The right to be forgotten
Healthcare professionals who have been the subject of regulatory proceedings may struggle with the electronic footprint that can be generated on the Internet. However, recent developments at a European level may benefit practitioners, particularly those who have all allegations found not proved in the course of regulatory or criminal proceedings.
Individuals can take steps to minimise the impact of negative publicity by asking online search engines to remove historic material from search results even where the accuracy of the information is not in dispute. This is the case whether the content may be damaging on a personal or professional level. Search engines may be required to remove that material at request by the offended party or face a financial penalties.
The right is often referred to as the ‘right to be forgotten’.
The landmark case which established the right is Google Spain SL, Google Inc v Agencia Española de Protección de Datos (AEPD), Mario Costeja González (ECLI:EU:C:2014:317). This case involved a Spanish lawyer, Mario Costeja Gonzalez, who took an action against a Spanish newspaper, La Vanguardia and Google Spain after La Vanguardia published two announcements concerning the forced sale of properties due to social security debts. Mario Costeja Gonzalez was named as being the owner of one of these properties and subsequently complained to the Spanish Data Protection Agency (AEPD) against Google Inc, Google Spain and La Vanguardia on the basis that the forced sale was completed a long time ago and was no longer relevant. The AEPD rejected his claim against La Vanguardia but upheld the complaint against Google Inc and Google Spain, requesting that they remove the information. As a result, Google Inc and Google Spain brought a High Court action attempting to annul the AEPD decision. The High Court then referred the matter to the European Court of Justice where it was held that Google must remove the content as requested. Applying relevant provisions of EU data protection law, it was held that Internet search engines are responsible for the processing of personal information which appears on third party websites and that individuals were entitled to have content removed from certain searches which relate to them.
Following this ruling, search engines have developed online application forms which can be submitted by individuals who wish to request that certain third party content does not appear in search results. As well as identifying the purportedly offensive content, applicants must explain why that content relates to him/her and why it is inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes for which it was collected and in the light of the time that has elapsed.
Compliance with EU data protection law is supervised by national authorities such as the Information Commissioner’s Office, which can impose fines for failing to adhere to the relevant laws. In March 2016 the French data protection authority, the CNIL, imposed a fine of €100,000 on Google for refusing to remove certain search results. This recent move could mean that a potential breach of your data protection rights may lead to a fine being imposed on the search engine and may even give rise to the possibility of suing for damages. According to several news reports, Google is planning to appeal the decision.
Practitioners should bear two important points in mind when making an application. Firstly, the scope of the application is limited to search engines in Europe and does not, for example, cover searches on the American website, google.com, even if those conducting the search are doing so from a location within the EU. Secondly, it should be remembered that whilst content may be removed from the search results, the content itself is not being removed from the Internet entirely and could still be accessed through the publisher’s own website.
The recently adopted EU General Data Protection Regulations (GDPR), which will come into force in 2018, includes a right to the erasure of personal data, previously referred to as the right to be forgotten. The exercise of that right will have to be weighed against the public interest. We are aware of medical practitioners who have made successful applications to have content removed and doubtless there will be others who will wish to explore this option further in order to minimise any reputational damage following regulatory or criminal proceedings.
For more information please contact:
T. 020 7227 7315
This briefing is for guidance purposes only. RadcliffesLeBrasseur LLP accepts no responsibility or liability whatsoever for any action taken or not taken in relation to this note and recommends that appropriate legal advice be taken having regard to a client's own particular circumstances.