32
A Democratic Licence to Operate
This concept of control is increasingly important to citizens and consumers alike. The
number of users of social-media platforms continues to grow at a rapid rate, as more and
more people seek to share information online. Yet 45 per cent of the population say they
feel they have little or no control over the personal information companies gather about
them while they are browsing the Web or using online services, such as photo-sharing,
travel or gaming.9
2.12
It is therefore unsurprising that citizens may seek to regain control over information
available about themselves online by exercising a ‘right to be forgotten’, particularly if
this information is inaccurate. Not everyone wants to have their information online for
all to see. A May 2014 judgment of the Court of Justice of the EU ruled that Google had
to ‘adopt the measures necessary to withdraw personal data [relating to the claimant]
from its index and to prevent access to the data in the future’.10 The ‘right to be forgotten’
was thus enshrined in European law, granting all EU citizens the right to request search
engines to remove links to personal information about them online, under certain
conditions. The ruling was based on the 1995 Data Protection Directive and Articles 12
(Right of Access) and 14 (Right to Object) in particular, which state that a person can
ask for personal data to be deleted in certain circumstances. Since Google launched its
official request process, it has received 32,192 requests from the UK to remove 127,004
URLs. Of these, Google has so far removed 39,646 URLs (37.6 per cent).11 The law applies
regardless of the individual’s nationality and even if the physical server of the company
is located outside of Europe: ‘EU rules apply to search engine operators if they have
a branch or a subsidiary in a Member State which promotes the selling of advertising
space offered by the search engine’.12 However, this does not require the company to
destroy the data, and Google is free to list a removed search result on their US or other
non-European websites. Thus, a search of google.com in the US will reveal data that
google.co.uk has had to remove for UK or European searches.
2.13
Any intrusion into people’s lives therefore needs to comply with various legislation,
including Data Protection law, Article 8 of the European Convention of Human Rights
and, of increasing significance, Articles 7 and 8 of the Charter of Fundamental Rights
of the European Union. Any processing by government of personal data, including the
collection of data and access to stored data, needs to be necessary, proportionate and
justified, with effective oversight arrangements in place.
9.
Microsoft, ‘Survey Shows People Need More Help Controlling Personal Info Online’, News
Centre, January 2013, <http://news.microsoft.com/2013/01/23/survey-shows-peopleneed-more-help-controlling-personal-info-online/>.
10. European Court of Justice, ‘Google Spain SL, Google Inc. v. Agencia Española de Protección
de Datos (AEPD), Mario Costeja González’, C-131/12 ruling, point 2.
11. Correct at the time of writing. See Google, ‘European Privacy Requests for Search
Removals’, Transparency Report, <http://www.google.com/transparencyreport/removals/
europeprivacy/?hl=en>.
12. European Commission, ‘Factsheet on the “Right to be Forgotten” Ruling’, C-131/12, 2014.