In the UK, this is the Information Commissioner’s Office.

What’s the best strategy?

In our experience, it’s best not to quickly dash off a request via the form on the search engine website. Google and other search engines rarely change their mind. While there is still a right of appeal to the data protection authority, you might as well maximise your chances of removal by putting in a strong submission first time round.

Instead, the submission should carefully address the factors which search engines are required to take into account – as set out in official guidance and court decisions. The same applies of course if appealing to a data protection authority. Relevant supporting evidence should be supplied if applicable.