Maurits van Buren

maurits (2)

Explanation of European Court's decision against Google

19-10-2014

On May 13, 2014, the European Court of Justice took an important decision on the territorial reach of European privacy laws and on the “right to be forgotten” of data subjects.
1.   The facts
The Spanish newspaper La Vanguardia had published two articles (on January 19th and March 9th, 1998) on the internet in which it had mentioned the name of a Spanish citizen, Mr. Costeja Gonzalez, in relation to a real-estate auction connected with attachment proceedings for the recovery of social security debts. Both articles would appear when “googling” Mr. Gonzalez’ name – reason for Mr. Gonzalez to request both the newspaper and Google Spain and Google, Inc. to remove or conceal his personal data in such a way that these articles would not show up when entering his name into Google’s search engine. When both La Vanguardia and Google refused to comply with his request, Mr. Gonzalez filed a complaint with the Spanish data protection authority (the AEPD). The AEPD rejected the claim against the newspaper but upheld the complaint against Google Spain and Google, Inc., and ordered them to remove Mr. Gonzalez’ personal data relating to the two mentioned articles. Google consequently initiated proceedings against the AEPD before the Spanish court, who in turn requested the European Court of Justice to give a preliminary ruling on several questions.
2.  The dispute
The issues the European Court of Justice had to answer were, in short, as follows:
  • Do the activities of a search engine operator qualify as “processing of personal data”, and does the operator of a search engine (i.e. Google Search) qualify as a “controller” in the meaning of the European Data Protection Directive (DPD)?
  • Does Google Spain qualify as an “establishment” of Google, Inc., in the meaning of the DPD? Consequently, does Google, Inc. – a corporation with its seat in the U.S. – fall under the scope of the DPD?
  • Does a data subject have the right to request the operator of a search engine to remove certain search results that show up when entering a search request, even when the information on which the search results are based is correct?
3.   The European Court of Justice’s decision
First of all, the Court held the activities of a search engine operator qualify as processing of personal data, and that the operator of a search engine qualifies as a controller, regardless of the fact that:
  • The operator of the search engine also carries out the same operations in respect of other types of information and does not distinguish between the latter and the personal data;
  • The personal data in question have already been published on the internet and are not altered by the search engine;
  • Publishers of websites have the option of indicating to operators of search engines that they wish specific information published on their site to be wholly or partially excluded from the search engines’ automatic indexes.

The Court emphasizes the fact that search engines offer the possibility of quickly and cheaply generating a list of information relating to a specific person, which can in turn be used to make a detailed profile of that person.

Furthermore, the Court held that Google Spain qualifies as an “establishment” of Google, Inc. Google had basically argued that its activities in the U.S. (offering “search engine”-services) had to be distinguished from its activities in Spain (offering advertisement space on its website to, mainly, Spanish companies and inhabitants). The Court, however, is of the opinion that these two activities are part of the same business model and cannot be separated from each other.

As to the third issue, the Court held that a data subject has, under circumstances, a right to request rectification, erasure or blocking of certain personal data, and the right to object to the processing of personal data by a search engine operator. Both rights already follow from the DPD (art. 12(b) and 14(a) DPD) and can be invoked when the processing of personal data does not comply with data protection laws, for example if the processing is not “legitimate” (art. 7 DPD). Whether the processing of personal data by a search engine is legitimate should be determined by applying a balancing test, in which the interests of the search engine operator, the interests of the data subject, and the interests of the internet users are balanced against each other. Relevant factors are the nature of the information in question, its sensitivity for the data subject’s private life, the interest of the public in having that information, and the role played by the data subject in public life.

The fact that the original post (in this case the two articles of La Vanguardia) itself may not be in violation of privacy laws does not necessarily mean that the use of this article by the search engine operator (to create a list of search results) is lawful. The Court states that search engines cannot invoke the exemption of privacy rules for processing personal data “solely for journalistic purposes” (art. 9 DPD). So even if the original publication is lawful the data subject can still request the search engine operator to remove certain search results if he/she can show that the personal data is inadequate, irrelevant or no longer relevant, or excessive in relation to the interest of the search engine operator. Both the time-element and the question as to whether the public is interested in this information, play a significant role in this aspect.

4.   Implications

The Court’s decision has been criticized by some for limiting the freedom of speech and of free access to information. It should be noted, however, that the “right to be forgotten” – which can be derived from the current DPD – only extends to search results that show up when typing the name of a specific person. Also, the Court has clearly made this right subject to certain conditions, and the burden of proof and risks (and costs) of litigation still lie with the data subject.

The finding of the Court that Google, Inc., should also comply with EU privacy regulations is interesting as well, especially given the fact that Google’s Spanish subsidiary was allegedly not involved in actually generating the search lists (they only focused on selling advertisements). U.S. companies doing business in the EU should be aware of this. Having a subsidiary in the EU does not necessarily rule out the obligation of the U.S. parent company to be compliant.

REAGEER OP MIJN BLOG