On 13 May 2014, the Court of Justice of the European Union (CJEU) handed down judgment in Google Spain SL and Google Inc. v AEPD and Costeja (Costeja). This case established the so-called “right to be forgotten” (RTBF) whereby a data subject may ask the operator of a search engine to remove information relating to them from a list of results generated by a search of their name. The OxHRH Blog previously covered this decision, but since then, further developments have clarified the operation and scope of this right.

What are the Criteria for Delisting Results?

The CJEU’s judgment in Costeja gives surprisingly little guidance on the criteria that an operator of a search engine must consider when faced with a takedown request. At §81, the Court cites as relevant “the nature of the information in question and its sensitivity for the data subject’s private life” and ”the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”

On 26 November 2014, the Working Party, established under Article 29 of the Data Protection Directive, adopted guidelines for national Data Protection Authorities (DPAs) on the implementation of the Costeja decision in their own jurisdictions. These guidelines elaborate on Costeja (for instance, what constitutes a “role in public life”) as well as adding further criteria to be used as a “flexible working tool.” In the UK this guidance has been largely replicated by the Information Commissioner’s Office (ICO) in its own list of relevant criteria published in April 2015.

In early 2015, Google’s Advisory Council produced a report containing further guidance on the delisting criteria to be applied, including further concrete examples and additional criteria, such as consideration of the source of the information.

These documents provide some welcome explanation of how the RTBF should work in practice. Clarity is vital for ensuring the correct balance between privacy and the right to access information through search engines, as delisting will, in many cases, lead to the de facto removal of information from public view.

Dutch courts appear to have interpreted these criteria narrowly, and with a keen eye on the need to preserve freedom of expression. In some of the first cases to interpret Costeja, they upheld Google’s refusal to delist in the case of the owner of an escort agency convicted of attempted incitement of contract killing, and of a partner of KPMG embroiled in a domestic dispute with a contractor.

What is the Role of National Bodies?

The CJEU at §77 makes clear that the implementation of the RTBF under the Directive requires that takedown requests “may be addressed by the data subject directly to the controller” (i.e. the search engine operator), and that where the request is not granted, the subject may “bring the matter before the supervisory authority or the judicial authority.” However, it is not yet clear precisely how the courts and DPAs will work together in practice, and there is certainly a risk of duplication of effort if the competences of each are not clearly delineated.

In July 2015 the Administrative Court of England & Wales indicated that judicial review of a RTBF decision by the ICO was limited. The court dismissed the claim in R (Khashaba) v Information Commissioner on the basis that: (1) a data subject already has the right to bring proceedings against a search engine operator directly and (2) the Court was not prepared to interfere with the Commissioner’s wide discretion in reviewing takedown refusals.

By contrast, the Spanish Supreme Court took a different approach in A and B v Ediciones El Pais. The Court considered that Costeja didn’t preclude a finding that the website host had responsibility for the processing. Consequently, the Court agreed that the website host had to adopt measures, such as the inclusion of no-index code instructions, to prevent the information being listed by search engines (although it did not make clear how these requirements sat alongside RTBF requests made to the search engine operator directly).

It is clear post-Costeja that DPAs and data subjects have required clarification of exactly what the RTBF entails. The next post in this two-part series will examine further practical difficulties that have required consideration in the aftermath of this decision.