U.K. DPA Wants Google Link Scrubbing to Go Further

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Ali Qassim

Nov. 3 — Tightening a previous right to be forgotten enforcement action order, the U.K. Information Commissioner's Office has asked Google Inc. to “go a step further” to ensure that none of the Internet search engine's U.K. services throw up search results linked to an individual's past minor criminal convictions.

In its original order, the ICO—the U.K.’s data protection authority—Aug. 18 ordered Google to remove nine search results brought up by entering a particular individual's name.

The ICO's “stop now” order was the U.K. data protection authority's first right to be forgotten action which it made public since the European Court of Justice's May 2014 ruling that data subjects in the European Union have the right to compel Google and other Internet search engines to remove search results linking to websites containing personal information about them if their individual privacy outweighs the public interest in displaying the results.

ICO Clarifies Previous Order

Although Google “responded constructively” to the initial enforcement notice, “and the links are no longer visible on the European versions of their search engine,” the ICO has since considered that Google “should go a step further” by making “the links no longer visible to anyone directly accessing any Google search services from within the UK,” ICO Deputy Commissioner David Smith said in a Nov. 2 blog post.

For example, Smith said, “this would include someone sat a desk” in Newcastle—a major city in northern England— “but using google.com.”

To ensure that the removed links are unsearchable in the U.K., Smith said the ICO has “clarified the original enforcement notice, with the original text remaining the same but with a new section added spelling out exactly what we expect of Google.”

The search engine has company until Nov. 25 to make the changes or appeal against the clarified notice. Google didn't immediately respond Nov. 2 to Bloomberg BNA's request for comment.

Smith, who is also the ICO's Director of Data Protection, argued that the added requirement on Google is a “proper and proportionate reflection of what the EU Court of Justice ruling means in practice.” He said that “implementation of the ruling is still an evolving area of law” and that the ICO's approach “remains very much rooted in our extensive experience of regulating compliance” under the existing law.

“And where the judgment breaks new ground, we're adapting quickly and working with European partners to ensure consistency,” he said.

No ‘Avalanche’ of Cases from ECJ Ruling

In the blog post reflecting on the impact of the ECJ's May 2014 ruling, Smith also highlighted that the ICO hasn't seen the “avalanche of cases coming to us that some predicted.”

For instance, U.K.’s Information Commissioner Christopher Graham said he expected the ruling to lead to a “tsunami” of requests while a U.K. House of Lords parliamentary committee referred to the ruling as “misguided in principle and unworkable in practice”.

Despite these predictions, Smith said “the sky has not fallen in,” “no books have been burned” and the Internet “has not stopped working.”

The ICO said that it has consistently received 25 to 45 cases each month, of which 60 percent are eligible for an ICO decision. “The rest typically don't involve personal data being processed”—for instance the search “was not against an individual's name” or fell outside the U.K. jurisdiction, he said.

Out of the 472 “right to be forgotten” cases it received as of Aug. 13, 2015, the majority—80 percent of cases—required no action from the ICO, the blog said. The remaining cases led to the ICO ordering Google to delist search results, Smith said.

The ICO has disagreed with Google's decision in not taking down searches in around a third of the cases it has ruled on, Smith added. The most common factor in those decisions has been that the passage of time rendered the information no longer relevant, he said.

More often than not, Smith said the process ends with the ICO agreeing with Google's decision.

“That is most commonly because we consider that the information was factually accurate.”

Dispelling ‘Criminals Rewriting History’ Myth

Smith said it was also appropriate to nip the “criminals rewriting history” myth in the bud.

Of the cases the ICO has considered, around a third have related to criminal convictions in some way and a quarter of the cases in which the ICO has ordered to take down results have referred to minor, historic convictions. Meanwhile, about a third of the cases in which the ICO has agreed with Google's decision not to take down searches have involved serious or recent convictions, he said.

He concluded that although “it's not necessarily our role to defend the judgment,” the cited figures “taken in the context of how few actual cases they refer to, do not seem alarming.”

To contact the reporter on this story: Ali Qassim in London at correspondents@bna.com

To contact the editor responsible for this story: Jimmy H. Koo at jkoo@bna.com

ICO's Nov. 2 blog post is available at https://iconewsblog.wordpress.com/2015/11/02/has-the-search-result-ruling-stopped-the-internet-working/.


Request Bloomberg Law: Privacy & Data Security