Google could be forced to remove links to news stories about individuals from its search results, following a ruling today (13 May) by the European Court of Justice, backing the EU's drive to introduce a "right to be forgotten" on the Internet.
Judges in Luxembourg said that internet search engine providers were responsible for processing personal data appearing on web pages published by third parties, such as newspapers. The decision must be taken into account by national courts across the EU.
Even if the publication of that information on those pages is legal, the search engines could still be compelled by national regulators to remove the links if the data breached EU privacy law, the judges ruled.
The ECJ said that some links could become incompatible with EU privacy law overtime even if the initial processing of the data was lawful.
This “right to be forgotten” enables people to request web companies to delete personal information from their servers, and is part of a 2012 European Commission proposal to revise EU privacy law. It was adopted by the European Parliament and is now with the European Council to be scrutinised by member states.
If there was a preponderance of public interest in the data being available such as the person involved being a public figure, national courts could reject a request to remove the links, the judges said.
The ECJ said, “The effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which renders the information contained in such lists of results ubiquitous.
“In the light of its potential seriousness, such interference cannot, according to the Court, be justified by merely the economic interest which the operator of the engine has in the data processing.”
Google appeal in Spain
Google had appealed an order from the Spanish data authority to remove information about a man whose home was auctioned off to pay for unpaid taxes. It is one of 200 cases where Spanish regulators have asked Google to remove content.
The Spanish regulator did not compel La Vanguardia, a Spanish daily newspaper, to remove the two 1998 stories about a real estate auction to recover social security debt from its website. Instead it focused on Google and Google Spain.
A Spanish court referred the appeal to the ECJ for clarification on points of law. The ECJ did not settle the dispute itself and it is up to national judges, using the ruling as guidance, to decide on whether a case breaches an individual’s right to privacy.
Data privacy directive
ECJ judges ruled that Google collects and processes data as part of its search engine. This brings it under a 1995 EU directive, giving individuals the right to have access to and request the deletion of data held by companies.
In a February hearing Google argued it was not a data “controller” and should not be asked to remove information from its search engine that it is published legally elsewhere.
The court rejected Google’s argument that the processing of personal data by Google Search was unrelated to the context of Google Spain’s activities. It said Google Spain should be defined as an “establishment” of Google Search and so must apply EU privacy law.
A Google spokesman said: “This is a disappointing ruling for search engines and online publishers in general. We are very surprised that it differs so dramatically from the Advocate General’s opinion and the warnings and consequences that he spelled out. We now need to take time to analyse the implications.”
In July last year, Advocate-General Jääskinen's opinion on the case, a non-binding yet influential document, argued against the imposition of a right to be forgotten. It stated, "This would entail sacrificing pivotal rights such as freedom of expression and information.”
Google has a market share of more than 80% of Europe’s search engine market, according to research firm comScore. The company already voluntarily removes search results worldwide if requests are made under US law.
Joe McNamee of European Digitial Rights (EDRi) said, "In the recent Telekabel case, the ECJ ruled that ISPs can have non-specific injunctions placed on them, and they have to work out the balance between a resonable effort to implement the injunction and the ISPs' responsibilities to defend citizens' fundamental rights. There are, however, no such legal responsibilities.
"In this case, the ECJ ruled that Google can be held liable for failing to remove content, taking into account 'the information in question and its sensitivity for the data subject’s private life and on the interest of the public.' When Google has an obligation on one side - delete to avoid a breach of the law - but no obligation regarding the interest of the public, there is clearly an imbalance that needs to be addressed.
"So, we now have two cases from the ECJ where private companies are asked to find a balance between legal obligations on the one hand and freedom of communication on the other."
The Liberal and Democratic candidate for the European Commission presidency, Guy Verhofstadt said: “This is a landmark ruling which backs my priority as candidate in putting in place privacy protection worthy of the 21st century. In line with what we have been standing up for, the Court reinforces the right to be forgotten for ordinary users whose personal data are actually processed through the results provided by Google, without compromising general access to public information.
“After last month’s Court ruling on data retention, today’s judgment also makes more urgent the implementation of my proposals, calling for in-depth fundamental rights checks in all future EU laws relating to the collection, processing, transfer and storage of personal data. I can only applaud this Court’s ruling but the Europe I want is a Europe led by a political project and not only by Luxembourg case law. That’s why I intend to lead on data protection and privacy and I call on Member States to stop delaying the adoption of the data protection package which is now on their table.”
Philipp Albrecht, justice and home affairs spokesperson of the Greens/EFA group in the European Parliament, said, "Today's ruling clarifies that search engine operators are responsible for the processing of personal data even if it comes from public sources. Affected individuals are therefore also entitled to exercise their right to erasure. The Court has also clarified that connecting publicly available data to a person’s profile constitutes a new and serious breach of a person's rights.
"In addition to this, the ruling clarifies that European data protection law is applicable as soon as a data controller is operating on the European market. It is now important that we adopt a uniform and consistent data protection regulation in order to strengthen the enforcement of such rights in all areas of the law and throughout the EU. Governments must finally deliver on this issue at the next Justice and Home Affairs Council in June."