The right to be forgotten – updated - Internet for Lawyers Newsletter

With our lives increasingly documented online – whether this takes the form of professional personas on LinkedIn, personal updates on Facebook, political views on Twitter, selfies on Instagram or damning reviews on forums – it has become virtually impossible to forget our past. Younger generations are sometimes publishing (either purposefully or inadvertently) their every thought, picture or video for the internet to archive in perpetuity.

Although users of social media and cloud storage services may think they are in control of their data, anything which becomes publicly visible is often quickly indexed by search robots. Once any content has been ranked on Google (or other search engines), it is often difficult to later remove this content from search results. Even if a social media account is later deleted, copies of any posted content may be stored by archive engines, making the removal process even more complicated.

This situation has led to much debate over the so-called “right to be forgotten” with ensuing case law and legislation attempting to grapple with the issue.

What is the right to be forgotten?

The 2014 ECJ decision in Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (or simply “Google Spain”) established a precedent on the right to be forgotten. The judgment essentially confirmed that, under Directive 95/46/EC, data subjects have a right to request that search engine operators delist their personal data from search index results and that, subject to certain exemptions, search engines must comply with this request if the information in question is “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing.”

Initially, the precedent was only applied on a country by country basis (ie if a removal request was made by a French citizen, results would only be scrubbed for searches via google.fr, not google.co.uk nor google.com). In 2016, Google announced that it would extend the right to be forgotten principle to cover all searches carried out in the EU, irrespective of which search URL was being used (ie it started applying search result removal based on the IP address of the device rather than the particular URL).

In early 2018, Google reported that it had received a whopping 2.4 million right to be forgotten requests from European citizens between 2014 and 2017, and that it had delisted 43 per cent of the URLs. Most of the content which was requested to be delisted concerned professional information (24 per cent) as opposed to personal information (7 per cent).

In April 2018 the decision in Google Spain was upheld by a British court in the case of NT 1 and NT 2 v Google LLC. The High Court ruled that a businessman who had committed a crime many years ago was entitled to have search results relating to his crime removed – despite Google arguing that retaining them would be in the public interest. However, the judge took the opposite decision regarding another businessman, demonstrating that litigation in this area is likely to be very much dependent upon the individual facts of the case.

The right to erasure under GDPR

Article 17 of the General Data Protection Regulation (GDPR) introduces a new right for individuals who live in the EU: the right to erasure. This new right, which came into force with the rest of the regulation on 25 May 2018, provides EU data subjects with a right to request the deletion or removal of personal data when it is no longer required for processing. The right to erasure applies if:

the personal data is no longer necessary for the original purpose for which it was collected;
the personal data has been processed unlawfully or needs to be deleted in order to comply with a legal obligation;
the personal data was collected “in relation to the offer of information society services directly to a child”; or
the data subject has withdrawn their consent in relation to the processing of the data or objects to it being processed (and there are no overriding legitimate grounds for the processing).

The right to erasure under the GDPR is not specifically designed for search engine operators, but instead it covers all data controllers (Google Spain held that search engines should be considered as “data controllers”). This potentially strengthens the right to be forgotten principle established under Google Spain – as any other listings of personal data (eg on forums etc) are covered alongside search results – but it also introduces various exceptions to the rule.

Technical solutions

Although there are now established legal avenues available for individuals who want to exercise their right to be forgotten, it will sometimes be more effective (and also quicker and cheaper) to adopt a practical and technical approach, particularly as far as search engine results are concerned. This may involve:

creating new websites and social media accounts;
using search engine optimisation (SEO) techniques to improve the ranking of favourable results;
in the case of review sites which are listed, encouraging satisfied customers to leave feedback, in an effort to “bury” an unfavourable review; and
temporarily using AdWords to ensure control over the top result.

These methods can help to at least move adverse results off the first page of search results and prioritise favourable results. A commonly quoted statistic (which refers to a study by Chitika) is that over 90 per cent of users conducting Google searches do not look beyond the first page of results, so clearing up the first page will often suffice to minimise reputational damage.

Helping clients facing reputational crises

Lawyers should consider taking a holistic approach when advising clients dealing with a reputational crisis caused by adverse search engine results. Legal techniques for requesting the delisting of results have gained teeth as a result of Google Spain and the GDPR and actions under libel, harassment and IP laws are also possible. But technical measures can be as effective, if not more so, as a pragmatic means of dealing with the reputational damage caused by unfavourable entries appearing on the first page of search results.

Yair Cohen, specialist internet lawyer at Cohen Davis Solicitors, says a few key questions must first be asked when clients are facing damaging online content:

“Help the client understand the nature of the online posts. Help them find answers to the following questions: Where is the website located? Who is responsible for the post? What laws could be utilised to have them removed? What are the technical possibilities of “burying” the posts with the use of positive articles and most importantly, how can the weaknesses of having the posts published online be turned into strengths?”

Iain Wilson, partner at Brett Wilson LLP, breaks down some of the possible options which legal professionals may want to consider when helping clients with a reputational crisis, as well as their pros and cons:

“Practitioners need to review adverse search engine results with their clients holistically and put together a detailed strategy. Each result needs to be considered carefully as there will always be a number of options.

“For instance, one could contact a party who has contributed to a web page, a webmaster, a platform, a hosting company, a domain name registrar and/or search engines (normally Google, sometimes Bing as well). Within this there are different approaches; for example, there are various different routes of complaint to Google: the ‘right to be forgotten’ principle (in respect of data protection rights), defamation and copyright.

“Intermediaries can sometimes block or remove content. In other circumstances they will have no control over the content and can only delist it from search results for certain geographic areas (as with Google search). Nevertheless, this may mitigate most of the damage. Mainstream media outlets tend to be resilient unless the information is demonstrably false. This is because, to date, their data protection obligations have not been properly tested by the courts.

“One also needs to consider whether to go in hard or adopt a more conciliatory approach when complaining about online content. This is particularly so as in some instances a misjudged approach can result in further unwanted content. Where the source of all adverse search results is the same person (eg a disgruntled ex-employee or former partner), then unless they have moved on, firefighting may be an expensive short term solution. The term ‘whack-a-mole’ is often used to describe this situation: a lawyer persuades a website to remove an adverse posting and then another one pops up. Here a client needs to decide whether to take on the root course of a problem and seek undertakings or an injunction against the perpetrator.

“Finally, where the client has had, say, ‘a colourful life’ and there are numerous prominent adverse search engine results (perhaps relating to different matters) having some, but not all results removed may offer little practical benefit. Practitioners will need to be upfront with clients to ensure they are realistic in their expectations. For example, an attempt to secure the delisting or removal of an article in the mainstream media of a very recent and unspent conviction for a serious criminal offence is likely to fail. Clearing up other results is unlikely to repair a client’s reputation if this result will come up prominently on search engine results.”

Lawyers advising clients in this area should consider working with IT professionals, who can implement practical measures with regards to cleansing search engine results, so that they have a wider array of tools at their disposal.

Internet for Lawyers Newsletter

Edited by Nick Holmes

The right to be forgotten – updated

What is the right to be forgotten?

The right to erasure under GDPR

Technical solutions

Helping clients facing reputational crises

Further reading