Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...
By Stephen Gardner
Feb. 6 — Google could face a stand-off with European privacy regulators after an advisory council convened by the company concluded Feb. 6 that the right to be forgotten, under which individuals can request deletion of Internet links to information about them, should apply only to European Union domains.
The advice contradicts the opinion of EU data protection commissioners, who meet in the Article 29 Working Party. In November, the Article 29 Working Party issued guidance stating that the delisting of links should apply globally, including to .com domains.
Google appointed the advisory council, including Wikipedia founder Jimmy Wales and Sabine Leutheusser-Schnarrenberger, a former federal justice minister of Germany, to provide guidance on the implications of a May 2014 ruling of the European Court of Justice on the right to be forgotten.
The court found that compilation of responses to search queries by Internet search engines constitutes data processing, and that search engines should remove on request links to Web pages containing personal information in situations in which the right to privacy outweighs the legitimate public interest in the availability of the information.
Leutheusser-Schnarrenberger recently predicted that the majority of the advisory council's members would find that the right to be forgotten applied only to European domains.
The Google advisory council report said that the “appropriate geographic scope for processing a delisting” of links had been a “difficult question” on which the ECJ ruling was “not precise.”
Requiring the delisting of links for domains other than EU domains could contravene freedom of speech laws in non-EU countries, the advisory council report said.
In addition, “95 percent of all queries originating in Europe are on local versions of the search engine,” such as google.de or google.fr, and delisting of links from those domains will, “as a general rule, protect the rights of the data subject adequately in the current state of affairs and technology,” the advisory council said.
The advisory council added that its view that delisting of links should be done only for EU domains was “bolstered by the legal principle of proportionality and extraterritoriality in application of European law.”
Tom De Cordier, counsel with Allen & Overy LLP in Brussels, told Bloomberg BNA Feb. 6 that the advisory council's conclusions constitute a “reasonable, well thought-through recommendation,” in particular because attempts to access google.com from EU countries are automatically routed to the local domain, on which delisting of links applies.
EU data protection authorities in seeking to include delisted links in results returned from google.com searches were attempting to “stretch the territorial scope” of the right to be forgotten, De Cordier said.
However, Olivier Rossignol, a spokesman for the European Data Protection Supervisor, told Bloomberg BNA Feb. 6 that, in line with the Article 29 Working Party position, delisting decisions “must be implemented in such a way that they guarantee the effective and complete protection of data subjects' rights.”
“Limiting delisting to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects,” and delisting should be done for all domains, Rossignol said.
The advisory council report also covered several other issues raised by the May 2014 EU Court of Justice ruling.
The advisory council said that Google should modify its search result removal request form to enable the provision of more information that might help Google to weigh the privacy and public interest aspects of a link to published information.
This could include information on the geographical area in which the data subject is publicly known and “whether the person chose to adopt a role in public life, or became well-known unintentionally,” the advisory council said.
The advisory council also concluded that Google should provide notification to the publishers of information subject to delisting decisions and that Google should publish “guidelines on the kinds of requests likely to be honored, and to the extent possible anonymized statistics about decisions, so data subjects can weigh the benefits of submitting the request.”
According to data published by Google and accessed Feb. 6, the company has received more than 212,000 requests for delisting of links and has agreed to the requests in about 40 percent of cases.
A privacy attorney who asked not to be identified told Bloomberg BNA Feb. 6 that the extent to which Google would take up the advisory council's recommendations remains to be seen.
Google would likely be “pleased” with the advisory council report, and “it does sound like there's a potential clash coming up” with privacy regulators over the territorial application of delisting decisions, the attorney said.
In addition to its November 2014 guidance on implementing the right to be forgotten ruling, the Article 29 Working Party Jan. 19 published letters to Microsoft Corp., Qwant and Yahoo! Inc., reinforcing the request that link deletions should be “effective on all relevant domains, including .com”.
Microsoft owns the Bing search engine. Qwant is a Paris-based Internet search engine that went live in 2013.
The privacy attorney said that EU DPAs might be “hesitant to enforce in reality” the request to extend link deletions to .com domains because they would face “a tough argument on jurisdiction.”
Christian Wigand, a spokesman for the European Commission, the EU's executive arm, told Bloomberg BNA Feb. 6 that the commission “takes note of the report of the advisory council to Google on the right to be forgotten.”
The commission proposed a reform of EU data protection legislation in January 2012. Discussions on the revision are ongoing.
Wigand said that the Article 29 Working Party, in drawing up its guidance on implementation of the right to be forgotten, had consulted Google.
“The commission calls on stakeholders to continue engaging in a constructive dialogue with the enforcement authorities in finding solutions that comply with the court ruling,” Wigand said.
To contact the reporter on this story: Stephen Gardner in Brussels at email@example.com
To contact the editor responsible for this story: Katie W. Johnson at firstname.lastname@example.org
The Google advisory council final report on the right to be forgotten is available at https://drive.google.com/a/google.com/file/d/0B1UgZshetMd4cEI3SjlvV0hNbDA/view?pli=1.
Notify me when updates are available (No standing order will be created).
Put me on standing order
Notify me when new releases are available (no standing order will be created)