The website reputationvip.com published an interesting blog (via Webwereld) with statistical data on how Google deals with the ‘right to be forgotten’. What is interesting is that Google apparently refuses requests for deletion if the content which is the subject of the request has been put online by the applicant himself. The question is whether this is right.
The ‘right to be forgotten’
In the famous Google Spain case the European Court of Justice found (summarised here) that the European privacy law also applies to Google in relation to activities connected with operating the search engine.
Since privacy law requires, among other things, that personal data that are processed must be ‘sufficient, relevant and not excessive’, anyone who believes that personal data relating to him which are not (or which are no longer) ‘sufficient, relevant and/or which are excessive’ can request that the controller refrains from further processing these data (either via the right of inspection and correction or via the right to object). The controller will then have to decide on that request.
This is no different for Google than for other parties that process personal data. With Google, however, this phenomenon is usually explained in the media as the ‘right to be forgotten’. It would be more accurate to refer to a ‘right to a reconsideration’, because you can never directly force a deletion of material.
The company Reputation VIP operates the website forget.me. Requests for deletion can be submitted via this website. The company published the illustration to the right with statistics on the outcomes of these requests (click to enlarge).
Grounds for refusal don’t seem to always hold
A few interesting numbers can be gathered from the statistics:
- in 22% of the rejections, it was argued that the information had been put online by the data subject himself;
- in 13% of the rejections, it was argued that the information was contained in the person’s own social media profile;
These do not seem to me to be correct grounds for rejection.
After all, the Court explicitly considered that a data subject’s interest in privacy weighs heavily and in principle prevails over the interest of the general internet public (legal ground 81). A request for deletion also does not in any way imply that the data must be removed from the source website (legal ground 82). In fact, publication on the source website can be entirely lawful, while the inclusion in the search index is not (or is no longer) (legal ground 86).
The fact that someone once put something online does not therefore justify their being eternally confronted with it in a search engine. Google should have to prove why it still has an interest in and justification for continuing to process the personal data, despite the explicit request from the data subject that the data be deleted.
It will only be a matter of time until a hateful online commenter pushes the matter and brings Google’s decision on a deletion request to court.
By Joost Becker