The European Court of Justice (ECJ) decision in the Google case established the principle that individuals have the right in certain circumstances to insist that Internet search engines remove their data from search results. Effectively, this provides for a limited “right to be forgotten” and has significant implications for Internet search engines.
The Google case originated in Spain and concerned a Spanish lawyer who had sought the removal from the results of Internet searches of the details of a public auction of his repossessed home. The auction occurred in 1998 and the details were published by a daily Spanish newspaper with national circulation. The Spanish Data Protection Commissioner (the AEPD) held that the newspaper itself was not obliged to remove the publication from its archives. The AEPD did, however, find that Google was obliged to remove the information concerned from its search results. Google appealed the decision of the AEPD to the Spanish High Court, which then referred certain questions to the ECJ for consideration.
The ECJ held that Google could be regarded as a data controller within the meaning of the European Data Protection Directive. The court held that by continually and systematically exploring the Internet, collecting data which it then subsequently recorded, organised and made available to users, Google could be considered to be operating as a data controller, even though none of the data which was made available through the search engine results was published by Google itself, nor could Google alter the data in any way.
Although the ECJ recognised the lack of control which Google had over the data it published as search results, Google was still found to have obligations to data subjects in relation to the publication of search results.
By deciding that Google was acting as a data controller in respect of the operation of its search engine, the Court was effectively deciding that Google was subject to the full gamut of data protection obligations.
There is no explicit “right to be forgotten” under Irish and European data protection law. However, if data has been held for longer than necessary, or is inaccurate and out of date or is no longer relevant, or the processing is regarded as excessive or disproportionate, then a data controller may be required to cease holding and processing such data. For Internet search engines, that would mean ensuring that a search using a person’s name no longer produces results relating to that person which fall foul of any of these data protection obligations.
The implications of these obligations are serious as if search engines do not comply with obligations concerning the processing of personal data, their processing of such data will be unlawful.
The judgment is likely to mean that Internet search engines will be forced to deal with multiple requests for data deletion. For example, within three weeks of the Judgment being handed down, Google had already reportedly received forty one thousand requests to remove personal data.
The decision has been the subject of adverse comment by some commentators on the basis that it may curtail freedom of expression as well as raising censorship issues. The Judgment of the Court may, for example, enable individuals to prevent facts about them from appearing on the Internet based on arguments that whilst the information may be true, it is no longer relevant e.g. because of the passage of time.
In considering data deletion requests, Internet search engines are placed in the invidious position of needing to determine whether the data revealed by their search results fall foul of any data protection obligations, including accuracy, relevance, proportionality and retention for no longer than necessary. As Internet search engines will not have collected and published the information in the first place (the information was originally published on the Internet by third parties such as media organisations), it is unclear how Internet search engines will make this determination.
The judgment could also lead to the curious result that a newspaper publishing material on the Internet will benefit from the journalistic public interest exemption which applies under data protection law (e.g. section 23 of the Irish Data Protection Acts), whilst the search engine which retrieves such information on foot of an Internet search does not have any equivalent exemption.