Using the right to be forgotten to benefit your business

Can finance directors take advantage of right to be forgotten to ensure negative information about their company is managed effectively?

In May 2014 the Court of Justice of the EU (EJC) made a landmark decision in the case of Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González.

The ECJ ruled that Google’s search engine business is that of a “data controller” in respect of the locating, indexing, storing and making available of information accessible on the internet and as such is subject to European Union data protection laws.

This in turn led to the decision that the applicant in this case had a right to rectification, erasure or blocking of certain information, and a right to object to the processing of such information in certain circumstances. The so called “right to be forgotten”.

The applicant, a Spanish citizen, had asked Google to remove from the list of search results based on his name, links to two announcements in a Spanish newspaper from 1998 concerning a real estate auction connected with attachment proceedings prompted by the applicant’s social security debts.

The fact that Google has a Spanish subsidiary in Madrid that promotes and sells advertising space targeted at the Spanish public using its search services, led the ECJ to determine that Google is subject to Spanish data protection laws for its search engine business.

This ruling establishes a framework to hold data controllers operating online search engines to account for the personal data they process even if that processing takes place in unknown locations around the world.

So what does this actually mean in practical terms for finance directors looking to ensure that negative information about their company is managed effectively?

Let’s imagine you put the name of the company of which you are finance director into a search engine. The list of results includes a link to a webpage that contains personal information about you that related to the company’s insolvency proceedings prior to a reorganisation.

This judgment establishes that if the way that information is being used is inadequate, irrelevant or outdated, then you can request that search engine provider to remove the link from future search results. The search engine provider must comply unless there is an overriding public interest.

If the search engine provider does not comply then you can contact your local data protection authority to file a complaint.

However, it is important to note:

(1) the right to be forgotten applies to personal data that is out of date, irrelevant or inadequate: there is no such right for information about the company, as company information is not personal data. Therefore in order to get the information about the company insolvency removed by applying this right, you need to show that the search result itself links you personally to the information found in the link.

(2) The original publication and the search engine are considered separately: the public record of a newspaper may not be deleted even if the link to it from a search website is removed.

(3) If it is in the public interest to know about your connection with the prior insolvency proceedings that will override your right to have the link removed.

It remains to be seen how the European data protection authorities interpret this judgement and apply it to concerns raised to them. A balance needs to be struck between the right to privacy and the public’s right to know.

The judgement does not establish an absolute right to have links to negative information removed.

The UK data protection authority, the Information Commissioner’s Office, says search engines need time to get systems in place to manage and deal with requests and it has indicated that to begin with it will only be focusing on complaints where there is clear evidence of damage and distress.

Therefore, for now at least in the UK, after you have established that the information linked to your name is out of date, irrelevant or inadequate and that there is no overriding public interest, it seems that to bring a complaint against a search engine provider that has refused to comply with your request, you would also need to demonstrate both damage and distress caused to you as a result of the continued existence of that link.