This post is also available in: Español
On July 7, 2020, the European Data Protection Board (“EDPB”) published the consolidated version of part 1 of its Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (the “Guidelines”). The EDPB published the first version of the Guidelines on December 2, 2019, submitting it to public consultation and corrections, and publishing the consolidated version on the stated date.e.
The Guidelines establish interpreting criteria on the application of articles 17 and 21 of the General Data Protection Regulation (“GDPR”) to search engines. These Guidelines are specifically aimed at online search engines because of the special nature of exercising these rights in the specific case of these companies.
Article 17.1 of the GDPR establishes the reasons why data subjects can request the erasure of their personal data, in this case the erasure of the link from the search engine’s results:
- The personal data are no longer necessary for the purposes for which they were collected or processed, taking into account the balance of rights at play: data protection and the right to freedom of expression and information. That balance requires studying whether the data have become incorrect or outdated over time.
- The data subjects withdraws their consent.
This reason is unlikely in the case of search engines since, if the legal basis for the processing is consent, it will generally have been given to the owner of the indexed website and not the search engine.
- The data subject objects to the processing, and other legitimate reasons for the processing do not take precedence.
This will be the most common reason to request the delisting of result in question. The data subjects must claim the reasons related to their personal situation that justify delisting the information. The search engine can put forward overriding legitimate reasons. The usual criteria will be taken into account in determining:
- whether the data subject is a person of public interest;
- whether the information is part of the data subject’s public, professional or private life;
- whether the information is considered defamatory by a court;
- whether the information appears true but is inaccurate or false; and
- whether the information is related to any insignificant offense that occurred a long time ago and whose indexing causes harm to the data subject.
- The personal data have been processed unlawfully. This case can arise, for example, when a court order has expressly prohibited indexing the information.
- The personal data must be erased to comply with a legal obligation established in EU or Member State law.
- The personal data have been obtained in relation to offering information society services to children.
The search engine is limited to ceasing to show the challenged results appearing in searches using the data subject’s name. Consequently, the information will still be available on the original website (for which the search engine is not responsible) and also on the search engine when performing a search with keywords other than the data subject’s name..
Furthermore, the Guidelines establish when exceptions apply to search engines, under which they can refuse to comply with the right of erasure exercised by the data subject:
a) Exercising the right to freedom of expression or information.
The Guidelines specify that this exception will apply as a rule to the original source of the indexed information but it indicates that, depending on the circumstances, it can also apply to search engines’ indexing activity.
b) Complying with a legal obligation, performing a mission in the public interest or exercising public powers granted to the data controller.
This exception will apply to search engines when the legal obligation or mission performed in the public interest or exercising public powers falls directly on them..
c) Reasons of public interest in the area of public health.
In this case, the Guidelines also stress that the public interest will be regulated, whether by the European Union or a Membe State, and directly affect the search engine.
d) Archiving purposes in the public interest, scientific or historic investigation purposes, or statistical purposes, if the stated right may prevent or seriously hinder achieving the objectives of that processing.
The EDPB insists that the archiving or investigation purpose must pertain to the search engine itself to apply the exception and not erase the link from the list of results. Therefore, it would not be sufficient to have originally published the information for scientific investigation purposes; rather, it would also have to be the reason why the search engine has indexed the information.
e)Filing, exercising and defending claims.
By: Álvaro Bourkaib, Ane Alonso and Pedro Méndez de Vigo
This post is also available in: Español