Recent Judgement: Right to be Forgotten
Michael Byrne explores the implications of this significant judgment by the Court of Justice of the European Union.
CJEU rules 'Right to Be Forgotten' Includes Manifestly Inaccurate Information in Search Engine Results
In the recent case of TU, RE v Google, the Court of Justice of the European Union ("CJEU") ruled that data subjects may seek removal of manifestly inaccurate material from search engine results in accordance with the established 'right to be forgotten'1 arising under the General Data Protection Regulation ("GDPR")2. The CJEU first recognised the right of data subjects to seek the removal of outdated, irrelevant or no-longer-relevant information from search results in the Google Spain3 case in 2014. The right was subsequently codified in Article 17 of the GPDR4.
Background to Matter
The complainants in TU, RE v Google were directors and shareholders in a group of German-based investment companies5. In 2015, articles criticising the investment model of certain companies within the group were published online, alongside images of one of the complainants driving luxury vehicles. These articles were subsequently indexed by Google and made available when searching for the complainants' names.
The complainants requested that the articles be removed on the basis that they contained inaccurate and defamatory material6. They further sought the removal of the accompanying thumbnail images from Google Image search results. Google refused the requests, arguing that the content arose in a professional context and that Google was not in a position to determine the alleged inaccuracy of the content. The complainants sought an order from the German Federal Court of Justice requiring Google to remove the content from its search results. The Court referred a number of questions on the interpretation of both the GDPR and the Data Protection Directive (the "Directive") to the CJEU.
Does the Right to be Forgotten Apply to Manifestly Inaccurate Material?
The CJEU firstly examined the limitations under Article 17(3) of the GDPR on exercising the right to be forgotten. The CJEU noted the competing interests of the complainant's privacy rights and the public interest in access to the information and in preserving freedom of expression. In balancing these rights, the CJEU determined that the right to freedom of expression and information generally overrides the right to privacy. However, the Court held that the right to freedom of expression and information cannot apply where the information is manifestly inaccurate, whether in full or in part7.
The CJEU held that the person seeking removal (i.e. the data subject) bears the burden of demonstrating that the material is manifestly inaccurate. However, to avoid an excessive burden on data subjects, they are only required to provide evidence reasonably within their ability to procure8. The CJEU further held that data subjects should not necessarily need to obtain a Court order to obtain removal of manifestly inaccurate material.
On the other hand, the CJEU determined that search engine operators cannot be required to 'play an active role' in verifying the accuracy of indexed webpages where the material is not, in itself, manifestly inaccurate. The Court sought to strike a balance, requiring search engine operators to remove content where a data subject provides evidence 'establishing the manifest inaccuracy of the information', thereby not requiring operators to independently verify such claims for themselves. Where the data subject fails to demonstrate inaccuracy or where data contains only inaccurate 'information of minor importance', search engine operators are not required to remove the data9.
Are Search Engine Operators Required to Remove Thumbnails?
The Court then examined the request to remove the thumbnail images which appeared in Google Images search results. The Court first affirmed that image-based search engine operators are considered data controllers for the purpose of the GDPR and Data Protection Directive (which was the relevant law in force at the time).
As a preliminary issue, the CJEU noted that operators of image-based search engines remain subject to the same rules as their text-based counterparts. The CJEU in particular noted the risk that indexing photographs, and making them available by way of image searches, poses to individuals' right to privacy. The Court reiterated its decision in Von Hannover v Germany in which the CJEU recognised that photographs may convey 'personal or even intimate information about an individual or his or her family'.
The Court then examined the balancing exercise to be carried out by search engine operators in deciding whether to remove thumbnails. It held that search engine operators cannot consider the source of the images (eg, the original article) in deciding whether there is a public interest in refusing the removal request. Search engine operators must consider the informative value of the image without the benefit of the context provided by the web-page of origin. If the photograph, by itself, cannot provide sufficient context to give rise to public interest in accessing it, then the competing privacy rights of the data subject will tend towards favouring removal, where removal is requested.
"The CJEU noted the competing interests of the complainant's privacy rights and the public interest in access to the information and in preserving freedom of expression. In balancing these rights, the CJEU determined that the right to freedom of expression and information generally overrides the right to privacy."
Conclusion
The judgment has significantly reduced the burden on data subjects seeking removal of search engine content pursuant to the right to be forgotten where the material is manifestly inaccurate, or where it consists of images of the data subject displayed without context. No guidance has yet been prepared by the European Data Protection Board or supervisory authorities as to how operators should consider the decision. Consequently, it remains unclear at present the extent to which the decision will impact websites which are not search engines, but which provide an internal search function.
Whilst the decision seeks to draw a balance between freedom of expression and the right to privacy, the position in respect of thumbnails is now decidedly weighted in favour of data subjects. Whilst search engine operators may be in a position to demonstrate public interest in maintaining links to articles, it is likely to be substantially more difficult to demonstrate a public interest in making the accompanying images available without including the accompanying article for context. In practical terms, search engine operators may trend towards removing images on request, given the difficulty of demonstrating a public interest in maintaining the content, and the accompanying administrative burden.
The author would like to credit Ciara McGarvey, trainee solicitor; and Samuel Elliott for their support and assistance in researching and producing this article.
References
[1] C-460/20 [2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [3] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [4] GPDR Article 17 (1) [5] TU, RE v Google paragraphs 15 - 16 [6] Ibid paragraph 20 [7] TU, RE v Google paragraph 62 [8] Ibid paragraph 68 [9] Ibid paragraphs 73 – 74
