On 25th November, the European data protection authorities assembled in the Article 29 Data Protection Working Party (WP 29)have adopted guidelines on the implentation of the judgment of the Court of Justice of European Union (CJEU) of 13 May 2014 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (C-131/12).
The WP29 considers that de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com.
The judgment expressly states that the right only affects the results obtained from searches made on the basis of a person’s name and does not require deletion of the link from the indexes of the search engine altogether. That is, the original information will always be accessible using other search terms, or by direct access to the source.
The guidelines also contain the list of common criteria which the data protection authorities will apply to handle the complaints filed with their national offices following refusals of de-listing by search engines. The list contains 13 main criteria and should be
seen as a flexible working tool to help DPAs during the decision-making processes. Criteria will be applied on a case by case basis and in accordance with the relevant national legislations.