News: Google takes a new approach to the “right to be forgotten” in response to regulator pressure

Starting this week, Google will implement “right to be forgotten” requests on all Google search engines (including Google.com) accessed from the country of the person making the request.  This change will be implemented retrospectively to all delisting carried out under the Google Spain ruling.

The change was announced in a blog post dated 4 March 2016 by the Google Global Privacy Counsel Peter Fleischer.

Google’s previous practice was that, when someone submitted a “right to be forgotten” request using its webform then, if the request was accepted, the URL would be “delisted” from all European versions of the Google search engine (google.co.uk, google.de, google.fr and so on).  It would, however, remain accessible on other versions of Google search, such as google.com.

Under the new practice, Google will also restrict access to the URL from the country of the person making the request (using “geolocation” indicators such as IP Addresses).

In November 2014, the EU Article 29 Working Party, adopted Guidelines on the implementation of Google Spain in which it said

The Working Party said that in order to give full effect to the data subject’s rights as defined in the Court’s ruling, de-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. As a result,

“limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com”.

In June 2015, the French data protection authority, CNIL, required Google to delist URLs on all versions of the search engine.  An informal appeal against this decision was rejected in September 2015.

It appears that by adopting this new approach Google has done what it believes is the minimum required to comply with the Article 29 Guidance and the CNIL order. However, geolocation is never fully effective and can be avoided by using a VPN and changing browser privacy settings. It remains to be seen whether Google’s change in approach will satisfy the European data protection authorities.

The Wall Street Journal noted that, the CNIL had refused to be drawn on the question saying that “an inquiry is currently under way into the new elements Google has provided” and that last year, CNIL has said that a geographically limited implementation would not be sufficient.

Large numbers of delisting requests are now being made under the Google Spain ruling. Google’s most recent transparency report indicates that it has received 400,564 removal requests and has removed 42.6% of URLs covered by them.  Google has received 48,979 requests from the United Kingdom and has removed 184,115 URLs (38.6% of those requested).