The recent AG’s Opinion in the Google case referred by the Spanish courts raises three issues of wide interest: the territorial scope of EU data protection law, liability of search engines and the Right To Be Forgotten. The ECJ will have the final say in the matter later this year. In the meantime, Datonomy flags the key issues – which are bound to influence debate on the new General Data Protection Regulation.
Datonomy’s correspondents in Spain have been following this case right from the start: back in March 2011 we reported that the Spanish Audiencia Nacional was considering requesting a preliminary ruling from the Court of Justice of the European Union (ECJ) on several matters regarding the position of search engines in relation to the European Data Protection Directive. That referral was made in March 2012, and the Advocate General in the case delivered his Opinion at the end of June. As we’re sure Datonomy readers are aware, an AG’s opinion provides guidance for the judges of the ECJ on interpreting EU legislation, but it does not bind their final decision (although in practice AG’s opinions tend to be followed).
Advocate General’s (AG) Opinion in Case C-131/12 stated that search engine service providers are not responsible for personal data appearing on web pages they process. In the opinion of AG Jääskinen, current data protection law (Directive 95/45/EC) does not establish a general “right to be forgotten” in the EU. Thus, individuals cannot invoke this right against search engine providers.
The Spanish Audiencia Nacional requested a preliminary ruling from the Court of Justice of the European Union (ECJ) on several matters regarding the position of search engines in relation to the European Data Protection Directive (mentioned above). The headline conclusions in the Opinion are as follows:
1. Territorial scope of the application of national data protection legislation. In the view of the AG Jääskinen, EU data protection legislation is applicable also to those search engines set up in a Member State when, for the purpose of promoting and selling advertising space on the search engine, an office or subsidiary which orientates its activity towards the inhabitants of that State.
2. Search engine providers cannot be considered “data controllers” in relation to the information on source web pages hosted on third party websites. In the opinion of the AG, the provision of an information location tool does not imply any control over the content included on third party web pages.
3. Directive 95/45/EC does not establish a general right to be forgotten. Under EU Directive, individuals have the right to access, rectify, erasure and object at any time to the processing of their personal data under some legal grounds. However, there is no right that allows citizens to block the dissemination of their personal data though the tools provided by search engine providers (with the exception of those contents declared illegal according to the national legislation e.g.: intellectual property infringements). Otherwise, other fundamental rights such as the freedom of expression and information would be seriously compromised.
The AG’s conclusion is not binding on the Court of Justice, and now we should wait for the final ruling of the ECJ, will be published by the end of this year. We need to emphasise that ECJ ruling will be crucial, since the new Data Protection Regulation, which is expected to be passed before the end of the EP legislature (i.e. before May 2014), proclaim this controversial new right. It is far from certain that the Right To Be Forgotten proposed in the first draft of the Regulation will make it into law be interesting to see how the Google ruling influences that debate.