In May 2014, three important principles emerged from the controversial ‘Google Spain’ case.
First, Google is a ‘data controller’ (legally responsible person) under data protection laws in respect of Google search engine results
Second, EU data protection law applies to Google’s processing of personal data of EU citizens, even where the search engine is based outside Europe
And finally, a ‘right to be forgotten’ exists where the online use of outdated and irrelevant information about an individual in search results, in the name of freedom of expression, is not proportionate to the rights and freedoms of the individual in respect of that personal information
Consequently, Google has been facing an avalanche of requests from individuals seeking removal from search results of personal data that they allege is ‘inaccurate, inadequate, irrelevant, or excessive’.
Google has the unenviable task of determining what lines are to be drawn – and where – when it comes to balancing the competing fundamental rights of data privacy and freedom of expression.
As of May 2015, Google reports that it has received more than 250,000 requests for the removal of personal information from search results, relating to in excess of 920,000 links.