The right to be forgotten by internet search engines: real right or real controversy?

July 2014 | EXPERT BRIEFING | DATA PRIVACY

financierworldwide.com

Since Google appeared in our everyday lives, it has undeniably led to a paradigm shift in the way we view the great diversity of internet service providers, as well as the way we apply existing laws to the swift-changing global reality of new technologies. Google has undoubtedly given the shifting sands of law the most interesting internet-related judgments.

On 13 May 2014, the Court of Justice of the European Union delivered one of these seminal judgments in what is known as the ‘right to be forgotten case’ (case C-131-12). This judgment, which interprets Directive 95/46/CE of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, contains a number of statements that mark a turning point in the processing of EU citizens’ personal data on the internet.

Firstly, concerning the Directive’s territorial scope, the Court observes that Google Spain, a subsidiary of Google Inc. in Spanish territory, is an ‘establishment’ within the meaning of the Directive because it is intended to promote and sell, in Spain, advertising space offered by the search engine which serves to make the service offered by the engine profitable. The Court thereby considerably broadens the Directive’s criteria, such that non-EU companies with a simple commercial presence in Europe will be affected by European data protection legislation, even if they do not technically process data in European territory. This decision is generating a great deal of controversy and has immense future implications for the business of certain internet operators; as such it deserves a commentary of much greater depth than space allows us here.

The second contention of this judgment is also the subject of controversy. The Court holds that the activity of internet search engines, which consists of locating information published or included on the net by third parties, indexing it automatically, storing it temporarily and finally making it available to internet users according to a particular order of preference, can be classified as ‘personal data processing’ when such information contains personal data. As a result, the search engine must be regarded as ‘controller’ in respect of such processing.

The above conclusion of the Court gives us two matters on which to reflect. On the one hand, we have the activity of internet search engines consisting in automatically locating and indexing information, which technically prevents them from determining the purpose, content and use to be made of such information. In light of this lack of decision-making power, we should ask ourselves whether such information truly falls under the responsibility of internet search engines. The Court’s answer to this question is yes; an affirmative answer that means a substantial change in the concept of data controller as defined up to now.

Finally, and as a result of the above, the Court remarks that as the controller of personal data processed on its search engine, Google must guarantee the rights provided for in Article 12(b) (the right to rectification, erasure or blocking of data where the processing does not comply with the Directive) and Article 14(a) (the right to object to the processing of personal data on compelling legitimate grounds).

The means by which Google is to guarantee these rights are structured in the ‘right to be forgotten’, which contains a number of distinctive characteristics derived from the particular nature of search engines. This right allows individuals to ask a search engine to remove, from the list of search results, links that include personal data which are unfavourable to them. In every single case of removal of links, the search engine must have regard to the following circumstances in deciding whether to remove them: (i) the nature and sensitivity of the information; (ii) the age of the information; (iii) the interest of the general public in having access to the information; and (iv) the role played by the data subject in public life.

The effect of this ruling is colossal, not only because of the huge controversy it has stirred by regarding a search engine as a data controller, but also because a private company has been tasked with making the decision of whether data should be made public (i.e., whether internet users’ ‘right to know’ overrides individuals’ ‘right to be forgotten’).

Google has already launched a form for users to exercise this ‘right to be forgotten’ and even if we question the Court’s criteria, we cannot deny that private citizens are interested in being forgotten on the internet. In one week, Google has received more than 50,000 requests to be forgotten.

Isabela Crespo and Iban Díez lawyers at Gómez-Acebo & Pombo. Ms Crespo can be contacted on +34 91 582 91 00 or by email: icrespo@gomezacebo-pombo.com. Mr Díez can be contacted on (34) 91 582 91 00 or by email: idiez@gomezacebo-pombo.com.

Isabela Crespo and Iban Díez

Gómez-Acebo & Pombo