The European Union's recent push to allow people to expunge personal information found in Internet searches may soon extend past the borders of the 28-nation political union. Search engines such as Google and Microsoft's Bing will be required to remove links on all of their pages, not just pages using the same domain as an individual's nation of residence.
The new rules interpretation comes courtesy of the EU data privacy authority, known as the Article 29 Data Protection Working Party. "Under EU law, everyone has a right to data protection," the body wrote in a press statement released Wednesday in Brussels. Although the rules will apply to all search engines' pages, regardless of domain, their authority will be limited to subjects who are either EU residents or citizens.
"EU Law Cannot Be Circumvented"
In May, the Court of Justice of European Union ruled that EU citizens have a "right to be forgotten." In practice, this has been interpreted to mean that individuals can request search engines like Google and Bing to remove links to pages that are returned when conducting a search on their name or other identifying information.
Google and other search engines have taken steps to comply with the ruling by creating mechanisms for individuals to issue requests for link removal. But the EU has also expressed frustration over Google's practice of regularly alerting the media when it complies with such requests, in effect defeating the purpose of the legislation.
"De-listing decisions must be implemented in such a way that they guarantee the effective and complete protection of data subjects' rights," the authority said in a press release. "EU law cannot be circumvented."
As a result, the agency ruled that limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains was insufficient to guarantee an individual's rights. In practice, it will mean Google and other search engines will have to remove links on all relevant domains.
The working party reiterated that it was unnecessary for search engines to delete information entirely. "The judgment expressly states that the right only affects the results obtained from searches made on the basis of a person's name and does not require deletion of the link from the indexes of the search engine altogether," the working party said in the press release. "The original information will still be accessible using other search terms, or by direct access to the source."
The guidelines were agreed to following a two-day meeting of national data regulators. The rules consist of 13 main criteria for national data protection authorities to consider when handling complaints within their jurisdiction. However, the guidelines do not offer hard and fast rules regarding when search engines must comply with a de-linking request. Rather, the working group said the rulings should be seen as a "flexible tool" with which to evaluate take-down requests.
"No single criterion is, in itself, determinative," the working group said, but are to be considered in the light of principles established by the court and the interest of the general public in having access to information.