On 13 May 2014, the European Court of Justice (“ECJ”) handed down a remarkable judgement on data protection that has proved controversial and is being widely debated.

Facts

In 1998 a Spanish newspaper published the name of a Spanish national as part of a story about the auction of a property to cover social security debts. When the individual’s name was entered into Google’s search engine, two links to the story appeared, even in 2010. The individual lodged a complaint against Google, in which he requested the removal or redaction of his personal data from these links. Eventually the case was referred to the ECJ for determination.

ECJ judgement

On the facts, the judges found that the interests of the Spanish national resident had priority over the public right to know. This was because the information was sensitive, the announcement was made 16 years ago and there was no public interest argument in having the links displayed in search results. Therefore the ECJ ruled that the links must be removed by Google, even though the information contained in the original news stories was true.

The importance that the ECJ has afforded to the data subject’s right to privacy, compared to the right of individuals to access information, has led to accusations that the decision legitimises individual reputation management, the falsification or historical records and ultimately, censorship.

The key legal points arising from the judgement are:

• In operating their search engine service, Google is processing personal data and is acting as a data controller under the terms of the European Data Protection Directive (“Directive”).
• Search providers can be required to remove links to web pages that contain personal information published by third parties, from the list of results displayed, following a search on the person’s name, where the processing of the personal data does not comply with the relevant provisions of the Directive.
• A search provider can be required to consider removal even if the information is true and where the original publication was lawful.
• The ECJ highlighted the significance of interference to personal data rights that can be caused by the availability of the links associated with a name.
• The ECJ observed that the data subject’s rights also override, as a general rule, the legitimate interest of internet users to access information.
• However, a balance will need to be struck between these interests. It will depend, in specific cases, on the nature of the information in question and its sensitivity for the individual’s private life. It will also depend on the interest in communicating the information to the public, an interest which may vary, according to the role played by the data subject in public life.

Application outside the EU

According to the ECJ, the processing of personal data by a search engine comes within the territorial scope of the Directive, if it sets up a branch or subsidiary in an EU member state, which is intended to promote and sell advertising space offered by that engine, and which orientates its activities towards the inhabitants of that member state.

The ECJ dismissed Google’s argument that because its search engine is operated and managed by Google Inc (a company established in the US) the processing of the personal data by that search engine could not be attributed to its subsidiary in Spain, which merely promotes and sells advertising space on behalf of the US parent company.

What does the judgement mean for businesses?

Although the wording of the judgement only refers to search engine operators, the decision has the potential to have a huge impact on the processing of data in general. For example:

• Operators of services that provide users with a collection of information about a particular data subject that can be found by entering the name of the data subject may generally be under an obligation to erase personal data upon request by the data subject. In such cases, the operator of the service would (like a search engine operator) have to decide on a case by case basis whether the legitimate interests of the data subject or the interests of the general public prevail.
• EU businesses might in the future need to look at more than their local data privacy regime. If an entity is established in an EU member state and has a subsidiary is established in another member state (which engages in advertising activities directed at the inhabitants of that member state) the entity may be obliged to comply with both national laws. The picture is further complicated if you have subsidiaries in several EU member states.
• An EU member state’s data protection laws will in the future likely be held applicable, if any entity established in a non-EU country (1) processes data and (2) has a subsidiary established in any EU member state, that engages in substantial advertising or promotional activities which are directed to inhabitants of that EU member state. This will especially affect all social network operators and website operators selling adverting space through EU subsidiaries. But due to the general wording and lack of depth in the ECJ’s assessment, potentially any foreign business can be affected if a subsidiary based in the EU “serves to make the service offered by that provider profitable” – a relatively easy requirement to fulfil.

House of Lords report

Last month a committee of the House of Lords published a report on the judgement. In particular, the committee examined whether, the law on data protection continues to achieve a fair balance between the competing fundamental rights of privacy, and of freedom to seek and impart accurate information that is lawfully acquired.

The report concluded that the right to be forgotten is “misguided in principle and unworkable in practice” and that neither the Directive on which the judgement is based, nor the ECJ’s interpretation of it “reflects the current state of communications service provision, where global access to detailed personal information has become part of the way of life.”

Update

Following the ruling, Google has launched a service to allow Europeans to ask for personal data to be removed from its search results by completing an online form. Google says it will assess each request and balance “privacy rights of the individual with the public’s right to know and distribute information”.

Up to mid-July, Google is said to have received around 90,000 applications to remove data which applicants considered to be “inadequate, irrelevant or no longer relevant.” The requests have involved criminal trials, embarrassing photographs, bullying and news articles that portray some people in a poor light. Google is believed to have acted on about half of those applications. Applicants can appeal if their request is refused. Disagreements about whether information should be removed or not will be overseen by national data protection agencies.

Google is to hold seven public meetings across Europe before 4 November 2014 in order to debate issues raised by the ruling. The European Commission welcomes the meetings, yet there is some scepticism from privacy experts that the meetings have more to do with PR than open discussion.