A Right To Be Forgotten?
28 May 2014
The ECJ has recently ruled on a number of important questions regarding the data protection obligations of search engine providers such as Google, meaning that in certain circumstances individuals can ask for search results relating to them to be blocked or erased.
In 2010, a Spanish citizen requested that Google remove from search results a link to a newspaper article written about him, which was published in 2008. The individual proceeded to lodge a complaint with the Agencia Espanola de Protectecion de Datos (AEPD) against both the newspaper publisher, Google Spain and Google Inc. This complaint was upheld against Google Spain, but not against the newspaper publisher. Google Spain and Google Inc brought appeals before the referring court, which stayed the proceedings and referred a number of questions to the ECJ regarding the territorial scope of the Data Protection Directive, the Data Protection duties of service engine providers, and the so-called right to be forgotten.
Search Engine Provider as Data Processor & Data Controller
It was held by the ECJ that as search engines were engaged in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users, this must be classified as ‘processing of personal data’. More significantly it was held that the operator of the search engine must be regarded as the ‘data controller’ given that the processing undertaken by the search engine was significantly different from the processing undertaken by the publishers of the websites.
Territorial scope of the Data Protection Directive
It was argued on behalf of Google that because its search engine was managed by Google Inc, a company which is based in the USA, and Google Spain merely sold advertising on its behalf, the processing of personal data was not carried out by a company within the European jurisdiction. The ECJ ruled that a search engine provider will come within the territorial scope of the Data Protection Directive where it sets up a branch or subsidiary in a member state which is intended to promote and sell advertising space offered by that engine and which directs this advertising towards the inhabitants of a Member State. The Court held that the activities of the search engine operator and the subsidiary were inextricably linked.
The right to be forgotten
The ECJ ruled that in certain circumstances, an individual can instruct a search engine provider to remove links to websites containing information about them. The individual can ask for incomplete or inaccurate information to be rectified, erased, or blocked. Even where information is accurate, where it is inadequate, irrelevant or historic an individual may still ask for the information to be blocked. The ECJ held that an individual’s right to privacy and data protection had to be balanced against the legitimate interest of internet users potentially interested in having access to particular information. This would depend upon the nature of the information in question, on its sensitivity for the data subject’s private life, and on the interest of the public in having that information, which would be greater, if, for example the individual was involved in public life. This will have a range of practical implications for those who are unhappy with information about them on the internet.