What if you find misleading information about yourself in a Google search?
Have you ever googled yourself and found unpleasant or even misleading information? Such discoveries can cause not only emotional discomfort, but also real damage to your reputation or performance. When can I request that such data be removed from search results and how can I do so? Sandra Mickienė, Senior Associate at AVOCAD, answers these questions and shares practical advice .
Primary Disseminator - the first step
It is important to understand that Google is not the entity that creates or uploads information about an individual to the internet. "As a search engine operator, Google merely indexes sources already available on the Internet and presents them to the user as search results. Therefore, if there are concerns about certain harmful information in the public domain, the first step should not be directed at Google, but at the original disseminator of the information.
Therefore, if you know of a specific natural or legal person who has published information that is untrue or defamatory, it is recommended that you first contact that person and ask them to remove the information. Such a request should be made in writing, clearly stating what information is considered to be untrue, how it violates the rights of the individual, and what action is being requested, such as immediate removal of the specific posting or a public denial of the publication.
However, it is not uncommon for the original disseminator to refuse to remove the information, or not to respond at all to a request, in the event of a belief (or a false declaration of belief) that the information he or she is disseminating is correct, or in the event of a conflicting relationship with the person about whom the information has been published.
In such cases, a person can defend his or her rights in court by suing the original disseminator for unlawful processing of personal data, violation of honour and dignity, and compensation for damages. However, in practice, such procedures take time: it can take several months or even years from the drafting of the lawsuit to a court decision. During this period, untrue information made publicly available on the internet can cause real and lasting damage by interfering with a person's professional, social or personal life.
Therefore, in order to mitigate the negative effects of such information as soon as possible, it is recommended that you do not delay, and that you contact Google to request the removal of the search results associated with such defamatory and untrue information, either in parallel or immediately after receiving a negative response (or no response) from the original disseminator of the information.
Application of the General Data Protection Regulation (GDPR) to search engine operators
The GDPR establishes that it applies not only to controllers established in the EU, but also to companies that offer services to data subjects in the Union or monitor the behaviour of individuals in the EU, regardless of where they are established. Thus, although Google is established outside the EU, it is active in all EU Member States, provides search services in individual national markets (e.g. via google.com, google.de, etc.) and processes data of EU residents, and is therefore directly subject to the GDPR.
The Court of Justice of the European Union (CJEU) has clarified in its case law that search engine operators such as Google are considered to be controllers of personal data under the GDPR when they index, store and make available personal data in the form of search results. This activity - i.e. obtaining information from third-party websites, organising it and presenting it in a structured way according to specific keywords (e.g. a person's name) - constitutes the processing of personal data, notwithstanding the fact that the information itself has been made publicly available by a third party. Moreover, even the mere display of a person's name or picture in search results already constitutes processing of personal data.
Therefore, Google, as data controller, is obliged to ensure the rights of data subjects, including the right to be forgotten, i.e. the right to require search engines to remove links to third-party websites that contain information relating to a specific individual. This obligation arises if (i) the person making the request is located in the EU (the GDPR applies to the processing of data of persons located in EU Member States) and (ii) one of the legal grounds for requesting erasure under Article 17 of the GDPR is present, for example:
- when the data are no longer necessary for the purpose for which they were collected;
- where the person withdraws the consent on which the processing was based;
- where the processing was unlawful;
- where the data must be erased in accordance with legal requirements.
The CJEU has also clarified that the inclusion of information in search results under a person's name significantly increases its accessibility, which can have a much greater impact on a person's right to privacy than the mere posting of the information itself on the original website. Therefore, where there is a legal basis for requesting the removal of information, search engine operators are obliged to delete links to the relevant pages, even if:
- that information is still available in the original source,
- its publication in that source is lawful.
This clarification strengthens the ability of data subjects to control the dissemination of their personal data on the internet and obliges search engine operators such as Google to implement the GDPR requirements responsibly in practice.
Practical tips: what is important to know when considering submitting an erasure request to Google
According to the case law of the CJEU, it is a fundamental principle that the right to privacy and the protection of personal data generally prevails over the commercial interests of the search engine operator or the public's interest to know and obtain information.
However, the right to the protection of personal data is not absolute - if the person is a public figure (e.g. a politician), or the information makes a significant contribution to the public interest or to the democratic debate, or if the information discloses alleged criminal offences or other improper/unlawful conduct, then public interest and the public's right to know may also take precedence over the protection of personal data in such cases. The balance between the individual's right to privacy, data protection and the public's right to be informed would thus be assessed on a case-by-case basis. It would also look at the nature of the information, its relevance, the prominence of the person, the context, the veracity of the information and the manner in which the information was obtained and disseminated.
In practice, we have found that Google often refuses requests to delete information relating to an individual on the grounds of public interest and the public's right to know. For example, when a person requests the removal from search results of links to information that links him or her to an alleged offence, Google often refuses to do so on the grounds that (i) the public has an interest in knowing the information, and (ii) the requester would have to prove that the sentence has been served, the conviction is spent or the like in order to have the information removed.
In this respect, it is important to note that such behaviour by Google is not in line with the case law of the CJEU. Although, in fact, a mere reference to the right to be forgotten is not in itself sufficient - the CJEU has clarified that a person requesting the deletion of information must provide certain evidence to substantiate the false, untrue nature of the information. However, the CJEU has also underlined another very important rule: this burden of proof must not be disproportionate or impossible to meet. The data subject cannot be required to produce a court judgment against the original disseminator or other evidence to prove that the person never committed the acts published in the online links whose removal is requested.
On the contrary, a person may only be subject to requirements that are reasonable in the light of the circumstances of the particular situation. As the CJEU has pointed out, placing an excessive burden of proof on the individual would not only be contrary to the principle of proportionality, but would also, in practice, undermine the exercise of the right to be forgotten.
Google is therefore not entitled to unreasonably burden a person's right to erasure by requiring evidence that the person is not objectively able to provide. Such a requirement violates the principle of proportionality and restricts the effective exercise of this right.
Another important and related aspect is that if the information disseminated about a person is inaccurate or at least partially misleading, the individual's rights to privacy and data protection must be given priority, even if the information relates to a topic of public interest or to a public figure. The CJEU has noted that, even where the data subject plays an important role in public life, the right to freedom of expression and information cannot extend to the right to disseminate or have access to inaccurate information. Therefore, if it is established that at least part of the information contained in the removal request is inaccurate and not of a minor nature, Google must delete the inaccurate, misleading or defamatory data from the search results.
Where and how to apply to Google
If a person decides to exercise the right to be forgotten, he or she must fill in a special Google form available online. When filling in this form, it is necessary to indicate:
- name and surname;
- the specific search queries (for example, a person's name) that produce the disputed results;
- each link (URL) that is requested to be removed from the search results;
- an explanation of why the information should be removed (e.g. misleading, untrue, defamatory, etc.);
- additional documents or information in support of the request (if available);
- proof of identity (e.g. a copy of your ID card or passport).
What to do if Google rejects your request
If a request to remove information is refused, the person may:
- contact a national data protection authority, such as the State Data Protection Inspectorate in Lithuania, which may issue a decision and order Google to remove the data if it finds that the individual's rights have been infringed.
- defend your rights in court, based on the GDPR and CJEU case law.
In summary, the right to be forgotten is an important personal data protection tool to protect one's reputation and private life against the dissemination of misleading, offensive or outdated information on the internet. While the practical implementation of this right still poses challenges - from the burden of proof to the refusal of requests by search engine operators - the CJEU's jurisprudence clearly defines the limits and helps to strike a balance between the individual's right to privacy and the public's right to know.
The key is not to delay, to act systematically and to follow the law and the CJEU's interpretations. And if you are faced with a difficult situation or a refusal to delete your data, it's a good idea to contact lawyers who can help you to prepare a well-founded and evidence-based request or defend your rights in court.