The controversial judgment of the Court of Justice of the European Union (CJEU) in the Google Spain case, has proved to be one of the biggest talking points of 2014 in the privacy sector and beyond.
The CJEU ruled on questions referred by a Spanish court relating to interpretation of the Data Protection Directive and its application to search engine activities. The CJEU found that search engines are data controllers in respect of their search results; that European data protection law applies to their processing of the data of EU citizens, even where they process the relevant data outside the EU; and that a 'right to be forgotten' online applies to outdated and irrelevant data in search results unless there is a public interest in the data remaining available and even where the search results link to lawfully published content.
The judgment is not appealable so, for the moment, the position is that:
- search engines and, by implication, non-EU companies with sales and marketing subsidiaries in the EU, are subject to European data protection law with respect to data processed relating to EU citizens wherever that data is processed;
- search engines are data controllers of the personal data which appears in their results and cannot rely on the exception of legitimate interests to justify that processing where it conflicts with the fundamental rights of an individual unless the rights of the individual are trumped by the public interest in having access to the relevant information; and
- individuals can (subject to limited exceptions) request that search engines disable links to third party pages which come up against searches using their name, whether or not the information relating to them is prejudicial and even where it is accurate and lawfully published, if they can validly claim that data is no longer being processed lawfully. The normal grounds which the data subject would be expected to use to support his claim would be that the data is inadequate, no longer relevant or excessive in relation to the original purpose for which it was processed and in the light of the time which has elapsed since that processing began. The individual's rights to privacy and data protection will usually take precedence over the rights of internet users and search engines to access and display information relating to them in search results unless there is a public interest in the information being available.
This potentially confirms an existing 'right to be forgotten' online. In other words, the 'right to be forgotten', which has been the subject of intense political debate in connection with the draft EC data protection Regulation for the past three years or more, has, unbeknown to us all, been in existence since the passing of the 1995 Directive.
This judgment came as a shock to many in the internet industry, particularly to those outside Europe and not least because it is in direct conflict with the Attorney General's Opinion which preceded the judgment in a number of areas.
The response of Google and other search engines
In the days following the judgment, Google reportedly received thousands of applications to have search results removed.
Google was quick to respond and put up a 'take down' request form while explaining that it would take some time to consider how to put the ruling into effect although it soon began taking down certain search results. Other search engines like Microsoft and Yahoo! followed suit. Google was subsequently criticised for its practice of informing publishers when it takes down a link following a request under the Google Spain ruling. The Irish Data Protection Commissioner said that this practice often served to highlight the very story which was being objected to and bring it back to prominence, a view which was shared by the UK's Information Commissioner (ICO). Media organisations including the BBC and the Daily Telegraph are keeping maintained details of links removed and, in some cases, summaries of the relevant content which can be easily accessed online, bearing out the Regulators' views.
Google has announced a panel of experts to help develop a coherent way of dealing with take down requests and has been holding a series of debates around Europe with members of the panel and the public.
In October, Google published data on requests received to have search results removed following the Google Spain ruling. Since May, it has received 18,304 requests from the UK to remove a total of 63,616 URLS of which 35.4% were removed. Worldwide, Google has evaluated 498,737 URLs in total and removed 41.8% of them. Examples were given as to the kind of requests received and the decisions reached in response.
The ICO's view
The ICO published initial thoughts on the judgment in a blog and highlighted the following as the main points of the judgment:
- search engines may have to remove some search results – the ICO recognised that if the search engine fails to respond to a removal request, the matter can be passed to the ICO. Given that companies will need time to work out how to respond to the impact of the judgment, the ICO says that it will not be ruling on any complaints "until the search providers have had a reasonable time to put their systems in place and start considering requests. After that, we'll be focusing on concerns linked to clear evidence of damage and distress to individuals";
- the current Data Protection Directive is still relevant – the ICO commented that this judgment shows that the existing data protection framework can "still be relevant when discussing modern data protection issues" and endorses the judgment's view that search engines are data controllers;
- a 'right to be forgotten' will still be difficult in practice - the ICO warned against reading too much into the judgment and stressed there is no absolute right to be forgotten. It underlined the fact that the original publication and the search engines are considered separately and that the exemption for journalism can apply to media organisations, bloggers and other publishers of information as well as highlighting that each case should be considered individually. The ICO took the opportunity to stress again that it has doubts about the workability of a right to be forgotten; and
- the judgment signals the beginning of a changed approach – the ICO recognised that while the judgment is primarily a matter for search engines, national data protection regulators will also need to interpret and apply the judgment and will need to produce guidance. The ICO said that there was space in the judgment "to balance the right to privacy against the public's right to know, recognising the role search engines play in facilitating access to information in today's society".
The Article 29 Working Party's views
The Article 29 Working Party, made up of European data protection regulators, has been hearing from search engines and other stakeholders with a view to consolidating its opinion on how the Google Spain ruling should be implemented and putting out advice to search engines and individuals. In September, the WP met to analyse how search engines were complying with the judgment and announced its intention to create an electronic case handling dashboard and appoint a team of specialists to help manage complaints escalated to regulators.
The House of Lords Committee report
In the meantime, the ruling was heavily criticised in a House of Lords Committee report on the grounds that neither it nor the 1995 Data Protection Directive are fit for purpose in today's world. The Committee's view was that it is impossible to fully implement a 'right to be forgotten', that the ruling is unfair, particularly to smaller search engines and that search engines in general should not be put in the position of deciding whether or not to delete information "based on vague, ambiguous and unhelpful criteria". The Committee urged the government to continue to lobby for the new EC data protection Regulation to omit any mention of a right to be forgotten and make the Google Spain ruling redundant by ensuring the definition of "data controller" cannot be applied to search engines.
Both the EU Justice Commissioner and the ICO have publicly disagreed with the House of Lords Committee. The then EU Commissioner for Justice said: "the recent European Court of Justice ruling does not elevate the right to be forgotten to a 'super right' trumping other fundamental rights, such as the freedom of expression or the freedom of the media. Finding the right balance is exactly the spirit of the ongoing EU data protection reforms". In an update of its response to the judgment, the ICO expressed disappointment at the House of Lords Committee report, arguing that the judgment was workable and pointing to actions taken by search engines as a result of the judgment as proof that it could work. The ICO also stressed the need to judge each complaint to Google on a case by case basis at all stages of the process, including in terms of informing publishers when links have been taken down. It also re-iterated that it would seek to balance rights of individuals with the right to access information in dealing with any appeals.
We can expect more details of how the ruling is to be implemented both by leading search engines and regulators over the next year. Those in Europe who were delighted by the ruling are likely to rely on the judgment to show the workability of the controversial 'right to be forgotten' in the draft EU data protection Regulation. Those Member States which have been more critical of the ruling, like the UK, are likely to continue to lobby for the Regulation to overturn its impact. To the Americans, the Google Spain judgment is anathema, going against the inviolable constitutional right to freedom of expression. No search results are being removed from the non-European versions of the search engines. For the first time, democracies are not seeing the same set of results in their searches. It's easy enough for Europeans to click on the .com version of Google but opinion remains deeply divided as to whether this judgment is a triumph for the rights of the individual to privacy or an attack on the right to freedom of expression.