“Right to be Forgotten” clashes with Euro AML regulations.

James Treacy , Co-Founder International Fraud Prevention

A landmark case relating to a citizen’s “right to be forgotten” in 2010 reverberates to this day and has the potential to seriously weaken the AML defences of organisations in the EU.

In 2010 a Spanish citizen, Mario Costeja González, took a case against La Vanguardia newspaper. In 1998 the paper published details of the forced repossession of González’s home. González argued that since the issue had been completely resolved in the subsequent 12 years, the information was now irrelevant and should be removed, both from the paper’s digital archives and from the search results of Google.

The court referred the case to the European Court of Justice (ECJ) who found that individuals have the right, based on certain conditions, to request search engines to remove links with personal information about them. This applies where the information is inaccurate, inadequate, irrelevant, or excessive for the purposes of the data processing and this gave birth to the right to be forgotten which is one of the pillars of the GDPR which came into force in 2018.

While this right is not absolute, and only applies in certain circumstances, it is being abused by nefarious actors for the purposes of evading detection when laundering illicit funds.

Google receives over 300,000 of these requests each year in the UK and Ireland and 31% relate to frauds, 20% relate to arrests for serious crimes and terrorist offences, and 12% relate to arrests for child pornography.

Terrorist recruiters in prisons are now instructing newly recruited acolytes how to file “right to be forgotten” requests, presumably with the intention of scuppering AML checks if and when they open bank accounts or try to launder money through other methods such as setting up charities on their release.

The implications are explicit for accurate customer screening. While the search engines are not sufficient KYC screening on their own, they are a very valuable tool to supplement official PEP, sanctions and watch lists from the likes of the FBI, CIA, and United Nations .

The EU’s top court recently ruled that Google only has to apply the right to be forgotten in Europe and does not have to remove links elsewhere in the world.

It will be interesting to how this weakness in the Euro AML defence infrastructure is tackled by the new European AML body when it’s up and running early next year.