18 months on - the ICO reflects on Google Spain

The ICO has recently blogged on the cases it has received in the year and a half since the Google Spain decision last May.

The author David Smith, the Deputy Commissioner and Director of Data Protection, described the effect of the judgment as something of an anti-climax; the ICO has required Google to de-list search results in only 20% of cases received. 

The ICO consistently receive roughly 15 – 30 eligible cases per month and, as at 13 August 2015, 441 of the total 472 cases received were closed.  Mr Smith draws our attention to the search result delisting criteria it applies when deciding whether to delist.  In the cases where the ICO disagrees with Google's decisions, the most common factor is that the passage of time means the ICO considers the information no longer relevant.

It is striking that a very small percentage of Google's delisting decisions are being referred to the ICO.  As at 11 November, Google had received 42,439 delisting requests from individuals with a connection to the UK and had removed 62.1% of the 160,054 URLS they related to.  That means that, of the unremoved requests, less than 2% are being referred to the ICO.  The latest figures can be found here.

Mr Smith also highlighted the first enforcement notice issued against Google in August, where the ICO ordered Google to remove nine search results brought up by entering an individual's name.  Google has so far removed the links from the European versions of its search engine but the ICO considers that it should remove the links so that anyone accessing any Google search service from within the UK (using the example of someone using google.com in Newcastle) will not be able to see them.  The ICO therefore clarified the enforcement notice in October, ordering that links should not be visible to anyone directly accessing any Google search services from within the UK.  William Malcolm, Senior Privacy Counsel at Google, stated this morning at the ICO Data Protection Policy Conference in London that Google are still considering their options and have until the end of November to respond.

This will no doubt be watched with interest.  The French privacy regulator (the CNIL) also ruled in September that Google must extend delisting to all of its websites, not just those with European domain names.  The European regulators seem determined to close the loophole that allows searchers to defeat the Google Spain judgment by simply using google.com.  Questions surrounding the jurisdiction of authorities to require non-European companies to respect European laws when offering their services in Europe remain, and will surely be tested in the months to come.