Out-Law News | 02 Jun 2014 | 4:40 pm | 3 min. read
However Google's decision to implement the measure is a welcome development following its history of lobbying against EU privacy laws, Reding said.
“It is a good move that companies are finally investing in compliance and in innovative solutions respecting privacy and data protection rights,” Reding told the newspaper. “This is certainly a smarter business plan than investing millions into lobbying against European laws."
Reding's comments follow Google's decision last week to launch an online form for European Union users to submit requests for links to personal data to be removed from search rankings.
Google acted after the Court of Justice of the European Union (CJEU) ruled that search engines can be obliged to remove links to individuals' personal data from their search rankings at those individuals' request, under certain circumstances.
Within 24 hours of launching the service, Google had reportedly received 12,000 requests , representing an average of seven requests per second, according to the Daily Telegraph.
According to the Financial Times Reding said Google's decision to introduce the form undermined the group’s earlier statement that to apply the right to be forgotten would be practically impossible.
“We will now need to look into how the announced tool will work in practice, but the move demonstrates that fears of practical impossibility raised before were unfounded,” Reding said.
Ms Reding added that the right to be forgotten would not trump that of freedom of expression, as she pointed out that there was a clear exemption to the rule for journalistic work.
“Finding the right balance is exactly the spirit of the ongoing EU data protection reform, empowering citizens to manage their personal data while explicitly protecting the freedom of expression and of the media. The freedom of expression is a fundamental right enshrined in Europe’s Bill of Rights,” Reding said.
Earlier this month the CJEU ruled that search engine businesses have a general duty to stop lawfully published content being available to read via their search rankings where individuals seek the deletion of their data from those indexes on privacy grounds. This duty even extends to information that may not be prejudicial to a person’s interests.
However, the ruling made it clear that search engines must balance this 'right to be forgotten' with the competing right to freedom of expression to ensure that material, particularly that which is in the public interest, is not deleted when it should otherwise remain indexed.
The CJEU case involved Google, which is the dominant search engine provider in the EU market. In its judgment the court ruled that Google was a 'data controller' despite only indexing content published on third party websites. It ruled that the company was subject to Spanish data protection laws and that it may have to delete references to individuals that appear in its search rankings when requested to do so by individuals.
Google described its online form as "an initial effort" to meet right to be forgotten requests and comply with the CJEU ruling. However, it said that it may amend the mechanism after meeting with EU data protection authorities.
Following the launch of the form, a data protection authority in Germany raised some concerns about the amount of data applicants are being asked to provide.
The form asks users to provide their name and contact details, as well as links to web addresses they do not want to appear when searches are performed for their name and reasons why the links are either "irrelevant, outdated, or otherwise inappropriate" as a reference to them.
In addition, applicants are required to include a copy of a photographic ID. Google said this measure is necessary to verify the identity of applications and address the risk of impersonators making "fraudulent removal requests".
However, the data protection authority in Hamburg has challenged Google's requirement of applicants to provide proof of identity from those who file a request for deletion. It has highlighted concerns about the copying and processing of scanned passports and German ID cards, which is highly restricted under German laws.
The Hamburg data protection commissioner Johannes Caspar said that other proofs of identity should only contain personal data that is absolutely required for the purpose of verifying the individuals' identity and that other details should be redacted
The watchdog also said that Google had not made it clear to users how long it would retain the personal data included on the forms for before deleting the information. It welcomed Google's rapid response to the CJEU's ruling but said that "thoroughness" was more important than "speed".