Following the ruling rendered by the Court of Justice of the European Union (CJEU) on May 13th, 2014 in relation to the “right to be forgotten”, the European data protection authorities adopted common guidelines within the framework of the WP29.
The CJEU indeed consecrated the right for individuals to request from a search engine that their personal data be de-listed, i.e. that the information relating to them personally be no longer made available to the general public in a list of results following a query in the search engine. However, these requests should be assessed on a case-by-case basis, in the light of the economic interests of the search engine operator and the preponderant interest of the public in having access to the information concerned by the request for removal.
Several complaints filed with the data protection authorities, following a rejection of de-listing requests by search engines, enabled the establishment of a list of criteria, which, according to the CNIL, should be considered as non-exhaustive and evolving over time.
The table below is a summary of the factors to be taken into account – no single criterion being in itself decisive - by search engines and data protection authorities for the assessment of the legal basis of a de-listing request.
Information concerning a public figure which relates to his/her family or health
Information concerning a public figure which relates to his/her professional life or facts which may contribute to a debate in a democratic society
The complainant is a minor
If the complainant is a minor, the child’s best interests must be a primary consideration
Accuracy and relevance of the data
Information which is inaccurate, which creates a misleading impression about the data subject, which may be qualified under criminal law as defamation, slander or libel, or which is excessive in relation to the context
Information which relates to the data subject’s professional life, depending on the profession and the public’s interest to have access to the information
The CNIL is more likely to be favorable to the de-listing of data relative to the data subject’s racial or ethnic origins, political convictions or religious and philosophical beliefs, trade union membership, health or sexuality
Context of release of the information
Contents put online by the complainant, who wishes to have them de-listed
Contents that the complainant could reasonably have expected to be made public
Out-of-date information with regard to the initial context of the online release
Information which relates to a criminal offense
Information which relates to an offence covered by amnesty or to a minor offence, the publicity of which may have a disproportionate impact on the subject’s private life and is not overridden by the public’s interest in having access to that particular information
Information causing a prejudice to the data subject or a risk such as identity theft or stalking
Information made public for journalistic or legal purposes
When de-listing is assessed to be appropriate, it should according to the CNIL’s document be effective on all relevant domain extensions (.fr, .com, etc.).
Furthermore, according to the same document, the practice of posting a notice informing the search engines’ users that some results have been removed would only be acceptable if the information is presented in such a way that users cannot, in any case, conclude that one particular individual has asked for de-listing of results. In this respect, Google opted for a universal notice posted under all name researches, regardless of content de-listing1.
1 “When you search for a name, you may see a notice that says that results may have been modified in accordance with data protection law in Europe. We’re showing this notice in Europe when a user searches for most names, not just pages that have been affected by a removal” (FAQ Privacy & Terms Google)