On May 13, 2014, the Court of Justice of the European Union ("CoJ" or "Court") adopted a judgment that resolves several questions about the interpretation of the EU Data Protection Law (Directive 95/46/EC) in relation to the activity of internet search engines.
The judgment is significant because, for the first time, the CoJ expressly recognized the application of the EU Data Protection Law to the activities carried out by search engines and clarified the responsibilities of these types of companies as regards the "right to be forgotten."
Key points of the judgment include the following.
Classification of Activity Carried Out by Search Engines under EU Data Protection Law
The activity carried out by search engines was classified by the CoJ as a processing of personal data. The Court held that the activity of search engines—locating information published or included on the internet by third parties, indexing it automatically, storing it temporarily, and making it available to internet users according to a particular order of preference—constitutes a processing of personal data according to the terms established in article 2 of Directive 95/46/EC when that information contains personal data of third parties.
The judgment considered a search engine operator to be acting as a controller, since the operator determines the purposes and means of this activity. The search engine operator must be regarded as the "controller" within the meaning of Article 2(d) of Directive 95/46/EC.
Application of EU Data Protection Law to Search Engine Operators
The CoJ held that the activity of search engines is subject to the EU Data Protection Law if (i) the search engines are operated by an undertaking that has its seat in a third state, (ii) the search engine operators have an establishment in a Member State, and (iii) the processing of personal data is carried out "in the context of the activities" of that establishment.
The CoJ made an "extensive interpretation" of article Article 4(1)(a) of Directive 95/46/EC and considered that it is not necessary for the processing of personal data to be carried out "by" the "local" establishment in question but that it is sufficient for this processing to be carried out "in the context of the activities" of that establishment.
In the case at hand, the Court considered that the processing of personal data is carried out in the context of the activities of the local establishment if the latter is intended to promote and sell advertising space offered by the search engine in that Member State. The Court determined that the activities of a search engine operator and those of its establishment located in the Member State are inextricably linked since the activities relating to the sale of advertising space constitute the means of rendering the search engine at issue economically profitable.
"Right to be Forgotten" and Responsibility of a Search Engine Operator
The judgment recognized an individual's "right to be forgotten." Individuals are entitled to request that the search engine remove search results that affect them, under the conditions of Directive 95/46/EC, even though this information has not been deleted by the publisher, nor has the publisher requested its de-indexation. If that request is not met, individuals are entitled to seek the involvement of competent authorities.
A search engine operator must guarantee the right to be forgotten in certain circumstances. The CoJ found that the operator of a search engine is obliged to remove from the list of results, following a search made on the basis of a person's name, (i) links to web pages published by third parties containing information related to that person and (ii) where that name or information is not erased beforehand or simultaneously from those web pages, even when its publication on those pages is lawful.
The right to be forgotten is not an absolute right and has a limited range. The Court stressed that a fair balance should be sought between the legitimate interest of internet users in potentially having access to that information and the data subject's fundamental rights (especially the right to privacy and the right to protection of personal data). In this regard, the Court recognized that the individual may request the removal of links if the personal data has become inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which it was processed, taking into account the time that has elapsed.
As a general rule, the Court held that the right to be forgotten prevails generally over the "mere economic interest of the manager of the search engine," unless the claimant has public relevance, and access to information is justified by the public interest.