ICO gives companies time to work out how 'right to be forgotten' will be implemented

Data protection registrars across Europe to push for unified approach

The Information Commissioner's Office (ICO) has responded to the European Court of Justice ruling last week on the "right to be forgotten".

In a blog posting, deputy commissioner and director of data protection David Smith argued that organisations need time to develop their response to the ruling, which is binding across the whole of the European Union and not subject to appeal.

The ICO recognises, he said, that search services face a "logistical and technical" challenge to comply with the ruling and that the ICO would not step-in to adjudicate on complaints just yet.

"This judgement was only made last week, and the companies will need some time to work out how they're going to handle this," wrote Smith. "We won't be ruling on any complaints until the search providers have had a reasonable time to put their systems in place and start considering requests. After that, we'll be focusing on concerns linked to clear evidence of damage and distress to individuals."

In addition, the ICO is pushing for consistent guidance to be issued by data protection authorities across the EU on how the judgement should be interpreted and applied as theoretically an individual could complain to the equivalent of the ICO in every country of the EU.

However, Smith welcomed the judgement as a long overdue clarification of the law: "It sets out a framework to hold data controllers operating online search engines to account for the personal data they process. It also backs our view that search engines are subject to data protection law, clarifying an area that was previously uncertain."

He continued: "We believe the judgement provides space to strike a balance between the right to privacy and the public's right to know, recognising the role search engines play in facilitating access to information in today's society."

The next step would be the production of guidance from data protection authorities to ensure search providers take the right approach. "We will be discussing this issue with our fellow European Data Protection Authorities in the Article 29 Working Party at the start of next month, to ensure a consistent approach is taken across Europe. Once we have done that we will be speaking to the main search providers established in the UK."

However, he claimed that the judgement is not "a full or absolute ‘right to be forgotten'... Such a right would be a valuable tool in enabling individuals to have stronger rights in terms of controlling the dissemination of information about them. But our concern remains how this can be achieved in practice and how to set reasonable expectations for the public about how such a right can operate."