Issued by the Article 29 Data Protection Working Party regarding search engines

---

Purpose of the document

This document is designed to provide information as to how the European Data Protection Authorities (“DPAs”) assembled in the Article 29 Working Party intend to implement the judgment of the Court of Justice of the European Union in the case of “Google Spain and Inc. v. ADEPC and Mario Costeja” C-131/12. It must be read together with the list of common criteria which the DPAs will apply to handle the complaints, on a case-by-case basis, filed with their national offices following refusals of de-listing by search engines. The list of criteria should be seen as a flexible working tool which aims at helping DPAs during the decision-making processes. The criteria will be applied in accordance with the relevant national legislations. No single criterion is, in itself, determinative. The list of criteria is non-exhaustive and will evolve over time, building on the experience of DPAs.

Search engines as data controllers

The ruling recognizes that search engine operators process personal data and qualify as controllers in the meaning of article 2 of Directive 95/46. The processing of personal data carried out in the context of the activity of the search engine must be distinguished from, and is additional to that carried out by editors of third-party websites.

A fair balance between fundamental rights and interests

In the terms of the Court, “in the light of the potential seriousness of the impact of this processing on the fundamental rights to privacy and data protection, the rights of the data subject prevail, as a general rule, over the economic interest of the search engine and that of internet users to have access to the personal information through the search engine”. However, a balance of the different rights and interests has to be made and the outcome may depend of the nature and sensitivity of the processed data and on the interest of the public to have access to that particular information, on the other. The interest of the public will be greater if the data subject plays a role in public life. 

Limited impact of de-listing on the access to information

In practice, the impact of the de-listing on individuals’ rights to freedom of expression and access by the users of search engines proves to be very limited. DPAs in their assessment of the circumstances will systematically take into account the interest of the public having access to the information. If the interest of the public overrides the rights of the data subject, de-listing will not be considered appropriate.

No information is deleted from the original source

The judgment expressly states that the right only affects the results obtained from searches made on the basis of a person’s name and does not require deletion of the link from the indexes of the search engine together. That is, the original information will still be accessible using other search terms, or by direct access to the source.

No obligation on data subjects to contact the original website

Individuals are not obliged to contact the original website in order to exercise their rights towards search engines. Data protection law applies to the activity of a search engine acting as a controller. Therefore, data subjects should be able to exercise their rights in accordance with the provisions of Directive 95/46 and, more specifically, of the national laws that implement it.

Data subjects’ entitlement to request delisting

Under EU law, everyone has a right to data protection In practice, DPAs will focus on claims where there is a clear link between the data subject and the EU. For instance, where the data subject is a citizen or resident of EU Member States.

Territorial effect of a decision of delisting

In order to give full effect to the data subject’s rights as defined in the Court’s ruling, De-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects’ rights and that EU law cannot be circumvented. In that sense, limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant .com domains.

Information of the public on the delisting of specific links

The practice of informing the users of search engines that the list of results to their queries is not complete as a consequence of the application of European data protection law is not based on any legal requirement. It would only be acceptable if the information is offered in such a way that users cannot in any case come to the conclusion that one concrete individual has asked for the removal of results concerning him or her.

Communication to website editors on the delisting of specific links

Search engines should not as a general practice inform the webmasters of the pages affected by removals of the fact that some webpages cannot be acceded from the search engine in response to specific queries. There is no legal basis for such routine communication under EU data protection law.

In some cases, search engines may want to contact the original in relation to particular requests prior to any delisting decision. In order to obtain additional information for the assessment of the circumstances surrounding that request.

Taking into account the important role that search engines play in the dissemination and accessibility of information posted on the Internet and the legitimate expectations that webmasters may have with regard to the indexation of information and display in response to users’ queries, the Working Party strongly encourages the search engines to publish their de-listing criteria they use, and make more detailed statistics available.

Questions ? Please contact Sarah Boulerhcha, communications officer

+32 (0)2 274 48 08 of +32(0)473 85 15 97

sarah.boulerhcha@apd-gba.be