Yesterday, Europe’s top court ruled that Google must amend some search results at the request of an individual in a test of the so-called "right to be forgotten".

Background

In 2010 Mario Costeja González, a Spanish national, lodged a complaint with the Spanish Data Protection Agency, the ‘AEPD’, against the publisher of a daily newspaper, La Vanguardia Ediciones SL, and against Google Spain and Google Inc. Mr Costeja González contended that, when an internet user entered his name in the search engine of the Google group (‘Google Search’), the list of results would display links to two pages of La Vanguardia’s newspaper, of January and March 1998. Those pages in particular contained an announcement for a real-estate auction organised following attachment proceedings for the recovery of social security debts owed by Mr Costeja González.

With that complaint, Mr Costeja González requested that La Vanguardia be required either to remove or alter the pages in question or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc be required to remove or conceal the personal data relating to him so that the data no longer appeared in the search results and in the links to La Vanguardia. In this context, Mr Costeja González stated that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.

The AEPD rejected the complaint against La Vanguardia, taking the view that the information in question had been lawfully published by it. On the other hand, the complaint was upheld as regards Google Spain and Google Inc. The AEPD requested that those two companies take the necessary measures to withdraw the data from their index and to render access to the data impossible in the future. Google Spain and Google Inc brought two actions before the Spanish National High Court, claiming that the AEPD’s decision should be annulled. It is in this context that the Spanish court referred a series of questions to the European Court of Justice.

Held

The ECJ upheld Mr Costeja González’s complaint, finding that people had the right to request information be removed if it appeared to be "inadequate, irrelevant or no longer relevant".

The ECJ stated:

“An internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties.

Thus, if, following a search made on the basis of a person’s name, the list of results displays a link to a web page which contains information on the person in question, that data subject may approach the operator directly and, where the operator does not grant his request, bring the matter before the competent authorities in order to obtain, under certain conditions, the removal of that link from the list of results.” 

The European judges made clear that in their view the EU data protection directive already established a "right to be forgotten" under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

The ruling makes clear that a search engine such as Google has to take responsibility as a "data controller" for the content that it links to and may be required to purge its results even if the material was previously published legally. Data protection lawyers said the ruling meant that Google could no longer be regarded legally as a "neutral intermediary".

Comment

The “right to be forgotten” has already been on Europe’s legislative agenda for some time. It is seen as legitimate for individuals not to want historic information about them – even if it is true – recorded for posterity in an easy-to-find format on the internet.  Of course implementing this right may be a practical challenge for companies such as Google. Lawyers in the reputation management field will be adding this decision to the growing armoury of rights now available for effectively enforcing the privacy rights of an individual.