Individuals Have The Right To Ask Google To Delete Personal Data Says The CJEU
May 12, 2014
In an important ruling rendered on 13th May 2014 in Google Spain v AEPD and Mario Costeja Gonzalez (C-131/12), the Court of Justice of the European Union (CJEU) found that, if a search is made on the basis of a person’s name, search engine operators such as Google must remove the links to third party content containing information relating to that person from the list of results even when the content has been lawfully published and the search engine operator is located outside of EU, provided that the passage of time has made the information irrelevant.
By this ruling, the judges of the CJEU backed the „right to be forgotten“ making it clear that in their view the current EU data protection law i.e. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Directive) already establishes the said right.
THE FACTS
Mr Mario Costeja González is a Spanish national with residence in Spain, whose property was subject of forced sale arising from social security debts. In 1998, the Spanish Ministry of Labour and Social Affairs ordered the Spanish newspaper La Vanguardia to publish two announcements for a real-estate auction to attract bidders for the property and to facilitate the sale. The announcements were published on 19th January and 9th March 1998, respectively, in the printed version of the newspaper and they mentioned Mr. Costeja González by name. The printed version of the newspaper eventually made its way to the internet. This resulted in links to the announcements mentioning Mr. Costeja González appearing in the list of results when Mr. Costeja González’s name was entered in the Google search engine.
In November 2009, Mr. Costeja González contacted the Vanguardia newspaper and requested that the data relating to him be removed, since the forced sale had been concluded many years before and was no longer relevant. The newspaper denied this request stating that the publication had been on the order of the Spanish Ministry of Labour and Social Affairs. After receiving such a reply, Mr. Costeja González contacted Google Spain in February 2010 requesting removal of the links to the announcements from the list of results of the Google search engine. Google Spain forwarded his request to Google Inc., based in California, United States, but did not remove the links.
On 5 March 2010, Mr. Costeja González lodged official complaints with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD) against La Vanguardia Ediciones SL (the publisher of La Vanguardia newspaper) and against Google Spain and Google Inc. He requested, first, that La Vanguardia be required either to remove or alter those pages so that the personal data relating to him no longer appeared, or to use certain tools made available by search engines in order to protect the data. Furthermore, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to La Vanguardia. He stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
By decision of 30th July 2010, the AEPD rejected the complaint directed to La Vanguardia, holding that La Vanguardia lawfully published the information, as the publication took place upon order of the Ministry of Labour and Social Affairs and was intended to give maximum publicity to the auction in order to secure as many bidders as possible. Conversely, the AEPD upheld the complaint against Google Spain and Google Inc. The AEPD considered that search engine operators carry out data processing for which they are responsible, as well as act as intermediaries in the information society and are, therefore, subject to data protection legislation. Thus, the AEPD requested that Google Spain and Google Inc. take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future.
Google Spain and Google Inc. refused to comply and brought two actions before the Audiencia Nacional (National High Court of Spain), claiming that the AEPD’s decision should be annulled, inter alia, because Google Inc. is not subject to the Data Protection Directive and Google Spain is not in charge of the search engine. Furthermore, it stated that neither of the companies can be considered a data controller. The National High Court of Spain stayed the proceedings and submitted three sets of questions to the CJEU regarding the interpretation of the Data Protection Directive.
The first set concerned the territorial scope of the Directive, namely does the Directive impact the non-EU resident processors of data. The second set of questions was directed at the clarification of activities caught by the Directive, inter alia, what is meant by „processing of data“ and who is considered „the controller of personal data“. Finally, the National High Court of Spain asked the CJEU whether the „right to be forgotten“ extends to situations when the information in question has been lawfully published by third parties or not.
THE DECISION OF THE COURT
The CJEU first assessed whether Google’s activities fell within the scope of the Data Protection Directive or not. Google contended that it had no control over the data nor over its selection and that its search engine does not distinguish between personal data and other data. The CJEU, however, found these arguments unconvincing.
The Court found that in exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine „collects’“ personal data within the meaning of the Directive. Such data is subsequently retrieved, recorded and organised within the framework of the indexing programmes of the search engine operator, stored on its servers and, as the case may be, disclosed and made available to the users of the search engine in the form of lists of search results. Since those operations are expressly and unconditionally referred to in Article 2(b) of Directive, the CJEU decided that they must be classified as „processing“ within the meaning of that provision. The fact that the search engine operator carries out those operations without making any distinction in respect of information other than the personal data and the fact that the operations concern only the content which has already been published on the internet and unaltered by the search engine is not relevant in this context, according to CJEU.
Regarding the term controller of personal data, the CJEU took the view that a broad definition must be adopted so as to ensure complete protection for data subjects. The definition, according to the CJEU, does not exclude search engine operators merely on the ground that they do not exercise control over the personal data published on the web pages of third parties, because it is the search engine operator which determines the purposes and means of the processing. The CJEU concluded that the activity of search engine operators, in addition to that of publishers of websites, significantly affects the fundamental rights to privacy and protection of personal data. Given that the search engine operator determines the purposes and means of that activity, it must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of the Data Protection Directive. Otherwise, as the CJEU holds, the guarantees laid down by the directive may not have full effect and may not give effective and complete protection of data subjects, in particular of their right to privacy.
As for the territorial scope of the Directive, the CJEU noted that Google Spain is to be considered an establishment of the controller in a Member State within the meaning of the Data Protection Directive, since it engages in the effective and real exercise of activity through stable arrangements in Spain and is a subsidiary of Google Inc. The Court rejected Google’s argument that the processing of personal data by Google Search is not carried out „in the context of the activities“ of the establishment in Spain, which is another criterion laid down in the Data Protection Directive. The Court found that the activities of Google Inc., which is seated in the US as a third State, and Google Spain, which is seated in an EU Member State are inextricably connected, since the former is processing personal data for the purposes of the service of the Google Search, while the latter promotes and sells advertising space offered on the search engine in respect of Spain. According to the Court, in such cases the processing of personal data is definitely carried out „in the context of the activities“ of the controller’s establishement in a Member State.
The CJEU then turned to the the question of whether Mr. Costeja González had the right to request the removal of the information from the list of the search results or not. The Court held that the search engine operator has the obligation, in certain circumstances, to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name. It further clarified that the search engine operator must act in that manner also when that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
Furthermore, the Court drew attention to a significant role search engine operators play in today’s world since they greatly simplify the finding of information, giving internet users the opportunity to carry out a search based on an individual’s name and obtain a structured overview of information related to that individual. That information can potentially concern many aspects of the individual’s private life, and without the search engine they would have never been interconnected or could have been only with great difficulty.
The decision, furthermore, emphasized that in situations such as in the case at hand a fair balance must be struck between the legitimate interest of internet users potentially interested in having access to information related to an individual and that individual’s fundamental rights under Articles 7 and 8 of the Charter, namely, the right to respect for private life and the right to protection of personal data. The Court, furthermore, stated that in general the interest of data subjects trumps the interest of internet users, but also that the balance sometimes might depend on the nature of information and its sensitivity for the data subject’s private life and on the interest of the public in having that information. That interest may vary, in particular, according to the role played by the data subject in public life.
Finally, the CJEU addressed the „right to be forgotten“. It held that even initially lawful processing of accurate data may, in the course of time, become incompatible with the Directive in the cases the data is no longer necessary for the purposes for which it was collected or processed. This applies if the data is inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has passed. If this is determined, then the links to web pages published lawfully by third parties and containing true information relating to an individual must be erased from the list of results of a search engine, unless there are particular reasons, such as the role played by the data subject in public life, justifying a preponderant interest of the public in having access to the information when such a search is made.
The Court points out that the data subject may address such a request directly to the search engine operator, which is the controller of personal data. The search engine operator must then duly examine the merits of the request. If the controller does not grant the request, the data subject may bring the matter before the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly.
COMMENT
By this decision, the CJEU basically gave individuals in the EU the possibility to edit their own online histories. The decision is a very important one for data protection in the EU, but equally so problematic for many reasons.
Eventhough the Court did emphasize the importance of balancing the interests of individuals, to which personal information pertain, and the public searching for such information online facilitated by search engines such as Google, the decision lacks clear guidelines on how to find this right balance between the opposed interests. It is actually the case of finding the balance between the right to freedom of speech on one side and the right to privacy on the other side, and this has in the past proved difficult even in the offline world, which seems much simpler to control with respect of data protection than the virtual one. However, It is questionable if this balance can be struck by allowing individuals to seek removal of true, accurate and lawfully published information about them. However inconvenient and embarassing the published information might be for these individuals, if it is lawfully published and accurate, erasing it from search results reeks of censorship and has vast potential for abuse. There is certainly little doubt that the same individuals would rarely request the removal of positive personal information, such as information about their successes or achievements.
The result of this decision might be a two-tiered internet, where one reality of information available via the search engines would exist for anybody outside of the EU, while another would exist for people searching from Europe. This reminds me of Wikipedia articles in different languages, in which completely different „truths“ can be read about the same politically charged subject, depending on whose version of the article one reads.
An admittedly less significant, but equally valid argument against this ruling is the unfairness of the commercial burden placed on search engine operators to evaluate requests for removal of links, which are surely going to pour in buckets following this decision of the CJEU. In addition to this, I don’t think that search engines are the right „institution“ to be able to judge what information is relevant to still be available through the list of results, and what isn’t any longer. Perhaphs it would make more sense to direct the requests for removal immediately to the competent data protection agency, which would than make a decision and order the search engine to remove the link in question.
Furthermore, this decision will also result in an interesting situation where lawfully published and accurate information will no longer be processed by search engines i.e. no longer be found in the list of results, because the removal of such information was requested by an individual to which it pertains. Conversely, search engines would still be able to harmlessly process all other personal information, be it lawfully or unlawfully published, accurate or innacurate, eventhough such processing would in principle be in contravention of the Directive as well.
The full text of the CJEU’s decision can be found here.
Jasmina Mutabžija
Latest posts by Jasmina Mutabžija (see all)
- Wide-Scope Tax Reform In Croatia Taking Effect From 1st January 2017 - December 14, 2016
- Employee Inventions Regulated By A New Law In Romania - October 1, 2014
- Following The Recent CJEU Decision, Google Announces How To Erase Your Personal Data From Google Search Results - May 30, 2014
- Individuals Have The Right To Ask Google To Delete Personal Data Says The CJEU - May 12, 2014
- Another Blow To Human Embryonic Stem Cell Patents In Europe: The TBA’s Decision In Culturing Stem Cells/TECHNION (T-2221/10) - February 8, 2014