Many of you will have read recently about a decision of the European Court of Justice ruling that Google must provide users with a right to delete links about them, in certain circumstances. The case arose in Spain and involved a request for a ruling on EU Directive 95/46 on the Protection of Personal Information (Directive). The Spanish Data Protection Agency and Google Spain and Google Inc. were the parties.
In the ruling, which can only be considered a landmark, the Court ruled that the automatic indexing of information containing personal data “must be classified as ‘processing of personal data’”. Accordingly, “the operator of the search engine [Google] must be regarded as the ‘controller’ in respect to that processing…”
Therefore, Google, as the operator of the search engine in this case is obliged to remove from the results displayed following a search made on the basis of a person’s name any links to web pages, published by third parties and containing information relating to that person. The requirement applies even if the original publication on those pages was lawful.
The court ruled that an individual’s rights will override both, “the economic interest of the operator of the search engine” and “the interest of the general public” in having that information.
The Court did recognize and exception if the individual was a public figure and if the public’s right to access the information is justified.
In the wake of the ruling, Google has apparently received a flood of requests from individuals to remove links. How Google is going to operationally implement the decision, and what its implications are for other sites such as social media sites remains unclear.
A useful review of the decision, reaction to it and its potential implications can be found in Spiegel Online International. While the ruling currently only applies in European Union countries, it does have implications for other jurisdictions, such as Canada, that have privacy legislation invoking similar rights to those found in the Directive.