+40-31 437 80 13

Data Privacy Insights: An individual is able to claim its „right to be forgotten” when search engines display misleading or inaccurate information

January 2023

28 January marks the celebration of the Data Protection Day. An anniversary that acknowledges, year after year, the efforts to raise awareness of the rules for processing personal data and to promote good practices in this field.

In this spirit, our colleagues Petruș Partene and Silvana Curteanu present their expert views on a topic that has been at the center of significant debate to date: the right to be forgotten.

This article was prepared for and first appeared on the avocatnet.ro platform in Romanian. The English version is include below.

Dear Internet, forget me!

The right to be forgotten does not represent a novelty in the field of personal data processing. However, a recent judgment published by the Court of Justice of the European Union (CJEU) has settled some potential controversies that (still) exist regarding the interpretation and implementation of the right to be forgotten and also the obligations of all operators involved, in particular the providers of online search engines.

The CJEU ruling in case C-460/20 underlines the importance of the truthfulness and accuracy of information that can be accessed through the use of online search engines. Thus, in applying the data subject’s “right to be forgotten”, the operator of a search engine will be obliged to remove the information from the indexed content if the person requesting de-referencing proves that the information is manifestly inaccurate.

The CJEU’s decision in this case relates to the situation complained of by the directors of a group of companies concerning the online publication of several articles criticising the group’s investment model and containing inaccurate information and defamatory opinions about them. The articles were accompanied by images of the complainants which continued to be indexed and displayed by Google as thumbnails, even after the content of the articles in question was no longer available.

Prior to the referral to the CJEU, the applicants requested the removal of this information available online, addressing this request primarily to Google, as operator of the online search engine. Following the failure of that request, the applicants brought an action against Google for the removal of that information, which was dismissed at first instance by the Kӧln Regional Court. However, the Higher Regional Court of Kӧln, hearing the appeal, was not as categorical in its reasoning and referred the interpretable legal aspects to the CJEU.

Other facts – the same assessment: the proportionality analysis between freedom of expression and information, and the right to private life and to protection of personal data – which one weighed more heavily, according to the CJEU?

It is important to emphasise that the legal rights provided to individuals regarding their personal data are not absolute, and a proportionality analysis is always required in relation to other fundamental rights enshrined in the European Charter of Human Rights.

As a general rule, the rights of data subjects to the protection of privacy and personal data outweigh the legitimate interest of internet users potentially interested in information that could constitute an interference with these fundamental rights.

However, as the CJEU has pointed out in this decision and in its previous case-law, the relationship between the two categories of rights may be reversed in cases where the publication of information in the sphere of a person’s private life is likely to contribute to a debate of general interest, taking into account, for example, the notoriety of the person concerned, the subject matter of the report, the previous conduct of the person concerned, the form and consequences of the publication, the manner and circumstances in which the information was obtained and its truthfulness. However, even in such situations, the right to personal data protection will prevail where at least part of the information concerned by the de-referencing request is inaccurate and ‘not minor in relation to the whole content‘.

However, the issue of truthfulness and accuracy of the indexed information should not translate into an obligation for search engines to play an active role in investigating and identifying the facts which the authors of the de-referencing requests claim to be inaccurate, as long as the relevant facts alleged by these persons are not proven by relevant evidence. Likewise, operators of online search engines cannot be required to debate with content providers in order to obtain missing evidence as to the accuracy/inaccuracy of the indexed content.

On the other hand, operators of online search engines are obliged, in the interpretation given by the CJEU to Article 17 of the GDPR, to accept  de-referencing requests made by data subjects whenever they present relevant, sufficient evidence to support their request and which establishes the manifestly inaccurate nature of the information contained in the indexed content or at least of a significant part of the content as a whole.

De-referencing of information is also mandatory in cases where data subjects produce a court judgment against the content creator, attesting to the inaccuracy of the information of which de-referencing is sought.

From theory to practice

In order to understand in which situations the obligation of online search engine providers to de-reference personal data upon request of data subjects applies, it needs to be clarified how the CJEU has interpreted the notion of “relevant evidence”. The Court has established that, although the burden of proof in establishing the inaccuracy of information lies with data subjects, it cannot be excessive. Thus, while it is considered reasonable to require, in support of a request for de-referencing, any evidence which the data subject could identify in order to establish the manifest inaccuracy of the content, the data subject cannot be required to prove the lack of truthfulness by a court judgment obtained against the creator of the content in question, “even in the form of an interim measures order”.

However, even in the absence of a decision establishing the inaccuracy of the information, if the data subject has initiated administrative or judicial proceedings concerning the inaccuracy of the information in an indexed content and such proceedings have been brought to the attention of the operator of the search engine concerned, the operator will be obliged, in order to inform users appropriately, to include in the search results a warning of the existence of such proceedings.

The request for de-referencethe data, as submitted by the applicants, involves a balancing of the right to privacy and the right to  personal data protection, on the one hand, and the right to freedom of information, on the other. As part of this proportionality test, the appropriateness of maintaining the indexation of the data was also assessed in the light of the initial context of the publication of that information. In this case, it was examined whether the retention of the thumbnails published when the articles appeared online was justified, given that the content of the articles was no longer available to search engine users. Thus, the display of the photographs in addition to the information essential to the original context – the text of the articles – has little informative value and therefore does not justify any processing of this data.

In conclusion, the rationale for data subjects’ requests for de-referencing will require very careful consideration in those situations where data subjects are still at a pre-contentious stage in relation to content creators. The rejection of possible requests for de-reference of personal data will be without prejudice to the right of data subjects to refer the matter to the supervisory or judicial authorities so that they can carry out the necessary checks and order appropriate measures to be taken.

Instead of “the end”,  “to be continued”

Although the CJEU in this case did not address the scope of the Regulation (EU) 2022/2065 on a single market for digital services (“Digital Services Act”) adopted in October 2022, we expect that the obligations laid down in this legislation will weigh significantly in the future development of case law, both at European and national level. The Digital Services Act includes an obligation for providers of very large online search engines to carry out risk assessments of the risks caused by the operation or use of their services, including in relation to the right to respect for private and family life and the right to protection of personal data. On the basis of these risk assessments, online search engine providers are obliged to take measures to mitigate the risks. Although it is not expressly stated, by the time when the rules established by the Digital Services Act will be applicable, we cannot preclude possible implications of this regulation in terms of proportionality assessment in the event of requests for de-referencing of data by data subjects.

SIMION & BACIU’s Data Privacy and Personal Data Processing practice combines strong technical expertise with on-the-job practical knowledge in order to provide a tailored response to each situation impacting our clients’ businesses.

Details about our practice are available HERE.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.