Article 29 Working Party adopts guidelines on the implementation on the Right to be Forgotten judgment of the CJEU

By Patrick Van Eecke & Julie De Bruyn

The Article 29 Working Party, the European data protection advisory body existing of representatives of the national data protection authorities of the EU Member States, announced yesterday to have adopted guidelines – for national data protection authorities – on the implementation of the Court of Justice’s ruling on the right to be forgotten.

Earlier this year the Court of Justice ruled in the so-called ‘Google case’ (C-131/12 case of Google Spain and Google Inc. v the Spanish Data Protection Authority and Mr. Mario Costeja Gonzalez) on the existence of a right to be forgotten, which was a milestone for EU data protection in respect of search engines in particular and the online world in general. By acknowledging this right to be forgotten, the Court of Justice confirmed that data subjects have the possibility to request, provided certain prerequisites are met, search engines to de-list links appearing in the search results based on a person’s name. See here and here for earlier blog posts on this topic.

Fully aware that this court case would soon be the topic of heated debates between all stakeholders involved, the Article 29 Working Party assembled to issue interpretation guidelines.

The key messages appear to be that:

• The right only affects the results obtained from searches made on the basis of a person’s name;
• The right does not require deletion of the link from the indexes of the search engine altogether, meaning that the original information can still be accessible using other search terms, or by direct access to the source;
• De-listing decisions must be implemented in such way that they guarantee the effective and complete protection of data subjects’ right; and
• The EU law cannot be circumvented by for instance limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains; it follows from this that in any case de-listing should also be effective on all relevant .com domains.

The guidelines furthermore contain a list of common criteria which the data protection authorities will apply to handle the complaints filed with their national offices following the refusal of de-listing by a search engine. 13 main criteria are included in the list, which are to be considered as a ‘flexible working tool’ to help data protection authorities during the decision-making process. These criteria are to be applied on a case by case basis, in line with national laws. Article 29 Working Party seems to be sensitive to other important – possibly prevailing – rights and freedoms, and specifies that none of these criteria in itself is determinative, and that each of them has to be read in light of the principles established by the Court of Justice, and in particular in the light of the ‘interest of the general public in having access to the information’.

In the press release it is announced that local data protection authorities will focus on claims where there is a clear link between the data subject and the EU, for instance where the data subject resides in or is a citizen of an EU Member State.

At the moment of publication of this blog post, the actual guidelines have not yet been made publicly available by the Article 29 Working Party.

For more information, please contact patrick.van.eecke@dlapiper.com. or julie.debruyn@dlapiper.com