The European Union Court of Justice has ruled that national authorities in the European Union can force search engines, such as Google, Yahoo and Bing, to remove webpages from its search results, regardless of whether the information on the webpage itself is lawful, on the basis that an individual has the “right to be forgotten”.

The decision would require removal of links from web search results notwithstanding the underlying websites had lawfully published data about an individual and could not be forced to alter or remove that information.

Background

In March 2010, Mr González, a Spanish resident, lodged a complaint with the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos (AEPD)) against a daily newspaper, La Vanguardia Ediciones SL, as well as Google Spain and Google Inc.

The complaint concerned two announcements that had been published in 1998 in the La Vanguardia Ediciones SL newspaper, and subsequently published on its website, mentioning Mr González’s name in connection with a real-estate auction which resulted from proceedings for the recovery of social security debts. When searching for Mr González’s name on Google, links to the two pages of the La Vanguardia Ediciones SL newspaper continued to be returned.

The AEPD rejected the complaint against the La Vanguardia Ediciones SL newspaper, ruling that the publication was justified as it had been made following an order of the Ministry of Labour and Social Affairs which had intended the publication to give maximum publicity to the auction.

However, the complaint was upheld against Google Spain and Google Inc. The AEDP considered that it had the power to require the withdrawal of, or prohibit access to, data when it considered that the locating and dissemination of that data would breach the right to data protection under European Union law. Further, the AEDP held that an obligation may be owed directly by search engines to remove links to webpages in circumstances where there was no finding that the data on the webpage itself was unlawful or needed be removed by the publisher.

Google Spain and Google Inc appealed the decision to the National High Court, the Audiencia Nacional. The Audiencia Nacional decided that the question of what obligations search engines owed to protect the personal data of individuals, was dependant on the interpretation of the EU Directive 95/46 (the Directive). The Audiencia Nacional therefore stayed the proceedings and referred a number of questions to the European Union Court of Justice (EUCJ) for a preliminary ruling.

Judgment

The EUCJ held1 that search engines “process personal data” and were “controllers” of personal information and therefore are subject to the obligations of the Directive which requires, amongst other things, that “every data subject have the right to obtain from a controller, as appropriate, the rectification, erasure or blocking of data, the processing of which does not comply with the provisions of [the Directive]”2.

The EUCJ held that, in order to comply with the rights and obligations in the Directive, following a request from an individual, search engines may be obliged to remove web pages from search results regardless of whether the information on the webpage itself is lawful.

The passage of time may mean that the processing of information on a webpage, which may have been initially lawful and accurate, but is no longer relevant or necessary, may be contrary to the Directive. In such a case, search engines may be required to erase webpage links from its search results, having regard to all the circumstances of the case including whether there is sufficient public interest in the information.

What does the judgment mean?

The judgment is a preliminary ruling on the interpretation of the Directive. It does not itself require Google to remove links from web search results. However, it is strong precedent that, in the EU, if Google does not remove links from web search results following a request to do so, an individual may be able to go to their national regulator for a judgment to require that the link be removed.

No such “right to be forgotten” currently exists in Australia. However, the Australian Law Reform Commission (ALRC) has recently recommended that the Privacy Act 1988 (Cth) be amended to include a provision to require entities to which the Privacy Act applies (APP entities), to provide a mechanism to request the deletion of private information held by the APP entity. The proposal differs significantly from the EU right to be forgotten as it does not extend to allowing an individual to request the deletion of private information generated by a third party.