ECJ
confirms right to have search engine results removed where they affect privacy
rights
The ECJ has ruled on three
questions concerning the interpretation of the Data Protection Directive (1995/46/EC)
with regard to the data processing activities of search engine providers, their
status as data controllers and the existence and scope of a right to be
forgotten, in a reference from a Spanish court. The proceedings had been
brought by a Spanish citizen, who had asked that Google remove from the list of
search results based on his name links to two announcements in a Spanish
newspaper from 1998. The announcements concerned a real-estate auction
connected with attachment proceedings prompted by the applicant's social
security debts. The ECJ held that a search engine provider is the data
controller in respect of the locating, indexing, storing and making available
of information accessible on the internet, and that the applicant has a right
to rectification, erasure or blocking of that information, and a right to
object to the processing of the information in certain circumstances.
The ECJ made it clear that
while the search engine's commercial interests in processing the information
will not, as a rule, override the data subject's rights to privacy and data
protection, a balancing of the data subject's fundamental rights and the
interests of other internet users in accessing that information must be carried
out. The interest in the continued accessibility of personal information may
override the data subject's interest in cases where the data subject plays a
prominent role in public life and the accessibility of the information is in
the public interest. The ECJ further clarified that the data subject's right to
request removal of the relevant links may also apply if the information is true
and where its original publication was lawful. This is particularly the case
where the information has since become inadequate, irrelevant or excessive.
The ECJ's decision has sent
shock waves not only through the online industry but also through the loose
collection of groups concerned with the protection of digital rights. While the
strengthening of the EU's right to apply its data protection framework to
non-EU data controllers in certain circumstances is broadly welcomed (within
the EU, if not in the US, where many of the largest, most popular search
engines are based), the importance that the court has afforded to the data
subject's right to privacy, compared to the right of individuals to access to
information, has led to accusations that the decision legitimises individual
reputation management, the falsification of historical records and ultimately,
censorship. (Google Spain SL and Google Inc. v Agencia Española de
Protección de Datos (AEPD) and Mario Costeja González, Case C-131/12, 13 May
2014.)
© 2014 Thomson Reuters. All
rights reserved
