Right to be forgotten further?

The repercussions of the judgment in Google Spain v AEPD and Mario Costeja González: C-131/12, [2014] All ER (EC) 717 (analysis for Lexis®PSL IP&IT subscribers here) may prove to be only a taster of the privacy issues Google must wrestle with as it prepares for a further test case of enormous consequences. Monica Salgado, data protection specialist at Speechly Bircham considers the possible implications of the action brought by Daniel Hegglin, a former Morgan Stanley banker over ‘vile and abusive’ material about him that repeatedly appears in search results.

What are going to be the central issues when this case is heard?

The main issue at play will be the scope of the right to be forgotten principle in England and Wales. Google was originally asked to ensure a specific URL containing allegedly defamatory materials relating to Daniel Hegglin did not appear in Google search results.

Google has made some attempts to remove such search results in relation to Mr Hegglin’s right to be forgotten request, but now Mr Hegglin wants Google to strengthen its efforts and take all reasonable and proportional technical steps as might be necessary to make sure the allegedly defamatory webpages do not appear as snippets in Google’s search results. In most right to be forgotten requests, the individual has to indicate what the URL of the website(s) that contain the controversial personal data is—so it’s not such an ‘open’ request. I think that will be the main point in the trial in November—does Google have to take all those reasonable steps to avoid any such materials appearing in search results, or is it still just the case of the individual listing the URLs and requesting Google to remove those from its web search results.

What is the current position in relation to the obligation of internet service providers (ISPs) to take down unlawful or defamatory content?

Google hasn’t been asked to remove the content of the pages as an ISP—it has been requested to remove, as a web search provider, from the search results the pages that might contain inaccurate, irrelevant personal data. The original web pages are not under attack, so to speak, under this request.

To what extent will the court consider the commercial implications of Mr Hegglin’s request? Is the court under any obligation to consider open internet principles?

Under the general right to be forgotten principle, as it was interpreted by the CJEU in Google Spain v AEPD and Mario Costeja González: C-131/12, [2014] All ER (EC) 717, whoever is analysing the request (either the court or Google/web search operator) will have to weigh up a number of competing interests:

  • the interests of the individual who does not want to have inaccurate or misleading information about themselves made accessible to the general public
  • the interests of Google and other web search operators to carry out their activities and provide search results, and
  • the public interest of freedom of expression and access to information

I imagine there will be a similar weighing of interests when analysing the scope of the right to be forgotten and how it applies in this specific case. It’s not so much the open internet concept itself that is engaged here, rather that when the court is dealing with personal data, it will have to balance a number of potentially contradictory interests.

Although separate from the right to be forgotten, how does this case build on the CJEU ruling?

Mr Justice Bean refers to the González decision in his judgment and points to how it clarifies that Google is indeed a ‘controller’ for the purposes of EU data protection law. Until González, the idea was that as Google’s web search operation was controlled by Google Inc in the USA such operations were not covered by EU data protection laws. All Google subsidiaries in Europe just sold advertising space, and so were not responsible for what the web search operation did. González clarified this, and said there is an inextricable link between the operation of the subsidiaries which sold advertising space in the web search or other related pages from Google, and actually how successful and profitable the web search operation is. As such, the CJEU held that that division does not apply, and that the local subsidiary in the EU (in González, Spain) does in fact carry out an activity that is relevant to the web search operation. Therefore, Google Inc’s web search operation is covered by data protection law. Mr Justice Bean specifically referred to this to justify granting leave for the claim form to be served out of jurisdiction to the US to Google Inc in this present case. Mr Hegglin’s had already submitted a right to be forgotten form to Google. What he is doing here is broadening the scope of that request.

What should lawyers be watching out for as this case progresses?

I think the most interesting aspect of this case will be identifying the remedies available to an individual who’s right to be forgotten request has not been properly respected by Google or other web search operators, and how they may resort to courts in England and Wales for redress. Also, going back to the core issue of this case, it will be interesting to see whether the scope of the right to be forgotten request will be something very specific that the individual will always have to pinpoint (ie the specific websites they consider are in breach of the Data Protection Act 1998), or will it be something that Google will have some discretionary judgment over and will have to take all reasonable steps to avoid.

Interviewed by Duncan Wood and republished with permission of WIPIT’s sister site, Lexis®PSL IP&IT

Area of Interest