Searching against a name – the EU Google judgment

The Court of Justice of the European Union was asked to rule on a series of questions on data protection law referred from the Spanish courts. This was in the context of an individual who had been seeking to require Google to remove links to articles which appeared in the results of a search against his name. The articles, originally published in 1998, were on the website of a Spanish newspaper and referred to proceedings to recover social security debts owed by the individual. The individual claimed that the matter had been resolved a number of years ago and the articles were now irrelevant, so they should no longer appear in search results. It had separately been determined that the publication on the newspaper’s website itself was lawful (and this was not in question in the current proceedings).

The EU Court of Justice gave its judgment on 13 May 2014. It ruled that the production of search results, involving searching for data and displaying links, constitutes the processing of personal data under data protection law. The search engine is a data controller in relation to such processing, as it determines the purposes and means by which the results are found and displayed. The role played by Google’s subsidiary in Spain in these activities was sufficient for EU data protection law to apply.

Following on from this, if certain conditions (specified in data protection legislation) are met, individuals have a right to require search engines to remove from search results links to web pages containing information relating to that person. Those conditions include where there has been a breach of core data protection principles, such that the personal data being inaccurate, irrelevant, excessive or out of date in context. This holds true even if inclusion of the information on the web page to which the link leads is lawful, as the search list enables interconnection of information and greater ease in finding and retrieving details.

The Court considered that, in general, an individual’s fundamental rights to privacy and to the protection of personal data in this context override the economic interest of the search provider, and the rights of the public to the information revealed by the links. Having said that, the Court acknowledged that there is a balance to be met between privacy and freedom of information: weighing up the nature of the information and the sensitivity for the individual’s private life against the interest of the public in knowing the information. The balance may be tipped in favour of inclusion of information for particular reasons, such as the role of the individual in public life.

There has been mixed reaction to the judgment: in some cases welcoming that rights of privacy have been respected; in other cases criticism that it impinges on freedom of expression and freedom of information. It presents practical difficulties for search engines, who may now need to exclude links to web pages, the content of which they do not themselves control. Google has launched an application form for removal requests to assist in managing the many requests it is already receiving.

Conceptually, this ruling may assist individuals to control the spread of information about them which is irrelevant or out of date, which might otherwise show up in online search results and have a negative impact on reputation or privacy. However, individuals will need to take positive action to spot such links and request removal when appropriate. By the time a link is removed, some damage may already have been done, and the right may therefore provide longer-term protection rather than immediate relief.

Further, in each case, there will be questions relating to the applicability of EU law, and variations on interpretation and enforcement within local implementations of the law (the Data Protection Act 1998 within the UK).

The practical application of this judgment is therefore still uncertain. The UK regulator (the Information Commissioner’s Office) has said it will give time for search engines to put procedures in place and will then be focussing on concerns where there is clear evidence of damage and distress to individuals.

The current EU data protection law is due to be replaced within the next couple of years by a new EU Regulation. This was approved in principle by the European Parliament in March 2014, although the text is not yet finalised. The early drafts of the Regulation gave individuals a “right to be forgotten” as well as a “right of erasure” of personal data. These would provide clearer and stronger rights than within current EU law (and national implementing legislation). However, there remains the challenge of applying and enforcing these rights in the online world where the spread of information is relentless.

• “What the EU’s Google ruling means for IT contractors” published by Contractor UK (www.contractoruk.com)