15 May 2014
In 2010 Spanish national Mario Costeja González, lodged a complaint against a Spanish Daily paper with the Spanish Data Protection Agency, the AEPD. The complaint also featured La Vanguardia Ediciones SL (the publisher of the paper), Google Spain and Google Inc. Mr Costeja González concern was that when an internet user entered his name in the Google search engine the list of results would display links to two pages of La Vanguardia’s newspaper, from January and March 1998.
The pages contained an announcement for an auction of property organised following attachment proceedings for the recovery of debts owed by Mr Costeja González. Mr Costeja González stated that the attachment proceedings had been fully resolved and were historical as such reference to them was irrelevant.
Mr Costeja González requested, that La Vanguardia be required either to remove or alter the pages in question,so that the data relating to him no longer appeared, or to restrict the personal data. He also requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia.
The AEPD rejected the complaint against La Vanguardia, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested those two companies to take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future.
Google Spain and Google Inc. brought actions before the National High Court in Spain, claiming the AEPD’s decision should be annulled. The Spanish Court then referred questions about the right to be forgotten to the Court of Justice.
The Court of Justice has found that,
- search engines ‘collect’ data within the meaning of the directive by searching automatically, constantly and systematically for information published on the internet. In doing so the indexing programmes, ‘retrieves’, ‘records’ and ‘organises’ the data ‘storing’ it and then, ‘disclosing’ data and ‘making it available’ to its users.
Those operations, are referred to in the directive as ‘processing’, regardless of the fact that the operator of the search engine carries them out without distinction in respect of information other than the personal data.
- The Court confirmed that the search engine operator was processing data even where the processing exclusively concerned material that has already been published in the media.
- The Court also determined that the operator of the search engine is the ‘controller’ in respect of that processing, because it is the operator which determines the purposes and means of the processing.
- The Court observed that the activity of a search engine is additional to that of publishers of websites and is liable to affect significantly rights to privacy and to the protection of personal data, The operator of the search engine must ensure, that its activity complies with the directive’s requirements.
This will no doubt become an interesting area as Search Engines will require to develop their policies in respect of requests for erasure of data. Previously individuals seeking removal of content from the internet often struggled to effect website take downs or removal of listings and even where they did search results might still show details of content from pages that it was no longer possible to access. This decision opens the door to another tool for individuals affected by adverse postings and those working in reputation protection.
There is however a word of caution regarding the extent of this decision and its implications, this may not be the silver bullet that some may have hoped. The UK's Information Commissioner's Office says "Our concern is about how difficult (or impossible) this may be to achieve in practice and how it could lead individuals to believe falsely that they can achieve the absolute erasure of information about them.
"We know from the efforts of well-resourced and motivated individuals that it can in fact be impossible to remove information from the internet once it has been posted.
- The Courts concern was with the relative ease with which Internet users could use search engines to establish a more or less detailed profile of the person searched against.
- It observed that interference with privacy rights is heightened by the role of the internet and search engines in modern society. The Court said such interference cannot, be justified by the economic interest which the operator of the search engine has in the data processing alone.
It seems likely that this case will fuel the ongoing international debate about where the balance between these conflicting interests should be. It is clear that this decision has resonated in other jurisdictions with commentators outside the EU expressing concerns about the implications of this decision as a form of internet ‘censorship’.
- The Court considered that there was a balance to be struck between privacy and matters of public interest.
- The Court observed that, whilst it is true that the data subject’s rights, as a general rule override, the interest of internet users, the balance may depend on the nature of the data in question and its sensitivity for the data subject’s private life and on the interest of the public in that information, the legitimacy of which may the court said depend upon the extent to which an individual is in the public eye.
The Court’s decision means, that where a data subject requests that a link to a web page be removed from a search listing on the grounds that he wishes the information appearing on those pages relating to him to be ‘forgotten’, that request should be given effect where the listing is, incompatible with the directive.
- It is important to note that the ruling is restricted to data which is incompatible with the directive. Even initially lawful processing of accurate data may, in time, become incompatible with the directive. The Court indicated it was necessary to have regard to all the circumstances of the case, and to whether the data appeared to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed.
Data subjects should address requests directly to the operator of the search engine (the controller) which must then examine the merits of the request. Where a request is refused by the controller the data subject may bring the matter before the national supervisory authority or the judicial authority.
The UK has been seeking exemptions in the context of the development of the European Data Protection reforms which are progressing at present. However the implications of this decision for search engines operating in the UK and the UK Information Commissioners Office will be substantial. At the present time the Information Commissioners Office has not issued a detailed statement about the implications of this case perhaps they are still absorbing the potential enormity of the task ahead should collective amnesia set in.
For further information please contact Paul Motion, Laura Irvine or Lindsay Urquhart on T: 0131 222 2939 or email us at firstname.lastname@example.org