What the EU's Google ruling means for IT contractors

They’re often the guardians of data belonging to their clients, but IT contractors now have a new way to limit the extent to which certain details about themselves can be found online, writes Olivia Whitcroft, principal of data and technology law specialist OBEP.

It all stems from the EU Court of Justice last month determining that individuals have a right to object and require removal of out-of-date or irrelevant links within online search results against their name.

In response to the decision, on Friday June 1^st, Google uploaded a form to allow users to ask for “irrelevant, outdated, or otherwise inappropriate” results to be removed.

But this does not create a blanket right of removal, as the right is dependent on the circumstances, and there remain practical difficulties in its application and enforcement. Further, it does not mean that contractors whose personal details show up in Google or other online search results can necessarily require the removal of accurate information on the website to which a link leads.

Google to offer a 'right to be forgotten' – the EU Court’s ruling:

The Court of Justice of the European Union was asked to rule on a series of questions on data protection law referred from the Spanish courts. This was in the context of an individual who had been seeking to require Google to remove links to articles which appeared in the results of a search against his name. The articles, originally published in 1998, were on the website of a Spanish newspaper and referred to proceedings to recover social security debts owed by the individual. The individual claimed that the matter had been resolved a number of years ago and the articles were now irrelevant, so they should no longer appear in search results. It had separately been determined that the publication on the newspaper's website itself was lawful (and this was not in question in the current proceedings).

The EU Court of Justice gave its judgment on May 13th 2014. It ruled that individuals have a right, in some circumstances, to require search engines to remove from search results links to web pages containing information relating to that person. Those circumstances include where the personal data are inaccurate, irrelevant, excessive or out of date in context. 

This holds true even if inclusion of the information on the web page to which the link leads is lawful, as the search list enables interconnection of information and greater ease in finding details. However, there is a balance to be met between privacy and freedom of information: weighing up the nature of the data and the sensitivity for the individual's private life against the interest of the public in knowing the information. 

Reaction and enforcement

There has been mixed reaction to the judgment. In some cases, the rights of privacy have been welcomed, while in others there is criticism that it impinges on freedom of expression and freedom of information. It presents practical difficulties for search engines, which may now need to exclude links to web pages, the content of which they do not themselves control. As noted above, Google has launched an application form for removal requests to assist in managing the many requests it is already receiving.

Furthermore, in each case, there will be questions on the applicability of EU law and how it will be enforced within a particular country. The UK regulator (the Information Commissioner's Office) says it will give time for search engines to put procedures in place and will then be focussing on concerns where there is clear evidence of damage and distress to individuals.

Taking responsibility

Conceptually, this ruling may assist IT contractors to control the spread of information about them which is irrelevant or out of date, which might otherwise show up in online search results and have a negative impact on work opportunities or reputation. Reports of previous debts or disputes which have long since been resolved are potential examples.

But IT contractors will need to take positive action to spot such links and request removal when appropriate. By the time a link is removed, some damage may already have been done, and the right may therefore provide longer-term protection rather than immediate relief.

As a separate matter, IT contractors may additionally be able to take action against a party which posts unlawful content about them on a website, or subsequently misuses personal information found online. However, whether such content is unlawful or being used unlawfully will need to be assessed in context, and use may be justified where it is relevant to legitimate activities (such as recruitment), or is in the public interest (such as journalism). 

Therefore, IT contractors should take some responsibility for their own privacy. This may include adjusting privacy settings on social media sites, and limiting the amount of information which they themselves post online. As an IT contractor, you may also wish regularly to keep an eye out for what is said about you or your business online, so that you can request removal where appropriate. Of course, IT contractors should consider the impact of actions taken in a public setting; even with privacy and data protection legislation, there are huge difficulties in controlling the flow of information on the internet.

Future changes to EU data protection law

The current EU data protection law is due to be replaced within the next couple of years by a new EU Regulation. This was approved in principle by the European Parliament in March 2014, although the text is not yet finalised. The early drafts of the Regulation gave individuals a distinct 'right to be forgotten' as well as a 'right of erasure' of personal data. These would provide clearer and stronger rights than within current EU law (and national implementing legislation). However, there remains the challenge of applying and enforcing these rights in the online world where the spread of information is relentless.

Editor’s Note: This article provides general information on the subject matter and is not intended to be relied upon as legal advice.