Thursday, May 15, 2014
The European Court of Justice has ruled that a user in a member state of the EU may ask a search engine company (such as Google) to delete links (in search results) to information that the user objects to, if it is irrelevant, incorrect, outdated, or inadequate, and even if the information is truthful.
More coverage here from the New York Times (editorial here), the Daily Mail, the Telegraph, and Digital Journal. A link to the ECJ Press Release here. Link to the ruling here. Link to the Advocate General's opinion, with which the ECJ parted ways, here.
Here is the holding of the Court:
Article 2(b) and (d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are to be interpreted as meaning that, first, the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d).
Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State. Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, when appraising the conditions for the application of those provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.
While the ruling, like most ECJ rulings, is narrow, it could have wide consequences, and it leaves many issues unresolved. For instance, how can we reconcile this ruling on privacy with the rights of free specch and free expression guaranteed under the European Charter? If a user in one member states requests removal of links, does that request guarantee removal in all other member states? How can we reconcile the ECJ decision with the laws in other nations, including the US, which like the EU have constitutional or charter provisions that protect freedom of expression as well as privacy, but balance the rights differently?
The case is Google Spain SL v. Agencia Espanola de Proteccion de Datos (AEPD), Mario Costeja Conzalez, decided May 13, 2014.