The European Court of Justice (“ECJ”) has handed down its ruling on the ‘right to be forgotten’ in Case 131/12 Google Spain and Google, and made clear its desire to uphold European citizens’ fundamental rights to privacy and data protection. In one of the most significant judgments on data protection and privacy, the ECJ compelled Google and all other search engines to remove links to information, but not the information itself, containing personal data in certain circumstances, if so requested by an individual to whom that personal data pertains.
Significantly, the ECJ ruled that the activities of a search engine, which consisted of finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and making it available to users in a specified order of preference, are classified as ‘processing of personal data’ within the meaning of section 2(b) of the Data Protection Directive (95/46/EC), when that information contains personal data. It went on to say that as the operator of the search engine determines the purpose and means of the processing of personal data the operator must therefore be regarded as the ‘controller’ of that data.
The ECJ considered that processing of data that was initially lawful could become incompatible with the Data Protection Directive in certain circumstances, such as where holding the data was no longer necessary in relation to the purpose for which it was originally collected or processed, or if the data had become inadequate, irrelevant or excessive. Following this ruling, it seems that search engines are obliged to remove links (rather than the material itself) to material published by third parties containing information relating to the individual who requested the removal, even where the publication was lawful when published.
In reaching its decision, the ECJ decided that an individual’s right to have control over the information containing their personal data, overrides the economic interest of the operator of the search engine and the interest of the general public in having access to that information upon conducting a search relating to the data subject’s name.
In July the House of Lords published a report considering the consequences of the ECJ’s decision which concludes that the right to be forgotten is “misguided in principle and unworkable in practice”. This was followed by the ICO’s comment in August which defended the ECJ’s ruling, stating the benefit of striking the balance between citizens’ fundamental rights and the legitimate interests of internet users, and urging member states to give Europe the data protection rules it requires.
The ECJ’s decision will have far reaching implications for businesses, as it applies to any business collating, storing and publishing data even if it does not distinguish between personal and non-personal data. The decision also extends to non-EU businesses which have local subsidiaries located within the EU. Businesses which operate search engines need to be prepared to delete links to information containing personal data on request, and adopt or adapt existing data retention and deletion policies.
Consistent with our policy when giving comment and advice on a non-specific basis, we cannot assume legal responsibility for the accuracy of any particular statement. In the case of specific problems we recommend that professional advice be sought.