The Right to be Forgotten: What it means for HR

The ECJ has recently ruled that Google and other search engines can be required to remove certain links from search results. Where a search is carried out using a person’s name as the search term, that person can ask the search engine to remove search results linking to information about them which is, for example, incomplete, inaccurate or out of date. This is the case even if the information is still lawfully and publicly available on the underlying website.

The issue came before the ECJ in the case of Google Spain v AEPD. Mr Gonzales had suffered some financial difficulties many years earlier and a search of his name on Google gave search results linking to two newspaper articles revealing details of his previous financial problems. He asked the newspaper to remove the article as it was out of date and no longer relevant. When it refused to do so, he asked Google to remove the links from its search results.

The ECJ ruled that search engines are data controllers who must therefore comply with the full range of data protection obligations. Therefore, where data about a person is inadequate, no longer relevant, excessive or out of date they can ask the search engine to remove the links to published webpages, giving them “the right to be forgotten”. The search engine must comply with the request unless it can justify retaining the search result, for example because there is a public interest in continuing to make the information available. Complaints about failure to comply can be made to the relevant data protection authority, which in the UK is the Information Commissioner’s Office. 

In response to the judgment, Google has published a “right to be forgotten” form which an individual can complete on line explaining why the link is “irrelevant, outdated, or otherwise inappropriate.” Google says it will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information. When evaluating the request, it will look at whether the results include outdated information, as well as whether there is a public interest in the information — for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials.

Employers are data controllers of personal information relating to candidates, employees and ex-employees and similar rules apply to employers as apply to Google (operating through Europe). Employers therefore need to consider how to comply with the data protection principles which relate to the accuracy of the information and the length of time it should be kept. Having a data retention policy is a useful starting point. Employers who carry out internet searches on candidates as part of their recruitment background checks will also have to have a rethink. It is likely that less information will be revealed from online recruitment checks as people seek to “clean up” their online footprint. In any event, this type of vetting is not considered good practice and is difficult to justify from a data protection perspective. The Employment Practices Data Protection Code of Practice makes it clear that vetting should only be used as a means of obtaining specific information and not as a means of general intelligence gathering. In addition, the extent and nature of the information sought must be justified. “Googling” a person’s name is not targeted vetting as it may reveal a whole host of irrelevant information, ranging from drunken pictures from student days, through to details of a person’s sexuality and details of a person’s spent convictions, something which in most cases an employer is not entitled to know about. 

For further information on carrying out background checks, data retention and data protection issues in general, please contact Piers Leigh-Pollitt.