By Anton Ziajka – Edited by Insue Kim
Case C-131/12, Google Spain SL, et al. v. AEPD, et al. (E.C.J. May 13, 2014)
Slip Opinion
[caption id="attachment_4363" align="alignleft" width="240"] Photo By: archie4oz - CC BY 2.0[/caption]
The European Court of Justice (“ECJ”) recently interpreted the EU’s Data Protection Directive, 95/46/EC (“Directive”), to affirm an individual’s “right to be forgotten.” SeeGoogle Spain, slip op. ¶ 91. The ECJ held that an Internet search engine is obligated, upon an individual’s request, to erase from its search results links to webpages that contain “inadequate, irrelevant or no longer relevant, or excessive” information that relates personally to the individual. Id. ¶ 94. The search engine must remove such results even if the information contained on the linked webpages is lawful and accurate, id., and even if the inclusion of the linked search results does not cause prejudice to the individual, id. ¶ 96. This obligation is limited to results responsive to searches “made on the basis of” the individual’s name, id. ¶ 94, and does not apply when access to the information is justified by “the preponderant interest of the general public,” id. ¶ 97.
Reactions to the ECJ’s judgment have ranged from condemnation to cautious optimism. TechCrunch provides an interview with Wikipedia founder Jimmy Wales, who criticizes the ruling as censorship of knowledge. By contrast, writers for the Guardian and Wired suggest that the holding may be a step in the right direction toward greater respect for people’s privacy. The New York Times, Ars Technica, and BBC further analyze the holding and its implications.
This case arose from a complaint lodged by a Spanish resident with the Spanish Data Protection Agency (“AEPD”), alleging that a newspaper published on its webpages a personally-identifying announcement from sixteen years ago about a real-estate auction connected with the complainant’s debt recovery. Id. ¶ 14. The complainant further alleged that a query for his name on Google Search returned links to these webpages. Id. He requested that the newspaper and Google remove this personal data from its webpages and search results, respectively, which the AEPD denied as to the newspaper but granted as to Google. Id. ¶ 15–17. Google appealed, and this decision followed. Id. ¶ 18.
First, the ECJ found that the search engine’s activity in locating, indexing, and displaying information on the Internet constitutes “processing of personal data” within the meaning of the Directive. Id. ¶ 41. In support, the ECJ observed that a search engine, in response to a search for a person’s name, provides a “structured overview of the information relating to that individual,” id. ¶ 37, and therefore “plays a decisive role in the overall dissemination of those data,” id. ¶ 36.
Next, the ECJ held that such data processing falls within the territorial and contextual scope of the Directive, because Google’s Spanish subsidiary promotes and sells Google’s advertising in Spain and “orients its activity towards the inhabitants” of that country. Id. ¶ 60. Whether Google actually processed the data within Spanish borders was considered irrelevant by the court. Seeid. ¶ 45.
Finally, the ECJ balanced “the legitimate interests pursued by the [data] controller” against the individual’s “right to privacy with respect to the processing of personal data.” Id. ¶ 74. The ECJ determined that, in general, the right to privacy overrides both the economic interests of the search engine and the interest of Internet users in obtaining the information. Id. ¶ 81. However, the legitimacy of each particular personal datum must be determined via a fact-specific inquiry, which may depend “on the nature of the information in question and its sensitivity to the data subject’s private life and on the interest of the public in having that information.” Id. Accordingly, the ECJ ruled that because the information about the complainant’s prior debt was sensitive, outdated, and of insufficient public interest, it must be erased from Google’s search results. Id. ¶ 98.
As the New York Times reports, the judgment leaves unresolved several issues, including the precise definition of “irrelevant” personal data, whether a search engine must remove such data globally or only within individual countries, and how much effort a search engine must expend investigating complaints. To comply with the ruling, search engines face a host of new complications; so far, Google has set up a search removal request webform for EU residents. Moreover, the European Commission is currently contemplating a major reform of the EU legal framework on the protection of personal data. In light of recent uncertainties, Internet companies’ obligations with respect to personal data may be redefined in the near future.
Photo By: archie4oz - CC BY 2.0[/caption]
The European Court of Justice (“ECJ”) recently interpreted the EU’s Data Protection Directive, 95/46/EC (“Directive”), to affirm an individual’s “right to be forgotten.” See Google Spain, slip op. ¶ 91. The ECJ held that an Internet search engine is obligated, upon an individual’s request, to erase from its search results links to webpages that contain “inadequate, irrelevant or no longer relevant, or excessive” information that relates personally to the individual. Id. ¶ 94. The search engine must remove such results even if the information contained on the linked webpages is lawful and accurate, id., and even if the inclusion of the linked search results does not cause prejudice to the individual, id. ¶ 96. This obligation is limited to results responsive to searches “made on the basis of” the individual’s name, id. ¶ 94, and does not apply when access to the information is justified by “the preponderant interest of the general public,” id. ¶ 97.
Reactions to the ECJ’s judgment have ranged from condemnation to cautious optimism. TechCrunch provides an interview with Wikipedia founder Jimmy Wales, who criticizes the ruling as censorship of knowledge. By contrast, writers for the Guardian and Wired suggest that the holding may be a step in the right direction toward greater respect for people’s privacy. The New York Times, Ars Technica, and BBC further analyze the holding and its implications.
This case arose from a complaint lodged by a Spanish resident with the Spanish Data Protection Agency (“AEPD”), alleging that a newspaper published on its webpages a personally-identifying announcement from sixteen years ago about a real-estate auction connected with the complainant’s debt recovery. Id. ¶ 14. The complainant further alleged that a query for his name on Google Search returned links to these webpages. Id. He requested that the newspaper and Google remove this personal data from its webpages and search results, respectively, which the AEPD denied as to the newspaper but granted as to Google. Id. ¶ 15–17. Google appealed, and this decision followed. Id. ¶ 18.
First, the ECJ found that the search engine’s activity in locating, indexing, and displaying information on the Internet constitutes “processing of personal data” within the meaning of the Directive. Id. ¶ 41. In support, the ECJ observed that a search engine, in response to a search for a person’s name, provides a “structured overview of the information relating to that individual,” id. ¶ 37, and therefore “plays a decisive role in the overall dissemination of those data,” id. ¶ 36.
Next, the ECJ held that such data processing falls within the territorial and contextual scope of the Directive, because Google’s Spanish subsidiary promotes and sells Google’s advertising in Spain and “orients its activity towards the inhabitants” of that country. Id. ¶ 60. Whether Google actually processed the data within Spanish borders was considered irrelevant by the court. See id. ¶ 45.
Finally, the ECJ balanced “the legitimate interests pursued by the [data] controller” against the individual’s “right to privacy with respect to the processing of personal data.” Id. ¶ 74. The ECJ determined that, in general, the right to privacy overrides both the economic interests of the search engine and the interest of Internet users in obtaining the information. Id. ¶ 81. However, the legitimacy of each particular personal datum must be determined via a fact-specific inquiry, which may depend “on the nature of the information in question and its sensitivity to the data subject’s private life and on the interest of the public in having that information.” Id. Accordingly, the ECJ ruled that because the information about the complainant’s prior debt was sensitive, outdated, and of insufficient public interest, it must be erased from Google’s search results. Id. ¶ 98.
As the New York Times reports, the judgment leaves unresolved several issues, including the precise definition of “irrelevant” personal data, whether a search engine must remove such data globally or only within individual countries, and how much effort a search engine must expend investigating complaints. To comply with the ruling, search engines face a host of new complications; so far, Google has set up a search removal request webform for EU residents. Moreover, the European Commission is currently contemplating a major reform of the EU legal framework on the protection of personal data. In light of recent uncertainties, Internet companies’ obligations with respect to personal data may be redefined in the near future.