European regulators are working on guidelines for appeals from people whose requests to remove information from search results under their name have been turned down by search engines such as Google. The guidelines may have consequences for the right to be forgotten in the current data protection legislation reform, affecting the rights and obligations of online merchants when processing consumers’ data. The guidelines will most likely be published in November.
A balanced right to be forgotten
Ecommerce Europe remains in continuous dialogue with policy makers to ensure that the right to be forgotten is used in a balanced way so not to harm online businesses. In exchanges with regulators, Ecommerce Europe stresses that in new data protection legislation the right to be forgotten should remain limited to user-generated content, as merchants have a wide range of legal obligations to keep data on transactions, for example for bookkeeping, taxes and consumer warranty.
Guidance from the Article 29 Working Party
The group publishing the guidelines, the Article 29 Working Party (WP29) aims to bring some clarity in implementing a landmark court decision in May that gave Europeans the right for the first time to ask search engines to erase information about them from the web.”We want the toolbox to guide difficult decisions on how to balance the individual’s right to privacy in the Internet age against the public interest,” said Isabelle Falque-Pierrotin, who heads France’s privacy watchdog and the WP29, earlier this month.
The Article 29 Working Party is composed of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor and the European Commission. The Working Party aims to coordinate the interpretation and enforcement of data protection rules throughout the European Union.
Criticism on Google’s handling of requests
Google says it has received over 120,000 requests from across Europe to remove from its search results everything from serious criminal records, embarrassing photos to negative press stories. The Internet giant, which handles over 80 percent of requests in Europe, has previously come under fire for its handling of “right to be forgotten” requests. Its restriction of the removal of Internet links to European sites only, for example, has been questioned by several authorities. “So far we’ve had the impression that some of the decisions Google has made have not been coherent,” Falque Pierrotin said.
Right to be forgotten and the Data Protection Directive
The ECJ ruling about Google serves as an important landmark in the reform of EU data protection rules. However, neither the Commission nor the EU Court of Justice have just invented the right to be forgotten. The notion is already present in the EU Data Protection Directive of 1995. The Commission aims to update this principle in the current data protection reform and to clarify it for the digital age, for example by making it clear that EU rules have to be applied by all firms offering products and services to EU consumers whether they are located in the EU or outside of it.
Data protection and the e-commerce sector
Harmonization of data protection rules will make it easier for European online merchants to expand cross-border, and it creates a level playing field with extra-EU companies. However, the data protection rules should not pose additional burdens upon the e-commerce sector. Ecommerce Europe engages in regular exchanges with policy makers to ensure the voice of the sector is heard in the legislative process.