28 August 2015 #Employment
The UK’s data protection authority - the Information Commissioner’s Office (ICO) - has issued Google with an enforcement notice requiring it to remove links to certain news stories.
An internet search engine that provides results in response to a search on a person’s name will be processing personal data for the purposes of data protection legislation. Last year, the Court of Justice of the European Union (in a case also involving Google) held that individuals have the right to request the removal of their personal data from search results if they feel the processing is incompatible with data protection law, for example, if it is inaccurate, inadequate, irrelevant or excessive in relation to the purposes of the processing. This has been referred to as the ‘right to be forgotten’.
In the present case, Google agreed to remove a link to a website which contained details of an individual’s criminal conviction imposed almost 10 years earlier. However, this removal sparked fresh news stories which again referred to the individual and the conviction. Google refused to remove the links to these news stories on the basis that they were recent news and in the public interest. The ICO disagreed with Google stating that the information was no longer relevant and was excessive in relation to the purposes for which it was processed.
In reaching this decision the ICO carried out a balancing exercise weighing up the individual’s right to privacy and the importance of allowing public access to the information. It noted that the information related to a relatively minor offence which had occurred almost a decade earlier, the information would not protect the public from improper or unprofessional conduct and the offence had not been the subject of public debate. The ICO recognised that the news stories themselves may be in the public interest but said that this interest could be ‘adequately and properly protected’ without allowing for search engines to produce links to the news stories based on a search of the individual’s name.
Google have until 22nd September to comply with the notice unless it decides to appeal the decision.
There is certainly an emerging trend from the courts and data protection authorities in Europe to recognise this ‘right to be forgotten’ and it will likely be given statutory footing in the new EU Data Protection Regulations, which will be directly applicable in member states including the UK. Whilst the impact of such a right will clearly be felt by commercial search engines such as Google, the right will also be relevant to employers whose company websites contain similar search functions. Employers should, therefore, seriously consider any requests from employees that their personal data be removed from such sites.