A ‘right to be forgotten’ confirmed?
Individuals have the right to request search engine operators to remove their personal data from the list of search results, says EU’s highest court. For companies handling personal data, the decision may be a cause for some concern. Although the ruling addresses search engines, it signals a stringent approach to an individual’s right to privacy online. It may pave the way for further requests to erase personal data.
Please remove my name!
The Court of Justice of the European Union (CJEU) held in its recent judgment in Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (Case C-131/12) that, under existing EU data protection legislation, search engine operators are, by request and in certain circumstances, obliged to remove from the list of results links to web pages that are published by third parties and contain information relating to an individual.
This obligation can exist even if the information is not removed beforehand or simultaneously from those web pages, and also when the publication on the linked web pages is lawful.
The case was brought by a Spanish national who lodged a complaint against a publisher of a local daily newspaper La Vanguardia, and against Google Spain and Google Inc. The plaintiff complained that when his name was entered in the Google Search, it brought up two pages of old newspaper concerning his social security debts.
With the complaint, he requested the removal of the information, since the matter has been already resolved and, thus, should no longer be linked to him. The Spanish data protection authority dismissed the complaint againstLa Vanguardia, but sustained it against Google Inc. and Google Spain.
Google appealed the decision, following which the Spanish high court referred the case to the CJEU for a preliminary ruling.
Search engines are data ‘controllers’
In practice, the CJEU’s ruling means that if following a search made on the basis of a person’s name, the list of results displays a link to a web page containing personal information on a person, that person may approach the search engine operator directly and seek removal from such list.
If the search engine does not grant the request, the matter can be brought before the supervisory authority or judicial authority.
It is worth mentioning that this obligation does not, however, apply to journalistic endeavour, such as news web pages.
In addition to taking a stand concerning the disputed ‘right to be forgotten’, the CJEU made important observations concerning the search engines’ legal status in general.
According to the CJEU, the activity of a search engine must be classified as ‘processing of personal data’ within the meaning of Article 2(b) of the Data Protection Directive (95/46/EC), when the information processed contains personal data. Consequently, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d) of the Directive.
Moreover, the CJEU held that the Data Protection Directive does not require the processing to be undertaken ‘by’ the local establishment in order for the local law to apply.
The CJEU pointed out that Google Search was bound to comply with Spanish law, since the activities of its Spanish advertising subsidiary (Google Spain) were “inextricably linked” to the search engine itself.
Therefore, all the processing was carried out “in the context of the activities” of the Spanish subsidiary.
Difficult balancing act
Although the judgement comes down in favour of data protection and privacy over the search engine operators’ economic interests and the general interest in freedom of information, a ‘right to be forgotten’ is not absolute.
According to the CJEU, a fair balance should be sought, in particular, between the interest of other users, and the individual’s right to privacy and the right to protection of personal data.
The CJEU’s ruling emphasises the special role of the search engines in the information society. Beyond that, the ruling reflects a renewed enthusiasm for the rights to privacy and data protection also reflected in the on-going EU Data Protection Regulation process. This approach may be of relevance to all organisations processing personal data.
