European Union: ECJ Obliges Search Engine Operators To Delete Personal Data And Implement "Right To Be Forgotten"

On 13 May 2014, the Court of Justice of the European Union ("ECJ") handed down a significant judgment regarding the protection of personal data on the Internet. The ECJ gave a preliminary ruling on a question referred to it by the Spanish National High Court. The Spanish court sought to know whether operators of search engines can be required to withdraw specific personal information from their indexes and search results.

The preliminary question had arisen from proceedings brought by Google Spain and Google Inc. against a decision of the Spanish Data Protection Agency ("AEPD"). In its decision, the AEPD had held that operators of search engines, such as Google, can be required to block access to certain data in view of the fundamental right to the protection of personal data of individuals under Data Protection Directive 95/46 (the "Data Protection Directive"). The decision of the AEPD followed a complaint lodged by Mr. Costeja González after he had failed to secure the deletion of two articles published on the website of a Spanish newspaper in 1998 in which reference was made to an auction notice of his repossessed home.

The ECJ first dealt with the question of whether Spanish data protection law must be applied to this case. The processing of data was carried out by Google Search, which is operated by Google Inc., based in the United States. Google Spain is a subsidiary of Google Inc. and has its seat in Spain. The Spanish subsidiary is responsible for promoting and selling online advertising space. When assessing the territorial application of the Data Protection Directive, the ECJ held that the data processing activities and the sale of online advertising space are closely linked with each other. It concluded that the processing of data is executed in the context of the activities of the Spanish subsidiary. Therefore, Spanish and EU data protection law must be applied to the data processing activities of Google under Article 4.1 (a) of the Data Protection Directive.

The ECJ added that operators of search engines qualify as "controllers" that "process" personal data within the meaning of the Data Protection Directive. As a result, the search engine operators are obliged to comply with Article 12(b) or Article 14 (a), first paragraph of the Data Protection Directive. Article 12(b) of the Data Protection Directive gives data subjects the right to request the rectification, the erasure or the blocking of data that do not comply with the Data Protection Directive. In addition, Article 14(a), first paragraph of the Data Protection Directive permits data subjects to object to the processing of their personal data on "compelling legitimate grounds relating to his particular situation".

Accordingly, search engine operators can be obliged to remove links to personal data from the listed search results. In particular, search engine operators may have to remove links to web pages published by third parties and containing information relating to a person from the list of results displayed following a search made on the basis of a person's name. The search engine operator must remove these links provided that the conditions under Article 12(b) or Article 14 (a), first paragraph of the Data Protection Directive are satisfied. The ECJ considered that personal data may become incompatible with the Data Protection Directive when the data appear to be inadequate, irrelevant or no longer relevant, even if the data were initially lawfully published on a website of a third party. If this is the case, a person should have the right to request the erasure of the data and of the links to the data from the list of results of the search engine.

The ECJ further noted that this principle might interfere with the right of the general public to have access to specific information. If this is the case, the right to privacy and to the protection of personal data must be balanced, on a case-by-case basis, against the interests of the Internet user and the general public.

Google has already taken steps to bring its search engine in line with the ECJ judgment. It made available an online form which data subjects can fill out to block websites containing personal data that are "inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed". Google will verify the request and assess whether there is no overriding public interest in the information. The online form can be found here.

The Belgian Privacy Commission (Commissie voor de bescherming van de persoonlijke levenssfeer/Commission de la protection de la vie privée) published list of frequently asked questions on the right to be forgotten. The FAQ explains the scope of the right and gives guidance on how data subjects can exercise their right. The FAQ is available in Dutch and French.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.