European Commission: Article 29 Working Party Issues Guidelines on Implementation of “Google Spain” Judgment

IRIS 2015-2:1/3

Ronan Ó Fathaigh

Institute for Information Law (IViR), University of Amsterdam

The Article 29 Working Party, an independent advisory body established under the EU’s Data Protection Directive (95/46/EC), has published its “Guidelines” on the implementation of the EU Court of Justice’s ruling in Google Spain v. AEPD concerning search engines as data controllers (see IRIS 2014-6/3). The Working Party is mainly comprised of representatives of data protection authorities from EU Member States and the purpose of its latest Guidelines is to (a) provide information on how data protection authorities intend to implement the Google Spain judgment; and (b) provide a list of common criteria which data protection authorities will apply to complaints following a “de-listing” refusal by search engines.

On the interpretation of the Google Spain judgment, a number of points are notable. First, the Guidelines state that search engines “should not as a general practice inform the webmasters of the pages affected by de-listing of the fact that some web pages cannot be acceded from the search engine in response to a specific name-based query”. Second, in relation to domains, the Guidelines state that “limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the judgment. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com”.

Third, while the Guidelines state that “the interest of search engines in processing personal data is economic”, there is also an interest of internet users in receiving the information using the search engines. Thus, the fundamental right of freedom of expression under Article 11 of the European Charter of Fundamental Rights has to be taken into consideration when assessing data subjects’ requests.

Finally, the Guidelines list 13 “common criteria” which data protection authorities will apply to complaints following a “de-listing” refusal by search engines. These criteria “should be seen as a flexible working tool” and “no single criterion is, in itself, determinative”. The criteria include: (1) Does the search result relate to a natural person - i.e. an individual? (2) does the data subject play a role in public life; (3) is the data subject a minor; (4) is the data accurate; (5) does the data relate to the working life of the data subject; (6) does the search result link to information, which allegedly constitutes hate speech/slander/libel against the complainant; (7) is the information sensitive within the meaning of Article 8 of the Directive; (8) is the data up to date; (9) is the data processing causing prejudice to the data subject; (10) in what context was the information published; (11) could the data subject have reasonably known that the content would be made public; (12) was the original content published in the context of journalistic purposes; and (13) does the data relate to a criminal offence?