European Court of Justice Issues Judgment on Right to Erasure Under EU Data Protection Rules

    View Author May 2014

    Following the referral of a series of questions from the Spanish National High Court, the European Court of Justice (ECJ) ruled earlier this week that individuals have a right to ask search engines to remove links containing personal data about them, if the information about the individual is “inadequate, irrelevant or no longer relevant”.

    The case concerned a complaint by a Spanish national about the results produced when his name was entered in Google’s search engine. The search results displayed a link to a newspaper article, from 1998, giving information about legal proceedings for the recovery of the complainant’s debts.

    The case has potentially far reaching implications both for businesses processing personal data and individuals seeking to exercise their rights.

    The ECJ held the following:

    • Territorial scope - Google is subject to EU data protection laws for its search engine business. Although the Google search engine is operated by Google Inc. outside of the EU, its Spanish subsidiary promotes and sells advertising space for the search service, which generates profit for Google Inc. This is sufficient for the processing by Google Inc. to be treated as occurring “in the context of the establishment” of the Spanish company, and so be subject to EU data protection laws.
    • Processing personal data - According to the ECJ, each of Google’s activities of collecting, retrieving, recording, organizing, storing and disclosing personal data in the form of search results must be classified as “processing”, regardless of the fact that it also carries out the same operations in respect of other types of information and does not distinguish between the latter and the personal data.
    • Controller – As it determines the purpose and the means of the processing of personal data within the search, Google is a data controller. To “exclude the operator of a search engine from
      that definition on the ground that it does not exercise control over the personal data published on the web pages of third parties” would be contrary to the concept of a controller and the protection of data subjects.
    • Right to be forgotten – An individual may request that information relating to him should no longer be included in a list of results displayed following a search made on the basis of his name. A data controller must comply with the request if, having regard to all the circumstances of the case, the information is inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes of the processing carried out by the operator of the search engine. The operator must then erase the information and links. According to the ECJ, the decision may have been different if, in the case, there was a preponderant interest of the general public having access to the information, such as if the individual had a role in public life.

    Potential Implications of the Decision

    The decision has already polarized opinion. Some view it as an important step toward recognizing an individual’s right to privacy on the Internet. Others have argued that it is an attack on freedom of expression and the right to know.

    The case certainly raises practical issues, as search engine operators will need to make difficult decisions as to what amounts to “inadequate, irrelevant or no longer relevant” information. This decision may also result in additional costs for business not only managing the requests but also dealing with challenges brought by individuals.

    Many unresolved issues remain. For example,

    • Will Google, as a data controller, be required to comply with other EU data protection requirements, e.g., individuals’ rights of access to personal data and the obligation to provide privacy notices?
    • Is the judgment limited to the activities of search engines or can it be applied more broadly?
    • Will the judgment about the territorial scope of EU data protection law mean that the processing of personal data by other parent companies outside Europe will also be caught?

    The case will now return to the Spanish court for it to apply the ECJ’s ruling and issue its own decision.

    For further information or for advice on how this could impact your business please contact one of the individuals listed in this publication.