Contact: John Warchus; Clarkslegal LLP (Reading, England)
In a major recent court decision, the European Court of Justice (ECJ) has confirmed for the first time that search engine providers are to be regarded as data controllers in respect of the locating and making available information relating to individuals and that an individual’s data protection rights to rectify, erase or block access to personal data can, in certain circumstances, amount to “a right to be forgotten”.
This means that search engines can be obliged to remove links to web pages containing information on an individual that it outdated or irrelevant and the decision has caused concern to search engine providers and organisations and individuals who fear that it may exaggerate the individual’s right to privacy at the expense of the public’s right to information.
Background
In 1998, a Spanish newspaper published two stories in relation to a property auction connected to social security debts owed by Mr Gonzalez, the owner. The newspaper initially created a printed edition and later an electronic version of the story. After the newspaper had refused Mr Gonzalez’s earlier request to remove the references to the story on the basis that the court proceedings had been concluded many years earlier, he contacted Google Spain to request that search results did not show links to the online story when his name was entered. Mr Gonzalez lodged a complaint with the AEPD (the Spanish equivalent of the Information Commission) requesting that the newspaper and Google Spain should be required to remove links to the online publication for search results in his name.
In July 2010, the AEPD upheld the complaint against Google Spain but rejected the complaint against the newspaper publisher on the grounds that the original publication in the press was legally justified. Google Spain duly appealed to the Spanish national courts which referred several questions to the ECJ seeking clarification on data protection law issues.
The ECJ held that:
- Processing of Data - The data protection Directive had to be interpreted as meaning that the activity of search engines in finding information published on the Internet by third parties and then indexing, storing and making it available was “processing”; furthermore, and unlike the Advocate General, the ECJ felt that search engines should also be considered to be the data controller in relation to such processing, increasing their obligations in relation to individuals
- The “Right to be Forgotten” – The combined effect of Article 12 of the Directive (giving individuals the right to rectify, erase or block personal data) and Article 14 (giving individuals the right to object to the processing of personal data on compelling legitimate grounds) meant that search engine operators are generally obliged to remove from search results links to web pages containing personal data where the conditions of these Articles are satisfied: this obligation arises whether or not personal data has been erased beforehand or simultaneously and could also arise even if the original publication of those pages was lawful
- The Legal Test to be Applied - The ECJ went on to clarify that in deciding whether or not search engines should be prevented from accessing personal data relating to an individual, the test is whether, at that point in time, the impact on the individual’s privacy is greater than the public’s right to the information, taking account of all relevant circumstances: it was not necessary for the individual to show that including information in the search would cause him/her actual prejudice as Articles 7 and 8 of the EU Charter of Fundamental Rights (the right to respect for private life and the right to data protection) meant that the individual’s rights would generally override both the economic interests of the search engine provider but also the interest of the public in having access to such information
- The Public Interest - the ECJ did recognise that there would be special situations where the individual played a role in public life where interference with his/her fundamental rights would be justified on the basis of the general public having access to such information – inevitably, this public interest test will vary, partly depending on the role played by an individual in public life
Commentary
In coming to its decision, the ECJ rejected arguments that a search engine does not exercise “control” over the processing of personal data because website publishers are able to exclude information on their site from being identified by search engines through the use of certain exclusion protocols and similar techniques. Throughout the ruling, the ECJ emphasised the importance of search engines in the overall operation of the Internet and their impact on an individual’s data protection rights – this was clearly instrumental in its decisions on rights enjoyed by individuals under data protection law.
As a result of the decision, search engines must now remove links to search results based on an individual’s name where an individual can demonstrate that the conditions in Article 12 and/or Article 14 of the Directive are met. Although it is clear from the court’s approach that there will need to be a balancing of the competing rights of the search engine provider/public and those of the individual where there is some form of public interest in being able to access such search results, the general approach of the ECJ suggests that it is the individual’s right to privacy which will generally override the interest of other Internet users and/or the search engine provider.
The ECJ did acknowledge that balancing the interests of search engine providers against individuals could lead to a different decision to balancing the rights of journalists/newspapers and the individual – throughout the decision, the ECJ was particularly concerned over the practical effect that search engines have on the dissemination of personal data and that this will often have a more significant effect on an individual’s privacy than an original newspaper publication, whether in print or online.
In confirming that there may be a right to be forgotten, the ECJ emphasised that the data protection legislation did not just protect individuals where information held was inaccurate but also where personal data could be processed in a way that was inadequate, irrelevant or excessive in relation to the purposes for the processing. Accordingly, personal data which is initially lawfully published may become inadequate, irrelevant or excessive at a later date, giving rise to an individual’s right for it not to be included in online searches.
The decision has caused quite a furore amongst the online industry due to the relative importance that the ECJ has afforded to the individual’s right to privacy, with fears that it may legitimise the destruction or falsification of historical data and, indirectly, contribute to a form of censorship. If the wording of the ECJ’s decision is followed, however, it is clear that there is to be a balancing of interests and that the public interest may well mean that search engines can continue to identify personal data which individuals would rather not have accessed about themselves. There may, however, be a danger in practice that search engine providers seek to minimise legal administrative costs by agreeing to all requests from individuals to remove information from their searches rather than contest the legitimacy of a request. In addition, the public do not have a ready means of raising their rights to freedom of expression and information with search engines to counterbalance the individual’s rights for personal data not to be accessed.
The decision will not just affect search engine providers – it is likely to apply to others, such as social media sites where individuals will seek to remove old and/or embarrassing content/photos that might be accessed by prospective employers.
A new draft Regulation on Data Protection is being discussed by the EU authorities with the European Parliament keen on introducing a more wide-ranging and explicit right to be forgotten, although it remains to be seen as to whether any express right adopted is wider than that interpreted by the ECJ.
