06 August 2014 #Commercial
In a major recent court decision, the European Court of Justice (ECJ) has confirmed for the first time that search engine providers are to be regarded as data controllers in respect of the locating and making available information relating to individuals and that an individual’s data protection rights to rectify, erase or block access to personal data can, in certain circumstances, amount to “a right to be forgotten”. This means that search engines can be obliged to remove links to web pages containing information on an individual that it outdated or irrelevant and the decision has caused concern to search engine providers and organisations and individuals who fear that it may exaggerate the individual’s right to privacy at the expense of the public’s right to information.
In 1998, a Spanish newspaper published two stories in relation to a property auction connected to social security debts owed by Mr Gonzalez, the owner. The newspaper initially created a printed edition and later an electronic version of the story. After the newspaper had refused Mr Gonzalez’s earlier request to remove the references to the story on the basis that the court proceedings had been concluded many years earlier, he contacted Google Spain to request that search results did not show links to the online story when his name was entered. Mr Gonzalez lodged a complaint with the AEPD (the Spanish equivalent of the Information Commission) requesting that the newspaper and Google Spain should be required to remove links to the online publication for search results in his name.
In July 2010, the AEPD upheld the complaint against Google Spain but rejected the complaint against the newspaper publisher on the grounds that the original publication in the press was legally justified. Google Spain duly appealed to the Spanish national courts which referred several questions to the ECJ seeking clarification on data protection law issues.
Decision of the ECJ
The ECJ held that:
In coming to its decision, the ECJ rejected arguments that a search engine does not exercise “control” over the processing of personal data because website publishers are able to exclude information on their site from being identified by search engines through the use of certain exclusion protocols and similar techniques. Throughout the ruling, the ECJ emphasised the importance of search engines in the overall operation of the Internet and their impact on an individual’s data protection rights – this was clearly instrumental in its decisions on rights enjoyed by individuals under data protection law.
As a result of the decision, search engines must now remove links to search results based on an individual’s name where an individual can demonstrate that the conditions in Article 12 and/or Article 14 of the Directive are met. Although it is clear from the court’s approach that there will need to be a balancing of the competing rights of the search engine provider/public and those of the individual where there is some form of public interest in being able to access such search results, the general approach of the ECJ suggests that it is the individual’s right to privacy which will generally override the interest of other Internet users and/or the search engine provider.
The ECJ did acknowledge that balancing the interests of search engine providers against individuals could lead to a different decision to balancing the rights of journalists/newspapers and the individual – throughout the decision, the ECJ was particularly concerned over the practical effect that search engines have on the dissemination of personal data and that this will often have a more significant effect on an individual’s privacy than an original newspaper publication, whether in print or online.
In confirming that there may be a right to be forgotten, the ECJ emphasised that the data protection legislation did not just protect individuals where information held was inaccurate but also where personal data could be processed in a way that was inadequate, irrelevant or excessive in relation to the purposes for the processing. Accordingly, personal data which is initially lawfully published may become inadequate, irrelevant or excessive at a later date, giving rise to an individual’s right for it not to be included in online searches.
The decision has caused quite a furore amongst the online industry due to the relative importance that the ECJ has afforded to the individual’s right to privacy, with fears that it may legitimise the destruction or falsification of historical data and, indirectly, contribute to a form of censorship. If the wording of the ECJ’s decision is followed, however, it is clear that there is to be a balancing of interests and that the public interest may well mean that search engines can continue to identify personal data which individuals would rather not have accessed about themselves. There may, however, be a danger in practice that search engine providers seek to minimise legal administrative costs by agreeing to all requests from individuals to remove information from their searches rather than contest the legitimacy of a request. In addition, the public do not have a ready means of raising their rights to freedom of expression and information with search engines to counterbalance the individual’s rights for personal data not to be accessed.
The decision will not just affect search engine providers – it is likely to apply to others, such as social media sites where individuals will seek to remove old and/or embarrassing content/photos that might be accessed by prospective employers.
A new draft Regulation on Data Protection is being discussed by the EU authorities with the European Parliament keen on introducing a more wide-ranging and explicit right to be forgotten, although it remains to be seen as to whether any express right adopted is wider than that interpreted by the ECJ.