Recently, the Court of Justice of the European Union passed a landmark ruling concerning the “right to be forgotten” in the digital sphere. Issues of personal data handling also play a role in REVEAL. Here, REVEAL partners from the Interdisciplinary Centre for Law and ICT (ICRI) of the University of Leuven, Jef Ausloos and Aleksandra Kuczerawy, present an assessment of the ruling.

Individuals have a right to be forgotten

A short while ago the Court of Justice of the European Union (CJEU) released its long-awaited judgement in the Google Spain (C-131/12) case. In the case, a Spanish citizen, backed by his national data protection authority, wanted Google to remove search results related to an old local newspaper story dealing with his bankruptcy many years earlier.

In short, the Court decided that individuals do have a right to request search engines to remove links to web pages when the individual’s name is used as a search query. This ruling cannot be overturned and is now referred back to the national court.

Although the case is often referred to as the Right to be Forgotten Case, it does not hinge upon the similarly named provision in the European Commission’s proposal for a Data Protection Regulation. Instead, the main legal basis in this decision was the Data Protection Directive 95/46 (hereafter: ‘the Directive’), including the rights to object (art.14) and to erasure (12(b)). The case is particularly interesting because it lies at the intersection of data protection law, freedom of expression and intermediary liability rules (a detailed discussion on this interaction is available here).

The CJEU was asked to answer three main questions relating to

• the territorial scope of the Directive;
• the material and personal scope of the Directive; and
• whether or not data subjects have a right to object/erasure when it comes to search engines directly.

Scope of application

With regard to the first two questions, the Court’s response was rather straightforward. To the extent that ‘the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State’, the processing falls within the territorial scope of application of the Directive (art.4(1)a) (§.60).

Given the fact that search engines ‘collect’, ‘retrieve’, ‘record’, ‘organize’, ‘store’ and ‘make available’, they do process personal data. As a result, they fall within the material scope of application of the Directive (art.2(b)) (§.28-29).

The Court also specified that search engines’ activities should be distinguished from (and are additional to) those carried out by the original publisher(s). Hence, they should be considered controllers (art.2(d)) (§.41).

Right to be forgotten?

The third category of questions that was presented to the CJEU relates to the so-called right to be forgotten and constitutes the most controversial aspect in this case. Some of the key issues are:

Limited scope of the judgement

The request in this particular case referred specifically to the link between using an individual’s name as a search query and the search result referring to a particular web page. This means that even if the request is granted, the same web page can still be reached through other channels (social media, other search engines, etc) or even different search terms. Since the actual information is still available on the net, we should not overstress the impact of this judgement on the right to freedom of expression (art. 11 Charter; art.10 ECHR).

No obligation to delete, but an obligation to balance

The judgement does not mean that any individual can now request search engines to delete links to web pages when their name is used as a search term. Such requests still have to comply with the requirements under the right to erasure (article 12(b) DPD) and/or the right to object (article 14 DPD). These provisions require a balance to be made between opposing rights and interests (§.74; 76). Hence, the complainant will have to motivate his/her request and the search engine will have to make the necessary balance upon receiving such a request. If the search engine does not grant the request, ‘the data subject can bring the matter before the supervisory or judicial authority so that it carries out the necessary checks’ (§.77). In other words, search engines are not obliged to comply with takedown requests unless they are issued by a supervisory or judicial authority.

Independent responsibility of search engines

The potential harm or negative consequences vis-à-vis the data subject will in many cases not result from an obscure publication in a local online newspaper, but rather from the widespread (and often decontextualised) availability of the information through search engines. For this reason the Court distinguished the activities of Google from those of the original publishers. As a consequence of this separation the Court decided that data subjects should be able to request the removal from search engines directly, even if the original content is published lawfully elsewhere. In certain circumstances requests might still be directed to the original publisher (e.g. to remove or blur out his/her personal data) (§. 39).

Presumption that data subject’s rights trump all others

In the decision the Court stated that ‘data subject’s rights […] override, as a general rule, the interest of internet users…’ as well as the economic interests of the search engine operator itself (§.81). It seems, therefore, that the Court presumes an imbalance of interests, favouring privacy interests over all others. At the same time, the Court recognizes that it might not always be the case by stating the balance might depend on the nature of the information, its sensitivity, the interest of the public, the role of the relevant individual in public life, etc.

Implications

The ruling by the Court of Justice surprised many people around the world. One of the reasons is that it almost entirely ignored the Opinion of the Advocate General issued in June 2013. Nevertheless, it is still very early to draw general conclusions from the judgement. Even though at first glance it seems to considerably threaten freedom of expression/information interests, much of the wording seems to be very nuanced and limited in scope when looked at more closely. Additionally, the decision is entirely based on the existing legal framework (Directive 95/46). It is hard to predict how the judgment will interact with the future Data Protection Regulation, which is being drafted at present.

Finally, it is worth highlighting that within two weeks after the judgement, Google started to implement measures to comply with the decision. Recently, it announced an introduction of a tool to request the removal of certain links from the search results. Moreover, Google formed a committee of Internet experts to help the company implement the ruling. One of the members of the committee is Prof. Peggy Valcke from ICRI – KU Leuven.

Additional note:

For more information see Google and the Right to be Forgotten: ICRI comments and contributions and the EC Factsheet on the “Right to be Forgotten” ruling.

This post is a modified and updated version of a text published on the LSE Media Policy Blog. This article provides the views of the named authors only and does not represent the position of the REVEAL Consortium, the LSE Media Policy Project blog, nor the views of the London School of Economics.