In general terms, Google is reluctant to remove search results containing personal information, as it is the objective of the company that their site indexes provide an accurate picture of the internet “as is”. However, there are a limited number of situations where Google will readily act to remove search results, including where the information leads to an increased risk of fraud or involves clear defamation (limited to sexually explicit content). Removal may also be agreed to where Google has a legally recognized obligation to act (as is the case with the EU “right to be forgotten”).
Personal information that Google is likely to remove as a matter of company policy
Google has adopted a company policy for removals of search results focusing on preventing criminal activity and the non-consensual use of sexually explicit information. Results are removed on a case-by-case basis, and the decision process focuses on whether the search result gives rise to significant risks of identity theft, financial fraud or other specific harms.
Google will normally remove search results containing the following information:
- National identification numbers
- Bank account numbers
- Credit card numbers
- Images of handwritten signatures
- Nudes or sexually explicit images when uploaded or shared without consent
- Confidential, personal medical records of private people
Google will normally not remove personal details that are more commonly available in the public sphere, such as the following:
- Date of birth
- Telephone numbers
The decision to remove is based on the following questions:
- Is it a government-issued identification number?
- Is it confidential or publicly available information?
- Can it be used for common financial transactions?
- Can it be used to obtain more information about an individual that would result in financial harm or identity theft?
- Is it a personally identifiable nude or sexually explicit photo or video shared without consent?
- If Google believes that the removal request is being used to remove non-personal information, the request will be denied. Further, Google will not remove information available from government websites as this is considered to be in the public domain.
Reporting may be done through the following link: https://support.google.com/websearch/troubleshooter/3111061#ts=2889054.
As a rule of thumb Google expects reports (when made with regard to pages appearing in Google Search) to be made first to the Webmaster responsible. This is because removing a given search result will not remove the content from the Internet, leaving it accessible directly or through alternative search engines.
Though Google states that requests for removal are considered on a case to case basis, it should be noted that the above form will only allow reports based on personal information that could conceivably be used to report fraud, or consists of sexually explicit content shared without consent.
In order to fulfill their obligations as a data controller under various applicable laws, Google also provides a report link for legal complaints specifically: https://support.google.com/legal/troubleshooter/1114905#ts=1115655. This form provides options to report requests to remove search results that contain defamatory content or that infringe the European data protection rules (right to be forgotten).
For the latter the procedure depends on the country where you are located. For most countries (e.g. Denmark) no specific form is provided and complaints are referred to the “other legal issues” form: https://support.google.com/legal/contact/lr_legalother?product=websearch.
Given the liberal freedom of speech laws in force in the United States, for persons located in that country it is the policy of Google not to remove allegedly defamatory content without a court order. However, this does not apply to sexually explicit content, which Google will remove independent of the country of the complainant.
EU data protection rules
For breaches of the EU data protection rules (right to be forgotten, introduced by the Court of Justice of the European Union in Case C-131/12, and now enshrined in Art. 17 of the new General Data Protection Regulation), Google will balance the right to privacy of the individual with the public’s interest to know and distribute information. In effect, the main determining factors are whether the information to which the search result is referring is outdated, and whether the public has a continued interest in the availability of the information i.e. criminal activities and the misconduct of government officials.