A data subject made a complaint against an internet search engine regarding the search engine’s response to their delisting request. The complaint concerned two URLs that appeared as results to searches of the individual’s name on the search engine. During the handling of this complaint, the individual included one further URL that they sought the search engine to delist.

The criteria to be applied by search engines is that delisting must occur if the results are irrelevant, inadequate or excessive. A case-by-case balancing exercise must be conducted by the search engine that balances rights of access and rights of those individuals affected by search results.

The individual had originally personally engaged with the search engine seeking delisting of the URLs because the individual argued the URLs contained defamatory content, making it unlawful to process them, and that the URLs were impacting on the individual’s private and professional life given their content . The search engine operator refused to delist the URLs because they related to information about the individual’s professional life and there was a public interest in accessing this information .

The DPC engaged with the search engine operator regarding their refusal to delist. The search engine operator relied on the legitimate interest of third parties to access the information in the URLs . No defamation proceedings had been pursued by the individual against the original publishers of the relevant content and so it was not possible to definitively decide the question of whether content in the URLs was defamatory or not.

That being said, during the course of the handling of this complaint by the DPC, the search engine operator delisted the URLs in Ireland alone based on the defamation arguments of the individual . The individual continued with their DPC complaint seeking delisting across Europe and not just Ireland . Further, the webpages underlying all of the three URLs were deactivated by the webmaster during the handling of this complaint.

Article 17(3)(a) of the GDPR states the right to be forgotten will not apply where the processing of personal data is necessary “for exercising the right of freedom of expression and information” . In examining this complaint, the DPC noted the information contained in the webpages — the subject of the individual’s complaint — relates to previous business conduct by them relevant to their professional life . The individual continues to engage in the same professional sphere and activities . The individual accepted this by arguing the content was impacting their professional life. The individual argued the content was inaccurate because it was defamatory . The DPC noted that a significant majority of the content the individual said was inaccurate was a blog post and comments of third parties and related to their professional activities; appearing to be the opinions of third-party commentators.

The DPC concluded if a third party were to consider the webpages the subject of this complaint it would be clear that the comments were made as user-generated content and represent third party opinions rather than appearing as verified fact. The role of the search engine in listing is not to challenge or censor the opinions of third parties unless to list results gives rise to personal data processing on the part of the search engine that is irrelevant, inadequate or excessive .

The DPC concluded that given the individual’s business role and role in public life arising from their professional life, there is a public interest in accessing information regarding their professional life within the European Union . The DPC wrote to the individual and under section 109(5)(b) of the 2018 Act dismissed the individual’s complaint based on the above considerations .