The Working Party said that in order to give full effect to the data subject’s rights as defined in the Court’s ruling, de-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. As a result,
“limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com”.
In other words, the Working Party has confirmed that, as was argued in recent Inforrm post, the attempt of Google to exempt its search engine at Google.com from the “delisting procedures”is misconceived. The Working Party is making it clear that Google cannot limit the de-indexing process to versions of search which it says are “targeted” at EU countries. In the words of the BBC, Google has been told to expand the “right to be forgotten”.
In addition, the Working Party has said that search engines should not as a general practice inform the webmasters of the pages affected by removals of the fact that some web pages cannot be accessed from the search engine in response to a specific name based query.
The guidelines contain a list of 13 “main criteria” which the data protection authorities should apply when complaints are made following refusals of de-listing by search engines. No single criterion is determinative and each much be read in the light of the “interest of the general public in having access to the information”.
The criteria are as follows:
1. Does the search result relate to a natural person – i.e. an individual? And does the search result come up against a search on the data subject’s name?
2 Does the data subject play a role in public life? Is the data subject a public figure?
3. Is the data subject a minor?
4. Is the data accurate?
5. Is the data relevant and not excessive?
a. Does the data relate to the working life of the data subject
b. Does the search result link to information which is allegedly constitutes hate speech/slander/libel or similar offences in the area of expression against the complainant?
c. Is it clear that the data reflect an individual’s personal opinion or does it appear to be verified fact?
6. Is the information sensitive in the meaning of Article 8 of the Directive?
7. Is the data up to date? Is the data being made available for longer than is necessary for the purpose of the processing?
8. Is the data processing causing prejudice to the data subject? Does the data have a disproportionately negative privacy impact on the data subject?
9. Does the search result link to information that puts the data subject at risk?
10. In what context was the information published?
a. Was the content voluntarily made public by the data subject?
b. Was the content intended to be made public? Could the data subject have reasonably known that the content would be made public
11. Was the original content published in the context of journalistic purposes?
12. Does the publisher of the data have a legal power – or a legal obligation – to make the personal data publicly available?
13. Does the data relate to a criminal offence?
The Full Guidelines can be found here [pdf].