The European Court of Justice ruled this Tuesday 13 May in the Google case on the obligations of search engine operators under the EU Data Protection Directive.
In 2010 a complaint was lodged with the Spanish Data Protection Agency against a Spanish newspaper publisher and the companies Google Spain and Google Inc. by an individual who was unhappy that when Internet users entered his name into Google the list of results would display links to two pages of the newspaper about a matter concerning him dating back to early 1998. The individual sought the removal of the two pages by the publisher and the removal or concealment by Google of the personal data relating to the individual so that the data no longer appeared in the search results and in the links to the newspaper.
The Spanish Data Protection Agency upheld the complaint against the two Google companies and requested the companies to remove the data in question and to make access to the data impossible, but it rejected the complaint against the publisher. Google brought actions against the Agency’s ruling in a Spanish court which then referred the matter under the so-called preliminary ruling procedure to the European Court for interpretation of certain provisions of the EU Data Protection Directive.
In sum, the European Court ruled as follows:
- The nature of the activities of a search engine qualify it as “processing” personal data under the Directive;
- Because a search engine operator determines the means and purposes of this “processing” it qualifies as a “controller” of the “processing” under the Directive;
- The Directive has extra-territorial jurisdiction application where an entity of the externally located “processing” search engine operator is located in the EU and the entity promotes and sells in the EU advertising space offered by the search engine in order to make the service offered by the search engine profitable; and,
- Generally-speaking, when requested to do so, a search engine operator must remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name, even when publication in itself on those pages is lawful. Public interest might override this concerning public figures. Further, aggrieved individuals may make their requests directly to the search engine operators.
Although technically-speaking the ruling only legally binds the (Spanish) court that referred the case, the ruling has in effect the character of precedent on other EU Member State courts (but who are not themselves prevented from making preliminary reference requests).
The ruling goes against the more nuanced official Opinion (25 June 2013) of the Court’s Advocate General in the case, notably concerning the issue of whether search engines are “controllers” of data “processing”, and, the exercise of the right freedom of expression and information by search engine operators. This ruling also strengthens the hand of those in the EU backing “the right to be forgotten” as set out in the proposed EU Data Protection Regulation, which it should be pointed out is not absolute but qualified.
The concern that some people could try to use the ruling to re-write history is a real one. UK courts have recently heard cases involving well-known public individuals who have manipulated information in the public domain on them to hide their crimes. Hot on the heels of the European Court’s ruling we understand that takedown requests are already being made including one individual seeking to exercise his rights who is a convicted paedophile wishing to hide his past. Whilst the excessive holding of incorrect data on individuals is clearly wrong, genuine concerns remain about the unintended consequences of the European Court’s decision.
Therefore, before there is a rush to enshrine “the right to be forgotten” under new law, the following questions are offered to provoke some debate and consideration of the issue:
- What about the financial costs for deleting data, including for all the smaller data and tech businesses ?
- What about the technical-logistical challenges of deleting data ?
- How do search engine operators decide what’s in the public interest and who a public figure is ? Has the Spanish individual in the case now himself become such a figure ?
- In the context of social media, might efforts be better concentrated on educating people to post responsibly ?
- Could this hamper the efforts of law enforcement and other regulatory bodies in their investigations ?
- Last but certainly not least, what happened to the right of free speech ?
What are your thoughts ?
Jonathan Armstrong & André Bywater, 15 May 2014
This article was first published on the Daftblogger eJournal webpage:
Jonathan Armstrong & André Bywater are lawyers with Cordery in London where their focus is on compliance issues.
Jonathan Armstrong, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH
Office: +44 (0)207 075 1784
André Bywater Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH
Office: +44 (0)207 075 1785