In other words, they have a “right to be forgotten.” Since the ruling, Google has been swamped with more than 70,000 removal requests and has had to quickly implement procedures to handle these applications, including establishing an advisory panel.
All a bit of a headache for Google, but how does this affect your business?
Getting to the full storyFirstly, it means that internet searches may no longer offer the full story when you’re carrying out due diligence into potential employees, business partners, investors, etc. Before the ECJ ruling, if an individual or business had, for example, been involved in High Court claims, previously been made bankrupt or been through an insolvency process, or been involved in shady dealings, it was highly likely that reference to these would appear in the results of a Google search. But now that it’s no longer guaranteed that such data will appear online, there are simple strategies which companies can use to try to ensure they get to the information they need. For the moment at least, if Google agrees to a “forget me” request, the “forgotten” web page remains a live internet site and the link to it will only be de-indexed from google.co.uk; it still remains on google.com’s index so the .com site should be your first port of call for searches. However, this may change in the future and companies should have other processes in place to check they can reach the information they need (but might not know exists). For example:
- Use crowdsourcing via social media to get informal information;
- Use more than one search engine – an individual’s “forget me” request made to Google may not have been made to Yahoo;
- Don’t just rely on search engines but go directly to websites which might have relevant information;
- Be imaginative when searching – don’t just search an individual or company name but, for example, the names of projects, or more generally for industry news; and
- Follow up all references and testimonials for employees and business partners.
Controlling dataNot only does the ECJ’s ruling affect everyone’s access to information, it may also significantly affect organisations which handle personal data but had thought that they fall outside of the EU’s data protection regime. Contrary to Google’s argument that it simply organised rather than controlled data, the ECJ decided that Google was a data controller, processing individual’s data. This has implications for businesses that process but do not change individual data they receive. It suggests that a company only needs to have some control over where data is displayed, and not necessarily total control over the information, to be classed as a data controller and to have to deal with the enhanced responsibilities this role attracts. In the future, businesses with this level of control over information may also need to implement steps to handle possible “forget me” requests in the same way as it approaches freedom of information requests.
Non-European operationsThe ECJ’s decided that Google’s processing of data on servers based in the US still fell within the European data protection regime because the processing was “inextricably linked” to Google’s European operation. This is worrying for search engines but also for any business that is not headquartered in Europe, but which uses personal data in its European operations and may likely have thought that these operations fell outside of the European data protection regime. Following the decision, this cannot be guaranteed and businesses which handle Europeans’ data but process or use it outside of Europe may need to still ensure that they comply with the EU data protection regime. Whilst the ECJ ruling has consumed the media in the last couple of months, there is a discussion to be had beyond the “individual privacy vs rights to freedom of expression” debate which is raging. The ruling has major implications for businesses and this judgment may just be the tip of the iceberg as there are more onerous “right to be forgotten” and “right to be erased” provisions for data controllers currently in draft European legislation, likely to become law in 2016/7. So it’s a case of watch this space. Caroline Benham is an associate in the commercial dispute resolution team at Gardner Leader law firm.
Share this story