Privacy and the right to be forgotten – removing your information from search engine results

In a recent article we looked at protecting your personal information in online public records. In this piece we discuss removing your information from search engine results. Following two high-profile cases before the English courts last year, as well as the introduction of the GDPR, this article considers how the right to be forgotten works in practice.

The right to be forgotten and the GDPR

Almost everyone who is concerned about their online profile will start with a Google search, and where results are unsatisfactory, many will consider whether it is possible to have these search results removed. In the aftermath of high-profile cases like Google Spain (before the European Court of Justice) and NT1& NT2 (before the English courts), the so-called "right to be forgotten" is now a well-known legal remedy, and many will hope it applies to their circumstances. While applications for search engine removals are increasingly common, determining whether or not your request will be successful is by no means simple.

In May 2018, the right to be forgotten was codified into European law under Article 17 of the GDPR ('right to erasure'). Article 17(1) allows individuals to request that search engines remove their personal data where one of the following applies:

1.  the data are no longer necessary in relation to the purposes for which they were processed;
2. any consent upon which the processing is based is withdrawn and there is no other legal ground for the information remaining available;
3. the individual objects to the processing where it is based on either of the grounds in Articles 6(1)(e) or (f) (the latter of which is more likely to be relevant in the context of search engine results and provides a lawful basis for processing personal data if it is necessary for the purposes of "legitimate interests" pursued by the search engine or a third party, such as the underlying website) and there are no overriding legitimate grounds for the processing;
4. the personal data are unlawfully processed (for instance if the information is inaccurate or ceases to be accurate or relates to matters that took place some years ago);
5. the personal data have to be erased for compliance with a legal obligation to which the search engine is subject; or
6. the personal data are information relating to a child and have been collected in relation to the offer of paid-for electronic services to the child (in reality this is unlikely to apply in the context of search engine de-listing requests).

However, it is important to understand that the right to be forgotten is not absolute. There are a number of qualifications and exemptions in both the GDPR and the Data Protection Act 2018. Search engines may for instance argue that there is an overriding legitimate interest in the information being available which trumps the rights of the individual. The rights in Article 17(1) GDPR also do not apply where the processing of the personal data in question is necessary for exercising the right of freedom of expression and information or where the information is being published in compliance with a legal obligation. Conversely, the NT1 and NT2 case discussed below concluded that the journalistic exemption (or at least the version which applied under the old Data Protection Act) on which newspapers and other publishers will often seek to rely did not apply to Google.

You do not need to show you have suffered harm to make a request under Article 17 (although that may be helpful in demonstrating that any legitimate interest claimed by the search engine should not override individual rights), and the search engine must provide information on action taken in response to a request within one month (this may be extended to two months where the request is complex or there are multiple requests). If the search engine does not take any action in response to the request, it must inform the individual within a month, although in practice this does not happen consistently.

As some of the provisions above show, the GDPR's wording is at times abstract and there is still much debate about the scope of its application. While the case law on right to be forgotten requests is limited, it is useful in providing a sense of the issues a court will take into consideration.

The right to be forgotten in practice

Determining how Article 17 applies to individual circumstances is difficult, but it is helpful to consider the decisions reached in two high-profile cases that took place last year: NT1 & NT2 v Google LLC [2018]. Although NT1 & NT2 were decided just before the GDPR came into force, the majority of the factors considered are likely to be applicable under the new law.

Both NT1 and NT2 (whose identities were anonymised) brought claims against Google after it refused to remove information about their spent convictions from search results. Only one of them succeeded. In both cases the court balanced the claimants' rights to have damaging personal data removed against Google's legitimate interest in processing the information. The balancing exercise was essentially the same as the balancing test in cases where the right to privacy and the right to freedom of expression are in conflict. Influential factors included the role of each claimant in public life, the accuracy, relevance and sensitivity of the data, the harm caused to NT1 and NT2 by continued processing, and the extent to which the information continued to be in the public interest.

Of the two NT2 was successful in having search results removed. He had been convicted of a lesser offence, had pleaded guilty and had expressed remorse for his mistake. He had received a six-month sentence and his crime had no continued relevance to his professional life. He also had children of school age who were likely to be affected by the availability of this information online. Taking all these factors into account, the judge accepted that Google's continued processing of information relating to NT2's previous offence could not be justified, considering the harm caused by the search results and their lack of relevance to NT2's current circumstances. Consequently, the court ordered Google to remove information relating to NT2's conviction from search results for his name.

In contrast, NT1 had been convicted of a more serious offence involving dishonesty, with a sentence of four years. The judge found that he had not fully accepted responsibility for his crime and he had also sought to counter reputational damage by publishing material which claimed he was a successful businessman of integrity. NT1 had been prosecuted for a second dishonesty offence at a later date as well as being involved in numerous civil claims. The judge found that information about NT1's spent conviction remained relevant to his professional life, so the information remained in the public interest. As a result, Google's legitimate interest in processing N1's personal data outweighed his right to be forgotten. NT1's appeal was heard in the Court of Appeal in December 2018 and judgment is awaited.

Applying the right to be forgotten to your circumstances

The factors considered in NT1 and NT2 are by no means exhaustive, but they emphasise the extent to which right to be forgotten requests depend on individual circumstances, including the nature of the information to be removed, the conduct of the individual making the request and whether the information is still relevant. Where the information is entirely inaccurate, continued processing would be difficult for the search engine to justify, but many right to be forgotten claims involve personal information that is partially or substantially true. In these cases, a careful balancing exercise takes place.

When it comes to the right to be forgotten, it is clear that there is no one-size-fits-all approach. For anyone seeking to make a removal request to search engines, it is therefore important to seek guidance on how the provisions of the GDPR and Data Protection Act apply to your particular circumstances. This will not only avoid wasted time and expense, but it will also ensure that an application is given its best possible chances of success.

If you require further information on anything covered in this briefing please contact Alicia Mendonca-Richards or Tom Rudkin or your usual contact at the firm on +44 (0)20 3375 7000.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, January 2019