On 13 May 2014, the European Court of Justice (“ECJ”) handed down a remarkable judgement on data protection that has proved controversial and is being widely debated.

Facts

In 1998 a Spanish newspaper published the name of a Spanish national as part of a story about the auction of a property to cover social security debts. When the individual’s name was entered into Google’s search engine, two links to the story appeared, even in 2010. The individual lodged a complaint against Google, in which he requested the removal or redaction of his personal data from these links. Eventually the case was referred to the ECJ for determination.

ECJ judgement

On the facts, the judges found that the interests of the Spanish national resident had priority over the public right to know. This was because the information was sensitive, the announcement was made 16 years ago and there was no public interest argument in having the links displayed in search results. Therefore the ECJ ruled that the links must be removed by Google, even though the information contained in the original news stories was true.

The importance that the ECJ has afforded to the data subject’s right to privacy, compared to the right of individuals to access information, has led to accusations that the decision legitimises individual reputation management, the falsification or historical records and ultimately, censorship.

The key legal points arising from the judgement are:

Application outside the EU

According to the ECJ, the processing of personal data by a search engine comes within the territorial scope of the Directive, if it sets up a branch or subsidiary in an EU member state, which is intended to promote and sell advertising space offered by that engine, and which orientates its activities towards the inhabitants of that member state.

The ECJ dismissed Google’s argument that because its search engine is operated and managed by Google Inc (a company established in the US) the processing of the personal data by that search engine could not be attributed to its subsidiary in Spain, which merely promotes and sells advertising space on behalf of the US parent company.

What does the judgement mean for businesses?

Although the wording of the judgement only refers to search engine operators, the decision has the potential to have a huge impact on the processing of data in general. For example:

House of Lords report

Last month a committee of the House of Lords published a report on the judgement. In particular, the committee examined whether, the law on data protection continues to achieve a fair balance between the competing fundamental rights of privacy, and of freedom to seek and impart accurate information that is lawfully acquired.

The report concluded that the right to be forgotten is “misguided in principle and unworkable in practice” and that neither the Directive on which the judgement is based, nor the ECJ’s interpretation of it “reflects the current state of communications service provision, where global access to detailed personal information has become part of the way of life.”

Update

Following the ruling, Google has launched a service to allow Europeans to ask for personal data to be removed from its search results by completing an online form. Google says it will assess each request and balance “privacy rights of the individual with the public’s right to know and distribute information”.

Up to mid-July, Google is said to have received around 90,000 applications to remove data which applicants considered to be “inadequate, irrelevant or no longer relevant.” The requests have involved criminal trials, embarrassing photographs, bullying and news articles that portray some people in a poor light. Google is believed to have acted on about half of those applications. Applicants can appeal if their request is refused. Disagreements about whether information should be removed or not will be overseen by national data protection agencies.

Google is to hold seven public meetings across Europe before 4 November 2014 in order to debate issues raised by the ruling. The European Commission welcomes the meetings, yet there is some scepticism from privacy experts that the meetings have more to do with PR than open discussion.