U.K. Right to Forget First: Google Must Scrub Links

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Ali Qassim

Aug. 20 — In what appears to be the first right to be forgotten enforcement action made public by the U.K. Information Commissioner's Office, the ICO Aug. 20 said it has ordered Google Inc. to remove nine search results linked to an individual's minor criminal offense committed almost 10 years ago.

In an enforcement notice dated Aug. 18, the ICO said the Internet search engine operator had to remove the links at issue within 35 days or face further enforcement action.

The ICO, the U.K.’s data protection authority, said in the notice that it issued the “stop now” order after Google “refused to remove the links,” arguing they “formed an essential part of a recent news story relating to a matter of significant public importance.”

In May 2014, the European Union's highest court, the European Court of Justice, held that EU data subjects have the right to compel Google and other Internet search engines to remove results linking to websites containing personal information about them if their fundamental right to individual privacy outweighs the public's right to know.

In July 2014, Information Commissioner Christopher Graham said the ICO was preparing for appeals from an expected a “tsunami” of applications from individuals in the U.K. seeking removal of links from search engines.

“Let's be clear, we understand that links being removed as a result of this court ruling is something that newspapers want to write about,” ICO Deputy Commissioner David Smith said in the ICO's Aug. 20 statement. “And we understand that people need to be able to find these stories through search engines like Google.”

However, that doesn't mean they should “be revealed when searching on the original complainant's name,” he said.

The ICO's enforcement action comes two months after France's data protection authority (CNIL) ordered Google to remove search listings for legitimate right to be forgotten requests for all of its search engine versions, including in the U.S. Google has disputed that CNIL's order reaches beyond the EU.

Data ‘No Longer Relevant.’

The ECJ's right to be forgotten ruling was clear that links prompted by searching an individual's name are subject to data protection rules, Smith said.

“That means they shouldn't include personal information that is no longer relevant,” he said.

“Google was right, in its original decision, to accept that search results relating to the complainant's historic conviction were no longer relevant and were having a negative impact on privacy,” Smith said, referring to the search engine's initial agreement to remove the report about the complainant's minor conviction almost a decade ago.

However, after newspaper articles about Google's removal of the link, including details about the complainant's conviction, later appeared, the search engine refused to remove these links.

Smith said “it is wrong of them to now refuse to remove newer links that reveal the same details and have the same negative impact.”

Will Google Appeal?

Asked about Google U.K.'s response to the ICO's order, a Google spokeswoman told Bloomberg BNA Aug. 20 that the company wasn't going to comment.

Organizations that receive enforcement notices have a right to appeal to the U.K.’s First-tier Tribunal (Information Rights), the ICO said in its enforcement notice.

Google has appealed separate unrelated ICO rulings against it with varying success, most recently in the case involving U.K. users of the Safari Internet browser being able to proceed with privacy claims against the search engine.

To contact the reporter on this story: Ali Qassim in London at correspondents@bna.com

To contact the editor responsible for this story: Katie W. Johnson at kjohnson@bna.com

The ICO's enforcement notice is available at https://ico.org.uk/media/action-weve-taken/enforcement-notices/1432380/google-inc-enforcement-notice-18082015.pdf.


Request Bloomberg Law: Privacy & Data Security