In years past, today’s news was tomorrow’s chip paper. Digital publishing and internet search engines mean it remains at our fingertips; ubiquitous and permanent. The information at everyone’s fingertips may be incomplete, out of date or simply inaccurate. For every trial or tribunal hearing which is covered in great detail, there are many more which receive scant, incomplete or no coverage. In the Google Spain case the CJEU recognised that the ever-present nature of the information available in response to a search against someone’s name posed a significant risk to an individual’s rights.
Context of Requests
The following example is illustrative of the context in which we have been involved in RTBF (delisting or dereferencing) requests. We made a right to be forgotten request on behalf of a healthcare professional who had previously been the subject of concerns in respect of their professional practice. Many years ago the existence of an investigation came into the public domain and was reported by national and local media. The reporting was superficial and incomplete, and in a number of respects inaccurate. No doubt the journalists would have asserted a public interest in the content of the report. They clearly did not regard it as being of sufficient public interest to merit seeing the story through to its conclusion; after the passage of considerable time the concerns which has been raised were explored at a contested oral hearing, held in public, before an independent regulatory tribunal – no adverse findings were made.
Neither the hearing nor its outcome were reported in the media. Importantly, in cases where no adverse finding is made, the statutory regulator’s policy is not to publish details of the hearing after its conclusion. That policy is the product of a transparent process of public consultation. The statutory register for the relevant profession records that the individual is registered and makes no reference to the historic proceedings.
The predictable consequence was that the crawled and indexed websites contained only the adverse early reports and no mention of the ultimate outcome.
An initial RTBF request to Google under the pre-GDPR regime was rejected. That outcome was not entirely surprising. As a registered healthcare professional the requester ran up against a predictable hurdle arising from the Article 29 Working Party Guidelines on the implementation of the Google Spain decision, and its indication that regulated professionals can usually be considered to ‘play a role in public life’. When made afresh post-GDPR the application for delisting was rejected on the basis that there is a public interest in making information available, in view of the registrant’s registered status. A complaint to the ICO followed with the associated a three month wait for them to begin consideration of the file. This was followed shortly afterwards by a letter from the ICO indicating that they had written to Google advising them the results should be delisted.
The ICO accepted our submissions that the public interest in obtaining information about this registered professional was served by the statutory regime of registration. Despite the ICO’s letter and Google’s indication that the material would be delisted, considerable further correspondence was required. This is one illustration of the sort of circumstances in which we have made delisting requests on behalf of clients.
Practical Issues with Delisting Requests
Google clearly prefers applicants to use their on-line form for any delisting request, but will deal with requests transmitted in other ways. For practical purposes, the URLs which are the subject of the request should be provided as active hyperlinks. It goes without saying that it is in the requester’s interest to communicate clearly their objection to the processing (i.e referencing of the identified URLs). Whilst there is no obligation to articulate the reasons for the objection, and no obligation to produce evidence in support of the objection, it is best to consider and address these issues at the outset and to provide such objective evidence as is available to support the request. Obviously this should include any objective evidence of inaccuracy or evidence that the referenced URLs contain out of date information.
However, you should also consider whether there is evidence of relevant authoritative assessments of where the public interest lies. In the example cited above, we supported the request with extensive evidence of public consultations, and evaluations by statutory bodies, of the circumstances which justified publication of historic allegations that concluded with no adverse findings. Those assessments deserved considerable weight, making it more difficult for Google to demonstrate a compelling interest in continued referencing.
It is also important to acknowledge when there may be a significant public interest in certain material remaining available but to demonstrate how that interest can be met without the material being referenced in a search against the data subject’s name. You should consider supporting the objection with evidence demonstrating that such material will continue to be referenced in response to relevant thematic search terms unrelated to the objector’s identity.
You can expect a rapid acknowledgment from Google but progress comes more slowly. Do not expect reasoned decision-making. Concessions (agreement to de-referencing) are made but no reasoned basis for the concession is disclosed. Do not expect consistency either. There may be agreement to dereferencing of some URLs but not others, with no explanation as to how those URLs have been distinguished.
The responses appear to draw from a small pool of stock phrases. It is unlikely that the statement of reasons will extend beyond the expression of a conclusion that having assessed the balance of relevant rights and interests relating to the content in question, including factors such as its “relevance” or “apparent relevancy” to the requester’s professional life, Google LLC has decided not to block the content. Even where the objections relate to different types of content, the response may well consist of a single conclusion with no granular analysis.
In the small number of cases which we have dealt with post-GDPR it has taken the intervention of the ICO to get Google to commit to more explicit reasoning which directly engages with specific arguments and evidence advanced in support of the request.
If your request relates to more than a handful of URLs you can expect some back and forth with Google. Expect responses which will cause you to doubt your sanity. You may be told that “the specified web page is not currently displayed in Google’s search results” or that they “did not locate your client’s name on the page” or that they were “unable to locate the content in question”. In one instance it became clear that the reason the URL was not appearing in the search (when Google undertook it) was that they were searching against the name of the solicitor acting for the client and not for the client’s name. Perhaps most peculiarly you may be told that “it appears that the full content is locked or otherwise inaccessible to us.” In our experience, problems of the sort identified above are often magically resolved by re-sending the relevant URL to Google.
Do not expect Google to use its own initiative in vindicating your client’s rights. By way of illustration, following a favourable decision from the ICO, Google indicated their agreement to our dereferencing request: considerable further correspondence was then required to ensure that the requisite action was taken. Progress was rather piecemeal. This was also the case when Google had indicated they would dereference results without ICO intervention.
Comment
In the context of the sort of balancing exercise required in handling RTBF requests, the failure to give a properly-reasoned decision is inconsistent with the principle of accountability. The primary decision-maker in these requests – which address the requester’s fundamental rights – has an interest in the outcome and the resources invested in arriving at it. The absence of reasoned decisions is a problem for data subjects and their advisers.
There are obvious benefits to the search engine in not providing a reasoned decision. It saves time and resources. In many cases the inequality of arms between the search engine and the requestor will mean the decision is never challenged. If it is challenged, greater time and energy can be invested in producing a post-hoc justification, unconstrained by any earlier explanation.
As a controller in receipt of an objection to processing, the GDPR imposes a positive obligation on the search engine to demonstrate ‘compelling legitimate grounds for the processing’ which override the objector’s rights. It would be surprising if the mere assertion that there is a public interest in continued referencing were deemed sufficient to discharge that positive obligation. However, that appears to be the approach of the largest player in this sector. Given the volume of cases which they handle, the ICO is well placed to scrutinse the processes adopted by search engines in responding to requests. In addition to dealing with individual complaints, the ICO should proactively assess whether there is a pattern of Search Engines failing to discharge the basic positive obligation to ‘demonstrate’ the grounds on which they continue processing following a delisting request.
Stewart Duffy is a Partner and Solicitor at RadcliffesLeBrasseur 85 Fleet Street London.
