Digital data can be disappeared

An internet search of Rebekah Brooks will always link her back to this period. Picture: Getty Images

In the modern world of 24-hour news reporting, social media and powerful internet search engines, there is more easily accessible information about individuals in the public domain than ever before.

In the current social climate where sharing and self promotion is rife and the selfie reigns supreme (Podolski’s selfie with the World Cup and Angela Merkel had nearly a million likes in nine hours), many of us are fairly relaxed about what we put out into the digital world and share regularly.

Google search Podolski in future and the picture will probably appear in the results. Given that moment with the World Cup is one Podolski will surely treasure forever and will happily have reinforced in people’s memories, that search result is one he would unlikely ever complain about. However, what if something is out there which you would rather be forgotten?

There have been years of coverage regarding Rebekah Brooks and the phone hacking allegations. Last month she was cleared of all wrongdoing. However, an internet search of her name, even in many years to come, will always link her back to this period. Where there is a public interest in information being available, the law in our country balances that public interest against the individual’s right to privacy. Given Rebekah Brooks’s role as a public figure, and the public interest in the subject matter, the eyes of the law would probably justify that information being available in perpetuity. However, what if your average individual wants information about them to be forgotten in the digital world? Does a right to be forgotten exist? This was addressed last month in a decision of the European Court of Justice.

Mario Costeja Gonzalez had, several years ago, auctioned his house to pay social security debts. He approached Google because he wanted to have newspaper announcements relating to this removed from Google search results. He also asked the newspaper to block the pages being indexed by search engines.

Both refused, and the case ultimately came before the European Court, which was asked to decide on whether Mr Gonzalez had the right to have the search results removed under the EU’s Data Protection Directive (DPD).

The Spanish courts had already decided that the newspaper did not need to delete their announcements. That would also be the case here, where there is an exemption for publishing carried out solely for journalistic purposes.

The law of data protection is fairly detailed and complex and the court firstly had to decide whether the DPD applied. It would apply if Google was a data controller which was processing personal information. The court felt it was, as a) it processes personal data on third-party web pages as it decides on the purposes the information is used for and how it is indexed; and b) indexing data is tantamount to processing personal data.

The next stage was to decide whether individuals had the right to have search engine entries removed and be forgotten. The court found that they do, explaining that 1) even if the publication of information on pages is lawful, interference with a person’s right to privacy cannot be justified by the economic interests of the data processor (in this case Google); 2) a balance has to be struck between the privacy rights of individuals and the interests of internet users seeking information; and 3) an individual can ask for personal data to be removed from internet search results if the personal data they want to have removed is now inadequate, irrelevant or excessive given the time elapsed and the reasons for the processing.

As a general rule, an individual’s rights will override the interests of the search engine operator and internet users. In the case of Mr Gonzalez, whose reputation was being damaged by references to attachment proceedings which had long been resolved, removal was justified.

In the earlier example of Rebekah Brooks, a public figure, and where there is a clear public interest in having access to the information, the result would in all likelihood be different.

The main effects of the decision are that 1) individuals have enhanced rights to request their removal from internet search results; and 2) the daily operations of internet companies and website publishers will be impacted as they will have to have procedures in place to accept and deal with such requests.

Not only that, however. All businesses who use data sources containing personal data and process it could be affected. As the “right to be forgotten” becomes more well known and used, individuals may seek to use it broadly. Even when looking at situations where the DPD would not strictly apply, if a business’s website has published details of a person or event they have sponsored, have promotional material featuring an individual or business or have links to external sources which contain personal data, they should be prepared for how they will deal with a removal request.

• Pamela Abbott is a solicitor with CCW Business Lawyers www.ccwlegal.co.uk