The EU Article 29 Working Party, has adopted Guidelines on the implementation of the CJEU’s judgment in the case of Google Spain v AEPD and Costeja.
The Working Party said that in order to give full effect to the data subject’s rights as defined in the Court’s ruling, de-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. As a result,
“limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com”.
In other words, the Working Party has confirmed that, as was argued in recent Inforrm post, the attempt of Google to exempt its search engine at Google.com from the “delisting procedures”is misconceived. The Working Party is making it clear that Google cannot limit the de-indexing process to versions of search which it says are “targeted” at EU countries. In the words of the BBC, Google has been told to expand the “right to be forgotten”.
In addition, the Working Party has said that search engines should not as a general practice inform the webmasters of the pages affected by removals of the fact that some web pages cannot be accessed from the search engine in response to a specific name based query.
The guidelines contain a list of 13 “main criteria” which the data protection authorities should apply when complaints are made following refusals of de-listing by search engines. No single criterion is determinative and each much be read in the light of the “interest of the general public in having access to the information”.
The criteria are as follows:
1. Does the search result relate to a natural person – i.e. an individual? And does the search result come up against a search on the data subject’s name?
2 Does the data subject play a role in public life? Is the data subject a public figure?
3. Is the data subject a minor?
4. Is the data accurate?
5. Is the data relevant and not excessive?
a. Does the data relate to the working life of the data subject
b. Does the search result link to information which is allegedly constitutes hate speech/slander/libel or similar offences in the area of expression against the complainant?
c. Is it clear that the data reflect an individual’s personal opinion or does it appear to be verified fact?
6. Is the information sensitive in the meaning of Article 8 of the Directive?
7. Is the data up to date? Is the data being made available for longer than is necessary for the purpose of the processing?
8. Is the data processing causing prejudice to the data subject? Does the data have a disproportionately negative privacy impact on the data subject?
9. Does the search result link to information that puts the data subject at risk?
10. In what context was the information published?
a. Was the content voluntarily made public by the data subject?
b. Was the content intended to be made public? Could the data subject have reasonably known that the content would be made public
11. Was the original content published in the context of journalistic purposes?
12. Does the publisher of the data have a legal power – or a legal obligation – to make the personal data publicly available?
13. Does the data relate to a criminal offence?
The Full Guidelines can be found here [pdf].
The EU’s collision course with the U.S. Congress, Constitution and courts continues. The U.S. Congress immunized intermediaries like Google from liability and any cause of action, including injunctions, relating to third-party content by virtue of the Communications Decency Act, 47 U.S.C. 230. The courts in every federal circuit have construed the immunity broadly. Congress reiterated their position by unanimously enacting The SPEECH Act in 2010, which bars all U.S. Courts from enforcing foreign judgments that do not comport with the CDA and the 1st Amendment. Here we have this working group now wanting to reach into the USA and not only tell Google.com that they must restrain speech within the USA and the rest of the non-EU world in a manner that is repugnant to the CDA and the 1st Amendment to the Constitution, but that they are also to not exercise their own 1st Amendment right to speak if they choose to tell webmasters of de-indexed content.
There is a reason that the overwhelming majority of UGC websites are based in the U.S. If the EU’s goal is to drive their localized operations out of the EU jurisdiction, they seem to be on the right path.
I think reasonability should be taken into consideration on this issue.