The European Court of Justice held yesterday that the online search engine operator Google is subject to European data protection laws and must delete content when requested to do so by users. The judgment essentially creates a ‚right to be forgotten‘.
Right to be forgotten
The ECJ has handed down a judgment essentially creating a right to be forgotten by search engine operators, such as Google (Case C-131/12).
The case was brought by Spanish data protection authorities on behalf of a citizen who argued that information relating to insolvency proceedings and the auctioning of his house was outdated and irrelevant. The citizen argued that his rights to privacy and protection of personal data were being violated.
The ECJ ruled that Google should be required to delete the search-index entry.
In reaching its judgment that Google should delete entries from its search index, the ECJ surprised experts as it contradicted the advisory opinion of the court’s Advocate General.
German lawyer and partner at WIDLE BEUGER SOLMECKE, Christian Solmecke, gave his assessment of the decision, “The judgment is a victory for civil rights and data protection in Europe. The ruling can be considered a sensation, as no one expected it in this form.
“In the future internet users will be able to protect themselves against people using a simple Google search to build complex personal profiles. This is true, even if the information is legally available on the internet. For example, internet users will be able to prevent their school certificates or information about where they studied being published. Although, in fact, the information will still be available online, it will not be accessible to the average person without much effort being expended in the search.
“The judgment shows that the ECJ recognises that in a digital age, the search engine Google has a decisive gate-keeper role to play. As such Google’s position is different to that of a press institution or a comprehensive school. Whereas such organisations only possess some pieces of information about a person, search engines use modern data processing technology to bring those pieces of information together in a large personality profile. As a result of today’s judgment, citizens are no longer forced to accept the creation of such profiles.
“I imagine that many people will take steps against Google entries in the future. The principle seems to be that the older the information is, the more likely it is that Google will have to delete it. But it is currently unclear how the search engines will react to the expected flood of deletion requests.
“The task will be hardly manageable without a manual examination. If Google fails to react, the ECJ has made it clear that citizens are entitled to pursue the matter in their home countries. Even that is to be seen as a success. Google can therefore no longer fall back on claims having to be brought in the USA, but will have to fight the disputes in the national courts of those affected.
“Yesterday’s judgment fixed the ‚right to be forgotten‘ securely in the European legal system,”
Search engine responsible for data processing
The court justified its decision, stating that the results shown by a search should clearly be categorised as data processing. According to the Luxemburg judges, it is irrelevant whether the personal data has already been legally published and is not modified by the search engine. The concept of ‘responsible person’ is to be interpreted broadly under data protection law, the court stated.
While search engines are not exclusively responsible for the compliance with data protection rules, they do share joint responsibility. The judges ruled that in addition to publishers of websites “…the activity of a search engine…is liable to affect significantly the fundamental rights to privacy and to the protection of personal data…”
From now on, search engine operators can be directly required to remove information from their indexes, without individuals having to contact the publishers of websites on which the information is situated.
‘Right to be forgotten’ following a case-by-case assessment
The court clarified that the ‘right to be forgotten’ is not absolute. Whether a right to have information deleted exists or not must be decided in light of the circumstances on a case-by-case basis after considering the interests of the person affected and the person responsible for the data processing.
The court stressed, however, that the rights of the individual have precedence as the interference with the right to privacy was of such a severity that it cannot be solely justified by the commercial interests of the search engine operator in processing such data. Nevertheless, the right to have information deleted does not derive simply from the fact that the individual fears damage or would just like the data to be “forgotten”.
European data protection applies to international search engines
Christian Solmecke welcomed the judgment in particular because “…the European Court of Justice has established that Google cannot simply fall back on US law and that it must observe national provisions within the European Union.”
Indeed, it was unclear at first whether Google would be able to escape the whole episode by claiming that the data processing takes place at the location of the USA’s parent company. The ECJ has now decisively rejected such an argument stating that “…the processing of data takes place within the activities of this subsidiary.”
The European judges have made clear that the European Union’s Data Protection Directive is to be interpreted broadly and that data protection has an overwhelmingly important role. The ‚right to be forgotten‘ is now a reality and will no doubt have a large influence on search engines in the future.