Header graphic for print
Password Protected Data Privacy & Security News and Trends

UK’s First Ever Right To Be Forgotten Enforcement: Google In the Firing Line Again

Posted in EU Data Protection

The UK’s Information Commissioner’s Office (ICO) has made what appears to be its first “right to be forgotten” enforcement action against Google Inc. The ICO issued the notice on 18 August 2015, ordering Google to remove nine links to news stories about an individual’s criminal offence committed almost a decade ago.

How we got here

In May last year, the European Court ruled in favour of the right to be forgotten, giving anyone permission to request that specific links no longer be returned in searches for their names if they involve information that is out of date, excessive, or irrelevant.

The search engine previously deleted links referencing the criminal history of an individual after that person made such a request. However, the removal of those links then made news and those news stories referenced the individual again by name, including details of the original criminal offence. Google refused to remove links to the subsequent news stories, arguing that they were “an essential part of a recent news story relating to a matter of significant public importance.”

This enforcement notice comes just two months after the French data protection authority (CNIL) ordered Google to remove links for right to be forgotten request from its entire search engine, as reported in our blog post in June.

Google’s aftermath

Google has 35 days from the date of the enforcement notice to remove the links from its search results when the individual’s name is searched, or, Google will face further enforcement action. Google has the right to appeal to the U.K.’s First-tier Tribunal (Information Rights) against the notice but, so far, the company has refused to comment on whether or not it will appeal.

Looking ahead and how this could affect other businesses

The ICO’s enforcement notice recognises that whilst these stories may be newsworthy and in the public interest, that does not justify retaining links to those stories when an individual’s name is searched because this negatively impacts the individual’s privacy and is a breach of the UK’s Data Protection Act.

This enforcement notice is the first of its kind from the ICO, but is unlikely to be the last. This is in light of recent case law in this area and given the fact that the new EU Data Protection Regulations will strengthen the right to be forgotten principle and provide legal certainty in the digital age. This will most likely impact search engine operators in particular, but also has implications for other website owners (e.g. social media sites, blogs and other websites containing search features or external links). It is important for our clients to note that the right to be forgotten allows individuals to request outdated or irrelevant data to be deleted. Therefore, there may well be an increase in the amount of requests to remove data from search results and your company website.