Microsoft building 'right to be forgotten' mechanism as EU watchdogs promise consistent privacy guidelines

Out-Law News | 13 Jun 2014 | 3:43 pm | 3 min. read

Microsoft is in the process of building a new mechanism that will allow individuals to submit 'right to be forgotten' requests.

The internet giant is obliged to develop the mechanism for Bing users following a recent ruling by the EU's highest court. The Court of Justice of the EU (CJEU) confirmed that search engine businesses can be subject to the trading bloc's data protection laws in certain cases and that, if they are, they can be forced to censor search results at individuals' request where the results displayed impinge on privacy rights.

"We’re currently working on a special process for residents of the European Union to request blocks of specific privacy-related search results on Bing in response to searches on their names," Microsoft said on a Bing Help web page. "Given the many questions that have been raised about how the recent ruling from the Court of Justice of the European Union should be implemented, developing an appropriate system is taking us some time. We’ll be providing additional information about making requests soon."

Google has already developed an online form that individuals can fill out to request the removal of links that reference them to be removed from Google's search engine index. Hamburg's data protection watchdog has highlighted concerns about the copying and processing of scanned passports and German ID cards in light of the requirement Google has set for applicants to submit proof of identity when submitting 'right to be forgotten' requests.

The company has conceded that the form is "an initial effort" to comply with the CJEU judgment and that its solution may be adapted following engagement with EU privacy watchdogs.

"In implementing [the CJEU's] decision, we will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information," Google said in outlining how it proposed to handle the forms submitted. "When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information – for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials."

In a statement, the Article 29 Working Party, which represents all the national data protection authorities in the EU, welcomed the speed with which Google had released its form for submitting right to be forgotten applications following the ruling. However, it said it was too early for it to endorse the form as being "entirely satisfactory".

The Working Party, which met to discuss the implications of the CJEU's judgment last week, said that it plans to issue guidelines on how the individual data protection authorities will handle complaints in cases where search engines refuse 'right to be forgotten' requests.

"The European data protection authorities assembled in the WP29 have decided to analyse the consequences of the CJEU ruling and to identify guidelines in order to develop a common approach of EU data protection authorities on the implementation of the ruling," it said. "These guidelines will help data protection authorities building a coordinated response to complaints of data subjects if search engines do not erase their content whose removal has been requested."

"In the meantime, the authorities invite search engines to put in place user-friendly and pedagogical tools for the exercise by their users of their right to request the deletion of the search results links containing information relating to them," it said.

In May, the CJEU outlined circumstances in which search engines could be said to be subject to EU data protection rules and found that, where they are in scope of the provisions, they have a general duty to stop lawfully published content being available to read via their search rankings where individuals seek the deletion of their data from those indexes on privacy grounds. This duty even extends to information that may not be prejudicial to a person’s interests.

However, the ruling made it clear that search engines must balance this 'right to be forgotten' with the competing right to freedom of expression to ensure that material, particularly that which is in the public interest, is not deleted when it should otherwise be remain indexed.

The CJEU case involved Google, which is the dominant search engine provider in the EU market. In its judgment, the court ruled that Google was a 'data controller' despite only indexing content published on third party websites. It ruled that the company was subject to Spanish data protection laws and that it may have to delete references to individuals that appear in its search rankings when requested to do so by individuals.