ECJ says Google, and other search engines, must abide by European data protection laws
This is going to upset the apple cart – the European Court of Justice (ECJ) has decided in favour of Mario Costeja González in his dispute with Google. Way back in 1998, a Spanish newspaper published reports on certain pecuniary difficulties in which González found himself.
By 2010 those difficulties were long past – but Gonzales found the archived pages on the internet and Google search links to them. He wanted both the pages and the links removed because they are no longer relevant.
The Spanish Data Protection Agency, the AEPD, half agreed. It made no demands against the newspaper because the information was valid when it was written. But it found against Google, requesting that Google Spain and Google Inc remove the links from the Google database.
Google objected, and appealed to the Spanish High Court to have the AEPD’s decision annulled. The High Court referred the matter to the ECJ for an interpretation of the European Data Protection Directive – and the ECJ has today delivered that interpretation.
It finds, in a nutshell, that search engines that operate in Europe are bound by European data protection laws, and that Google is one such search engine.
So far as concerns, next, the extent of the responsibility of the operator of the search engine, the Court holds that the operator is, in certain circumstances, obliged to remove links to web pages that are published by third parties and contain information relating to a person from the list of results displayed following a search made on the basis of that person’s name.
Judgment in Case C-131/12 – Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González
Green MEP Jan Philipp Albrecht is pleased with the outcome, commenting,
The ruling by the European Court of Justice to also hold search engine operators responsible for compliance with data protection law is the right decision. Today’s ruling clarifies that search engine operators are responsible for the processing of personal data even if it comes from public sources. Affected individuals are therefore also entitled to exercise their right to erasure… It is now important that we adopt a uniform and consistent data protection regulation in order to strengthen the enforcement of such rights in all areas of the law and throughout the EU.
But life is never that simple, and the ECJ’s ruling leaves the waters very muddy. While making it clear that as a general principle individuals have the right to demand that personal information is removed from the search engines,
The Court observes in this regard that, whilst it is true that the data subject’s rights also override, as a general rule, that interest of internet users, this balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.
If that seems a bit convoluted, it just means that there is a ‘public interest’ loophole. In González’ case it’s pretty straightforward – there is no public interest argument in providing links to long dissatisfied pecuniary difficulties from 1998. Those links must go.
But what about links to the improprieties of celebrities? Those who perhaps dress up as Nazis or attend S&M parties. And will this lead to two separate internets – one for the US where freedom of speech prevails and one for Europe where data protection and privacy prevails?