Google decision: the right to be forgotten | Practical Law

Google decision: the right to be forgotten | Practical Law

The European Court of Justice’s decision that individuals have the right to have search engine results removed where they affect privacy rights will have huge implications, not just for search engines, but also for social media operators and, in fact, any business with European operations. Content providers may now find themselves with obligations to comply with data protection laws even where they are not involved in making decisions about the online content provided.

Google decision: the right to be forgotten

Practical Law UK Articles 3-568-9605 (Approx. 5 pages)

Google decision: the right to be forgotten

by Ann Bevitt, Morrison & Foerster (UK) LLP
Published on 29 May 2014 • European Union, United Kingdom
The European Court of Justice’s decision that individuals have the right to have search engine results removed where they affect privacy rights will have huge implications, not just for search engines, but also for social media operators and, in fact, any business with European operations. Content providers may now find themselves with obligations to comply with data protection laws even where they are not involved in making decisions about the online content provided.
The European Court of Justice’s (ECJ) decision that individuals have the right to have search engine results removed where they affect privacy rights will have huge implications, not just for search engines, but also for social media operators and, in fact, any business with European operations (Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González C-131/12).
The decision is binding in all EU member states, so internet search engines with EU operations will have to handle requests from individuals who want the deletion of search results that link to pages containing their personal data.
This puts search engines in a very difficult situation: either they de-activate the name search, which would result in information that has been legally published being available to a limited audience only, or they risk complaints to data protection agencies (DPAs) and the courts. Search engines will have to assess each case carefully before making any decision, and incur the additional costs of handling complaints and legal challenges.
Social media operators and other content providers may now found themselves with obligations to comply with data protection laws even where they are not involved in making decisions about the online content provided.
The implications for other businesses with European operations are also far-reaching: the ECJ’s very broad interpretation of “establishment” extends the jurisdictional reach of EU law to cover organisations outside the EU whenever users in the EU are targeted. Essentially, if an EU subsidiary is intertwined with the goals and purposes of a non-EU parent company and if a service is aimed at the local EU member state market, EU law may be found to apply to the non-EU entity.

The dispute

In 2010, Mr Mario Costeja González, a Spanish national, lodged a complaint before the Spanish DPA against the publisher of a daily newspaper, and against Google Spain and Google Inc for their refusal to remove web links to the newspaper. The webpages contained Mr González’s personal details in an announcement concerning an auction of real estate connected with a procedure prompted by social security debts. The Spanish DPA ordered Google Spain and Google Inc to remove the data from their search results and to render future access to them impossible. Google appealed to the Spanish National High Court, seeking an annulment of the DPA’s decision.
The Spanish National High Court referred the following questions to the ECJ for a preliminary ruling:
  • Is Google a data controller with respect to its activity relating to its search engine?
  • Does the Data Protection Directive (95/46/EC) (the Directive) apply even though Google Spain does not carry out any activity related to the search engine?
  • Can individuals require Google to erase their personal data in a search engine, regardless of whether third-party content is legitimate?
The Advocate General said that Google cannot be considered the data controller of data available on third-party websites because it does not control the content of these sites (see News brief "Data protection and the internet: status of search engines"). Also, in his opinion, there was no such thing as a general right to be forgotten under the Directive. Unusually, the ECJ did not follow his conclusions (see box "Summary of the decision").

Google as data controller

The ECJ highlighted that the definition of a data controller in the Directive is broad; that is, a “natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data” (Article 2(d)).
It held that Google, as the operator of a search engine, is a data controller in relation to the processing of the data by that search engine. Google retrieves, records and organises personal data, which it stores on its servers and, as the case may be, discloses the data to its users in the form of lists of results. In the ECJ’s view, this indexing activity is a processing of personal data under the Directive.
According to the ECJ, Google determines the purposes and means of data processing and its activity is liable to significantly affect individuals’ fundamental rights to privacy.

EU data protection law

The ECJ held that Google’s search engine is subject to EU data protection laws even if Google Spain does not carry out an activity directly linked to indexing or storing data.
According to the ECJ, a broad territorial scope of EU laws is required to ensure the effectiveness of the Directive. Article 4 of the Directive provides, among other things, that national laws implementing the Directive apply to the processing of personal data where there is an establishment of the controller on the relevant member state’s territory.
The ECJ held that Google Spain constituted a stable establishment of Google Inc within the meaning of the Directive, and that Google Inc’s data processing was closely related to Google Spain’s activities because it was intended to promote and sell advertising space in Spain in order to make the service offered by the search engine more profitable. In doing so, the ECJ took account of the fact that Spanish users were targeted.

The right to be forgotten

In the ECJ’s view, a website operator may have to remove links to webpages that are published by third parties when the inclusion of the link is, or has become, incompatible with the Directive. This is the case when the data appear to be inadequate, irrelevant, or no longer relevant, or where the data are excessive or are not kept up-to-date in relation to the purposes for which they were processed.
The ECJ found that the webpages contained true information but held that the data might no longer be necessary. As a result, while the information was legitimately published and may remain available offline and searchable on the internet by, for example, date or location, it should no longer be searchable by the name of the individual.
As a result, individuals may request deletion from the search engine provider. If unsuccessful, they may complain to the competent DPA or court. The ECJ stated that the following factors need to be taken into account by the search engine provider in deciding whether to make information available by a name search:
  • The nature of the information.
  • The sensitivity of the information for the individual’s private life.
  • The interests of the general public in having that information, which may vary according to the role played by each individual in public life.
Significantly, the ECJ affirmed that publishers are still allowed to publish contested personal data for journalistic purposes. These rights do not, however, extend to search engines. Therefore, while an individual may require a search engine operator to erase his data, the content of the webpage would be left unchanged.
Ann Bevitt is a partner at Morrison & Foerster (UK) LLP.

Summary of the decision

The European Court of Justice:
  • Sided with the Spanish data protection authority and found that individuals have a right to request from the search engine provider that content that was legitimately published should not be searchable by name where the data were inadequate, irrelevant or no longer relevant.
  • Found that Google’s search function resulted in Google acting as a data controller within the meaning of the Data Protection Directive (95/46/EC), despite the fact that Google did not control the data appearing on third-party websites.
  • Stated that Spanish law applied where Google Inc processed data that were closely related to Google Spain’s selling of advertising space, even where Google Spain did not process any of those data.