Contact The Team


* indicates required

Right to be forgotten

Friday, October 24, 2014

The decision of the European Court of Justice in Google Spain & Google Inc v Agnecia Espanola de Proteccion de Datos (AEPD) & Mario Costega Gonzales (C-131/12) that individuals have a “Right to be Forgotten” in relation to search engine results arising from their name looks set to have far-reaching implications for both internet search engines and individuals, with some arguing that the judgment could lead to the erosion of freedom of speech and the information society.

In a judgment delivered on 13 May 2014, the Grand Chamber of the European Court of Justice ruled that individual rights to privacy and data protection mean that individuals have a right to have information about them removed from the results of an internet search carried out using their name, where the information is inaccurate, inadequate, irrelevant or excessive.

The judgment was unexpected, not least because it departed from the Advocate General’s Opinion on the case, but also because it departed from the previously held view that search engines are “mere conduits” for information, with few direct data protection obligations as a result.

Practical Consequences

The so-called “Right to be Forgotten” ruling has extensive implications and practical consequences:

  • Internet search engines are regarded as “data controllers” when handling personal data;
  • Where a request is received from an individual, search engines are obliged to conduct specific analysis to determine whether the removal of a link is justified;
  • Where a search engine refuses to remove a link, it is open to the affected individual to complain to national Data Protection Authorities and/or the courts (in certain countries).

The effects of the ruling also go beyond data protection law, in that it serves as a reminder for global businesses offering services to EU customers that they are bound by the requirements of EU law.

The impact of the judgment is already being seen in practice: Google has reportedly received more than 90,000 individual requests for the removal of information involving more than 328,000 links and has since rolled out a web-form for processing removal requests:

However, smaller search engines are unlikely to have the same resources to facilitate such straightforward processing of removal requests received.

The judgment has been subject to criticism as it obliges search engines to decide whether or not to delete accurate and lawfully available information.

In addition, there have been numerous subsequent media reports about the removal of links from individual searches , which will have implications for the general public, in terms of the availability of information and the accuracy of results from “big data” analyses of search trends.

Further, the UK High Court has subsequently held that the judgment also obliges search engines to block links to third party sites where inaccurate personal information is available (Hegglin v Person(s) Unknown and Google Inc [2014] EWHC 2808 (QB), 31 July 2014).

However, as the proposed Data Protection Regulation specifically provides for a “Right to be Forgotten”, the impact and ramifications of the judgment are likely to continue. This is likely to lead to further litigation from individuals who wish to be forgotten and internet companies seeking clarity on the practical application of the judgment.

Case Details

The judgment of the ECJ arose out of a referral by the Spanish National High Court in proceedings taken by Google Spain and Google Inc. against the Spanish Data Protection Authority (the “Spanish Authority”) and a Spanish citizen (Mario Costega Gonzales), regarding a decision of the Spanish Authority on a complaint received from Mr. Gonzales. In his complaint, Mr. Gonzales had sought the withdrawal of links to newspaper articles comprising an auction notice of his repossessed home from Google’s search results. He had argued that, while the articles were accurate, they were no longer relevant as the attachment proceedings had been fully resolved many years previously and the links to the articles ought to be removed as a result. The Spanish Authority upheld his complaint as infringing his fundamental rights to privacy and protection for his personal data, as protected by Articles 7 and 8 of the European Charter of Fundamental Rights.

In its referral to the ECJ, the Spanish Court sought answers to questions on the following issues:

1. Applicability of EU Data Protection Rules to Search Engines:
Whether the EU Data Protection Directive (94/46/EC) applied to search engines such as Google;

2. Territoriality of EU Rules:
Whether EU law applied to Google Spain, in circumstances where the server of the company that processed the data in issue was located in the US; and

3. “Right to be Forgotten”
Whether an individual has a “right to be forgotten” or a right to request the removal of his personal data from accessibility through a search engine.

In its judgment, the ECJ ruled as follows:

1. Applicability of EU Data Protection Rules to Search Engines:

The ECJ ruled that the activities underlying a Google search, including exploring the internet, colleting, storing and making data available) amounted to “processing” of personal data, notwithstanding the fact that the data was already published on the internet and was not altered by Google when compiling the search results.

The ECJ further held that even though search engines do not control personal data on third party webpages, nonetheless, they constitute “data controllers” as they play a decisive role in the dissemination of information on individuals via internet searches using their names: the search results render the data accessible to any internet user making a search on the basis of the data subject’s name and the list of results provides a structured overview of the information relating to an individual, in the form of a detailed individual profile.

2. Territoriality of EU Rules:

The ECJ determined that EU law applies to search engine operator if they have a branch or subsidiary in a Member State that promotes the selling of advertising space offered by the search engine. It does not matter that the server actually processing the data is located outside Europe.

3. “Right to be Forgotten”

On the substantive question referred regarding the rights of individuals to object to processing of their personal data (Article 14(a) of the Data Protection Directive) and to request the rectification, erasure or blocking of their personal data (Article 12(b) of the Data Protection Directive), the ECJ held that these rights should be interpreted as imposing an obligation on search engine operators to remove links to third party websites containing personal information from search results in certain circumstances.

The ECJ held that the processing of personal information in the form of a structured list of links to information on an individual, enabling a detailed profile on that individual, engaged the fundamental rights to privacy and protection of personal data protected by Articles 7 and 8 of the European Charter of Fundamental Rights. The Court went on to hold that these rights could not be overridden solely by the economic interests of a search engine operator.

As a result, the Court held that national Data Protection Authorities could order search engine operators to remove links to webpages from search results based on a person’s name, without requiring the removal of the information itself from the third party websites.

In addition, the Court held that individuals have the right to require search engine operators to remove links to third party websites from search results based on their names, even where accurate, on the grounds that the information might be irrelevant after a certain time or excessive. The Court stated that this was not an absolute right and identified an exception arising where the individual in question plays a public role, such that there is a strong public interest in the continuing availability of out-of-date information.

Since the judgment, the Article 29 Working Party (the EU advisory body on data protection and privacy) has indicated that it will release guidelines on the implementation of the ruling across the EU. Questions that remain include what other exceptions might be considered as justifying a refusal to remove links from search results or whether it is possible for search engines to retain links in non-name search results, even though the same links must be excluded from name search results. The result of doing so would effectively prevent the availability and accessibility of information, except where the originating webpage is known and would have a chilling effect on freedom of expression.

Data Protection Regulation

The ECJ ruling was based on principles derived from the existing Data Protection Directive. However, Article 17 of the proposed Data Protection Regulation specifically provides for a “right to be forgotten”, that includes the following express provisions:

(a) It will apply to non-European companies offering services to European consumers, regardless of where the physical server of a company processing data is located;

(b) The company must prove that the data cannot be deleted because it is still needed or still relevant;

(c) The data controller who has made the data publicly available will either be obliged to:
a. Take “reasonable steps” to inform third parties of the fact that the affected individual wants the
data to be deleted (European Commission Proposal);
b. Ensure the erasure of data by third party websites (European Parliament Proposal).

(d) Data Protection Authorities will be able to impose fines of up to 2% of annual worldwide turnover where companies do not respect citizens’ data protection entitlements, including the right to be forgotten.

(e) The limitations on the right to be forgotten are specified as including the right of freedom of expression, the interests of public health and where data is processed for historic, statistic or scientific purposes.

The proposed Regulation provides an indication of the scope and extent of application of the ECJ ruling to search engine operators in practice.