In its judgment published on 13 May in the case C-131/12 Google Spain v AEPD and Mario Costeja Gonzalez, the Court of Justice of the European Union (CJEU), Grand Chamber, recognized a “right to be forgotten” with regard to Internet search engine results. Unfortunately, the judgment has important international implications that the Court did not sufficiently consider. In this post, I will put aside the issues of EU data protection law that the judgment raises, and focus instead on its implications for the rights of individuals to use the Internet as a global communications medium. It is important to note that application of the judgment extends beyond particular search engine providers to include any “provider of content which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference” (paragraph 21), which could include Internet archives, social media, news crawler services, and many other types of online services.
The plaintiff in the case complained to the Spanish Data Protection Agency (DPA) against a Spanish newspaper and Google, stating that a Google search brought up a link to the newspaper containing irrelevant information about him, and requesting that the newspaper be required to remove or alter the pages and that Google be required to remove the data from the search results. The DPA found against Google, which then appealed to the Spanish Audiencia Nacional (National High Court). The Spanish court referred the case to the CJEU. On June 25, 2013, Advocate-General Jääskinen recommended that the Court find that it had jurisdiction over Google; that in its role as a search engine provider, Google was a data processor rather than a controller; and that the EU Data Protection Directive 95/46 does not contain a right to be forgotten that could entitle the plaintiff to have his data deleted from search engine results.
In its judgment, the Court differed in several important points from the Advocate-General’s opinion, and reached the following conclusions:
–Google’s branches in the EU are subject to the national data protection law of the EU member states where they are located, since they are “inextricably linked” to the activities of the Google headquarters in the US by virtue of Google Spain selling advertising space on the search engine provided by Google Inc, even if the actual processing is carried out in the US (paragraphs 42-60).
–Search engines are “data controllers” and as such are independently responsible for the personal data they retrieve, store, and display from websites (paragraphs 21-41).
–Under the Directive, there exists a limited right to have search engines delete material from search results (i.e., a “right to be forgotten”), regardless of whether the material indexed was posted legally or whether it is accurate (paragraphs 62-99). Read the rest of this entry…