Europeans wasted no time in exercising their “right to be forgotten,” with 91,000 removal requests covering 328,000 URLs being logged with Google alone in the first two months since the European Union’s high court ruling.

Under the Court of Justice of the European Union’s (CJEU) May decision, individuals in the EU can request search engines to omit certain results from popping up on a search by the individual’s name if that information is inadequate, irrelevant, no longer relevant, or excessive. The case was brought by Spaniard Mario Costeja Gonzalez, who was trying to block links related to attachment proceedings from appearing in results from a search on his name. Costeja’s complaint targeted La Vanguardia newspaper, Google Spain, and Google Inc.

European data protection authorities met in Brussels recently with representatives from Google, Microsoft, and Yahoo on how the search engines are implementing the court ruling.

The decision has presented a host of implementation challenges, not the least of which is the flood of requests it triggered. The group of regulators, known as the Article 29 Data Protection Working Party (WP29), is looking to come up with guidelines by this fall for both the search engine firms and the national regulators who must handle any appeals.  The group is hoping to ensure consistency among the various search engines and jurisdictions.

The questions put to the search engines included what information they seek from a data subject before considering a delisting request, the criteria used to weigh the individual’s rights with the greater public interest in the information, what justifications they use for refusal, and whether results are delisted only on EU domains or globally. That last point has been a sticky one, with Google so far choosing to delist results from the European versions of its site, like Google.co.uk in Britain or Google.de in Germany, but not for Google.com.

Isabelle Falque-Pierrotin, chairman of WP29 and the French data protection authority CNIL, told Reuters that the issue is a complicated one.“The court’s decision opened a Pandora’s Box,” Pierrotin was quoted as saying. “Everyone involved now has to figure out how to handle these requests in a way that is operationally feasible and legally defensible.”

Pierrotin took issue in particular with Google’s practice of delisting search results only from European versions of its website. The omitted result would still be available through the main Google.com.

“If you delist only on Google.fr, for example, the right to be forgotten is much weaker,” Pierrotin said. Also at issue is the company’s notification to users that some search results may have been omitted in accordance with the law, and notification to publishers of the content when a link is removed.

 Google defended the practice in its written response to the working party’s questions. Peter Fleischer, Google’s global privacy counsel, said removing search results on a country-specific ccTLD has been a long-held practice when a search result violates the country’s law, for example on copyright infringement or extremist content. Because of the desire for consistency throughout the EU, Fleischer said the company is extending that practice to all EU country-specific domains for right to be forgotten removals. He added that fewer than 5 percent of users in the EU use the main Google.com site, and expects the bulk of those who do are travelers.

Informing users of omitted results helps maintain Google’s credibility while notifying the publishers helps transparency and provides an opportunity for corrections to be made, Fleischer wrote.

“Google has moved quickly to comply with the Court’s ruling,” Fleischer wrote. “The CJEU’s ruling was issued on May 13th, and by May 30th, we were able to launch the webform for processing removals. Our approach will not be static. We know it will change over time as data protection authorities and courts issue guidance, and as we all learn through experience.”

Fleischer revealed that Google has fielded 91,000 removal requests as of mid-July, and those requests resulted in about 53 percent of the 328,000 targeted URLs being removed. Google rejected requests for about 32 percent of the URLs, and sought more information for roughly 15 percent.

France topped the list, with 17,500 removal requests for roughly 58,000 URLs. Second was Germany, with 16,500 requests for 57,000 URLs, followed by the United Kingdom, with 12,000 requests involving 44,000 URLs. Spain, where the case started, has seen 8,000 requests for 27,000 URLs, followed by Italy and the Netherlands, according to Google’s response.

Fleischer noted that the company has to weigh requests on a case by case basis, leading to a hiring blitz to comply with the ruling. The only part of the process which is automated is the webform’s detection of the omission of required information.

“We are not automating decisions about these removals,” Fleischer wrote. “We have to weigh each request individually on its merits, and that is done by people. We have many people working full time on the process, and ensuring enough resources are available for the processing of requests required a significant hiring effort.”

Fleischer was unable to answer the group’s question about average processing time because of the initial flood of requests the company received.

Microsoft and Yahoo also were involved in the discussions with the data protection regulators, but their responses were not immediately available.

Topics