In November 2014, the Article 29 Working Party (A29WP) issued a set of Guidelines following the Google right to be forgotten ruling by the Court of Justice of the European Union.

The Court had held that private individuals have the right to request search engine operators to de-list any inaccurate, irrelevant or outdated information pertaining to them which appears in search results for their name. The Court further ruled that this right does not, subject to certain exceptions, extend to public figures on the grounds of public interest.

The A29WP Guidelines advise as to how national data protection authorities intend to implement the decision. The main features of the Guidelines are the following:

• Public Interest Balance: where a data subject requests personal data to be de-listed, it will be for the search engine operator to consider the nature and sensitivity of the processed data and the interest of the public in having access to that particular information. The stronger the public interest in not de-listing the relevant information, the less likely a request for erasure will be granted.
• Territorial Effect of a De-Listing Decision: where a request to de-list search results is granted, any de-listing must include all web domains to which European citizens have access and not just regional ones (for example i.e., .eu and .com).
• Search Engine Notice: search engine operators cannot display a notice which states that information has been de-listed. This is to avoid users of a search engine knowing that a de-listing request has been made and granted. Moreover, where a search engine operator de-lists search results, it cannot inform webmasters of this.
• 13 Criteria: in cases where a request to remove search results is rejected, a search engine operator must provide reasons outlining the basis for its decision. Individuals can appeal such a decision to their national Data Protection Authority to see if the decision is in line with data protection law. In making its judgment, the relevant DPA will apply a list of 13 criteria. The DPA must apply these criteria to any data subject complaint regarding a de-listing request. The criteria focus on both the information listed and the individual as a data subject. For example, a DPA must assess if the data subject is a minor, whether the personal data constitutes sensitive personal data and whether the data subject is suffering prejudice as a result of the information listed. The DPA must also assess whether or not the personal data relates to a criminal offence. The criteria also allow a request to de-list to be applied for in respect pseudonyms and nicknames.

While these latest Guidelines have been criticised by some public figures, overall it is hoped that they will provide a degree of consistency in the application of the right to be forgotten decision across the EU.

Contributed by:  Brian McElligott