The Information Commissioner’s office has issued its first official response to last week’s ruling in the Court of Justice of the European Union, which classified search engines as data controllers under the Data Protection Directive.
In a blog post on the ICO website, Deputy Commissioner David Smith sought to reassure search providers in the UK.
This judgment was only made last week, and the companies will need some time to work out how they’re going to handle this. We won’t be ruling on any complaints until the search providers have had a reasonable time to put their systems in place and start considering requests. After that, we’ll be focusing on concerns linked to clear evidence of damage and distress to individuals.
Nevertheless, Smith said that the ICO welcomed the judgement.
It sets out a framework to hold data controllers operating online search engines to account for the personal data they process. It also backs our view that search engines are subject to data protection law, clarifying an area that was previously uncertain.
The Information Commissioner’s Office will be tasked with adjudicating disputes in cases where a search engine refuses to take down a link in response to a complaint.
Other commentators have been less positive about the ruling. Guardian columnist James Ball said that the ruling “creates a real quagmire” for information-based businesses.
This creates a real quagmire for any company offering up information online: after how long does a bankruptcy ruling become something that should be private? Is that different if the subject is a celebrity or a politician? What if they offered the information voluntarily (or sold their story) in the first place? How about drug use, or prostitution, or murder? What if a person stands for public office a few years after having their search records scrubbed?
If nothing else, deciding such issues on a case-by-case basis will require huge teams of compliance staff in every tech company (and probably most media companies), and will tie up courts on the limits of each provision for years to come.
For more information, see: Four things we’ve learned from the EU Google judgment – ICO Blog