The Court observes, furthermore, that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty.
This week the European Union Court of Justice in Luxembourg ruled that individuals have a “right to be forgotten” by search engines. While it was a Google listing which complainant M of Spain sought to have removed, and on which the EU Court of Justice ruling turned, the holding applies across a broad spectrum of search engines and other aggregators of personal data about individuals.
The facts of the actual case are that after Mario Costeja Gonzalez ran into financial difficulties, he had to sell a piece of property at auction. That auction was listed in a small local paper, which was eventually scanned and put online, and which was eventually indexed by Google. This was an embarrassing event for Gonzalez – an event that happened more than 16 years ago. And while few people would go dig up a 16-year-old newspaper, at the time that Gonzalez brought the lawsuit against both Google and the newspaper, La Vanguardia Ediciones SL, a search for his name turned up the auction listing among the first search results.
Original newspaper listing for sale of Mario Costeja Gonzalez’ property
While Gonzalez was named in the complaint, reports indicate that there are many more individuals, even just in Spain alone, who have wanted Google to “forget” them – who want links to outdated data about their personal lives to be removed, as no longer accurate or relevant.
In the portion of the official statement (see below for full text) by the EU Court of Justice that goes to the heart of the matter, the court says that “if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased. The Court observes in this regard that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.”
The bottom line is that the EU Court found that individuals have a “right to be forgotten” by search engines, which means that they can ask search engines to remove data if the data is “inadequate, irrelevant or no longer relevant.” How a search engine or other aggregator would determine whether or not to honor that request seems open to interpretation, as does how exactly one would prove the inadequacy or irrelevance of the personal data one is requesting be removed.
For that matter, what “removed” even means seems to be wide open. For example, what if Google removes your personal data from being displayed but continues to retain it on the backend, where it can be accessed behind the scenes?
Google, for its part, says that requiring it to remove such links and data amounts to censorship, and called this week’s ruling “disappointing.”
“We now need to take time to analyse the implications,” said a Google spokesperson.
On the other hand, EU Commissioner stated that the decision is “a clear victory for the protection of personal data of Europeans,” adding that “The ruling confirms the need to bring today’s data protection rules from the ‘digital stone age’ into today’s modern computing world.
Below is the full text of the press release issued by the EU Court of Justice. You can also see the full text of the statement by the EU Court of Justice in PDF format here.
Court of Justice of the European Union
Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González
An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties. Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.
An EU directive has the objective of protecting the fundamental rights and freedoms of natural persons (in particular the right to privacy) when personal data are processed, while removing obstacles to the free flow of such data.
In 2010 Mario Costeja González, a Spanish national, lodged with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, the AEPD) a complaint against La Vanguardia Ediciones SL (the publisher of a daily news paper with a large circulation in Spain, in particular in Catalonia) and against Google Spain and Google Inc..
Mr Costeja González contended that, when an internet user entered his name in the search engine of the Google group (‘Google Search’), the list of results would display links to two pages of La Vanguardia’s newspaper, of January and March 1998. Those pages in particular contained an announcement for a real estate auction organised following attachment proceedings for the recovery of social security debts owed by Mr Costeja González .
With that complaint, Mr Costeja González requested, first, that La Vanguardia be required either to remove or alter the pages in question (so that the personal data relating to him no longer appeared ) or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. In this context, Mr Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant. The AEPD rejected the complaint against La Vanguardia, taking the view that the information in question had been lawfully published by it. On the other hand, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future.
Google Spain and Google Inc. brought two actions before the Audiencia Nacional (National High Court, Spain), claiming that the AEPD’s decision should be annulled. It is in this context that the Spanish court referred a series of questions to the Court of Justice. In today’s judgment , the Court of Justice finds, first of all, that by searching automatically, constantly and systematically for information published on the internet, the operator of a search engine ‘collects’ data within the meaning of the directive. The Court considers, furthermore, that the operator, within the framework of its indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data in question, which it then ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its users in the form of lists of results. Those operations, which are referred to expressly and unconditionally in the directive, must be classified as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data.
The Court also points out that the operations referred to by the directive must be classified as processing even where they exclusively concern material that has already been published as it stands in the media. A general derogation from the application of the directive in such a case would have the consequence of largely depriving the directive of its effect. The Court further holds that the operator of the search engine is the ‘controller’ in respect of that processing, within the meaning of the directive, given that it is the operator which determines the purposes and means of the processing. The Court observes in this regard that, inasmuch as the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly the fundamental rights to privacy and to the protection of personal data, the operator of the search engine must ensure, within the framework of its responsibilities, powers and capabilities, that its activity complies with the directive’s requirements. This is the only way that the guarantees laid down by the directive will be able to have full effect and that effective and complete protection of data subjects (in particular of their privacy) may actually be achieved.
As regards the directive’s territorial scope, the Court observes that Google Spain is a subsidiary of Google Inc. on Spanish territory and, therefore, an ‘establishment’ within the meaning of the directive . The Court rejects the argument that the processing of personal data by Google Search is not carried out in the context of the activities of that establishment in Spain. The Court holds, in this regard, that where such data are processed for the purposes of a search engine operated by an undertaking which, although it has its seat in a non-member State, has an establishment in a Member State, the processing is carried out ‘in the context of the activities’ of that establishment, within the meaning of the directive, if the establishment is intended to promote and sell, in the Member State in question, advertising space offered by the search engine in order to make the service offered by the engine profitable.
So far as concerns, next, the extent of the responsibility of the operator of the search engine, the Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. The Court makes it clear that such an obligation may also exist in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. The Court points out in this context that processing of personal data carried out by such an operator enables any internet user, when he makes a search on the basis of an individual’s name, to obtain, through the list of results, a structured overview of the information relating to that individual on the internet. The Court observes, furthermore, that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty. Internet users may thereby establish a more or less detailed profile of the person searched against.
Furthermore, the effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous .
In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing.
However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, the Court holds that a fair balance should be sought in particular between that interest and the data subject’s fundamental rights, in particular the right to privacy and the right to protection of personal data. The Court observes in this regard that, whilst it is true that the data subject’s rights also override, as a general rule, that interest of internet users, its balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
Finally, in response to the question whether the directive enables the data subject to request that links to web pages be removed from such a list of results on the grounds that he wishes the information appearing on those pages relating to him personally to be ‘forgotten’ after a certain time, the Court holds that, if it is found, following a request by the data subject, that the inclusion of those links in the list is, at this point in time, incompatible with the directive, the links and information in the list of results must be erased. The Court observes in this regard that even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.
The Court adds that, when appraising such a request made by the data subject in order to oppose the processing carried out by the operator of a search engine, it should in particular be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results that is displayed following a search made on the basis of his name. If that is the case, the links to web pages containing that information must be removed from that list of results, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made. The Court points out that the data subject may address such a request directly to the operator of the search engine (the controller) which must then duly examine its merits. Where the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly .
|Get notified of new Internet Patrol articles!