On Wednesday 8 July, data protection practitioners gathered to discuss some of the important issues arising from the CJEU decision in Costeja v Google with leading experts in this area, including Anya Proops of 11 KBW, Ashley Hurst and Dan Tench of Olswang and Jan Clements of the Guardian.
The Right to be Forgotten
Problems with application in practice
Anya Proops began by highlighting how there appears to be a privileging of the ECHR, Article 8 (privacy rights) over Article 10 (freedom of speech), caused by two types of asymmetry:
1) Legal asymmetry: The legal test of how the right to be forgotten is to be applied states that data privacy rights are to be treated as paramount in the first instance, albeit in some cases the balance will tip in favor of Article 10 rights.
2) Procedural asymmetry: Whilst it is clear that the Article 8 voices of data subjects are heard, it is less clear how the same can be said for the competing Article 10 voice of the author. What is more, online authors do not appear to have any obvious legal recourse if their voices are not heard.
This position is augmented by the fact that the Costeja procedure operates on the assumption that intermediaries will conduct the balancing exercise between Article 8 and Article 10. However, Google is ultimately a commercial entity and not a neutral or independent arbitrator.
Should Google notify webmasters of de-indexing requests?
Costeja did not specify any notification requirements, and there is uncertainty and disagreement as to what extent online authors should be notified as and when requests are made to de-list urls. Some consider that notification itself is in breach of data protection rights, whilst others maintain that notification is required in order for the Article 10 voices of online authors to be heard and for the necessary balancing test to be carried out.
The approach Google has taken to date is to notify newspapers in batches of URLs that have been delisted after the de-listing has taken place. No other information is provided and journalists are required to engage in a ‘jigsaw’ exercise to be enlightened as to the bigger picture. Jan Clements called for more transparency, so that journalists have a greater awareness of what is happening. At present, there is no real visibility of how decisions are being made.
Effective remedy?
The Costeja procedure has two notable limitations:
1. Google currently limits de-listing to EU domains. As such, any de-listed URLs can still be found on Google.com. This loophole might well close in due course but remains a current limitation.
2. By asserting their right to be forgotten, data subjects risk increasing their notoriety. At present for example, BBC and The Daily Telegraph have published lists of content which has been removed from search results.
The effectiveness of the remedy is thus highly dependent on the individual in question and the nature of their request. What might be effective for an otherwise unknown individual seeking to remove references to one event in their past might not be so effective for a public figure looking to clear a wider range of results (as Max Mosely’s case has demonstrated).
Damages
Dan Tench explained how the remedies available to individuals asserting data protection rights have been widened by the landmark ruling in Google v Vidal-Hall [2015] EWCA Civ 311, as s 13(2) of the DPA has now been disapplied and individuals are entitled to recover damages under the Act for non-material loss.
Whilst a relatively unexplored area, it is fair to predict that the level of these compensatory damages is unlikely to be considerable where no pecuniary loss has been suffered. The recent substantial privacy damages awarded in the phone hacking cases related to cases that involved serious breaches of privacy and should not be taken as any kind of guideline.
Future issues
The panel added that issues around the corner that need to be resolved include:
· the extent to which the journalistic exemption under s 32 of the DPA applies in relation to archived material that is sought to be removed under the Act; and
· the extent to which the Data Protection Directive and the E-Commerce Directive should be read in harmony, if at all, such that the same protections are available to internet intermediaries for data protection claims as they are for libel and privacy claims.
This is a brief summary report of the event and cannot do justice to the insight and detail of the information shared during the event.
Emma Cross is an Associate at Olswang LLP.
