People will be able to use an online tool to ask Google not to display search results about them, according to a German data protection commissioner.
Google will create the tool following a decision by the Court of Justice of the European Union (CJEU), which ruled on Tuesday that Google and other search engines can be ordered to delete links to outdated information about a person published on the Internet.
European citizens that want to be forgotten by search engines can file a request directly with the search engine operator to have out-of-date information about them deleted. The operator must determine if the information displayed about the person in its search results is still relevant, and if not, must remove it from the results, the court ruled.
In order to deal with these requests Google plans to release an online tool to implement a procedure for a right to be forgotten, or rather for the right not to be found, said Johannes Caspar, Hamburg’s Commissioner for Data Protection. The system will include an authentication mechanism to prevent unauthorized takedown requests, he added.
Google already offers semi-automated tools for requesting that limited categories of personal information such as signatures, national identification numbers, or bank account details be removed from its search results, but those will need to be expanded.
“The ruling has significant implications for how we handle takedown requests,” a Google spokesman said in an email, declining to comment on how the system would work exactly.
“This is logistically complicated—not least because of the many languages involved and the need for careful review. As soon as we have thought through exactly how this will work, which may take several weeks, we will let our users know,” he said. He could not say if the amount of takedown requests has increased since the ruling.
Caspar called for data protection authorities (DPAs) in Europe to consider harmonizing their criteria for the deletion of a link in a search engine. “In the interest of an equal treatment of all European citizens, especially the search engine providers, there should be coherent principles amongst all DPAs in Europe,” he added.
France’s DPA, the National Commission on Computing and Liberty (CNIL), said Friday that the court ruling confirms its existing interpretation of French law, and that it stands ready to enforce the ruling in France if Google does not respond satisfactorily to requests.
Meanwhile other European DPAs including the Irish Office of the Data Protection Commissioner (DPC), the U.K.’s Information Commissioner’s Office (ICO) and the Norwegian Data Protection Authority are still reviewing the verdict and its possible implications.
Google has been discussing the implications of the judgement with the Irish and the Norwegian agencies though.
“As far as I understand they have not decided how they will cope” with these takedown requests in the Nordics, said Bjørn Erik Thon, Norway’s Data Protection Commissioner.
People who want references to them deleted from Google would first have to file a request with Google directly, Paula Nerney, senior investigations officer of the Irish DPC said in an email. Data protection authorities should become involved if an individual’s request made to Google is not satisfied, she said.