In this post, our new Datalab members Kurt Pärli and Anita Zimmermann from ZHAW’s Zurich Center for Privacy and Dataprotection comment on the recent judment of the European court against Google; see also
Guidelines
The activity of a search engine must be classified as ‘processing of personal data’ when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing.
Processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.
The operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.
As the data subject may request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.
Facts of the case
On 5 March 2010, Mr Costeja González, a Spanish national resident in Spain, lodged with the AEPD (Agencia Española de Protección de Datos) a complaint against La Vanguardia Ediciones SL, which publishes a daily newspaper with a large circulation, in particular in Catalonia (Spain) (‘La Vanguardia’), and against Google Spain and Google Inc. The complaint was based on the fact that, when an internet user entered Mr Costeja González’s name in the search engine of the Google group (‘Google Search’), he would obtain links to two pages of La Vanguardia’s newspaper, of 19 January and 9 March 1998 respectively, on which an announcement mentioning Mr Costeja González’s name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts.
By that complaint, Mr Costeja González requested, first, that La Vanguardia be required either to remove or alter those pages so that the personal data relating to him no longer appeared or to use certain tools made available by search engines in order to protect the data. Second, he requested that Google Spain or Google Inc. be required to remove or conceal the personal data relating to him so that they ceased to be included in the search results and no longer appeared in the links to La Vanguardia. Mr Costeja González stated in this context that the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant.
By decision of 30 July 2010, the AEPD rejected the complaint in so far as it related to La Vanguardia, taking the view that the publication by it of the information in question was legally justified.
On the other hand, the complaint was upheld in so far as it was directed against Google Spain and Google Inc. The AEPD considered in this regard that operators of search engines are subject to data protection legislation given that they carry out data processing for which they are responsible and act as intermediaries in the information society. The AEPD took the view that it has the power to require the withdrawal of data and the prohibition of access to certain data by the operators of search engines when it considers that the locating and dissemination of the data are liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense, and this would also encompass the mere wish of the person concerned that such data not be known to third parties. The AEPD considered that that obligation may be owed directly by operators of search engines, without it being necessary to erase the data or information from the website where they appear, including when retention of the information on that site is justified by a statutory provision.
Google Spain and Google Inc. brought separate actions against that decision before the Audiencia Nacional (National High Court). The Audiencia Nacional joined the actions.
In those circumstances, the Audiencia Nacional decided to stay the proceedings and to refer to the Court for a preliminary ruling.
Commentary
The judgment of the European Court of Justice shall be considered differentiated as a whole. On the one hand the judgment is very positive in regard to data protection. The Court protects Mario Costeja Gonzalez who led off the hopeless fight against the giant Google and who even won the battle in the end. As a consequence Google has to avoid now that the whole world finds out the problems of Mario Costeja Gonzalez with a simple click in the Internet. The European Court of Justice acknowledges with this decision the right to be forgotten even though it was not explicit expressed. Furthermore, the decision from the Court is very much appreciated that the EU data protection law is applicable for Google Spain as well.
On the other hand it is irritating that the European Court of Justice doesn’t comment the opinion of the advocate general Jääskinen. Jääskinen objects that the use of search engines is part of the fundamental right “freedom of information”. The removal or alteration would amount to the censuring of the internet. It would have been appreciated if “freedom of information” and “data protection” were weighted more carefully and the Court had considered the judicature of the European Court of Human Rights. Furthermore the ruling holds a risk of censorship through powerful private actors. It’s a thin line between “freedom of information” and effective “protection of privacy” and “data protection”- It’s a big challenge for the authority’s (administration, tribunals) to weight both interests in a balanced way.