In a landmark decision on internet privacy, the European Court of Justice (“ECJ”) has ruled that search engine operators must comply with requests to remove links to personal data that is “irrelevant or excessive”, even where the person is not prejudiced by the listing and even where the original publication was lawful. The decision, on 13 May, comes in the wake of broader EU proposals for a new data privacy law, including a ‘right to be forgotten’ that would oblige operators to delete personal data unless there are legitimate grounds to retain it. It also, somewhat surprisingly, contradicts previous advice by the EU’s Advocate General that search engines should ignore such requests, since a general right to be forgotten would “entail sacrificing pivotal rights such as freedom of expression and information”.
The case was brought by a Spanish man who complained that a foreclosure notice in a newspaper dating back to 1998, but still available via a Google search, was an infringement of his privacy. When Spain’s data protection agency, the AEPD, ruled that the newspaper archive should not be amended but upheld his complaint against Google, Google appealed to the Spanish court, which in turn referred questions on the precise interpretation of the Data Protection Directive to the ECJ. The Directive (as it is currently drafted) requires controllers of personal data to take “every reasonable step” to ensure that data which is “inaccurate or incomplete” is erased or rectified.
First, the ECJ rejected Google’s arguments that it had no control over the data, or the selection of the data, and therefore that its activities fell outside the scope of the Directive. It found that Google’s actions in collecting, organising and storing data must amount to “processing” within the meaning of the Directive, and made Google an undisputed “controller” for the purposes of such processing. With regard to the territorial scope of the Directive, the ECJ also found that Google processes personal data “in the context of the activities” carried out in a Member State, which is to say that Google is caught by the Directive even though the physical processing takes place in the USA and Google Spain merely sells advertising space. This is because the two activities are “inextricably linked, since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed”.
The ECJ then considered Google’s responsibilities under the Directive, stressing the “potential seriousness” of the interference that the processing of personal data can have with the fundamental rights to privacy, “since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. Furthermore, the effect of the interference with those rights of the data subject is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such a list of results ubiquitous.”
Importantly, the ECJ made clear that complying with the Directive requires the removal of data (on request) that is not only inaccurate, but also “inadequate, irrelevant or excessive,” and that an individual’s right to make such a request overrides both the search engine operator’s economic interests and the general public’s right to information. There does however, appear to be a “public interest” exemption, where the interference is justified by a “preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question”. Nevertheless, the decision paves the way for fierce debate over what exactly amounts to “irrelevant or excessive” personal data.
Within days after the ruling there have been reports of individuals, including “an ex-politician seeking re-election, a paedophile and a doctor” seeking to have damaging data erased, and in Spain alone there are tens of similar cases pending. In terms of who might succeed, we would expect high-profile figures and convicted criminals, for example, to face an uphill struggle in demonstrating that the required “fair balance” between the general public’s right to information and their own right to privacy should tip in their favour. On the other hand, a doctor plagued by negative patient reviews might stand a better chance, if he or she could demonstrate that the reviews in question are inaccurate or unfair.
Interestingly, the move towards a ‘right to be forgotten’ echoes the changes in March to the Rehabilitation of Offenders Act 1974 in the UK, under which convictions will now be deemed “spent” much more quickly. Once a conviction is spent, an individual should have a stronger argument that links to data referencing the conviction should be removed.
As yet, Google has said only that it found the ruling “disappointing” and that it will need time to analyse its implications. Undoubtedly, managing the inevitable deluge of requests will be an enormous task.
Our Newsletter
