On 13 May the CJEU accepted a partial ‘right to be forgotten’ in the Case of Google Spain, Google v. AEPD. What is remarkable about this ruling, is the extent of privacy protection adopted.
The Facts of the Case
Some 16 years ago Mario Costeja González was going through a rough patch in his life and was unable to pay his social security debts. As a result, his house was sold via public auction. This auction was announced in a newspaper. At a later date an electronic version of the newspaper was made available online by its publisher. Google indexed the link and if you ‘googled’ the name of Mr. González a link to the newspaper article showed up in the search results. Even well over a decade after the forced auction of the property it still shows up in the search results on his name. Mr. González wanted the links to the newspaper article removed from Google’s search results. Is Google obligated to comply with his request under the Data Protection Directive? That was the question the CJEU had to answer.
Questions to the CJEU (paraphrased)
The most important questions of all of these, is the latter. Does there exist something as a ‘right to be forgotten’ and more importantly, what is required before someone may make use of this ‘right’?
Does the Data Protection Directive apply to Google (Spain) in this case?
As regards the first two questions, the CJEU was quick to assume that Google Spain, as a commercial agent of Google Inc. (in California), was processing personal data in the context of the activities of the controller (Google Inc.) on the territory of Spain. Therefore the Directive, and its protection mechanism, was fully applicable. Google was also ‘processing personal data’ as the information which it collects via ‘scraping’ of websites, was subsequently retrieved, recorded and organised within the framework of its indexing programmes, and made available to its users in the form of lists of search results. This is processing in the means of the Directive. (See para. 28 et seq.) Furthermore, Google was ‘controller’ of these data as “[i]t is the search engine operator which determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within the framework of that activity and which must, consequently, be regarded as the ‘controller’ in respect of that processing pursuant to Article 2(d).” (Para. 33).
Independent assessment of liability of Google
This means that, independently of the information and the liability of the provider (in casu the (online)publisher of the newspaper), Google has its own duty under the Data Protection Directive as a controller of processing personal data. Therefore, the request of Mr. González should be assessed independently of his options against the publisher. (Para. 39-40).
The Charter, the Directive and the search engine operator
Interesting to note is the relationship between the Data Protection Directive, the Charter of Fundamental Rights of the European Union and the existence of search engines. This case required interpretation of the Directive’s provisions in light of the fundamental rights and freedoms laid down by the Charter. Interesting is that the Court stated that the requirements that flow from these Charter rights are implemented in several articles in the Directive. This is rather remarkable considering the fact that the Charter did not exist at the time of the enactment of the Directive. Furthermore, one can ask questions about the Directive in light of the rapid development of the internet. The Directive was drafted in 1990’s and enacted in ’95, when Google founders Larry Page and Sergey Brin had just met, but had not created their famous search engine yet. The Court therefore interprets the provisions of the Directive in a rather wide manner in order to apply old rules to new situations, so that the protection envisaged at the time of enactment has not atrophied due to the technical developments. This extensive interpretation of rules, required due to the age of the Directive shows the reason why a reform of the Data Protection Directive regime is currently being discussed and is very welcome.
The provisions of the Directive nevertheless need to be explained in light of the fundamental freedoms as laid down in the Charter and that has to be done for this particular case as well.
Balancing of fundamental freedoms and the ruling
The Court stated that:
“However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.” (Para. 81)
More specifically, the incompatibility of processing personal data with the fundamental rights of the data subject “may result not only from the fact that such data are inaccurate but, in particular, also from the fact that they are inadequate, irrelevant or excessive in relation to the purposes of the processing, that they are not kept up to date, or that they are kept for longer than is necessary unless they are required to be kept for historical, statistical or scientific purposes.” (para 92.)
It is astounding that the Court does not even mention Articles 11 and 16 of the Charter in this respect. Article 11 of the Charter affords the right to freedom of expression, which is applicable to the freedom of internet users to receive information and the publisher’s right to make information available and to disseminate it. Article 16 of the Charter protects the freedom to conduct a business. Both of which would favour Google’s point of view in this case. The lack of explicitly mentioning these articles appears odd. AG Jääskinen in his opinion (ECLI:EU:C:2013:424) in this case, which was very different from the Court’s ruling, had no qualms using nor interpreting and applying these articles explicitly. The Court however briefly touched upon something akin to Article 16 when discussing Google’s economic interest in exploiting the information. Freedom of expression is only awarded mild attention in the Court’s ruling, and is not strongly used as a counterbalance to the privacy rights of the individual.
For Mr. Gonzáles the balance tipped in his favour. The information regarding the auction of his house due to social security debts, according to the Court, appears to be “inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing at issue carried out by the operator of the search engine” and therefore the links have to be deleted. (para 94).
The implications: for Google and search engine operators alike
So, when confronted with a request to remove certain links relating to a search based on a person’s name, what does Google have to do?
The Court does not give much guidance other than that a search engine should examine the request. “in particular [it should, AB] be examined whether the data subject has a right that the information relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name. In this connection, it must be pointed out that it is not necessary in order to find such a right that the inclusion of the information in question in the list of results causes prejudice to the data subject.” (para. 96)
The interest of the person requesting removal should however have to include also “a preponderant interest of the public in having, in the context of such a search, access to that information” (para. 98)
Thus, the tool that Google is currently working on to comply with this case law, will have to assess not only the fundamental rights of the person requesting removal, but also the interest of the public in access to the information. If the application to Google is granted, the links will be removed. If denied, the ‘data subject’ could bring a claim to “the supervisory authority or the judicial authority so that it carries out the necessary checks and orders the controller to take specific measures accordingly“. (para. 77). There are already signs that the Data Protection Agencies have had to deal with an increase in requests concerning links on Google than prior to this judgment.
The implications: for private persons
People will now have the option to have certain data be removed from search engine result lists. The information may very well still be available online, as the publisher of the information may not (necessarily) have to remove the information itself because it was published, for instance, for journalistic purposes or the purpose of artistic or literary expression (Article 9 Data Protection Directive). However, the ease by which the information can be found is significantly reduced.
Some remaining questions about clarity
The judgment does not answer all questions, and raises even more:
By very widely interpreting the provisions of the Data Protection Directive, the CJEU has attempted to apply a rather archaïc Directive to a modern situation. The result is an out of proportion win for privacy and a blow to freedom of expression.
NB. As a property lawyer I have to state one last thing: An easier solution for everyone, why not have a look at the requirement to mention the reason for the public auction? Property law might require publicity of certain information such as the announcing of an auction in the newspaper. Yet, one can scrutinise the need for publicity of the reason for the auction as well, i.e. Social security debts. I doubt it is really necessary. Perhaps here, a balance of publicity v. privacy should have been made much earlier, at the property law level.
NB: Stefan Kulk wrote a more comprehensive analysis on this blog.