In a landmark ruling in May, the European Court of Justice ruled that search engines need to remove the link between search results and a web page if it contains information an individual deems should be “forgotten.”
In 1998, a major Spanish newspaper published two short announcements about a real estate auction that occurred due to a Spanish citizen’s social security debts. In 2009, this person contacted the newspaper, complaining the announcements still appeared in Google searches of his name. Arguing the search results damaged his reputation and the attachment proceedings had been resolved long before, he asked the newspaper to block the pages from being indexed by search engines. The newspaper declined.
In 2010, the citizen contacted Google and filed a complaint with the Spanish data protection authority, the AEPD, which took the view that “it has the power to require the withdrawal of data and the prohibition of access to certain data by the operators of search engines when it considers that the locating and dissemination of the data are liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense, and this would also encompass the mere wish of the person concerned that such data not be known to third parties.”
Google Spain and Google Inc. appealed the AEPD’s decision to the Audiencia Nacional, Spain’s national high court, which then submitted several questions to the European Court of Justice regarding the application of the European Data Protection Directive.
The ECJ decision
The main points of the ECJ ruling in Google Inc. v Agencia Española de Protección de Datos follow:
Controller: The ECJ ruled that Google is not merely a processor but also a controller of personal data on third-party web pages because Google decides on the purposes and means of the indexing activity.
Indexing is processing: The ECJ ruled that indexing information by a search engine is processing of personal data in the sense of the European Data Protection Directive.
National data protection law is applicable: The ECJ ruled Spanish data protection law applies, even if indexing happens in the US. Google Spain is established in Spain and is a subsidiary of Google Inc.; thus the promotion and selling, in Spain, of advertising space offered by the search engine makes Spanish data protection law applicable.
Data subjects may request removal of links from search engines: Google is obliged to remove links to web pages containing personal data, the ECJ ruled, even if publication on the web pages is lawful, because potential interference in a person’s rights “cannot be justified by merely the economic interest which the operator of such an engine has in that processing.” Removal may be necessary when search results “are liable to constitute a more significant interference with the data subject’s fundamental right to privacy than the publication on the web page.”
Fair balance: A fair balance should be found between the legitimate interests of Internet users seeking access to information and the privacy rights of citizens. The ECJ stated this balance depends “in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”
Right to be forgotten: The ruling endorses a right to be forgotten by the ECJ under the current Data Protection Directive. A citizen may require Google to remove him or herself from search results, making use of his or her “right to be forgotten” if the personal data have become inadequate, no longer relevant or excessive in relation to the purposes for which they were processed and in light of elapsed time.
Broad implications: EU and US
This ruling increases the rights of private individuals to remove themselves from search results, making search results less reliable. The ruling could impact day-to-day operations of Internet companies and could have broad implications for any service using third-party data sources containing personal data.
In the upcoming new Data Protection Regulation, the right to erasure is defined even more broadly. The present case will be of interest to Internet companies and publishers for balancing privacy rights of citizens against the right to access information, to conduct a business and the freedom of expression. Although such information would still be available on the original websites, it will become more difficult to find if removed from search results.
It is now up to the Spanish National High Court to decide whether the earlier decision of the Spanish Data Protection Authority should be annulled. The High Court will probably soon confirm the decision of the Data Protection Authority, obliging Google to “take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future.”
This ECJ decision will have an impact throughout the European Union because it is binding on any other EU national court or tribunal before which a similar issue may be raised. Also, the ECJ’s conclusion is directly contrary to US law, whereby search engines normally enjoy immunity, under 47 U.S.C. § 230, for linking to content provided by others. The First Amendment strongly protects against lawsuits seeking to remove non-defamatory postings of third parties or other speech about those postings. US providers of Internet search functionality with some presence in the EU should be mindful of requests from Europe to remove links to websites purportedly infringing data protection rights of EU residents.