UK Gives Search Engines Time to Comply With 'Right to Be Forgotten'


The UK data protection watchdog has said that it will give search engines like Google some time to put measures in place to respond to requests to take down links in search results.

On May 20, 2014, the UK Information Commissioner’s Office made its first public response to last week’s Court of Justice of the European Union decision against Google and its Spanish subsidiary. The court’s decision requires Google to take down links to lawfully published content about an individual if the individual believes the information to be inaccurate, irrelevant, outdated or excessive. See our advisory for more information about the CJEU ruling.

In a blog post, ICO Deputy Commissioner David Smith provided a pithy summary of the ICO’s takeaways from the Google decision and announced:

“We won’t be ruling on any complaints until the search providers have had a reasonable time to put their systems in place and start considering requests. After that, we’ll be focusing on concerns linked to clear evidence of damage and distress to individuals.”

The approach is similar to the informal grace period the ICO provided when unclear “cookie consent” rules were introduced by the EU in 2011.

It is worth noting that the ICO will focus on complaints involving “clear evidence of damage or distress” even though the CJEU says it is not necessary to show that the inclusion of information in search results causes prejudice (harm) to the individual.

The ICO is also careful to only mention search engines when discussing who needs to take steps to comply with the EU court decision. There has been much speculation about the application of the decision to content aggregators other than the major search providers, including social networks.

Helpfully, the ICO is ready to lead an effort with other EU data protection authorities to provide consistent implementation guidance across the EU.

In the meantime, the UK watchdog wants search providers to begin work on compliance:

“[W]e expect search providers to start the process of considering what solutions are needed to deal with requests to remove links. We recognise that the challenge is logistical and technical. Any solutions should enable appropriate consideration to be given to each case, and should reflect a judgment that upholds the data protection rights of individuals.”

The most important impact of the Google Spain decision may be something other than identifying a “right to be forgotten” in EU law. Instead, it may be the court’s ruling that the EU has very broad jurisdiction with respect to data protection regulation. The decision removes any doubts that search engines and similar online services are subject to EU data protection regulation (as they can be considered “data controllers”). The CJEU also takes a broad view of the geographic reach of EU privacy rules: non-EU companies with limited sales operations in the European Union or a limited amount of computer equipment in the EU are considered “established” wherever those operations are located and potentially subject to national data protection legislation in each of those countries. Both are principles the ICO seems ready to embrace.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Davis Wright Tremaine LLP | Attorney Advertising

Written by:


Davis Wright Tremaine LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.