Data protection regulators in Europe are working on creating a common set of guidelines for handling appeals by individuals whose requests to search engines to de-index personal information, under the region’s recent right to be forgotten ruling, have been refused.
The Article 29 Working Party (WP29), which is composed of representatives from the data protection regulators of individual European Union Member States, said the aim is to ensure a “coordinated and consistent approach” in the handling of complaints.
The so-called ‘right to be forgotten’ (RTBF) refers to a judgment by Europe’s top court back in May, which determined that search engines are data controllers and are therefore subject to European data protection legislation, and must accept and process requests by private individuals to remove links to outdated or irrelevant information about them.
The WP29 met this week to come up with draft criteria for the appeals guidelines, and yesterday issued a press release stating they have agreed on a “common ‘tool-box’ to ensure a coordinated approach to the handling of complaints resulting from search engines’ refusals to “de-list” complainants from their results”.
While the RTBF ruling requires search engines to accept and process requests it does not require them to grant requests. Indeed there is rather a requirement that data controllers weigh up whether the information involved in a de-indexing request is “inaccurate, inadequate, irrelevant or excessive for the purposes of the data processing,” and that they balance requests against other fundamental rights, such as the freedom of expression and of the media.
The complexities of the judgment calls involved here are obvious. So it’s not surprising the WP29 is seeking to establish common guidelines across European data protection regulators for determining appeals in instances where initial de-listing requests have not been granted.
Per country inconsistencies on that front would further undermine the rtbf ruling — which is already under sustained attack from free speech campaigners, as well as facing a well-funded lobbying effort by Google especially. The latter is currently engaged in a parallel public debate tour of Europe with the rtbf ruling at its core, in an effort to exert pressure for regulatory reform.
The WP29’s statement holds the line on the rtbf, and notes that data protection authorities in Europe have received complaints as a result of search engines refusing to de-list complainants’ results — which it describes as an illustration of “genuine demand” for data protection. A demand it says the ruling is addressing.
That said, the statement does not detail how many appeals DP authorities have received. According to Reuters the number of appeals is minuscule vs the number of de-listing requests received by Google alone. Earlier this week it reported around 90 appeals filed in the UK, 70 in Spain, 20 in France and 13 in Ireland; vs the more than 120,000 de-listing requests Google has reported receiving from across Europe.
Regarding the specifics of the WP29’s appeals criteria, it says it has agreed to establish a network of “dedicated contact persons” in order to develop common case-handling criteria so that data protection authorities can deal with complaints consistently.
It says this network will provide DPs with:
- a common record of decisions taken on complaints
- a dashboard to help identify similar cases as well as new or more difficult cases
The WP29 also confirms it is continuing to consult with stakeholders affected by the rtbf ruling, noting that in addition to the meeting it held with search engines back in July it also met with media companies this week.
Many media outlets have been outspoken critics of the rtbf ruling. Indeed, some outlets have published stories about the data involved in individual de-listing requests, especially where it involves their own content, thereby undermining the ruling by re-publicizing content that private individuals might have been seeking to obscure.
If the WP29 is looking for ways to resolve this re-publication problem it is not yet tipping its hand on how it intends to do that.
The other big issue to consider is how search engines are weighing and judging requests which do not result in an appeal to a DP authority. The effectiveness of the data protection decisions being made by commercial entities is an unknown at this early stage, with the rtbf ruling in place. The WP29 notes only that it is continuing to “analyse how search engines are complying with the ruling”. So presumably that’s an area where it feels it needs to amass more data.
However, with Google’s theatrical — and very public — anti-RTBF lobbying efforts, the WP29’s rather closed-box approach risks becoming problematic. Public confidence can easily be undermined where there is no public oversight of how a ruling is being implemented. And it’s certainly not hard to find critics of the RTBF ruling, given that the information the public is party to is whatever Google — the key protagonist in this drama — chooses to leak.
One thing is certain: The whole process continues to emphasise exactly how much power Google’s data-pointer wields. For more commentary on that power, I recommend reading this excellent blog by UK law professor Paul Bernal.