The judgment of the Court of Justice of European Union (CJEU) of 13 May 2014 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (C-131/12) sets a milestone for EU data protection in respect of search engines and, more generally, in the online world.
It grants the possibility to data subjects to request to search engines, under certain conditions, the delisting of links appearing in the search results based on a person’s name.
On Wednesday 26 November, the European data protection authorities assembled in the Article 29 Working Party (WP29) have adopted guidelines on the implementation of the CJEU’s judgment. These guidelines contain the common interpretation of the ruling as well as the common criteria to be used by the data
protection authorities when addressing complaints.
CNIL received hundreds of complaints following Google’s refusals to carry out delisting on Internet links (or URL).
Following the assessment of the complaints, the CNIL has requested Google to carry out the delisting of several results. It was expressly requested that the delisting should be effective on whole search engine, irrespective of the extension used (.fr; .uk; .com …).
Although the company has granted some of the requests, delisting was only carried out on European extensions of the search engine and not when searches are made from “google.com” or other non-European extensions. In this context, the President of the CNIL has put Google on notice to proceed, within a period of fifteen (15) days, to the requested delisting on the whole data processing and thus on all extensions of the search engine.
Google disagrees with an order from the French Data Protection Authority to apply the right to be forgotten to all its search results around the world.
In June, CNIL ordered Google to remove search results meeting “right to be forgotten” criteria from any regional version of Google’s search engine. However, granting CNIL’s request could have a “serious chilling effect on the web,” Google said Thursday in a blog post.
Shodan, a search engine for the Internet of Things (IoT), recently launched a new section that lets users easily browse vulnerable webcams.
Since July 2014, the Dutch Data Protection Authority has received 111 requests to delist search results on a person's name in a search engine. The right to de-list information from the index of a search engine follows a ruling by the European Court of Justice in the case Google Spain (C-131/12). All requests related to Google. In 32 cases the Dutch DPA has mediated between Google and the data subject. In 24 cases the search results were delisted.
French citizens have submitted 250 000 requests to the Google search engine for the application of right to be forgotten, almost half of the request concerned personal information which was either outdated or inexact. Starting from 24 May 2014, Google received a total of 347 533 such requests in Europe, France being the country with the highest number of applicants.
Policy Observatory