What organizations must know about the: 'right to be forgotten'.

• Author: Werfel, Erik

The European Union's (EU) "right to be forgotten" affects not only search engines but any organization that hosts EU citizens' information or does business in the EU. Records and information management professionals who get requests to remove information must understand the factors that should guide their decisions.

[ILLUSTRATION OMITTED]

The European Union's (EU) right to be forgotten does not apply specifically to Google alone, although reports sometimes suggest it. Rather, the decision in Google Spain v. AEPD and Mario Costeja Gonzalez is the application of a more general right of erasure under the EU's Data Protection Directive of 1995, and the directive applies not just to search engines but to all organizations that control and process EU consumer data. Organizations should therefore be aware of the directive's provisions, particularly if they do business in the EU.

Under the right of access provisions of the directive's Article 12, EU individuals have the right to request that any data controller remove personal data if the information is inaccurate, inadequate, irrelevant, or excessive. Typical applications of this provision might be a request to remove misleading information on an individual's credit report or to remove inaccurate data from medical records. The Google Spain decision held that this right is not a right to the removal of records in data sets, but is a more general right to have obsolete information removed.

The Court Decision

In Google Spain, a Spanish citizen living in Spain asked that a notice of foreclosure be removed from the website of La Vanguardia, the newspaper that had originally published the public notice, and that links to the notice be removed from Google's search engine. The European Court of Justice ruled that La Vanguardia need not remove the notice from its site, in part because the notice was published in fulfillment of Spanish law, and because under the principles of the Data Protection Directive, rights to freedom of expression may counterbalance the right to erasure, especially for media companies.

Google Spain declined to be considered a media company. The court found that Google was a data controller under Article 12 and that the information about the foreclosure was no longer relevant. Google Spain was therefore required to remove all links to the notice.

The EU Court of Justice indicated that Google should consider each request on a case-by-case basis, balancing the public's interest in the information, the data controller's right to free expression, and the individual's right to privacy. It is anticipated that...