German watchdog expresses concern over Google's 'right to be forgotten' mechanism

The form asks users to include their name and contact details, as well as links to web addresses they do not want to appear when searches are performed for their name and reasons why the links are either "irrelevant, outdated, or otherwise inappropriate" as a reference to them.

In addition, applicants must include a copy of a photographic ID. Google said that is necessary so as to verify the identity of applications and address the risk of impersonators making "fraudulent removal requests".

Google said that the form was "an initial effort" to meet 'right to be forgotten' requests and comply with a recent judgment of the Court of Justice of the EU (CJEU). However, it said that it may amend the mechanism after meeting with EU data protection authorities.

"In implementing [the CJEU's] decision, we will assess each individual request and attempt to balance the privacy rights of the individual with the public’s right to know and distribute information," Google said. "When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information – for example, information about financial scams, professional malpractice, criminal convictions, or public conduct of government officials."

However, the data protection authority in Hamburg has challenged Google's requirement of applicants to provide proof of identity from those who file a request for deletion. It has highlighted concerns about the copying and processing of scanned passports and German ID cards, which is highly restricted under German laws.

The Hamburg data protection commissioner Johannes Caspar said that other proofs of identity should only contain personal data that is absolutely required for the purpose of verifying the individuals' identity and that other details should be redacted.

The watchdog also said that Google had not made it clear to users how long it would retain the personal data included on the forms for before deleting the information. It welcomed Google's rapid response to the CJEU's ruling but said that "thoroughness" was more important than "speed".

Earlier this month the CJEU, Europe's highest court, ruled that search engines can be obliged to remove links to individuals' personal data from their search rankings at those individuals' request, under certain circumstances.

The CJEU said that search engine businesses have a general duty to stop lawfully published content being available to read via their search rankings where individuals seek the deletion of their data from those indexes on privacy grounds. This duty even extends to information that may not be prejudicial to a person’s interests.

However, the ruling made it clear that search engines must balance this 'right to be forgotten' with the competing right to freedom of expression to ensure that material, particularly that which is in the public interest, is not deleted when it should otherwise be remain indexed.

The CJEU case involved Google, which is the dominant search engine provider in the EU market. In its judgment, the court ruled that Google was a 'data controller' despite only indexing content published on third party websites. It ruled that the company was subject to Spanish data protection laws and that it may have to delete references to individuals that appear in its search rankings when requested to do so by individuals.