More French and Brits want Google to forget them

Google has been forced to offer EU citizens the option to request that certain personal data is hidden from search engine results, after a landmark ruling by the EU's Court of Justice, three years ago this week.

The 13 May 2014 ruling said that EU citizens have the right to ask search engines to remove links to personal information which is “inadequate, irrelevant or no longer relevant”. The removal process has become known as delisting.

The onus for action was put on search engines like Google. Only if the company refuses a request, can citizens appeal with their national data protection authority.

Google publishes the number of requests it has received on its website, but only provides cumulative figures.

To make a comparison between two time periods since the court ruling (the first period is 16 months long, the second is 19 months long), EUobserver downloaded the data for each EU member state in September 2015.

This website found that in the more recent period, the monthly average of requests has gone down in 26 of 28 EU member states.

The finding seems plausible because it is likely that those citizens most worried about certain personal information, would have invoked their right-to-be-forgotten in the first months after the court's ruling.

However, the number of requests saw a sharp rise in France and the UK.

According to a calculation of Google's data, Google received on average 8,473 requests from France in the past 19 months, compared to half that number in the 16 months before that.

The monthly average from the UK was 3,529, up from 2,511.

Google did not respond to a request for a comment, neither did the French data protection authority CNIL.

One reason for the French spike could be that the French data protection authority has been in a public row with Google about whether Google should include non-French domain names, like Google.com in its delisting.

Initially Google only wanted to delist information from French citizens from Google.fr, but in February 2016 it succumbed to CNIL's pressure.

A spokeswoman for the British data protection authority, the Information Commissioner's Office (ICO), said she did not want to “speculate” about the reason for the increased number of requests.

But while requesting Google to remove information has become more popular in the UK, the number of people who approach ICO to appeal a rejection by Google, is still very low.

Since May 2014, ICO received 967 requests to delist information, only a drop in the ocean compared to the 107,429 requests Google has received.

Google denied 39 percent of the link deletion requests. That means just over 2 percent of UK citizens whose request was denied by Google appealed.

Rejected by Google? Few appeal

This low appeals rate is in line with findings EUobserver published in 2015.

It emerged that very few Europeans who receive a rejection from Google, appeal to their national data protection authority. In most member states, no more than 2 percent of those who received a denial from Google appealed.

Calculations by this website showed that this appeals rate has somewhat improved, at least in the countries that sent specific figures: Austria, Denmark, Estonia, Hungary, Italy, Luxembourg, the Netherlands, Norway, Spain, and the UK.

However, the appeals rate still remained very low.

Of these, Spain was the country where appealing to the data protection authority was most common: citizens did so in 3.5 percent of the cases, up from 1.7 percent. In the other countries, the appeals rate was between 0.3 percent and 2.5 percent.

Reluctance to contact a state body

One reason why citizens do not appeal may be that the perceived threshold to request Google to delist information is probably much lower than to write to an official government body.

Martin Husovec, assistant professor at the Tilburg Institute for Law, Technology and Society told EUobserver in 2015 that we should not assume all requests sent to Google are “legitimate”.

“It makes perfect sense that the number of follow-up requests is significantly lower, because applying to a state authority forces a citizen think twice whether his or her situation is really in need of this kind of strong remedy”, Husovec said.

That assessment is substantiated by data published on Thursday (11 May) by the Dutch data protection authority.

It said that in the past three years, it assessed 155 requests to delist. It decided not to mediate between the requester and the search engine in almost half of those cases (70), because it said the company had made the right assessment.

Awareness

Another reason may be a lack of awareness.

In 2015, experts said that both Google and the European data protection authorities should do more to make citizens aware of the fact that the ultimate authority on the right-to-be-forgotten is not Google, but their national data protection authority.

As of next year, the national data watchdogs will be legally required to raise awareness about EU citizens' data rights.

The general data protection regulation will come into force on 25 May 2018, and it includes an obligation for data protection authorities to “promote the awareness of the public on risks, rules, safeguards and rights in relation to the processing of personal data”.

So far, most of the data protection authorities raise awareness only by making information available on their website.

But that may not be enough.

A 2015 Eurobarometer poll showed that 61 percent of respondents did not even know their country had a public authority in charge of protection their personal data.