The Court of Justice of the European Union (“CJEU”) made a historic ruling in the case of Google v Spain [Case C‑131/12]. The CJEU ruled that Googleis responsible for the processing that it carries out of personal data which appear on web pages published by third parties.
The decision is something of a surprise given that it goes against the Advocate General’s Opinion delivered last year, and indeed is quite a bold statement by the CJEU on what it sees as the future of data protection in the internet age and the legal responsibilities of search engines.
The case arose after a complaint that was brought against Google by a Spanish individual, Mario Costeja González, to the Spanish Data Protection Authority (AEPD). Mr González had been the subject of an auction notice for unpaid debts that was published in a widely-read newspaper in Spain around a decade ago. Despite the time that had elapsed since this initial publication, this was still featured prominently in a Google search for Mr González’s name. Mr González argued that this was in breach of the EU Data Protection Directive (the “DPD”) as the data was not current and that in such circumstances, there should essentially be a “right to be forgotten.”
The AEPD agreed, and Google subsequently appealed to the Spanish National High Court which in turn referred questions on the meaning of the DPD to the CJEU.
Despite the Opinion of Advocate General Jääskinen, who considered last year that search engine service providers should not be considered responsible for third-party content on the basis of the DPD for personal data appearing on web pages they process, the Grand Chamber of the ECJ in the judgement published today has concluded as follows:
- The activities carried out by Google, namely ‘finding information published, indexing it automatically, storing it temporarily and making it available to the public’, must be classified as ‘processing of personal data’ for DPD purposes. Furthermore, the operator of the search engine must be regarded as the ‘data controller’ regardless of the fact that they have no control over the underlying data itself.
- Google falls within the territorial scope of the DPD as its Spanish subsidiary is intended to promote and sell advertising space directed at the citizens of that Member State, which is sufficient to be considered ‘established’ in that Member State.
- Google must remove links to third-party websites displayed from a search of an individual, where those websites contain personal data relating to the individuals concerned. This is subject to certain exceptions, such as public figures, and to achieving a proper balance between the data subject’s fundamental rights and the right to information.
This decision has far-reaching consequences for Google in Europe. The bar to when there would be a public interest in search engines processing data relating to individuals in the form of search returns seems very high and where the data relates to an individual who is not a public figure, it is rather doubtful that this could ever be permitted.
There is no clear view how Google will respond to the judgment, but there must be a significant possibility that it will have to establish an elaborate administrative system to deal with individuals who complain about it using their data and sophisticated technical means to ensure that this is blocked.
It is also unclear how the ruling will affect the ongoing negotiations of the General Data Protection Regulation. Early drafts of the Regulation included a broad “right to be forgotten” though the latest draft has watered this down somewhat. Commissioner Viviane Reding who is championing the draft Regulation welcomed today’s ruling saying it was a “strong tailwind” to the proposed data protection reforms in Europe. The reality is that the Regulation still faces a rocky road before it is passed and some commentators are already questioning why we need new rules for a right to be forgotten at all given today’s ruling.
What is clearer is that the ruling is a sign of the CJEU’s reluctance to allow non-EU-based multinationals to evade European laws where they are clearly otherwise established here.